# Hidden in the Noise: Two-Stage Robust Watermarking for Images

arXiv: https://arxiv.org/abs/2412.04653 · HTML: https://mlsanity.com/paper/2412.04653/

## Key facts

- Cited by 21 papers in the map (data through 14 Oct 2026).
- Builds on 39 of its 59 references that are in the map.
- First posted on arXiv 5 Dec 2024.

## Builds on (most cited first, 30 of 39)

- [Denoising Diffusion Probabilistic Models](https://mlsanity.com/paper/2006.11239/) (2020)
- [High-Resolution Image Synthesis with Latent Diffusion Models](https://mlsanity.com/paper/2112.10752/) (2021)
- [Microsoft COCO: Common Objects in Context](https://mlsanity.com/paper/1405.0312/) (2014)
- [Denoising Diffusion Implicit Models](https://mlsanity.com/paper/2010.02502/) (2020)
- [Deep Unsupervised Learning using Nonequilibrium Thermodynamics](https://mlsanity.com/paper/1503.03585/) (2015)
- [Scalable Diffusion Models with Transformers](https://mlsanity.com/paper/2212.09748/) (2022)
- [Zero-Shot Text-to-Image Generation](https://mlsanity.com/paper/2102.12092/) (2021)
- [Scaling Rectified Flow Transformers for High-Resolution Image Synthesis](https://mlsanity.com/paper/2403.03206/) (2024)
- [CLIPScore: A Reference-free Evaluation Metric for Image Captioning](https://mlsanity.com/paper/2104.08718/) (2021)
- [Efficient and robust approximate nearest neighbor search using Hierarchical Navigable Small World graphs](https://mlsanity.com/paper/1603.09320/) (2016)
- [Extracting Training Data from Diffusion Models](https://mlsanity.com/paper/2301.13188/) (2023)
- [Black-box Adversarial Attacks with Limited Queries and Information](https://mlsanity.com/paper/1804.08598/) (2018)
- [Jailbreaking Leading Safety-Aligned LLMs with Simple Adaptive Attacks](https://mlsanity.com/paper/2404.02151/) (2024)
- [HiDDeN: Hiding Data With Deep Networks](https://mlsanity.com/paper/1807.09937/) (2018)
- [PixArt-Sigma: Weak-to-Strong Training of Diffusion Transformer for 4K Text-to-Image Generation](https://mlsanity.com/paper/2403.04692/) (2024)
- [Robust Distortion-free Watermarks for Language Models](https://mlsanity.com/paper/2307.15593/) (2023)
- [The Stable Signature: Rooting Watermarks in Latent Diffusion Models](https://mlsanity.com/paper/2303.15435/) (2023)
- [Understanding and Mitigating Copying in Diffusion Models](https://mlsanity.com/paper/2305.20086/) (2023)
- [Tree-Ring Watermarks: Fingerprints for Diffusion Images that are Invisible and Robust](https://mlsanity.com/paper/2305.20030/) (2023)
- [Robust Invisible Video Watermarking with Attention](https://mlsanity.com/paper/1909.01285/) (2019)
- [Gaussian Shading: Provable Performance-Lossless Image Watermarking for Diffusion Models](https://mlsanity.com/paper/2404.04956/) (2024)
- [A Recipe for Watermarking Diffusion Models](https://mlsanity.com/paper/2303.10137/) (2023)
- [Invisible Image Watermarks Are Provably Removable Using Generative AI](https://mlsanity.com/paper/2306.01953/) (2023)
- [On Memorization in Diffusion Models](https://mlsanity.com/paper/2310.02664/) (2023)
- [WAVES: Benchmarking the Robustness of Image Watermarks](https://mlsanity.com/paper/2401.08573/) (2024)
- [RingID: Rethinking Tree-Ring Watermarking for Enhanced Multi-Key Identification](https://mlsanity.com/paper/2404.14055/) (2024)
- [Watermarks in the Sand: Impossibility of Strong Watermarking for Generative Models](https://mlsanity.com/paper/2311.04378/) (2023)
- [An Undetectable Watermark for Generative Image Models](https://mlsanity.com/paper/2410.07369/) (2024)
- [Evading Watermark based Detection of AI-Generated Content](https://mlsanity.com/paper/2305.03807/) (2023)
- [RoSteALS: Robust Steganography using Autoencoder Latent Space](https://mlsanity.com/paper/2304.03400/) (2023)

## Built on by (most cited first, 21 of 21)

- [SEAL: Semantic Aware Image Watermarking](https://mlsanity.com/paper/2503.12172/) (2025)
- [Forging and Removing Latent-Noise Diffusion Watermarks Using a Single Image](https://mlsanity.com/paper/2504.20111/) (2025)
- [A Baseline Method for Removing Invisible Image Watermarks using Deep Image Prior](https://mlsanity.com/paper/2502.13998/) (2025)
- [SLICE: Semantic Latent Injection via Compartmentalized Embedding for Image Watermarking](https://mlsanity.com/paper/2603.12749/) (2026)
- [MaXsive: High-Capacity and Robust Training-Free Generative Image Watermarking in Diffusion Models](https://mlsanity.com/paper/2507.21195/) (2025)
- [NoisePrints: Distortion-Free Watermarks for Authorship in Private Diffusion Models](https://mlsanity.com/paper/2510.13793/) (2025)
- [MarkDiffusion: An Open-Source Toolkit for Generative Watermarking of Latent Diffusion Models](https://mlsanity.com/paper/2509.10569/) (2025)
- [Secure and Robust Watermarking for AI-generated Images: A Comprehensive Survey](https://mlsanity.com/paper/2510.02384/) (2025)
- [TRACE: A Two-Channel Robust Attribution Watermark via Complementary Embeddings for LLM-Agent Trajectories](https://mlsanity.com/paper/2607.08400/) (2026)
- [SHIFT: Stochastic Hidden-Trajectory Deflection for Removing Diffusion-based Watermark](https://mlsanity.com/paper/2603.29742/) (2026)
- [Towards Robust Content Watermarking Against Removal and Forgery Attacks](https://mlsanity.com/paper/2604.06662/) (2026)
- [Watermarking Should Be Treated as a Monitoring Primitive](https://mlsanity.com/paper/2605.13095/) (2026)
- [Decoupling Defense Strategies for Robust Image Watermarking](https://mlsanity.com/paper/2602.20053/) (2026)
- [Luminark: Training-free, Probabilistically-Certified Watermarking for General Vision Generative Models](https://mlsanity.com/paper/2601.01085/) (2026)
- [PGID: Progressive Guided Inversion and Denoising for Robust Watermark Detection](https://mlsanity.com/paper/2605.09319/) (2026)
- [DRIFT: Removing Diffusion Watermarks by Deflecting the Generative Trajectory](https://mlsanity.com/paper/2609.08213/) (2026)
- [An Efficient and Effective Watermarking Scheme for the Protection of the Intellectual Property Rights of Video Generative Models](https://mlsanity.com/paper/2609.23586/) (2026)
- [MoSign: Challenge-Response Motion-Watermark Authentication for Anonymous Virtual-Reality Users](https://mlsanity.com/paper/2609.29603/) (2026)
- [Disentangle and Drop: Robust Universal Removal of Image Watermarks via Reconstructive Grayscale Residual Decomposition](https://mlsanity.com/paper/2609.31693/) (2026)
- [TANGO: Watermarking Masked Diffusion Language Models in Token Pairs](https://mlsanity.com/paper/2609.35224/) (2026)
- [On the Intrinsic Limited Robustness of Latent-Based Watermarking](https://mlsanity.com/paper/2610.08178/) (2026)

## Abstract (arXiv)

As the quality of image generators continues to improve, deepfakes become a topic of considerable societal debate. Image watermarking allows responsible model owners to detect and label their AI-generated content, which can mitigate the harm. Yet, current state-of-the-art methods in image watermarking remain vulnerable to forgery and removal attacks. This vulnerability occurs in part because watermarks distort the distribution of generated images, unintentionally revealing information about the watermarking techniques. In this work, we first demonstrate a distortion-free watermarking method for images, based on a diffusion model's initial noise. However, detecting the watermark requires comparing the initial noise reconstructed for an image to all previously used initial noises. To mitigate these issues, we propose a two-stage watermarking framework for efficient detection. During generation, we augment the initial noise with generated Fourier patterns to embed information about the group of initial noises we used. For detection, we (i) retrieve the relevant group of noises, and (ii) search within the given group for an initial noise that might match our image. This watermarking approach achieves state-of-the-art robustness to forgery and removal against a large battery of attacks.