We propose SERUM: an intriguingly simple yet highly effective method for marking images generated by diffusion models (DMs). We only add a unique watermark noise to the initial diffusion generation noise and train a lightweight detector to identify watermarked images, simplifying and unifying the strengths of prior approaches. SERUM provides robustness against any image augmentations or watermark removal attacks and is extremely efficient, all while maintaining negligible impact on image quality. In contrast to prior approaches, which are often only resilient to limited perturbations and incur significant training, injection, and detection costs, our SERUM achieves remarkable performance, with the highest true positive rate (TPR) at a 1% false positive rate (FPR) in most scenarios, along with fast injection and detection and low detector training overhead. Its decoupled architecture also seamlessly supports multiple users by embedding individualized watermarks with little interference between the marks. Overall, our method provides a practical solution to mark outputs from DMs and to reliably distinguish generated from natural images.
Figures & tables
Figure 1: Overview of SERUM . First, we train a watermark detector to distinguish between watermarked latents (with/without augmentations) from clean latents. Second, to inject the SERUM watermark , the watermark noise is added to the initial random Gaussian noise for diffusion generation and passed through the LDM (Latent Diffusion Model) and decoder to produce a watermarked image. Finally, in order to detect the watermark , the image is encoded using the LDM’s encoder and passed through the detector, which outputs a high score for watermarked and a low score for clean images.
Method
Model
Perturbation Robustness (TPR @ 1% FPR)
Average
Clean
Rotate
JPEG
C&S
R. Drop
Blur
S. Noise
G. Noise
Bright
TrustMark
SD 2.1
59.43
100.00
4.30
93.18
99.98
0.42
100.00
14.80
86.96
35.20
SD 2.0
48.22
93.28
1.88
52.20
96.00
0.14
93.14
21.14
53.58
22.58
SD 1.4
59.32
100.00
4.64
93.36
100.00
0.40
100.00
14.92
86.08
34.54
Stable Signature
SD 2.1
90.94
99.96
94.62
91.14
99.96
99.06
99.40
91.02
49.02
94.24
SD 2.0
91.09
99.96
95.76
90.96
99.92
99.18
99.52
90.80
48.36
95.36
Table 1: Watermark robustness against perturbations. Results are calculated on 10,000 samples (5,000 watermarked and non-watermarked) and TPR @ 1% FPR thresholds are calculated separately for each perturbation.
Method
Average
VAE
Regen-12
Rinse-4x8
Regen-30
Rinse-2x25
CtrlRegen
I2V
TrustMark
12.30
57.62
1.32
0.70
1.06
1.02
1.18
23.20
Stable Signature
1.18
2.70
1.30
0.62
0.42
0.76
0.86
1.60
RingID
65.40
99.98
98.22
84.12
32.58
24.88
77.82
40.20
GaussMarker
58.01
98.36
89.30
65.80
9.72
10.40
91.06
41.40
SERUM (Ours)
90.87
99.88
99.72
99.38
88.50
90.76
99.64
58.20
Table 2: Robustness against advanced generative removal attacks. We report TPR @ 1% FPR evaluated on 10,000 samples.
Model
Adaptation
TPR @ 1%FPR
SD 1.4
LoRA
52.30%
SD 1.4
FFT
77.12%
SANA
FFT
96.76 %
Table 3: Radioactivity.
Method
FID ( ↓ )
CLIP Score ( ↑ )
SD 1.4
SD 2.0
SD 2.1
Avg
SD 1.4
SD 2.0
SD 2.1
Avg
Clean
17.74
17.53
18.43
17.90
0.3123
0.3169
0.3137
0.3143
TrustMark
17.80
17.51
18.45
17.92
0.312
0.3162
0.3135
0.3139
Stable Signature
17.87
17.60
18.44
17.97
0.3069
0.3159
0.3140
0.3123
RingID
20.17
18.73
20.19
19.70
0.3103
0.3147
0.3125
0.3125
GaussMarker
20.03
19.32
21.13
20.16
0.3115
0.3157
0.3147
0.3140
Table 4: Quantitative analysis of the generation quality. Adding SERUM has a negligible effect on the quality of the generated images and comparable to prior approaches.
Figure 2: Qualitative analysis of generation quality. We present outputs from the SD 2.1 model without (Clean) and with our SERUM (denoted as Ours with the parameter α=0.5 ) watermark. The most important image qualities like style and content are preserved while slightly modifying shape or perspective. More examples can be found in Appendix Figure 8 .
Figure 3: Performance of SERUM in a multi-user setting .
α
FID
Perturbation Robustness (TPR @ 1% FPR)
Average
Clean
Rotate
JPEG
C&S
R. Drop
Blur
S. Noise
G. Noise
Bright
0.0
18.43
-
-
-
-
-
-
-
-
-
-
0.1
18.91
78.49
98.64
23.92
94.60
41.18
90.76
97.30
94.82
76.14
89.02
0.2
18.84
91.85
99.74
66.16
97.72
80.08
97.86
99.22
98.90
92.50
94.44
0.3
18.95
97.73
99.96
91.98
99.74
94.84
98.68
99.74
99.78
97.64
97.24
0.4
19.05
98.92
99.98
95.50
99.78
98.38
99.32
99.92
99.76
98.62
98.98
Table 5: Impact of watermark strength α on image quality (FID) and detection robustness (TPR @ 1% FPR) for SD 2.1. We select α=0.5 as the optimal trade-off.
Setup
Perturbation Robustness (TPR @ 1% FPR)
Average
Clean
Rotate
JPEG
C&S
R. Drop
Blur
S. Noise
G. Noise
Bright
clean
78.68
100.00
14.94
99.86
59.80
77.44
100.00
98.52
66.86
88.74
precompute
97.16
100.00
79.72
99.90
97.18
99.56
99.96
99.86
99.18
99.06
transform ( τ=0 )
99.48
100.00
98.06
99.70
99.24
99.82
99.98
99.92
98.86
99.30
transform ( τ=0.1 )
99.60
100.00
99.06
99.88
99.12
99.68
100.00
99.94
99.28
99.42
transform ( τ=0.3 )
99.64
100.00
99.00
99.94
99.38
99.66
99.96
99.94
99.44
99.48
Table 6: Impact of watermark components and sampler temperature τ on robustness (TPR @ 1% FPR) for SD 2.1. We compare: clean (training solely on clean images), precompute (adding precomputed augmentations), and transform (our dynamic sampler). The temperature τ controls the sampler’s focus: τ=0 strictly prioritizes hard examples, while τ=∞ samples uniformly.
Appendix figures & tables12 assets
Supplementary material from the paper’s appendix.
Appendix
VAE
Regen-12
Rinse-4x8
Regen-30
Rinse-2x25
CtrlRegen
I2V
98.64
90.62
87.22
52.28
51.90
86.90
47.10
Appendix
Table 7: Robustness to advanced attacks. TPR @ 1% FPR for a watermark detector trained without any perturbations.
Rotate
JPEG
C&S
R. Drop
Blur
S. Noise
G. Noise
Bright
18.46
99.96
56.34
64.02
99.96
99.88
91.70
78.02
Appendix
Table 8: Watermark robustness. Results showing TPR @ 1% FPR on each perturbation for a watermark detector trained without this specific transformation. Evaluated on 5,000 watermarked and clean samples.
Method
Training Time
Watermark Injection
Watermark Detection
TrustMark
336 h
76 s
1.34 min
Stable Signature
57.52 h
0 ms
1.1 min
RingID
-
1922 ms
140.7 min
GaussMarker
0.93 h
2022 ms
117.0 min
SERUM (Ours)
9.48 h
17 ms
2.5 min
Appendix
Table 9: Runtime Performance. Measured on an NVIDIA A100 GPU. Injection and detection times are reported for a batch of 5,000 images. Training time for SERUM includes the overhead for data generation and pre-computing augmentations.
Architecture
Model
Perturbation Robustness (TPR @ 1% FPR)
Average
Clean
Rotate
JPEG
C&S
R. Drop
Blur
S. Noise
G. Noise
Bright
Transformer
SD 3.0
95.24
99.82
81.18
99.50
88.64
98.66
99.60
99.10
91.86
98.76
UNet
SD 2.1
99.75
100.00
99.34
99.98
99.54
99.86
100.00
100.00
99.30
99.72
Appendix
Table 10: Impact of architectures on watermark robustness. Results are calculated on 10,000 samples (5,000 watermarked and non-watermarked) and TPR @ 1% FPR thresholds are calculated separately for each perturbation. We use SD 3.0 (medium) underpinned by the Diffusion Transformer (DiT) and compare it against the UNet-based SD 2.1.
Method
Metric
75%
50%
45%
40%
35%
30%
25%
TrustMark
TPR@1%
99.98
0.18
0.04
0.06
0.00
0.02
0.04
TPR@0%
99.96
0.04
0.02
0.00
0.00
0.00
0.00
Stable Signature
TPR@1%
99.96
99.72
87.64
57.76
37.68
5.80
0.94
TPR@0%
98.24
80.98
75.66
3.10
0.88
0.00
0.00
RingID
TPR@1%
5.50
0.01
0.00
0.00
0.00
0.00
0.00
TPR@0%
0.12
0.01
0.00
0.00
0.00
0.00
0.00
Appendix
Table 11: Ablations on Crop and Scale. We present a range of retain values for the Crop and Scale perturbation on SD 2.1. We report both TPR @ 1% FPR and TPR @ 0% FPR.
Method
Model
Perturbation Robustness (TPR @ 0% FPR)
Average
Clean
Rotate
JPEG
C&S
R. Drop
Blur
S. Noise
G. Noise
Bright
TrustMark
SD 2.1
59.33
100.00
4.42
93.18
99.96
0.02
100.00
14.78
87.16
34.46
SD 2.0
48.12
93.28
1.98
52.18
96.0
0.00
93.02
21.0
54.18
21.44
SD 1.4
59.23
100.00
3.42
93.38
100.00
0.76
100.00
15.74
85.24
34.56
Stable Signature
SD 2.1
77.37
99.78
81.04
44.54
98.24
96.22
95.10
77.62
17.70
86.08
SD 2.0
80.80
99.98
41.44
98.72
99.88
96.34
97.66
99.90
67.76
25.54
Appendix
Table 12: Watermark robustness against perturbations. Results are calculated on 10,000 samples (5,000 watermarked and non-watermarked) and TPR @ 0% FPR thresholds are calculated separately for each perturbation. Please note that this table is equivalent to Table 1 but with decreased FPR.
Batch Size
Time
Perturbation Robustness (TPR @ 1% FPR)
Average
Clean
Rotate
JPEG
C&S
R. Drop
Blur
S. Noise
G. Noise
Bright
precompute
2.63 h
97.16
100.00
79.72
99.90
97.18
99.56
99.96
99.86
99.18
99.06
m=2
5.66 h
99.52
100.00
99.22
99.84
99.00
99.60
99.96
99.92
99.08
99.04
m=4
9.48 h
99.75
100.00
99.34
99.98
99.54
99.86
100.00
100.00
99.30
99.72
m=8
15.69 h
99.80
100.00
99.74
99.90
99.62
99.80
100.00
99.94
99.50
99.74
m=16
28.15 h
99.83
100.00
99.76
99.88
99.70
99.92
99.96
99.98
99.60
99.70
Appendix
Table 13: Ablation of the augmentation sampler batch size ( m ). We report TPR @ 1% FPR for the SD 2.1 model, evaluated on 10,000 samples. The precompute row denotes the baseline where only clean and precomputed augmentations are applied (equivalent to m=0 ). Increasing m consistently improves robustness at the cost of training time.
Figure 4: Evaluation of radioactivity.
Figure 5: Watermark detector architecture.
Figure 6: Visualization of advanced attacks. Qualitative examples of advanced watermark removal attacks.
Figure 7: Visualization of augmentations. We show qualitative examples of augmentations used to perturb the watermarked and non-watermarked images.
Figure 8: More qualitative results. Clean vs Images watermarked with our SERUM .
Image watermarking enables provenance tracing for photorealistic images generated by diffusion models. However, state-of-the-art (SOTA) removal attacks can suppress embedded signals with little perceptual degradation. This vulnerability limits the effectiveness of watermarks for intellectual property protection and misuse attribution. We propose WaveMark, a novel wavelet-domain watermarking method that embeds messages in a diffusion model's initial noise. To support robust recovery from perturbed carriers, WaveMark distributes keyed replicas of message bits across spatial positions, wavelet orientations, and scales. Each carrier groups coefficients from four latent channels and encodes a randomized bit through magnitude projection, providing an explicit decoding margin. We evaluate WaveMark with SD2.1 on SDP and MS-COCO Captions under 14 attacks. WaveMark achieves 100.0% bit accuracy (BA) without attacks, while maintaining image quality comparable to the evaluated baselines. Under SOTA MarkNull and MarkNull-A, it retains over 88% BA, outperforming all baselines.
Jie Cao, Qi Li, Chaklam Cheong +4
Department of Electrical and Computer Engineering, Queen’s University, Kingston, Canada · School of Computing, Queen’s University, Kingston, Canada · School of Computer Science, Nanjing University, Jiangsu, China
Watermarking diffusion-generated images requires balancing provenance signals with image quality, robustness, and computational cost. This work organizes methods along two axes: insertion mechanism and primary signal-bearing representation, and formalizes a representative zT-Fourier pipeline for verification and identification. We then use the taxonomy to structure three protocol-bounded case studies. The first examines associations among frequency integrity, detection, quality, and cropping behavior. The second revisits persistence under seed-linked and seed-independent editing and formulates a scoped Semantic Imprinting Hypothesis without claiming a localized carrier or causal mechanism. The third studies single-shot VAE-latent phase modulation, including its efficiency, regeneration robustness, and robustness--quality operating points. Finally, we separate four content-level attack families from model/pipeline adaptation, propose corresponding evaluation protocols and testable conjectures for parameter-tuning threats, and identify additional temporal extensions for video. These analyses do not establish a universal ranking; instead, they provide a framework for matched, protocol-aware comparisons of watermarking systems for diffusion-generated images.
Sung Ju Lee, Nam Ik Cho
Department of ECE & INMC, Seoul National University, Korea
Text-to-image diffusion models enable data-efficient "mimicry" attacks, wherein adversaries fine-tune the model on a handful of public photos to synthesize convincing forgeries of a target individual. A common countermeasure is to embed imperceptible, low-energy watermarks, yet recent studies show these signatures are brittle: modest post-processing or lightweight adversarial perturbations readily suppress detection, exposing a fundamental tension between imperceptibility and robustness. We introduce FeatMark, a watermarking framework that shifts from pixel-level, energy-starved perturbations to inconspicuous semantic features: small, scene-consistent micro-features that remain natural to humans while providing a stronger, machine-verifiable provenance signal. FeatMark builds domain-specific feature banks that encode each watermark as a compact concept program, pairing open-vocabulary semantic cues with reliable edit regions and instruction templates. It then automatically selects features that are both feasible and executable and injects them through modular, mask-guided concept editing, yielding highly localized, scene-consistent micro-edits that are difficult to perceive. We conduct extensive experiments across VGGFace2, CelebA-HQ, and WikiArt, evaluating against 10 strong watermark removal/purification attacks (including regeneration-style purification) and several bespoke adaptive attacks tailored to FeatMark, to assess perceptual fidelity, watermark detection accuracy, and robustness. We further demonstrate FeatMark's extensibility to video mimicry attacks. The results show FeatMark remains virtually impervious, withstanding all evaluated attacks with negligible bit-accuracy and fidelity degradation.
Haoyang Li, Ruoxi Sun, Qingqing Ye +4
The Hong Kong Polytechnic University · CSIRO’s Data61 · Macquarie University