AI 中文总结
IRIS是一种无需训练的扩散图像防伪造水印方案，通过视觉-语义绑定抵御固定图案移植与事后再生剥离，在三个提示数据集上检测可靠且保真度优异。
AI 中文摘要
大多数代内扩散水印嵌入与承载图像无关的图案，攻击者可将这些水印移植到生成器未生成的图像上，从而造成伪造。将水印与视觉语义绑定可防止此类移植，但现有绑定锚定的是代理图像而非其标记的图像。在生成过程中实现视觉-语义绑定面临两大挑战：水印源自图像本身，但在该图像存在前就进入采样轨迹，且可能会改变其绑定的语义；绑定还需满足相反的敏感性需求——在语义变化下失效，而在常见处理下保持有效。我们提出IRIS，一种无需训练的水印方案，用于嵌入源自语义的固有环标识符。IRIS从无水印的生成图像中读取内容代码，结合该代码与密钥生成一次性环，返回至同一轨迹的最终低噪声步骤，在其绑定的语义稳定后将环融入。为满足相反敏感性需求，代码通过嵌入与检测共享的规范化方式读取，在常见失真和轻度再生下保持稳定，而在语义变化时翻转。检测仅从查询图像和密钥重新计算环，因此水印在外来或拼接图像上失效，接受度可追踪语义位移。在三个提示数据集上，IRIS检测可靠，且与同种子无水印对应图像接近，这是代内水印未达到的保真度先验。固定图案水印可被伪造移植，事后再生水印可被剥离，而在对比的水印中，仅IRIS可同时抵御这两种攻击。
英文摘要
Most in-generation diffusion watermarks embed patterns independent of the image that carries them, and attackers transplant the marks onto images the generator did not produce, resulting in forgery. Binding the mark to visual semantics prevents such transplantation, yet existing bindings anchor to a proxy image rather than the image they mark. Realizing visual-semantic binding inside generation faces two challenges. The mark derives from the image itself yet enters the sampling trajectory before that image exists, and may itself shift the semantics it binds. The binding also meets opposite sensitivity demands, breaking under semantic change while holding through common processing. We present IRIS, a training-free watermarking scheme that embeds an Intrinsic Ring Identifier from Semantics. IRIS reads a content code from the non-watermarked generated image, derives a one-time ring from the code and a secret key, returns to the final low-noise steps of the same trajectory and blends the ring in, after the semantics it binds are settled. To meet the opposite sensitivity demands, the code is read through a canonicalization shared between embedding and detection, holding through common distortions and mild regeneration while flipping under semantic change. Detection recomputes the ring from the query image and the key alone, and the mark therefore fails on a foreign or spliced image, with acceptance tracking semantic displacement. On three prompt datasets IRIS detects reliably and stays close to its same-seed non-watermarked counterpart, a fidelity prior in-generation marks do not reach. While forgeries transfer fixed-pattern marks and regeneration strips post-hoc marks, IRIS alone among the compared marks withstands both.
CommentsSubstantial revisions
