Reproduce “Gaussian Shading: Provable Performance-Lossless Image Watermarking for Diffusion Models” on OpenResearch

About this paper

Zijin Yang, Kai Zeng, Kejiang Chen, Han Fang, Weiming Zhang, Nenghai Yu

Gaussian Shading embeds watermark information in diffusion models’ initial noise while preserving its Gaussian distribution and leaving model parameters unchanged. It randomizes repeated watermark bits and samples noise from corresponding probability intervals; extraction uses DDIM inversion and a key. On Stable Diffusion v2.1, its adversarial-average detection true-positive rate is 0.996 versus Tree-Ring’s 0.906 at false-positive rate 10⁻⁶, across tested distortions.

Key insights

• Watermarks can be integrated into diffusion models without compromising generative performance by meticulously preserving the standard Gaussian distribution of initial latent representations through distribution-preserving sampling.
• Diffusing and randomizing the watermark prior to embedding significantly enhances its robustness against various image manipulations and allows for a high capacity for user traceability.
• The theoretical proof, based on complexity-theoretic steganographic security, demonstrates that a polynomial-time tester cannot distinguish between watermarked and normally generated images, validating the performance-lossless claim.

Summary by alphaXiv.