An Undetectable Watermark for Generative Image Models

Abstract: We present the first undetectable watermarking scheme for generative image models. Undetectability ensures that no efficient adversary can distinguish between watermarked and un-watermarked images, even after making many adaptive queries. In particular, an undetectable watermark does not degrade image quality under any efficiently computable metric. Our scheme works by selecting the initial latents of a diffusion model using a pseudorandom error-correcting code (Christ and Gunn, 2024), a strategy which guarantees undetectability and robustness. We experimentally demonstrate that our watermarks are quality-preserving and robust using Stable Diffusion 2.1. Our experiments verify that, in contrast to every prior scheme we tested, our watermark does not degrade image quality. Our experiments also demonstrate robustness: existing watermark removal attacks fail to remove our watermark from images without significantly degrading the quality of the images. Finally, we find that we can robustly encode 512 bits in our watermark, and up to 2500 bits when the images are not subjected to watermark removal attacks. Our code is available at https://github.com/XuandongZhao/PRC-Watermark.

• The paper introduces an undetectable PRC watermarking method using pseudorandom error-correcting codes integrated in latent diffusion models.
• The approach preserves high image fidelity while robustly resisting attacks like JPEG compression and adversarial perturbations.
• Experimental results demonstrate improved FID and CLIP scores over traditional watermarking techniques, setting a new benchmark.

An Undetectable Watermark for Generative Image Models

The paper "An Undetectable Watermark for Generative Image Models" (arXiv ID: (2410.07369)) introduces an innovative watermarking scheme designed for generative image models that promises undetectability without compromising image quality or robustness. This work addresses critical issues in watermarking by ensuring that the watermark is indistinguishable from un-watermarked images under efficient computational metrics. The scheme leverages pseudorandom error-correcting codes, making it a promising tool in counteracting AI-generated disinformation. Here, we explore the methodology, robustness, and implications of this undetectable watermarking approach.

Introduction to Undetectable Watermarks

With the proliferation of AI-generated content, watermarking becomes vital in flagging AI-generated images to prevent disinformation. Traditional watermarking schemes often degrade image quality, raising barriers to adoption. The newly proposed scheme termed as the pseudorandom code (PRC) watermark stands out by ensuring undetectability—meaning adversaries cannot efficiently differentiate between watermarked and non-watermarked images.

Figure 1: Examples of different watermarks applied to generated images, highlighting the undetectable nature of the PRC watermark.

Methodology

PRC and Watermarking Setup

The watermark utilizes latent diffusion models, which operate within a denoising framework to generate images from noise vectors. The PRC watermark introduces specific PRC-coded latents into this process, ensuring the preservation of semantic information while embedding the watermark.

Key Components:

• Pseudorandom Code (PRC): Embeds watermark at a semantic level using pseudorandom codes, ensuring robustness and undetectability.
• Sign-Based Encoding: Utilizes specific sign patterns in latent space, influenced by PRC, to encode watermarks while preserving image quality.

Implementation Details

The watermark is implemented within the latent diffusion framework, specifically targeting Stable Diffusion 2.1. Codewords generated from PRC are integrated into the initial noise of the image generation process, ensuring non-detectability and high fidelity.

Watermark Integration Process:

def PRCWat_Sample(key, message): codeword = PRC_Encode(key, message) latent = sample_latent() watermarked_latent = integrate_codeword(latent, codeword) image = generate_image(watermarked_latent, prompt) return image

Quality and Detectability Evaluation

Experiments comparing PRC with traditional watermarking schemes demonstrate significant improvements in image quality metrics such as FID and CLIP scores. Unlike alternative methods which introduce noticeable artifacts, the PRC watermark maintains high perceptual fidelity, minimizing detection risks.

Figure 2: Robustness evaluation of different watermarking schemes showing significant resilience of PRC watermark under various attacks.

Robustness and Security

Attack Resistance

PRC watermark demonstrates substantial robustness across multiple attack scenarios, including JPEG compression and adversarial perturbations. Its effectiveness in maintaining watermark integrity under high-quality image retention is remarkable.

Figure 3: Robustness under strongest attacks, excluding embedding attacks.

Spoofing and Removal Attacks

The watermark's resistance to spoofing attacks further solidifies its position as a reliable choice for secure watermarking. Such robustness is achieved by maintaining undetectable parity checks within the encoded message, making it computationally expensive to spoof.

Implications and Future Work

The introduction of cryptographically secure PRC watermarks paves the way for watermarking methods in generative models that could facilitate widespread adoption. The development of such undetectable mechanisms is critical in regulatory and commercial contexts, especially when dealing with AI-driven image generation services. Future work may explore extending the algorithm to other generative models and further optimizing PRC constructions for improved undetectability.

Conclusion

The integration of undetectable watermarks into generative image models offers a transformative approach to preserving content authenticity. By coupling robustness with quality preservation, the PRC watermark addresses critical limitations in existing schemes, setting a benchmark for watermarking methodologies in computational imaging.

This work not only provides a viable tool against disinformation but also stimulates further research in cryptographically secure watermarking technologies that maintain generative model performance while ensuring content integrity.