Watermarking the outputs of generative models is a crucial technique for tracing copyright and preventing potential harm from AI-generated content. In this paper, we introduce a novel technique called Tree-Ring Watermarking that robustly fingerprints diffusion model outputs. Unlike existing methods that perform post-hoc modifications to images after sampling, Tree-Ring Watermarking subtly influences the entire sampling process, resulting in a model fingerprint that is invisible to humans. The watermark embeds a pattern into the initial noise vector used for sampling. These patterns are structured in Fourier space so that they are invariant to convolutions, crops, dilations, flips, and rotations. After image generation, the watermark signal is detected by inverting the diffusion process to retrieve the noise vector, which is then checked for the embedded signal. We demonstrate that this technique can be easily applied to arbitrary diffusion models, including text-conditioned Stable Diffusion, as a plug-in with negligible loss in FID. Our watermark is semantically hidden in the image space and is far more robust than watermarking alternatives that are currently deployed. Code is available at https://github.com/YuxinWenRick/tree-ring-watermark.
FreqMark: Invisible Image Watermarking via Frequency Based Optimization in Latent Space
University of California, Santa Cruz（加州大学圣克鲁兹分校）；The University of Hong Kong（香港大学）；University of Science and Technology of China（中国科学技术大学）；IEG, Tencent（腾讯IEG）；Fudan University（复旦大学）
University of Science and Technology of China（中国科学技术大学）；Institute of Artificial Intelligence（人工智能研究院）；Hefei Comprehensive National Science Center（合肥综合国家科学中心）；Michigan State University（密歇根州立大学）；Cisco Research（思科研究）
Nanjing University of Information Science and Technology（南京信息工程大学）；Jinan University（暨南大学）；University of Siena（锡耶纳大学）
We propose a watermarking method for protecting the Intellectual Property (IP) of Generative Adversarial Networks (GANs). The aim is to watermark the GAN model so that any image generated by the GAN contains an invisible watermark (signature), whose presence inside the image can be checked at a later stage for ownership verification. To achieve this goal, a pre-trained CNN watermarking decoding block is inserted at the output of the generator. The generator loss is then modified by including a watermark loss term, to ensure that the prescribed watermark can be extracted from the generated imag…
Breaking Watermarks in the Frequency Domain: A Modulated Diffusion Attack Framework
Qilu University of Technology (Shandong Academy of Sciences)（齐鲁工业大学（山东省科学院））；Dalian Maritime University（大连海事大学）；Nanjing University of Science and Technology（南京理工大学）；Shandong Jianzhu University（山东建筑大学）
LVMark: Robust Watermark for Latent Video Diffusion Models
Department of Artificial Intelligence, Korea University, Seoul 02841, Republic of Korea（人工智能系，韩国大学，首尔02841，大韩民国）；Google DeepMind, Mountain View, CA 94043, USA（谷歌DeepMind，山景城，加利福尼亚州94043，美国）
Safe-Sora: Safe Text-to-Video Generation via Graphical Watermarking
Tsinghua University（清华大学）；Institute of Automation, Chinese Academy of Sciences（中国科学院自动化研究所）；South China University of Technology（华南理工大学）；Guangdong Laboratory of Artificial Intelligence and Digital Economy (SZ)（广东人工智能与数字经济实验室）；Singapore Management University（新加坡管理学院）
Safe-VAR: Safe Visual Autoregressive Model for Text-to-Image Generative Watermarking
Zhejiang University（浙江大学）；Shenzhen University（深圳大学）；South China University of Technology（华南理工大学）；Institute of Automation, Chinese Academy of Sciences（中国科学院自动化研究所）；Peking University（北京大学）；Guangdong Laboratory of Artificial Intelligence and Digital Economy (SZ)（广东省人工智能与数字经济实验室（深圳））
San Diego State University（圣地亚哥州立大学）；University of California San Diego（加州大学圣地亚哥分校）
Deepfakes and manipulated media are becoming a prominent threat due to the recent advances in realistic image and video synthesis techniques. There have been several attempts at combating Deepfakes using machine learning classifiers. However, such classifiers do not generalize well to black-box image synthesis techniques and have been shown to be vulnerable to adversarial examples. To address these challenges, we introduce a deep learning based semi-fragile watermarking technique that allows media authentication by verifying an invisible secret message embedded in the image pixels. Instead of …
Convolutional Neural Networks (CNNs) deployed in real-life applications such as autonomous vehicles have shown to be vulnerable to manipulation attacks, such as poisoning attacks and fine-tuning. Hence, it is essential to ensure the integrity and authenticity of CNNs because compromised models can produce incorrect outputs and behave maliciously. In this paper, we propose a self-contained tamper-proofing method, called DeepiSign, to ensure the integrity and authenticity of CNN models against such manipulation attacks. DeepiSign applies the idea of fragile invisible watermarking to securely emb…
We propose adversarial embedding, a new steganography and watermarking technique that embeds secret information within images. The key idea of our method is to use deep neural networks for image classification and adversarial attacks to embed secret information within images. Thus, we use the attacks to embed an encoding of the message within images and the related deep neural network outputs to extract it. The key properties of adversarial attacks (invisible perturbations, nontransferability, resilience to tampering) offer guarantees regarding the confidentiality and the integrity of the hidd…
