SERUM: Simple, Efficient, Robust, and Unifying Marking for Diffusion-based Image Generation

Jan Kociszewski; Hubert Jastrzębski; Tymoteusz Stępkowski; Filip Manijak; Krzysztof Rojek; Franziska Boenisch; Adam Dziedzic

cs.CVMar 11, 2026

SERUM: Simple, Efficient, Robust, and Unifying Marking for Diffusion-based Image Generation

Authors: Jan Kociszewski, Hubert Jastrzębski, Tymoteusz Stępkowski, Filip Manijak, Krzysztof Rojek, Franziska Boenisch, Adam Dziedzic

Organizations: CISPA Helmholtz Center for Information Security

Abstract

We propose SERUM: an intriguingly simple yet highly effective method for marking images generated by diffusion models (DMs). We only add a unique watermark noise to the initial diffusion generation noise and train a lightweight detector to identify watermarked images, simplifying and unifying the strengths of prior approaches. SERUM provides robustness against any image augmentations or watermark removal attacks and is extremely efficient, all while maintaining negligible impact on image quality. In contrast to prior approaches, which are often only resilient to limited perturbations and incur significant training, injection, and detection costs, our SERUM achieves remarkable performance, with the highest true positive rate (TPR) at a 1% false positive rate (FPR) in most scenarios, along with fast injection and detection and low detector training overhead. Its decoupled architecture also seamlessly supports multiple users by embedding individualized watermarks with little interference between the marks. Overall, our method provides a practical solution to mark outputs from DMs and to reliably distinguish generated from natural images.

Figures & tables

Figure 1: Overview of SERUM . First, we train a watermark detector to distinguish between watermarked latents (with/without augmentations) from clean latents. Second, to inject the SERUM watermark , the watermark noise is added to the initial random Gaussian noise for diffusion generation and passed through the LDM (Latent Diffusion Model) and decoder to produce a watermarked image. Finally, in order to detect the watermark , the image is encoded using the LDM’s encoder and passed through the detector, which outputs a high score for watermarked and a low score for clean images.

Method	Model	Perturbation Robustness (TPR @ 1% FPR)
Method	Model	Average	Clean	Rotate	JPEG	C&S	R. Drop	Blur	S. Noise	G. Noise	Bright
TrustMark	SD 2.1	59.43	100.00	4.30	93.18	99.98	0.42	100.00	14.80	86.96	35.20
	SD 2.0	48.22	93.28	1.88	52.20	96.00	0.14	93.14	21.14	53.58	22.58
	SD 1.4	59.32	100.00	4.64	93.36	100.00	0.40	100.00	14.92	86.08	34.54
Stable Signature	SD 2.1	90.94	99.96	94.62	91.14	99.96	99.06	99.40	91.02	49.02	94.24
	SD 2.0	91.09	99.96	95.76	90.96	99.92	99.18	99.52	90.80	48.36	95.36

Table 1: Watermark robustness against perturbations. Results are calculated on 10,000 samples (5,000 watermarked and non-watermarked) and TPR @ 1% FPR thresholds are calculated separately for each perturbation.

Method	Average	VAE	Regen-12	Rinse-4x8	Regen-30	Rinse-2x25	CtrlRegen	I2V
TrustMark	12.30	57.62	1.32	0.70	1.06	1.02	1.18	23.20
Stable Signature	1.18	2.70	1.30	0.62	0.42	0.76	0.86	1.60
RingID	65.40	99.98	98.22	84.12	32.58	24.88	77.82	40.20
GaussMarker	58.01	98.36	89.30	65.80	9.72	10.40	91.06	41.40
SERUM (Ours)	90.87	99.88	99.72	99.38	88.50	90.76	99.64	58.20

Table 2: Robustness against advanced generative removal attacks. We report TPR @ 1% FPR evaluated on 10,000 samples.

Model	Adaptation	TPR @ 1%FPR
SD 1.4	LoRA	52.30%
SD 1.4	FFT	77.12%
SANA	FFT	96.76 %

Table 3: Radioactivity.

Method	FID ( $\downarrow$ )				CLIP Score ( $\uparrow$ )
Method	SD 1.4	SD 2.0	SD 2.1	Avg	SD 1.4	SD 2.0	SD 2.1	Avg
Clean	17.74	17.53	18.43	17.90	0.3123	0.3169	0.3137	0.3143
TrustMark	17.80	17.51	18.45	17.92	0.312	0.3162	0.3135	0.3139
Stable Signature	17.87	17.60	18.44	17.97	0.3069	0.3159	0.3140	0.3123
RingID	20.17	18.73	20.19	19.70	0.3103	0.3147	0.3125	0.3125
GaussMarker	20.03	19.32	21.13	20.16	0.3115	0.3157	0.3147	0.3140

Table 4: Quantitative analysis of the generation quality. Adding SERUM has a negligible effect on the quality of the generated images and comparable to prior approaches.

Figure 2: Qualitative analysis of generation quality. We present outputs from the SD 2.1 model without (Clean) and with our SERUM (denoted as Ours with the parameter $\alpha=0.5$ ) watermark. The most important image qualities like style and content are preserved while slightly modifying shape or perspective. More examples can be found in Appendix Figure 8 .

Panel of Figure 3 — Figure 3: Performance of SERUM in a multi-user setting .

$\bm{\alpha}$	FID	Perturbation Robustness (TPR @ 1% FPR)
$\bm{\alpha}$	FID	Average	Clean	Rotate	JPEG	C&S	R. Drop	Blur	S. Noise	G. Noise	Bright
0.0	18.43	-	-	-	-	-	-	-	-	-	-
0.1	18.91	78.49	98.64	23.92	94.60	41.18	90.76	97.30	94.82	76.14	89.02
0.2	18.84	91.85	99.74	66.16	97.72	80.08	97.86	99.22	98.90	92.50	94.44
0.3	18.95	97.73	99.96	91.98	99.74	94.84	98.68	99.74	99.78	97.64	97.24
0.4	19.05	98.92	99.98	95.50	99.78	98.38	99.32	99.92	99.76	98.62	98.98

Table 5: Impact of watermark strength

\alpha

on image quality (FID) and detection robustness (TPR @ 1% FPR) for SD 2.1. We select

\alpha=0.5

as the optimal trade-off.

Setup	Perturbation Robustness (TPR @ 1% FPR)
Setup	Average	Clean	Rotate	JPEG	C&S	R. Drop	Blur	S. Noise	G. Noise	Bright
clean	78.68	100.00	14.94	99.86	59.80	77.44	100.00	98.52	66.86	88.74
precompute	97.16	100.00	79.72	99.90	97.18	99.56	99.96	99.86	99.18	99.06
transform ( $\tau=0$ )	99.48	100.00	98.06	99.70	99.24	99.82	99.98	99.92	98.86	99.30
transform ( $\tau=0.1$ )	99.60	100.00	99.06	99.88	99.12	99.68	100.00	99.94	99.28	99.42
transform ( $\tau=0.3$ )	99.64	100.00	99.00	99.94	99.38	99.66	99.96	99.94	99.44	99.48

Table 6: Impact of watermark components and sampler temperature

\tau

on robustness (TPR @ 1% FPR) for SD 2.1. We compare: clean (training solely on clean images), precompute (adding precomputed augmentations), and transform (our dynamic sampler). The temperature

\tau

controls the sampler’s focus:

\tau=0

strictly prioritizes hard examples, while

\tau=\infty

samples uniformly.

Appendix figures & tables12 assets

Supplementary material from the paper’s appendix.

Appendix

VAE	Regen-12	Rinse-4x8	Regen-30	Rinse-2x25	CtrlRegen	I2V
98.64	90.62	87.22	52.28	51.90	86.90	47.10

Appendix

Table 7: Robustness to advanced attacks. TPR @ 1% FPR for a watermark detector trained without any perturbations.

Rotate	JPEG	C&S	R. Drop	Blur	S. Noise	G. Noise	Bright
18.46	99.96	56.34	64.02	99.96	99.88	91.70	78.02

Appendix

Table 8: Watermark robustness. Results showing TPR @ 1% FPR on each perturbation for a watermark detector trained without this specific transformation. Evaluated on 5,000 watermarked and clean samples.

Method	Training Time	Watermark Injection	Watermark Detection
TrustMark	336 h	76 s	1.34 min
Stable Signature	57.52 h	0 ms	1.1 min
RingID	-	1922 ms	140.7 min
GaussMarker	0.93 h	2022 ms	117.0 min
SERUM (Ours)	9.48 h	17 ms	2.5 min

Appendix

Table 9: Runtime Performance. Measured on an NVIDIA A100 GPU. Injection and detection times are reported for a batch of 5,000 images. Training time for SERUM includes the overhead for data generation and pre-computing augmentations.

Architecture	Model	Perturbation Robustness (TPR @ 1% FPR)
Architecture	Model	Average	Clean	Rotate	JPEG	C&S	R. Drop	Blur	S. Noise	G. Noise	Bright
Transformer	SD 3.0	95.24	99.82	81.18	99.50	88.64	98.66	99.60	99.10	91.86	98.76
UNet	SD 2.1	99.75	100.00	99.34	99.98	99.54	99.86	100.00	100.00	99.30	99.72

Appendix

Table 10: Impact of architectures on watermark robustness. Results are calculated on 10,000 samples (5,000 watermarked and non-watermarked) and TPR @ 1% FPR thresholds are calculated separately for each perturbation. We use SD 3.0 (medium) underpinned by the Diffusion Transformer (DiT) and compare it against the UNet-based SD 2.1.

Method	Metric	75%	50%	45%	40%	35%	30%	25%
TrustMark	TPR@1%	99.98	0.18	0.04	0.06	0.00	0.02	0.04
TrustMark	TPR@0%	99.96	0.04	0.02	0.00	0.00	0.00	0.00
Stable Signature	TPR@1%	99.96	99.72	87.64	57.76	37.68	5.80	0.94
Stable Signature	TPR@0%	98.24	80.98	75.66	3.10	0.88	0.00	0.00
RingID	TPR@1%	5.50	0.01	0.00	0.00	0.00	0.00	0.00
RingID	TPR@0%	0.12	0.01	0.00	0.00	0.00	0.00	0.00

Appendix

Table 11: Ablations on Crop and Scale. We present a range of retain values for the Crop and Scale perturbation on SD 2.1. We report both TPR @ 1% FPR and TPR @ 0% FPR.

Method	Model	Perturbation Robustness (TPR @ 0% FPR)
Method	Model	Average	Clean	Rotate	JPEG	C&S	R. Drop	Blur	S. Noise	G. Noise	Bright
TrustMark	SD 2.1	59.33	100.00	4.42	93.18	99.96	0.02	100.00	14.78	87.16	34.46
	SD 2.0	48.12	93.28	1.98	52.18	96.0	0.00	93.02	21.0	54.18	21.44
	SD 1.4	59.23	100.00	3.42	93.38	100.00	0.76	100.00	15.74	85.24	34.56
Stable Signature	SD 2.1	77.37	99.78	81.04	44.54	98.24	96.22	95.10	77.62	17.70	86.08
	SD 2.0	80.80	99.98	41.44	98.72	99.88	96.34	97.66	99.90	67.76	25.54

Appendix

Table 12: Watermark robustness against perturbations. Results are calculated on 10,000 samples (5,000 watermarked and non-watermarked) and TPR @ 0% FPR thresholds are calculated separately for each perturbation. Please note that this table is equivalent to Table 1 but with decreased FPR.

Batch Size	Time	Perturbation Robustness (TPR @ 1% FPR)
Batch Size	Time	Average	Clean	Rotate	JPEG	C&S	R. Drop	Blur	S. Noise	G. Noise	Bright
precompute	2.63 h	97.16	100.00	79.72	99.90	97.18	99.56	99.96	99.86	99.18	99.06
$m=2$	5.66 h	99.52	100.00	99.22	99.84	99.00	99.60	99.96	99.92	99.08	99.04
$m=4$	9.48 h	99.75	100.00	99.34	99.98	99.54	99.86	100.00	100.00	99.30	99.72
$m=8$	15.69 h	99.80	100.00	99.74	99.90	99.62	99.80	100.00	99.94	99.50	99.74
$m=16$	28.15 h	99.83	100.00	99.76	99.88	99.70	99.92	99.96	99.98	99.60	99.70

Appendix

Table 13: Ablation of the augmentation sampler batch size (

m

). We report TPR @ 1% FPR for the SD 2.1 model, evaluated on 10,000 samples. The precompute row denotes the baseline where only clean and precomputed augmentations are applied (equivalent to

m=0

). Increasing

m

consistently improves robustness at the cost of training time.

Panel of Figure 4 — Figure 4: Evaluation of radioactivity.

Figure 5: Watermark detector architecture.

Figure 6: Visualization of advanced attacks. Qualitative examples of advanced watermark removal attacks.

Figure 7: Visualization of augmentations. We show qualitative examples of augmentations used to perturb the watermarked and non-watermarked images.

Figure 8: More qualitative results. Clean vs Images watermarked with our SERUM .

Explore similar work

WaveMark: Robust Wavelet-Domain Image Watermarking for Diffusion Models
Oct 9, 2026Jie Cao, Qi Li, Chaklam Cheong +4Diffusion Model Watermarking Robust Watermarking
Department of Electrical and Computer Engineering, Queen’s University, Kingston, Canada · School of Computing, Queen’s University, Kingston, Canada · School of Computer Science, Nanjing University, Jiangsu, China
Diffusion-Generated Image Watermarking: A Two-Axis Taxonomy and Three Protocol-Bounded Case Studies
Oct 7, 2026Sung Ju Lee, Nam Ik ChoDiffusion Model Watermarking Robust Watermarking
Department of ECE & INMC, Seoul National University, Korea
FeatMark: Feature-level Watermark Protection against Mimicry Attacks with Diffusion Models
Sep 25, 2026Haoyang Li, Ruoxi Sun, Qingqing Ye +4Diffusion Model Watermarking Robust Watermarking
The Hong Kong Polytechnic University · CSIRO’s Data61 · Macquarie University

Oct 9, 2026J/K move · Enter open · S save

WaveMark: Robust Wavelet-Domain Image Watermarking for Diffusion Models

Jie Cao, Qi Li, Chaklam Cheong, Yutong Jin+3

Department of Electrical and Computer Engineering, Queen’s University, Kingston, Canada · School of Computing, Queen’s University, Kingston, Canada · School of Computer Science, Nanjing University, Jiangsu, China

Diffusion Model Watermarking Robust Watermarking

Open paper AskPDF arXiv

Image watermarking enables provenance tracing for photorealistic images generated by diffusion models. However, state-of-the-art (SOTA) removal attacks can suppress embedded signals with little perceptual degradation. This vulnerability limits the effectiveness of watermarks for intellectual property protection and misuse attribution. We propose WaveMark, a novel wavelet-domain watermarking method that embeds messages in a diffusion model's initial noise. To support robust recovery from perturbed carriers, WaveMark distributes keyed replicas of message bits across spatial positions, wavelet orientations, and scales. Each carrier groups coefficients from four latent channels and encodes a randomized bit through magnitude projection, providing an explicit decoding margin. We evaluate WaveMark with SD2.1 on SDP and MS-COCO Captions under 14 attacks. WaveMark achieves 100.0% bit accuracy (BA) without attacks, while maintaining image quality comparable to the evaluated baselines. Under SOTA MarkNull and MarkNull-A, it retains over 88% BA, outperforming all baselines.

Abstract

Explore similar work

WaveMark: Robust Wavelet-Domain Image Watermarking for Diffusion Models

Diffusion-Generated Image Watermarking: A Two-Axis Taxonomy and Three Protocol-Bounded Case Studies

FeatMark: Feature-level Watermark Protection against Mimicry Attacks with Diffusion Models