Watermarking the initial noise of diffusion models has emerged as a promising approach for image provenance, but content-independent noise patterns can be forged via inversion and regeneration attacks. Recent semantic-aware watermarking methods improve robustness by conditioning verification on image semantics. However, their reliance on a single global semantic binding makes them vulnerable to localized but globally coherent semantic edits. To address this limitation and provide a trustworthy semantic-aware watermark, we propose Semantic Latent Injection via Compartmentalized Embedding (SLICE). Our framework decouples image semantics into four semantic factors (subject, environment, action, and detail) and precisely anchors them to distinct regions in the initial Gaussian noise. This fine-grained semantic binding enables advanced watermark verification where semantic tampering is detectable and localizable. We theoretically justify why SLICE enables robust and reliable tamper localization and provides statistical guarantees on false-accept rates. Experimental results demonstrate that SLICE significantly outperforms existing baselines against advanced semantic-guided regeneration attacks, substantially reducing attack success while preserving image quality and semantic fidelity. Overall, SLICE offers a practical, training-free provenance solution that is both fine-grained in diagnosis and robust to realistic adversarial manipulations.
Figures & tables
Figure 1: The overall framework of SLICE.
Figure 2: Structure of the Meta-Prompt Pmeta .
Figure 3: Semantic extraction stability across prompt languages . The axes represent text embedding cosine similarity between initial and re-extracted descriptors.
Detector (ASR % ↓ )
LFA [ 24 ]
RPM [ 2 ]
CSI [ 16 ]
Content-independent semantic watermarks
Gaussian Shading [ 46 ]
100
100
100
Tree-Ring [ 43 ]
93.81
100
100
WIND [ 1 ]
100
100
100
Content-aware semantic watermark
SEAL [ 2 ]
0
7
81
Table 1: Quantitative comparison of watermark resistance against generative semantic attacks .
Transformation
Clean
Rotate
JPEG
Blur
Noise
Bright
Accuracy
1.000
1.000
0.990
0.988
0.993
0.941
Table 2: Resistance of SLICE against common image perturbations.
SDP
COCO
CLIP (before)
CLIP (after)
CLIP (before)
CLIP (after)
33.034
32.789
31.342
31.240
Table 3: CLIP scores before and after SLICE watermark injection .
Figure 4: Qualitative comparison of visual fidelity with and without SLICE watermarking.
Figure 5: Case study of the proposed multi-granularity verification mechanism .
Vulnerability
Mitigation via Passive Forensics (AUC ↑ )
Method
Ours (C&S)
Feature Stab.
Resampling
Freq-Texture
ResNet18
Spectral Aniso.
AUC
0.054
0.850
0.920
0.940
0.980
0.990
Table 4: Mitigation of C&S attack via passive forensics.
Generative images have proliferated on Web platforms in social media and online copyright distribution scenarios, and semantic watermarking has increasingly been integrated into diffusion models to support reliable provenance tracking and forgery prevention for web content. Traditional noise-layer-based watermarking, however, remains vulnerable to inversion attacks that can recover embedded signals. To mitigate this, recent content-aware semantic watermarking schemes bind watermark signals to high-level image semantics, constraining local edits that would otherwise disrupt global coherence. Yet, large language models (LLMs) possess structured reasoning capabilities that enable targeted exploration of semantic spaces, allowing locally fine-grained but globally coherent semantic alterations that invalidate such bindings. To expose this overlooked vulnerability, we introduce a Coherence-Preserving Semantic Injection (CSI) attack that leverages LLM-guided semantic manipulation under embedding-space similarity constraints. This alignment enforces visual-semantic consistency while selectively perturbing watermark-relevant semantics, ultimately inducing detector misclassification. Extensive empirical results show that CSI consistently outperforms prevailing attack baselines against content-aware semantic watermarking, revealing a fundamental security weakness of current semantic watermark designs when confronted with LLM-driven semantic perturbations.
Zheng Gao, Xiaoyu Li, Zhicheng Bao +2
University of New South Wales Sydney, New South Wales, Australia · Griffith University Brisbane, Queensland, Australia
With the proliferation of AI-generated images, digital watermarking has become an essential safeguard for protecting intellectual property and mitigating malicious exploitation. Recent works on semantic watermarking have enabled efficient copyright protection for diffusion models. However, the dependence of semantic watermarking on diffusion inversion for watermark detection creates a critical vulnerability. Imprint removal and forgery attacks exploit this weakness to produce deceptive results. Our analysis reveals that these attacks succeed by displacing watermarked latents into the unwatermarked region, while guiding unwatermarked latents into the watermarked region. Based on that, we propose Progressive Guided Inversion and Denoising (PGID), the first plug-and-play, training-free noise extraction framework designed to defend against both attack strategies. PGID effectively defends by projecting perturbed latents back to the region where they originally belong. The projection is achieved by eliminating intermediate latent deflections and mitigating adversarial perturbations through progressive inversion-denoising cycles. Comprehensive evaluations across multiple schemes demonstrate that PGID successfully restores detection reliability by recovering removed watermarks and identifying forged instances.
Semantic text watermarks encode signals in meaning rather than surface token choices, offering robustness to paraphrasing and other semantic-preserving edits. Existing semantic watermarking methods are primarily designed for autoregressive language models (ARLMs), where completed candidate units can be generated and scored before generation proceeds. This paradigm does not naturally extend to diffusion language models (DLMs), where semantic units remain incomplete during intermediate denoising steps and tokens may be updated in flexible orders. We propose DenMark, a semantic watermarking framework that injects key-dependent signals directly into the DLM denoising process. DenMark partitions the output into fixed token regions and uses temporary rollouts as semantic lookahead: conditional completions estimate the eventual semantics of an incomplete region, enabling DenMark to select local updates with higher estimated semantic watermark scores. Repeating this procedure across denoising steps progressively accumulates watermark evidence in the final output. For detection, DenMark uses calibrated scanning over candidate unit sizes to remain robust to boundary shifts introduced by semantic attacks. Across four DLMs, three datasets, and four semantic attacks, DenMark gives the strongest overall robustness and achieves the best TPR at each reported operating point in 46 of the 48 backbone-dataset-attack combinations. Overall, DenMark provides an effective semantic watermark for DLMs. Code is available at https://github.com/TianhaoMa5/DenoMark.
Tianhao Ma, Weihao Xuan, Dong-Dong Wu +5
The University of Tokyo · RIKEN Center for Advanced Intelligence Project