Diffusion watermarks survive erasure: wavelet-domain replicas keep 88% bit accuracy under MarkNull
Synopsis
Provenance watermarks for diffusion-generated images were previously suppressed by removal attacks with little visible quality loss. WaveMark embeds the message in the initial noise's wavelet domain, using a key to spread replicas of each message bit across spatial positions, wavelet orientations, and scales, then encodes each bit in a carrier's projection magnitude. On SD2.1 it reaches 100.0% bit accuracy without attacks and retains 88.66% and 88.06% under MarkNull and MarkNull-A, above the compared baselines.
Interpretation
The watermark moves from the finished image or a post-processing step into the wavelet domain of the diffusion model's initial noise, so the provenance signal enters during generation. Earlier initial-noise watermarks were suppressed by regeneration and adversarial removal, because those attacks alter the latent signal recovered by inversion or perturb the projections used for detection. On SD2.1 with a 64-bit message and a 256-bit key, bit accuracy is 100.0% without attacks, comparable to the six evaluated baselines.
Each message bit is no longer stored once; keyed replicas are spread over disjoint four-channel carriers covering spatial positions, wavelet orientations, and scales. Simply repeating a bit does not solve the problem, because replicas exposed to correlated distortions can fail together. Replicas are assigned across subbands of a two-level Haar decomposition, each carrier groups coefficients from four latent channels, and decoding combines replica decisions by hard majority voting.
A bit is carried by a carrier's projection magnitude, set to zero or a fixed amplitude along a keyed direction, with the orthogonal residual scaled to preserve carrier energy in expectation. Raising embedding strength widens the separation between bit values, but repeated carrier modifications change initial-noise energy and reduce image quality. Evaluation uses 100 watermarked images per method on SD2.1 and MS-COCO Captions under 14 attacks; under MarkNull and MarkNull-A bit accuracy is 88.66% and 88.06%, improving on the strongest baselines by 27.30% and 13.32%.
Perspective
Evaluation covers 14 attacks on SD2.1 with 100 generated images per watermarking method, plus watermark recovery validation on SD3.5-Medium. The intended setting is user attribution in a text-to-image service that supports this watermark: a user supplies a personal key and message, and verification extracts with the matching key and compares against the registered message. Future work points toward publicly verifiable watermarking, enabling third-party verification without disclosing users' secret keys.
Under NFPA bit accuracy drops to 54.18%, below the 71.875% detection threshold, and under CtrlRegen+ it falls to 79.47%. The authors note that NFPA treats the watermarked image as an initial video frame and predicts the next frame; although this suppresses the watermark, the resulting images differ substantially from the original inputs. Publicly verifiable watermarking is not yet implemented.