Diffusion-model watermarks survive erasure: hiding bits in wavelet subbands keeps 88% bit accuracy under MarkNull

The watermark's embedding site moves from the whole initial noise to disjoint four-channel carriers in the wavelet domain, with replicas of each message bit spread across spatial positions, wavelet orientations, and scales. Earlier initial-noise watermarks spread the signal across the noise as a whole, and under regeneration and adversarial erasure attacks the recovered carrier projections drift toward or across the decision boundary. On SD2.1, 100 watermarked images were generated for each of SDP and MS-COCO Captions; bit accuracy is 100.0% with no attack and 88.66% and 88.06% under MarkNull and MarkNull-A, above all compared baselines.

Each carrier groups coefficients from four latent channels, and embedding changes only the carrier's projection magnitude along a keyed direction while scaling the orthogonal residual by a fixed gain to compensate for the energy the projection introduces. Raising embedding strength alone widens the separation between bit values, but repeated modification alters the initial-noise energy and lowers image quality, so the decision margin has to be bought under an energy constraint. Decoding estimates the initial noise with a VAE encoder and empty-prompt DDIM inversion, applies the same Haar transform to locate carriers, compares each projection magnitude with the midpoint of the two target magnitudes, and recovers message bits by majority voting.

The reported setting is user attribution in a text-to-image generation service: the provider runs the service, a compliant user supplies a personal key and a chosen watermark message, and verification extracts the watermark with the corresponding key and matches it against the registered message. Evaluation uses SD2.1 with 50 DDIM sampling steps, guidance scale 7.5, a 64-bit message and a 256-bit key, with recovery also validated on SD3.5-Medium. The authors propose future work extending WaveMark toward publicly verifiable watermarking, so a third party can verify without disclosing users' secret keys.

Among regeneration attacks, bit accuracy falls to 79.47% under CtrlRegen+ and 54.18% under NFPA; the authors note that NFPA treats the watermarked image as an initial video frame and predicts the next frame, which suppresses the watermark but leaves images substantially different from the original inputs. Except for NFPA, bit accuracy stays above the 71.875% detection threshold under every evaluated attack. The authors also state that WaveMark does not have the best value for every metric, but retains competitive image quality while achieving full bit accuracy.