An Undetectable Watermark for Generative Image Models

Question 1.

Yes, you are absolutely correct! That was a typo; there should not have been a 1/2 in the first place. We have updated it now, and thank you for noticing this.

Question 2.

We would like to point out a couple of key things:

a. In fact our robustness is significantly greater than Tree-Ring for the strongest attacks. See Figures 3 and 8.

b. Our robustness is very similar to that of StegaStamp for small perturbations. However, StegaStamp hugely impacts image quality — see Figure 1 (where splotches are clearly visible in the watermarked image) and Table 1.

c. Gaussian Shading does outperform our watermark on robustness. However, that method massively impacts image variability — see Figure 10 for a visual example, Table 2 for a quantitative measurement of variability using the LPIPS score, Table 1 for quality, and the “Gaussian Shading watermark” paragraph of our Related Work section for a more in-depth discussion.

Taking a step back, the premise of our work is that quality is an absolute necessity. It is not clear that any company would be willing to implement a watermark with an 8% loss in quality [1] with no guarantees about performance on un-tested edge cases, if the model cost over 100 million dollars to train. Indeed, to our knowledge no major company has implemented a watermark by default on a production-level model. (Even Google’s SynthID is an opt-in service with highly limited availability.) Once we have quality down, only then should we start worrying about robustness.

Finally, one should consider whether robustness is even important for large perturbations. It's true that for heavy perturbations, StegaStamp and Gaussian Shading are more robust. But in this regime, one can easily tell that perturbations have been applied (see e.g. Figure 12). Users willing to tolerate such a significant hit on quality would probably simply use a weaker model that isn't watermarked in the first place.

[1] Tree-Ring, Gaussian Shading, and Stable Signature all suffer from at least an 8% loss under FID on the Stable Diffusion Prompts dataset in Table 1.

Question 1:

We include standard deviations in Table 1 to indicate the significance of the results. We have updated that table to highlight the quality scores that are more than 3 standard deviations away from the original model in red. We hope that this helps make this part of our result more convincing; we do not have time to conduct a more in-depth analysis now.

Question 2:

Ok, thanks for the suggestion! We have performed the same calculations using FID with 1,000 images. We obtained similar results:

Question 3:

Sorry, this concern probably stems from our Figure 1, which previously showed some watermarks used as post-processing schemes and others used as in-processing schemes. In that figure, we had treated Stable Signature as an in-processing scheme, and therefore the image was unrelated to the "original image." It was instead a freshly sampled watermarked response to the prompt. We have now updated the figure to use fresh images for every watermark, to make it more clear that we are only interested in the in-processing scenario.

Question 4:

The PSNR measures the relative quality, i.e., the amount of noise relative to the initial sampled image. However, the initial sampled image under StegaStamp and Gaussian Shading is significantly lower quality than the initial sampled image under the PRC watermark.

It's true that for heavy perturbations, StegaStamp and Gaussian Shading are more robust. But we believe that this is not the interesting regime: Here, one can easily tell that perturbations have been applied (see e.g. Figure 12). Users willing to tolerate such a significant hit on quality would probably simply use a weaker model that isn't watermarked in the first place.

Question 5:

See our response to Question 3.

To be clear, our watermark is embedded into content as it is being generated. This is the scenario considered in Tree-Ring and Gaussian Shading, and is the most relevant scenario for generative AI. See our Related Work section for an explanation of "in-processing" vs "post-processing" watermarks.

In our in-processing application scenario, the amount one needs to modify any particular initial noise vector to embed the watermark is immaterial, as it is never observed by any user. That is, to generate an image, the model owner first samples a fresh initial noise vector each time. So what matters is that the distribution of initial noise vectors is not noticeably changed, and our watermark is the first to satisfy this property! In contrast, as demonstrated in our experiments in Section 4.2, prior schemes noticeably alter the distribution of generated content.

Question 6:

We performed the same experiment for several models, obtaining the same result each time. The new results are shown in Figure 6 of the updated PDF. We would like to emphasize that the results of these experiments were essentially pre-ordained by Theorem 1.

Question 1.

Re: Changing the initial noise: We believe that there may have been some confusion about our application scenario. Our watermark is embedded into content as it is being generated. If one needs to add a watermark to an existing image, then our method does not apply at all. While it is possible to use Tree-Ring to embed a watermark in an existing image, it will drastically change the image and is not intended for this purpose — see their paper. Also see our Related Work section for the difference between "in-processing" watermarks (such as ours, Gaussian Shading, and Tree-Ring) and "post-processing" watermarks.

In our in-processing application scenario, the amount one needs to modify any particular initial noise vector to embed the watermark is immaterial, as it is never observed by any user. That is, to generate an image, the model owner first samples a fresh initial noise vector each time. So what matters is that the distribution of initial noise vectors is not noticeably changed, and our watermark is the first to satisfy this property! In contrast, as demonstrated in our experiments in Section 4.2, prior schemes noticeably alter the distribution of generated content.

TLDR: Our results demonstrate that our watermark is actually the strongest existing watermark in terms of minimizing discrepancies observable by the end-users in practical applications. In particular, the end-user without the key cannot tell that our watermark is there, even if they are looking for it.

Re: Novelty compared to Tree-Ring: It is true that the idea to select initial noise of a diffusion model is from the Tree-Ring paper, but we argue that there is still highly substantial work to be done in determining precisely how to select the initial noise. In particular, if one uses the Tree-Ring watermark, then there is a significant distribution shift in the generated images (as demonstrated in our quality results, and even pointed out in the Tree-Ring paper itself!). Therefore in our view, the key idea of this work is to use a pseudorandom code to select the latents of the image — an idea that is both novel and, we believe, interesting from both a theoretical/security standpoint and a practical/ML standpoint.

Question 2.

Sorry, this concern probably stems from our Figure 1, which previously showed some watermarks used as post-processing schemes and others used as in-processing schemes. In that figure, we had treated Stable Signature as an in-processing scheme, and therefore the image was unrelated to the "original image." It was instead a freshly sampled watermarked response to the prompt. We have now updated the figure to use fresh images for every watermark, to make it more clear that we are only interested in the in-processing scenario.

Question 3.

Please see our explanation of undetectability on Page 1. Due to space constraints we do not state a separate formal definition of undetectability, but one is anyways implicit in Theorem 1.

In Figure 2, we demonstrate that it is very easy to detect prior watermarks without knowing the key. Observe in Figure 2 that a distinguisher quickly learns to identify other watermarks with nearly 100% accuracy, and therefore they unambiguously fail to qualify as undetectable. In contrast, the distinguishing rate hovers around 50% for the PRC watermark (no better than random guessing). Note also that the result of this experiment for the PRC watermark was essentially pre-ordained by Theorem 1.

Re: “Competitive” metric performance: We believe that it is imperative that a watermark absolutely minimizes quality degradation for production-level models. For instance, an 8% increase in FID (which is observed under Tree-Ring on the Stable Diffusion Prompts dataset in Table 1) may not sound like a lot, but for a modern state-of-the-art model that takes immense resources to train, we believe that it is unlikely for anyone to be willing to take such a hit. This is the primary motivation for our work: Ensure that you truly preserve quality, then worry about robustness. And as demonstrated in Table 1, ours is the only quality-preserving watermark.

Question 4.

We demonstrate many different attacks, described in detail in Section A.2. All of the attacks we consider use only a single query, and then apply post-processing to the watermarked image.

We agree that FPR=0.01 is too high to be practical. Our watermark tends to excel at lower FPRs, but we used this high FPR because it is the most common choice for prior works and we wanted to compare on equal footing.

It's true that for heavy perturbations, StegaStamp and Gaussian Shading are more robust. But we believe that this is not the interesting regime: Here, one can easily tell that perturbations have been applied (see e.g. Figure 12). Users willing to tolerate such a significant hit on quality would probably simply use a weaker model that isn't watermarked in the first place.

Thanks for your comments! We have updated the PDF to address your concerns and those of the other reviewers.

Question 1.

We only used 1 key to generate Figure 2; note that using additional keys without adjusting the scheme will increase the false positive rate. More importantly, it is unlikely to affect the results: Other than the PRC watermark, existing schemes embed simple patterns in the images and can therefore easily be learned (see our Related Work section). Indeed, we reproduced Figure 2 using 2 keys for each scheme and observed essentially the same results. This is included in Figure 7 of our updated PDF. We will try to include a larger experiment with more keys by Wednesday, we have just not yet had the time to do this.

Question 2.

Good point. We reference the basic idea on page 5, but as you point out, it is extremely terse: "this PRC works by sampling random $t$-sparse parity checks and using noisy solutions to the parity checks as PRC codewords." In more detail, we first sample the parity checks at random, then we sample a generator matrix consistent with those parity checks with carefully chosen dimension; codewords are noisy samples from the image of the generator matrix.

The main reason for our brevity is that there exist several new constructions of PRCs in the literature now [Golowich & Moitra 2024; Ghentiyala & Guruswami 2024], and our method immediately works by substituting any of these. We chose the PRC of [Christ & Gunn 2024], but in general the PRC watermark should use the best known PRC. We did not want to detract from this point by overly focusing on the particular construction in the body of the paper. Therefore we chose to instead focus on how we use the PRC in the body.

(We also found it difficult to fit more discussion into the 10-page limit.)

Question 3.

Great catch, thank you! We have added a pointer to the appropriate figure in Section 4.5. We again only used 1 key to generate this figure.

My concerns have been resolved, and I will raise my score. The idea is interesting. Thanks for your efforts!