Tree-Ring Watermarks: Fingerprints for Diffusion Images that are
  Invisible and Robust
Watermarking the outputs of generative models is a crucial technique for
tracing copyright and preventing potential harm from AI-generated content. In
this paper, we introduce a novel technique called Tree-Ring Watermarking that
robustly fingerprints diffusion model outputs. Unlike existing methods that
perform post-hoc modifications to images after sampling, Tree-Ring Watermarking
subtly influences the entire sampling process, resulting in a model fingerprint
that is invisible to humans. The watermark embeds a pattern into the initial
noise vector used for sampling. These patterns are structured in Fourier space
so that they are invariant to convolutions, crops, dilations, flips, and
rotations. After image generation, the watermark signal is detected by
inverting the diffusion process to retrieve the noise vector, which is then
checked for the embedded signal. We demonstrate that this technique can be
easily applied to arbitrary diffusion models, including text-conditioned Stable
Diffusion, as a plug-in with negligible loss in FID. Our watermark is
semantically hidden in the image space and is far more robust than watermarking
alternatives that are currently deployed. Code is available at
github.com/YuxinWenRick/tree-ring-watermark.
6477ec65168cb428e01195b2
Yuxin Wen
claimed_verified
2023-06-01T05:54:42.869Z
62cda27d248f9e6bc20c4261
/avatars/907b9464071ff7ed1ff064331595f12f.svg
Yuxin Wen
user
ywen
6477ec65168cb428e01195b3
John Kirchenbauer
admin_assigned
2023-06-01T08:05:55.217Z
63d98af1897746d6496177df
/avatars/c5d0031c796a3c11bcb0d01b959168dc.svg
John Kirchenbauer
user
jwkirchenbauer
6477ec65168cb428e01195b4
Jonas Geiping
admin_assigned
2023-06-01T08:06:48.444Z
63d86dbf3130cadcaf8bdd11
/avatars/29d79a0c6dcec01111ef192fecd0fa7a.svg
Jonas Geiping
user
JonasGeiping
6477ec65168cb428e01195b5
Tom Goldstein
admin_assigned
2023-06-01T08:07:24.092Z
6381ca7d65dc156aba0b933d
/avatars/84dfdca8e1cd6fbf50d6fb2a6f1b488d.svg
Tom Goldstein
user
tomgoldstein
Tree-Ring Watermarks: Fingerprints for Diffusion Images that are
  Invisible and Robust
Watermarking the outputs of generative models is a crucial technique for
tracing copyright and preventing potential harm from AI-generated content. In
this paper, we introduce a novel technique called Tree-Ring Watermarking that
robustly fingerprints diffusion model outputs. Unlike existing methods that
perform post-hoc modifications to images after sampling, Tree-Ring Watermarking
subtly influences the entire sampling process, resulting in a model fingerprint
that is invisible to humans. The watermark embeds a pattern into the initial
noise vector used for sampling. These patterns are structured in Fourier space
so that they are invariant to convolutions, crops, dilations, flips, and
rotations. After image generation, the watermark signal is detected by
inverting the diffusion process to retrieve the noise vector, which is then
checked for the embedded signal. We demonstrate that this technique can be
easily applied to arbitrary diffusion models, including text-conditioned Stable
Diffusion, as a plug-in with negligible loss in FID. Our watermark is
semantically hidden in the image space and is far more robust than watermarking
alternatives that are currently deployed. Code is available at
github.com/YuxinWenRick/tree-ring-watermark.
A novel technique called Tree-Ring Watermarking robustly fingerprints diffusion model outputs by embedding a pattern into the initial noise vector and is invariant to various image transformations.
Tree-Ring Watermarking diffusion models sampling process Fourier space semantic hidden convolutions crops dilations flips rotations noise vector FID text-conditioned Stable Diffusion