T2SMark: Balancing Robustness and Diversity in Noise-as-Watermark for Diffusion Models
Jindong Yang, Han Fang, Kejiang Chen, Weiming Zhang, Nenghai Yu
Diffusion models have advanced rapidly in recent years, producing high-fidelity images while raising concerns about intellectual property protection and the misuse of generative AI. Image watermarking for diffusion models, particularly Noise-as-Watermark (NaW) methods, embeds watermarks into latent representations drawn from a standard Gaussian distribution to preserve image quality. For detection, the generation process is inverted to recover the initial noise vector containing the watermark before extraction. However, existing NaW methods struggle to balance watermark robustness with generation diversity. Some methods achieve strong robustness by heavily constraining the initial noise sampling, which degrades user experience, while others preserve diversity but prove too fragile for real-world deployment. To address this issue, we propose T2SMark, a training-free watermarking scheme based on two-stage tail-truncated sampling. Unlike prior methods that simply map bits to positive or negative values, tail-truncated sampling excludes the easily flipped regions of the latent distribution, enhancing robustness with even less redundancy. Our two-stage framework then compensates sampling diversity by incorporating a random key into both encryption pipelines—first as the payload and then as the encryption key. We evaluate T2SMark on diffusion models with both U-Net and DiT backbones. Extensive experiments show that it achieves an optimal balance between robustness and diversity.