SoK: On the Role and Future of AIGC Watermarking in the Era of Gen-AI
On the map: LLM safety and security → Watermarking generated content and models
Abstract (arXiv)
The rapid advancement of AI technology, particularly in generating AI-generated content (AIGC), has transformed numerous fields, e.g., art video generation, but also brings new risks, including the misuse of AI for misinformation and intellectual property theft. To address these concerns, AIGC watermarks offer an effective solution to mitigate malicious activities. However, existing watermarking surveys focus more on traditional watermarks, overlooking AIGC-specific challenges. In this work, we propose a systematic investigation into AIGC watermarking and provide the first formal definition of AIGC watermarking. Different from previous surveys, we provide a taxonomy based on the core properties of the watermark which are summarized through comprehensive literature from various AIGC modalities. Derived from the properties, we discuss the functionality and security threats of AIGC watermarking. In the end, we thoroughly investigate the AIGC governance of different countries and practitioners. We believe this taxonomy better aligns with the practical demands for watermarking in the era of GenAI, thus providing a clearer summary of existing work and uncovering potential future research directions for the community.
Key facts. Cited by 14 papers in the map (data through 14 Oct 2026). Placed in Watermarking generated content and models, one of 12 directions in LLM safety and security. Builds on 84 of its 148 references that are in the map. First posted on arXiv 18 Nov 2024.
Builds on
84 of 148 references.
Closest ancestors · 38
Same direction, newest first
- 2024Towards Reliable Verification of Unauthorized Data Usage in Personalized Text-to-Image Diffusion Models14 Oct
- 2024GROOT: Generating Robust Watermark for Diffusion-Model-Based Audio Synthesis15 Jul
- 2024Large Language Model Watermark Stealing With Mixed Integer Programming30 May
- 2024Explanation as a Watermark: Towards Harmless and Multi-bit Model Ownership Verification via Watermarking Feature Attribution8 May
- 2024Watermark-embedded Adversarial Examples for Copyright Protection against Diffusion Models15 Apr
- 2024Gaussian Shading: Provable Performance-Lossless Image Watermarking for Diffusion Models7 Apr
- 2024Bypassing LLM Watermarks with Color-Aware Substitutions19 Mar
- 2024Learning to Watermark LLM-generated Text via Reinforcement Learning13 Mar
- 2024Watermark Stealing in Large Language Models29 Feb
- 2024Can Watermarks Survive Translation? On the Cross-lingual Consistency of Text Watermark for Large Language Models21 Feb
- 2024Cross-Attention Watermarking of Large Language Models12 Jan
- 2023A Survey of Text Watermarking in the Era of Large Language Models13 Dec
26 more
- 2023On the Learnability of Watermarks for Language Models7 Dec
- 2023A Somewhat Robust Image Watermark against Diffusion-based Editing Models22 Nov
- 2023Watermarks in the Sand: Impossibility of Strong Watermarking for Generative Models7 Nov
- 2023Publicly-Detectable Watermarking for Language Models27 Oct
- 2023A Semantic Invariant Robust Watermark for Large Language Models10 Oct
- 2023Catch You Everything Everywhere: Guarding Textual Inversion via Concept Watermarking12 Sep
- 2023T2IW: Joint Text to Image & Watermark Generation7 Sep
- 2023DUAW: Data-free Universal Adversarial Watermark against Stable Diffusion Customization19 Aug
- 2023An Unforgeable Publicly Verifiable Watermark for Large Language Models30 Jul
- 2023Robust Distortion-free Watermarks for Language Models28 Jul
- 2023Provable Robust Watermarking for AI-Generated Text30 Jun
- 2023Generative Watermarking Against Unauthorized Subject-Driven Image Synthesis13 Jun
- 2023Intellectual Property Protection of Diffusion Models via the Watermark Diffusion Process6 Jun
- 2023Invisible Image Watermarks Are Provably Removable Using Generative AI2 Jun
- 2023Tree-Ring Watermarks: Fingerprints for Diffusion Images that are Invisible and Robust31 May
- 2023DiffusionShield: A Watermark for Copyright Protection against Generative Diffusion Models25 May
- 2023Watermarking Text Generated by Black-Box Language Models14 May
- 2023Evading Watermark based Detection of AI-Generated Content5 May
- 2023Robust Multi-bit Natural Language Watermarking through Invariant Features3 May
- 2023PTW: Pivotal Tuning Watermarking for Pre-Trained Image Generators14 Apr
- 2023RoSteALS: Robust Steganography using Autoencoder Latent Space6 Apr
- 2023The Stable Signature: Rooting Watermarks in Latent Diffusion Models27 Mar
- 2023A Recipe for Watermarking Diffusion Models17 Mar
- 2023A Watermark for Large Language Models24 Jan
- 2021Tracing Text Provenance via Context-Aware Lexical Substitution15 Dec
- 2021CMUA-Watermark: A Cross-Model Universal Adversarial Watermark for Combating Deepfakes23 May
Other references · 46
- 2021High-Resolution Image Synthesis with Latent Diffusion Modelscited by 18,863
- 2023GPT-4 Technical Reportcited by 18,396
- 2023LLaMA: Open and Efficient Foundation Language Modelscited by 14,132
- 2024OmniGen: Unified Image Generationcited by 394
- 2018Turning Your Weakness Into a Strength: Watermarking Deep Neural Networks by Backdooringcited by 357
- 2019StegaStamp: Invisible Hyperlinks in Physical Photographscited by 265
- 2023EditGuard: Versatile Image Watermarking for Tamper Localization and Copyright Protectioncited by 111
- 2021Watermarking Images in Self-Supervised Latent Spacescited by 94
- 2020Distortion Agnostic Deep Watermarkingcited by 90
- 2022Untargeted Backdoor Watermark: Towards Harmless and Stealthy Dataset Copyright Protectioncited by 86
- 2019SteganoGAN: High Capacity Image Steganography with GANscited by 72
- 2023Seeing is not always believing: Benchmarking Human and Model Perception of AI-Generated Imagescited by 66
34 more
- 2022Black-box Dataset Ownership Verification via Backdoor Watermarkingcited by 65
- 2017Generating Steganographic Images via Adversarial Trainingcited by 58
- 2018ReDMark: Framework for Residual Diffusion Watermarking on Deep Networkscited by 57
- 2023Domain Watermark: Effective and Harmless Dataset Copyright Protection is Closed at Handcited by 57
- 2020Model Watermarking for Image Processing Networkscited by 56
- 2023WOUAF: Weight Modulation for User Attribution and Fingerprinting in Text-to-Image Diffusion Modelscited by 53
- 2023WavMark: Watermarking for Audio Generationcited by 50
- 2021DVMark: A Deep Multiscale Framework for Video Watermarkingcited by 46
- 2021Defending against Model Stealing via Verifying Embedded External Featurescited by 46
- 2017Generating Steganographic Text with LSTMscited by 44
- 2022Supervised GAN Watermarking for Intellectual Property Protectioncited by 40
- 2022FedTracker: Furnishing Ownership Verification and Traceability for Federated Learning Modelcited by 30
- 2024V2A-Mark: Versatile Deep Visual-Audio Watermarking for Manipulation Localization and Copyright Protectioncited by 28
- 2021Data Hiding with Deep Learning: A Survey Unifying Digital Watermarking and Steganographycited by 24
- 2022DeAR: A Deep-learning-based Audio Re-recording Resilient Watermarkingcited by 22
- 2023Large-capacity and Flexible Video Steganography via Invertible Neural Networkcited by 21
- 2024Is Difficulty Calibration All We Need? Towards More Practical Membership Inference Attackscited by 21
- 2024PointNCBW: Towards Dataset Ownership Verification for Point Clouds via Negative Clean-label Backdoor Watermarkcited by 20
- 2019ROMark: A Robust Watermarking System Using Adversarial Trainingcited by 18
- 2022Watermarking in Secure Federated Learning: A Verification Framework Based on Client-Side Backdooringcited by 17
- 2024Generative Text Steganography with Large Language Modelcited by 17
- 2024Which Model Generated This Image? A Model-Agnostic Approach for Origin Attributioncited by 16
- 2024Latent Watermarking of Audio Generative Modelscited by 16
- 2022Free Fine-tuning: A Plug-and-Play Watermarking Scheme for Deep Neural Networkscited by 15
- 2023Securing Deep Generative Models with Universal Adversarial Signaturecited by 14
- 2022LECA: A Learned Approach for Efficient Cover-agnostic Watermarkingcited by 13
- 2024Who Followed the Blueprint? Analyzing the Responses of U.S. Federal Agencies to the Blueprint for an AI Bill of Rightscited by 11
- 2017Coverless Information Hiding Based on Generative adversarial networkscited by 10
- 2021Watermark Faker: Towards Forgery of Digital Image Watermarkingcited by 8
- 2024TraceableSpeech: Towards Proactively Traceable Text-to-Speech with Watermarkingcited by 7
- 2024From Covert Hiding to Visual Editing: Robust Generative Video Steganographycited by 5
- 2023A Brief Yet In-Depth Survey of Deep Learning-Based Image Watermarkingcited by 3
- 2024Finding needles in a haystack: A Black-Box Approach to Invisible Watermark Detectioncited by 3
- 2018Review on Optical Image Hiding and Watermarking Techniquescited by 2
Built on by
Citing papers per year: 2025: 10; 2026: 4.
14 papers.
Sort:
By area:
- 2025Rethinking Data Protection in the (Generative) Artificial Intelligence Eracited by 18
- 2025GaussMarker: Robust Dual-Domain Watermark for Diffusion Modelscited by 16
- 2025SoK: Large Language Model Copyright Auditing via Fingerprintingcited by 15
- 2025FIT-Print: Towards False-claim-resistant Model Ownership Verification via Targeted Fingerprintcited by 10
- 2025First-Place Solution to NeurIPS 2024 Invisible Watermark Removal Challengecited by 9
- 2025DATABench: Evaluating Dataset Auditing in Deep Learning from an Adversarial Perspectivecited by 8
- 2025Secure and Robust Watermarking for AI-generated Images: A Comprehensive Surveycited by 5
- 2026MarkSweep: A No-box Removal Attack on AI-Generated Image Watermarking via Noise Intensification and Frequency-aware Denoisingcited by 4
- 2025PromptCOS: Towards Content-only System Prompt Copyright Auditing for LLMscited by 3
- 2025RobustSora: De-Watermarked Benchmark for Robust AI-Generated Video Detectioncited by 3
- 2025SOLIDO: A Robust Watermarking Method for Speech Synthesis via Low-Rank Adaptationcited by 1
- 2026DeMark: A Query-Free Black-Box Attack on Deepfake Watermarking Defensescited by 1
- 2026MarkSweep: A No-box Removal Attack on AI-Generated Image Watermarking via Noise Intensification and Frequency-aware Denoising17 Feb 2026
- 2026ALIEN: Analytic Latent Watermarking for Controllable Generation5 Feb 2026
- 2026MarkCleaner: High-Fidelity Watermark Removal via Imperceptible Micro-Geometric Perturbation2 Feb 2026
- 2026DeMark: A Query-Free Black-Box Attack on Deepfake Watermarking Defenses23 Jan 2026
- 2025RobustSora: De-Watermarked Benchmark for Robust AI-Generated Video Detection11 Dec 2025
- 2025Secure and Robust Watermarking for AI-generated Images: A Comprehensive Survey30 Sep 2025
- 2025PromptCOS: Towards Content-only System Prompt Copyright Auditing for LLMs3 Sep 2025
- 2025First-Place Solution to NeurIPS 2024 Invisible Watermark Removal Challenge28 Aug 2025
- 2025SoK: Large Language Model Copyright Auditing via Fingerprinting27 Aug 2025
- 2025DATABench: Evaluating Dataset Auditing in Deep Learning from an Adversarial Perspective8 Jul 2025
- 2025Rethinking Data Protection in the (Generative) Artificial Intelligence Era3 Jul 2025
- 2025GaussMarker: Robust Dual-Domain Watermark for Diffusion Models13 Jun 2025
- 2025Secure and Robust Watermarking for AI-generated Images: A Comprehensive Surveycited by 5
- 2026MarkSweep: A No-box Removal Attack on AI-Generated Image Watermarking via Noise Intensification and Frequency-aware Denoisingcited by 4
- 2025PromptCOS: Towards Content-only System Prompt Copyright Auditing for LLMscited by 3
- 2025RobustSora: De-Watermarked Benchmark for Robust AI-Generated Video Detectioncited by 3
- 2026DeMark: A Query-Free Black-Box Attack on Deepfake Watermarking Defensescited by 1
- 2026ALIEN: Analytic Latent Watermarking for Controllable Generationcited by 0
- 2026MarkSweep: A No-box Removal Attack on AI-Generated Image Watermarking via Noise Intensification and Frequency-aware Denoising17 Feb 2026
- 2026ALIEN: Analytic Latent Watermarking for Controllable Generation5 Feb 2026
- 2026DeMark: A Query-Free Black-Box Attack on Deepfake Watermarking Defenses23 Jan 2026
- 2025RobustSora: De-Watermarked Benchmark for Robust AI-Generated Video Detection11 Dec 2025
- 2025Secure and Robust Watermarking for AI-generated Images: A Comprehensive Survey30 Sep 2025
- 2025PromptCOS: Towards Content-only System Prompt Copyright Auditing for LLMs3 Sep 2025
- 2025Rethinking Data Protection in the (Generative) Artificial Intelligence Eracited by 18
- 2025SoK: Large Language Model Copyright Auditing via Fingerprintingcited by 15
- 2025FIT-Print: Towards False-claim-resistant Model Ownership Verification via Targeted Fingerprintcited by 10
- 2025First-Place Solution to NeurIPS 2024 Invisible Watermark Removal Challengecited by 9
- 2025DATABench: Evaluating Dataset Auditing in Deep Learning from an Adversarial Perspectivecited by 8
- 2026MarkCleaner: High-Fidelity Watermark Removal via Imperceptible Micro-Geometric Perturbationcited by 0
- 2026MarkCleaner: High-Fidelity Watermark Removal via Imperceptible Micro-Geometric Perturbation2 Feb 2026
- 2025First-Place Solution to NeurIPS 2024 Invisible Watermark Removal Challenge28 Aug 2025
- 2025SoK: Large Language Model Copyright Auditing via Fingerprinting27 Aug 2025
- 2025DATABench: Evaluating Dataset Auditing in Deep Learning from an Adversarial Perspective8 Jul 2025
- 2025Rethinking Data Protection in the (Generative) Artificial Intelligence Era3 Jul 2025
- 2025FIT-Print: Towards False-claim-resistant Model Ownership Verification via Targeted Fingerprint26 Jan 2025
Similar, not cited
Close in wording, no citation either way
- 2024SoK: Watermarking for AI-Generated Content
- 2025Adoption of Watermarking for Generative AI Systems in Practice and Implications under the new EU AI Act
- 2023A Survey on ChatGPT: AI-Generated Contents, Challenges, and Solutions
- 2025Watermarking for AI Content Detection: A Review on Text, Visual, and Audio Modalities
- 2024Watermark-based Attribution of AI-Generated Content
- 2026From Forensics to Ecosystems: Rethinking Watermarks for Generative AI Oversight
- 2024Protect-Your-IP: Scalable Source-Tracing and Attribution against Personalized Generation
- 2026Attack-Resistant Watermarking for AIGC Image Forensics via Diffusion-based Semantic Deflection