论基于潜变量的水印方法的内在有限鲁棒性
On the Intrinsic Limited Robustness of Latent-Based Watermarking
AI总结：
本文首次从理论上揭示基于潜变量的扩散模型水印方法对几何扰动缺乏不变性，推导最大扰动界限并给出检测机制解析公式，实验证实其固有鲁棒性有限，并提出未来设计指南。
AI中文摘要：
现有的基于潜变量的扩散模型水印方法高估了其对图像失真的鲁棒性，包括旋转、缩放和平移（RST）等几何变换。此外，这种水印方法范式可能因水印嵌入所在的域而遭受固有局限性。在本文中，我们首次提供了理论分析，解释这些方法为何缺乏对扰动的不变性。通过放宽不变性关系，我们推导出一个最大扰动界限，该界限刻画了像素空间扰动与其在潜空间中对应效应之间的关系。此外，我们提出了首个能够涵盖实际检测机制所有组成部分的解析公式。最后，我们进行实验以验证理论发现以及基于潜变量的水印方法的局限性。我们的理论和实证结果表明，在当前设计范式下，基于潜变量的水印方法本质上表现出有限的鲁棒性。最后，我们提供了未来研究可遵循的解析工具和设计指南。
英文摘要：
Existing latent-based watermarking methods for diffusion models have overestimated their robustness to image distortions, including geometric transformations such as rotation, scaling, and translation (RST). Moreover, this paradigm of watermarking approaches may suffer from inherent limitations arising from the domain in which the watermark is embedded. In this paper, we provide the first theoretical analysis explaining why these methods lack invariance to perturbations. By relaxing the invariant relation, we derive a maximum perturbation bound that characterizes the relationship between pixel-space perturbations and their corresponding effects in latent space. In addition, we present the first analytical formulation that captures all components of practical detection mechanisms. Finally, we conduct experiments to validate the theoretical findings and the limitations of latent-based watermarking methods. Our theoretical and empirical results indicate that, under the current design paradigm, latent-based watermarking methods intrinsically exhibit limited robustness. We conclude by providing the analytical tool and design guidelines that future research could follow.
