mlsanityData to 14 Oct 2026

Watermarking Autoregressive Image Generation

arXiv 2506.16349 ↗First posted 19 Jun 2025cs.LG cs.AI cs.CRcited by 16

On the map: LLM safety and security → Watermarking generated content and models

Abstract (arXiv)

Watermarking the outputs of generative models has emerged as a promising approach for tracking their provenance. Despite significant interest in autoregressive image generation models and their potential for misuse, no prior work has attempted to watermark their outputs at the token level. In this work, we present the first such approach by adapting language model watermarking techniques to this setting. We identify a key challenge: the lack of reverse cycle-consistency (RCC), wherein re-tokenizing generated image tokens significantly alters the token sequence, effectively erasing the watermark. To address this and to make our method robust to common image transformations, neural compression, and removal attacks, we introduce (i) a custom tokenizer-detokenizer finetuning procedure that improves RCC, and (ii) a complementary watermark synchronization layer. As our experiments demonstrate, our approach enables reliable and robust watermark detection with theoretically grounded p-values. Code and models are available at https://github.com/facebookresearch/wmar.

Key facts. Cited by 16 papers in the map (data through 14 Oct 2026). Placed in Watermarking generated content and models, one of 12 directions in LLM safety and security. Builds on 101 of its 128 references that are in the map. First posted on arXiv 19 Jun 2025.

Builds on

101 of 128 references.

Closest ancestors · 22

Same direction, newest first

  1. 2025A Watermark for Auto-Regressive Image Generation Models13 Jun
  2. 2025Autoregressive Images Watermarking through Lexical Biasing: An Approach Resistant to Regeneration Attack1 Jun
  3. 2025Training-Free Watermarking for Autoregressive Image Generation20 May
  4. 2024A Watermark for Black-Box Language Models2 Oct
  5. 2024PostMark: A Robust Blackbox Watermark for Large Language Models20 Jun
  6. 2024Large Language Model Watermark Stealing With Mixed Integer Programming30 May
  7. 2024Gaussian Shading: Provable Performance-Lossless Image Watermarking for Diffusion Models7 Apr
  8. 2024Watermark Stealing in Large Language Models29 Feb
  9. 2024Watermarking Makes Language Models Radioactive22 Feb
  10. 2023REMARK-LLM: A Robust and Efficient Watermarking Framework for Generative Large Language Models18 Oct
  11. 2023A Resilient and Accessible Distribution-Preserving Watermark for Large Language Models11 Oct
  12. 2023Robustness of AI-Image Detectors: Fundamental Limits and Practical Attacks29 Sep
10 more
  1. 2023Robust Distortion-free Watermarks for Language Models28 Jul
  2. 2023Three Bricks to Consolidate Watermarks for Large Language Models26 Jul
  3. 2023Provable Robust Watermarking for AI-Generated Text30 Jun
  4. 2023On the Reliability of Watermarks for Large Language Models7 Jun
  5. 2023Tree-Ring Watermarks: Fingerprints for Diffusion Images that are Invisible and Robust31 May
  6. 2023Undetectable Watermarks for Language Models25 May
  7. 2023RoSteALS: Robust Steganography using Autoencoder Latent Space6 Apr
  8. 2023The Stable Signature: Rooting Watermarks in Latent Diffusion Models27 Mar
  9. 2023Paraphrasing evades detectors of AI-generated text, but retrieval is an effective defense23 Mar
  10. 2023A Watermark for Large Language Models24 Jan

Other references · 79

  1. 2021High-Resolution Image Synthesis with Latent Diffusion Modelscited by 18,863
  2. 2014Microsoft COCO: Common Objects in Contextcited by 17,608
  3. 2018The Unreasonable Effectiveness of Deep Features as a Perceptual Metriccited by 11,177
  4. 2022Hierarchical Text-Conditional Image Generation with CLIP Latentscited by 6,585
  5. 2022Photorealistic Text-to-Image Diffusion Models with Deep Language Understandingcited by 6,355
  6. 2016Overcoming catastrophic forgetting in neural networkscited by 4,787
  7. 2017Neural Discrete Representation Learningcited by 4,712
  8. 2024GPT-4o System Cardcited by 4,588
  9. 2023SDXL: Improving Latent Diffusion Models for High-Resolution Image Synthesiscited by 4,356
  10. 2021Zero-Shot Text-to-Image Generationcited by 4,288
  11. 2020Taming Transformers for High-Resolution Image Synthesiscited by 3,253
  12. 2019Generating Diverse High-Fidelity Images with VQ-VAE-2cited by 1,387
38 more
  1. 2022Scaling Autoregressive Models for Content-Rich Text-to-Image Generationcited by 1,295
  2. 2024Visual Autoregressive Modeling: Scalable Image Generation via Next-Scale Predictioncited by 1,023
  3. 2018Variational image compression with a scale hyperpriorcited by 935
  4. 2024Chameleon: Mixed-Modal Early-Fusion Foundation Modelscited by 927
  5. 2024Emu3: Next-Token Prediction is All You Needcited by 781
  6. 2024Autoregressive Model Beats Diffusion: Llama for Scalable Image Generationcited by 777
  7. 2021SoundStream: An End-to-End Neural Audio Codeccited by 771
  8. 2024Show-o: One Single Transformer to Unify Multimodal Understanding and Generationcited by 752
  9. 2022Autoregressive Image Generation using Residual Quantizationcited by 722
  10. 2023OpenAssistant Conversations -- Democratizing Large Language Model Alignmentcited by 721
  11. 2022High Fidelity Neural Audio Compressioncited by 687
  12. 2018Joint Autoregressive and Hierarchical Priors for Learned Image Compressioncited by 664
  13. 2021Vector-quantized Image Modeling with Improved VQGANcited by 658
  14. 2024Autoregressive Image Generation without Vector Quantizationcited by 651
  15. 2022AudioLM: a Language Modeling Approach to Audio Generationcited by 616
  16. 2020Learned Image Compression with Discretized Gaussian Mixture Likelihoods and Attention Modulescited by 590
  17. 2024Moshi: a speech-text foundation model for real-time dialoguecited by 568
  18. 2023SpeechGPT: Empowering Large Language Models with Intrinsic Cross-Modal Conversational Abilitiescited by 529
  19. 2020Scaling Laws for Autoregressive Generative Modelingcited by 522
  20. 2019Quantifying the Carbon Emissions of Machine Learningcited by 521
  21. 2023Simple and Controllable Music Generationcited by 488
  22. 2024Transfusion: Predict the Next Token and Diffuse Images with One Multi-Modal Modelcited by 483
  23. 2022Diffusion Models for Adversarial Purificationcited by 476
  24. 2021VoxPopuli: A Large-Scale Multilingual Speech Corpus for Representation Learning, Semi-Supervised Learning and Interpretationcited by 463
  25. 2024Janus: Decoupling Visual Encoding for Unified Multimodal Understanding and Generationcited by 457
  26. 2023Finite Scalar Quantization: VQ-VAE Made Simplecited by 440
  27. 2023High-Fidelity Audio Compression with Improved RVQGANcited by 431
  28. 2018HiDDeN: Hiding Data With Deep Networkscited by 397
  29. 2019Parallel WaveGAN: A fast waveform generation model based on generative adversarial networks with multi-resolution spectrogramcited by 340
  30. 2020CompressAI: a PyTorch library and evaluation platform for end-to-end compression researchcited by 276
  31. 2019StegaStamp: Invisible Hyperlinks in Physical Photographscited by 265
  32. 2019Understanding Straight-Through Estimator in Training Activation Quantized Neural Netscited by 231
  33. 2024AnyGPT: Unified Multimodal LLM with Discrete Sequence Modelingcited by 217
  34. 2024Deep Compression Autoencoder for Efficient High-Resolution Diffusion Modelscited by 217
  35. 2024World Model on Million-Length Video And Language With Blockwise RingAttentioncited by 198
  36. 2023Making LLaMA SEE and Draw with SEED Tokenizercited by 185
  37. 2024JanusFlow: Harmonizing Autoregression and Rectified Flow for Unified Multimodal Understanding and Generationcited by 163
  38. 2024Fluid: Scaling Autoregressive Text-to-image Generative Models with Continuous Tokenscited by 147

50 most cited of 79 All 79 (JSON)

Built on by

Cited by year (2026 to 14 Oct)

Citing papers per year: 2025: 4; 2026: 12.

16 papers.

Sort:

By area:

  1. 2025Pixel Seal: Adversarial-only training for invisible image and video watermarkingcited by 15
  2. 2025Watermarking Diffusion Language Modelscited by 10
  3. 2025Geometric Image Synchronization with Deep Watermarkingcited by 7
  4. 2025ClusterMark: Towards Robust Watermarking for Autoregressive Image Generators with Visual Token Clusteringcited by 3
  5. 2026Learning to Watermark in the Latent Space of Generative Modelscited by 3
  6. 2026Hidden in Plain Tokens: Simply Robust, Gradient-Free Watermark for Synthetic Audiocited by 2
  7. 2026On the Robustness of Watermarking for Autoregressive Image Generationcited by 1
  8. 2026Compositional Adversarial Training for Robust Visual Watermarkingcited by 1
  9. 2026Data Provenance for Image Auto-Regressive Generationcited by 1
  10. 2026Luminark: Training-free, Probabilistically-Certified Watermarking for General Vision Generative Modelscited by 0
  11. 2026ADD for Multi-Bit Image Watermarkingcited by 0
  12. 2026UniMark: Unified Adaptive Multi-bit Watermarking for Autoregressive Image Generatorscited by 0
4 more
  1. 2026MGI: Member vs Generated Inferencecited by 0
  2. 2026Understanding Security and Privacy Perceptions of Content Creators Regarding AI Labels of AI-Generated Contentcited by 0
  3. 2026Tokens Change, Structure Endures: Spectral Watermarking for Generated Speechcited by 0
  4. 2026Trustworthy synthetic visual media: Evidence across the media lifecyclecited by 0

Similar, not cited

Close in wording, no citation either way

  1. 2025BitMark: Watermarking Bitwise Autoregressive Image Generative Models
  2. 2026A Locally Tokenized Generative Model for Robust Time-Series Watermarking
  3. 2025Safe-VAR: Safe Visual Autoregressive Model for Text-to-Image Generative Watermarking
  4. 2026Chainwash: Multi-Step Rewriting Attacks on Diffusion Language Model Watermarks
  5. 2026Persistent Watermarking of Text-to-Image Models
  6. 2025Addressing Tokenization Inconsistency in Steganography and Watermarking Based on Large Language Models
  7. 2026Global Sketch-Based Watermarking for Diffusion Language Models
  8. 2025DMark: Order-Agnostic Watermarking for Diffusion Large Language Models