# InvisMark: Invisible and Robust Watermarking for AI-generated Image Provenance

arXiv: https://arxiv.org/abs/2411.07795 · HTML: https://mlsanity.com/paper/2411.07795/

## Key facts

- Cited by 23 papers in the map (data through 14 Oct 2026).
- Placed in Watermarking generated content and models, one of 12 directions in LLM safety and security.
- Builds on 20 of its 42 references that are in the map.
- First posted on arXiv 10 Nov 2024.

## Placed in

- LLM safety and security / [Watermarking generated content and models](https://mlsanity.com/safety/watermarking-generated-content-and-models/)

## Builds on (most cited first, 20 of 20)

- [Deep Residual Learning for Image Recognition](https://mlsanity.com/paper/1512.03385/) (2015)
- [High-Resolution Image Synthesis with Latent Diffusion Models](https://mlsanity.com/paper/2112.10752/) (2021)
- [The Unreasonable Effectiveness of Deep Features as a Perceptual Metric](https://mlsanity.com/paper/1801.03924/) (2018)
- [A ConvNet for the 2020s](https://mlsanity.com/paper/2201.03545/) (2022)
- [Taming Transformers for High-Resolution Image Synthesis](https://mlsanity.com/paper/2012.09841/) (2020)
- [Multimodal Unsupervised Image-to-Image Translation](https://mlsanity.com/paper/1804.04732/) (2018)
- [HiDDeN: Hiding Data With Deep Networks](https://mlsanity.com/paper/1807.09937/) (2018)
- [StegaStamp: Invisible Hyperlinks in Physical Photographs](https://mlsanity.com/paper/1904.05343/) (2019)
- [Focal Frequency Loss for Image Reconstruction and Synthesis](https://mlsanity.com/paper/2012.12821/) (2020)
- [Artificial Fingerprinting for Generative Models: Rooting Deepfake Attribution in Training Data](https://mlsanity.com/paper/2007.08457/) (2020)
- [Robust Invisible Video Watermarking with Attention](https://mlsanity.com/paper/1909.01285/) (2019)
- [Invisible Image Watermarks Are Provably Removable Using Generative AI](https://mlsanity.com/paper/2306.01953/) (2023)
- [Watermarking Images in Self-Supervised Latent Spaces](https://mlsanity.com/paper/2112.09581/) (2021)
- [Robustness of AI-Image Detectors: Fundamental Limits and Practical Attacks](https://mlsanity.com/paper/2310.00076/) (2023)
- [RoSteALS: Robust Steganography using Autoencoder Latent Space](https://mlsanity.com/paper/2304.03400/) (2023)
- [Leveraging Optimization for Adaptive Attacks on Image Watermarks](https://mlsanity.com/paper/2309.16952/) (2023)
- [TrustMark: Universal Watermarking for Arbitrary Resolution Images](https://mlsanity.com/paper/2311.18297/) (2023)
- [GenAI Against Humanity: Nefarious Applications of Generative Artificial Intelligence and Large Language Models](https://mlsanity.com/paper/2310.00737/) (2023)
- [PTW: Pivotal Tuning Watermarking for Pre-Trained Image Generators](https://mlsanity.com/paper/2304.07361/) (2023)
- [VPN: Video Provenance Network for Robust Content Attribution](https://mlsanity.com/paper/2109.10038/) (2021)

## Built on by (most cited first, 23 of 23)

- [SynthID-Image: Image watermarking at internet scale](https://mlsanity.com/paper/2510.09263/) (2025)
- [Pixel Seal: Adversarial-only training for invisible image and video watermarking](https://mlsanity.com/paper/2512.16874/) (2025)
- [Transferable Black-Box One-Shot Forging of Watermarks via Image Preference Models](https://mlsanity.com/paper/2510.20468/) (2025)
- [MaXsive: High-Capacity and Robust Training-Free Generative Image Watermarking in Diffusion Models](https://mlsanity.com/paper/2507.21195/) (2025)
- [Guidance Watermarking for Diffusion Models](https://mlsanity.com/paper/2509.22126/) (2025)
- [Attack-Resistant Watermarking for AIGC Image Forensics via Diffusion-based Semantic Deflection](https://mlsanity.com/paper/2601.06639/) (2026)
- [Learning to Watermark in the Latent Space of Generative Models](https://mlsanity.com/paper/2601.16140/) (2026)
- [All in One: Unifying Deepfake Detection, Tampering Localization, and Source Tracing with a Robust Landmark-Identity Watermark](https://mlsanity.com/paper/2602.23523/) (2026)
- [MetaSeal: Defending Against Image Attribution Forgery Through Content-Dependent Cryptographic Watermarks](https://mlsanity.com/paper/2509.10766/) (2025)
- [Low-Compute Watermark Removal via Dual-Domain Natural Projection](https://mlsanity.com/paper/2510.07538/) (2025)
- [Removing the Watermark Is Not Enough: Forensic Stealth in Generative-AI Watermark Removal](https://mlsanity.com/paper/2605.09203/) (2026)
- [Compositional Adversarial Training for Robust Visual Watermarking](https://mlsanity.com/paper/2605.16720/) (2026)
- [Learning Probabilistic Embeddings for Unsupervised Action Segmentation](https://mlsanity.com/paper/2607.05263/) (2026)
- [MultiNeRF: Multiple Watermark Embedding for Neural Radiance Fields](https://mlsanity.com/paper/2504.02517/) (2025)
- [Meta-FC: Meta-Learning with Feature Consistency for Robust and Generalizable Watermarking](https://mlsanity.com/paper/2602.21849/) (2026)
- [ResGuard: Enhancing Robustness Against Known Original Attacks in Deep Watermarking](https://mlsanity.com/paper/2604.03693/) (2026)
- [Flow of Truth: Proactive Temporal Forensics for Image-to-Video Generation](https://mlsanity.com/paper/2604.15003/) (2026)
- [DeepSignature: Digitally Signed, Content-Encoding Watermarks for Robust and Transparent Image Authentication](https://mlsanity.com/paper/2604.23016/) (2026)
- [Beyond AI-Generated Labels: Watermarking, Co-Creation, and Conflation of AI-Generation with Disinformation](https://mlsanity.com/paper/2607.13082/) (2026)
- [Signpost Watermarking: Joint Optimization for Visual Watermark Coexistence](https://mlsanity.com/paper/2608.10091/) (2026)
- [Can Pixels Alone Reveal Image Origin? Minimax Limits and Learnable Interfaces for Passive Provenance](https://mlsanity.com/paper/2609.30997/) (2026)
- [Trustworthy synthetic visual media: Evidence across the media lifecycle](https://mlsanity.com/paper/2609.34232/) (2026)
- [WARP: A Unified Benchmark for Invisible Image Watermarking -- Robustness and Protection Against Attacks](https://mlsanity.com/paper/2609.40031/) (2026)

## Abstract (arXiv)

The proliferation of AI-generated images has intensified the need for robust content authentication methods. We present InvisMark, a novel watermarking technique designed for high-resolution AI-generated images. Our approach leverages advanced neural network architectures and training strategies to embed imperceptible yet highly robust watermarks. InvisMark achieves state-of-the-art performance in imperceptibility (PSNR~51, SSIM ~ 0.998) while maintaining over 97% bit accuracy across various image manipulations. Notably, we demonstrate the successful encoding of 256-bit watermarks, significantly expanding payload capacity while preserving image quality. This enables the embedding of UUIDs with error correction codes, achieving near-perfect decoding success rates even under challenging image distortions. We also address potential vulnerabilities against advanced attacks and propose mitigation strategies. By combining high imperceptibility, extended payload capacity, and resilience to manipulations, InvisMark provides a robust foundation for ensuring media provenance in an era of increasingly sophisticated AI-generated content. Source code of this paper is available at: https://github.com/microsoft/InvisMark.