Organizations: Institute of Information Engineering, Chinese Academy of Sciences · School of Cyber Security, University of Chinese Academy of Sciences · State Key Laboratory of Cyberspace Security Defense · University of Science and Technology of China
Recent advancements in diffusion-based image editing pose a significant threat to the authenticity of digital visual content. Traditional embedding-based watermarking methods often introduce perceptible perturbations to maintain robustness, inevitably compromising visual fidelity. Meanwhile, existing zero-watermarking approaches, typically relying on global image features, struggle to withstand sophisticated manipulations. In this work, we uncover a key observation: while individual image patches undergo substantial alterations during AI-based editing, the relational distance between patch pairs remains relatively invariant. Leveraging this property, we propose Relational Zero-Watermarking (Rel-Zero), a novel framework that requires no modification to the original image but derives a unique zero-watermark from these editing-invariant patch relations. By grounding the watermark in intrinsic structural consistency rather than absolute appearance, Rel-Zero provides a non-invasive yet resilient mechanism for content authentication. Extensive experiments demonstrate that Rel-Zero achieves substantially improved robustness across diverse editing models and manipulations compared to prior zero-watermarking approaches.
Figures & tables
Figure 1: Analysis of Relational Stability. We reveal a key insight: Patch-pair distance tends to be preserved after AI editing. This invariant property can be extracted as a zero-watermark. Here we present the patch-pair distance of RGB vectors in original images (first row) and edited images (second row) across five main editing models. The last row illustrates the distance difference between pre-edit and post-edit with a color scale spanning [-0.2,0.2].
Figure 2: Analysis of Relational Stability.
Figure 3: Framework of the proposed Rel-Zero. (a) Stable Patch Pair Identification. To train a predictor capable of identifying patch pairs with invariant distance relationships, we first construct training targets. A pretrained VAE is employed to simulate generative edits. Features of the original and VAE-modified images are extracted using a ViT to obtain patch-wise features F and F^ . Pairwise distance is computed on both feature maps, and their differences are measured to identify the most stable top- K pairs surviving edits, which serve as the ground-truth pairs Eg . (b) Patch Relational Learning. Given an input image, ViT features are extracted and all patch pairs are densely formed to construct fully-connected pairs E . A learnable pair predictor Φ then estimates the stability scores of each pair, which are trained to align with the ground-truth pairs Eg from (a). During inference (i.e., watermark generation and verification), only the module in (b) is required to generate relational zero-watermarks Ep .
Figure 4: Visualization of pre-edit and post-edit extracted watermarks.
Method
PSNR(dB) ↑
SSIM ↑
LPIPS ↓
TPR@(0.1%FPR)(%) ↑
Regeneration
Global Editing
Local Editing
Common Distortions
Det
Pix2Pix
Magic
Ultra
CtrlN
Cropout
Scaling
Contrast
Brightness
Gaussian
Embedding Watermarking
DWT-DCT [ 1 ]
40.38
0.9705
0.0136
0.09
0.04
0.05
0.32
0.56
10.35
6.78
30.18
51.88
12.45
Robust-Wide [ 14 ]
41.93
0.9908
0.0034
90.41
97.23
81.97
80.45
82.11
95.31
96.45
98.93
98.89
98.12
VINE [ 24 ]
37.34
0.9934
0.0063
99.98
97.46
94.58
99.96
93.04
54.87
76.43
98.43
97.90
98.37
Table 1: Comparison of visual fidelity (PSNR, SSIM, LPIPS) and robustness (TPR@(0.1%FPR)) between Rel-Zero and baseline methods. Zero-watermarking methods do not modify image pixels, thus their PSNR metrics are marked as “–”. Abbreviations: Det (Deterministic Regeneration), Pix2Pix (InstructPix2Pix), Ultra (UltraEdit), CtrlN (ControlNet-Inpainting).
Figure 5: Watermark similarity distribution of different images.
Figure 6: Analysis on the number of top- K pairs and the patch count N . Robustness is evaluated over all edit types.
Model Configuration
TPR@(0.1%FPR)
-Ours (ViT + MLP)
97.43
- ViT → ResNet-18
84.13
- ViT → ResNet-50
85.21
- MLP → Transformer+MLP
92.11
- MLP → GAT+MLP
94.45
Table 2: Component ablation study. TPR@(0.1%FPR) over ControlNet-Inpainting.
Figure 1: PCA visualization of ViT patch embeddings before and after generative editing or VAE reconstruction. Both transformations cause similar displacement patterns: only patches in drastically semantically edited regions move noticeably, while most patches remain stable. The similarity of these trajectories demonstrates that VAE reconstruction effectively mimics edit-induced feature changes.
Method
Salt & Pepper
JPEG
Rotation
S&P-1
S&P-2
Q = 90
Q = 50
Rot- 3∘
Rot- 5∘
Embedding Watermarking
DWT-DCT [ 1 ]
85.56
80.21
68.53
70.21
0.02
0.05
Robust-Wide [ 14 ]
98.89
98.55
93.55
95.76
2.43
3.56
VINE [ 24 ]
100.00
100.00
99.45
99.56
5.43
6.78
Zero Watermarking
Table 2: Robustness under common distortions measured by TPR@(0.1%FPR). We report results under Salt&Pepper noise, JPEG compression, and small-angle rotation.
Figure 2: Correlation between patch–pair ViT features distance before and after editing. Distance aligns strongly with a fitted linear model Mafter≈αMbefore , confirming that ViT patch–pair relationships remain stable and support our relational watermark extraction.
Figure 3: ViT Self-Similarity Matrix stability under editing. First row: SSM before editing. Second row: SSM after editing. Right: Residual ∣Mafter−Mbefore∣ . The near-zero residual indicates that the relational geometry of ViT patch features is preserved up to a global scale.
Figure 4: Visual comparison of embedding-based watermarking and zero-watermarking. From left to right: original image, embedding-based watermarked image, residue highlighting injected perturbations, and our zero-watermarking visualization. Unlike embedding-based methods, zero-watermarking introduces no pixel-level noise , preserving perfect perceptual fidelity. Zoom in to see the detailed difference.
Robust watermarking is critical for intellectual property protection, whereas existing methods face a severe vulnerability against regeneration-based AIGC attacks. We identify that existing methods fail because they entangle the watermark with high-frequency cover texture, which is susceptible to being rewritten during generative purification. To address this, we propose WaterVIB, a theoretically grounded framework that reformulates the encoder as an information sieve via the Variational Information Bottleneck. Instead of overfitting to fragile cover details, our approach forces the model to learn a Minimal Sufficient Statistic of the message. This effectively filters out redundant cover nuances prone to generative shifts, retaining only the essential signal invariant to regeneration. We theoretically prove that optimizing this bottleneck is a necessary condition for robustness against distribution-shifting attacks. Extensive experiments demonstrate that WaterVIB significantly outperforms state-of-the-art methods, achieving superior zero-shot resilience against unknown diffusion-based editing.
This paper investigates a fundamental yet underexplored question: can watermarked images remain editable without compromising watermark integrity? We propose SafeMark, a framework for watermark-preserving text-guided image manipulation that explicitly integrates watermark integrity into the editing process. Specifically, SafeMark adds a thresholded watermark-decoding loss directly to the diffusion editor's training objective, fine-tuning the editor so that semantically valid edits also preserve the embedded watermark at the final output. This design admits a clean information-theoretic justification: maintaining high bit-accuracy on the edited image lower-bounds the mutual information that the editor channel preserves between watermark and edited output, the quantity that fundamentally controls watermark recoverability. SafeMark is compatible with differentiable diffusion-based editors, and requires no architectural modification. Extensive evaluations across multiple datasets, text-guided editing methods, and post-edit distortion settings demonstrate that SafeMark achieves high watermark bit accuracy across diverse editing settings while maintaining high-quality semantic edits, without sacrificing robustness to common post-edit distortions. These results demonstrate that semantic editability and watermark integrity are fundamentally compatible, enabling trustworthy image provenance in generative editing pipelines.
Text-guided diffusion editing raises disinformation concerns, making reliable image provenance essential. While watermarks are commonly used for this purpose, most methods carry a fixed ID that cannot explain what was changed and which prompt produced it. Furthermore, under open-source white-box access, attackers can easily locate and remove watermarks added as separate modules. Targeting this setting, we propose AngelFingerprint, a novel watermarking framework ensuring edit traceability, explainability, and white-box stealthiness. It integrates a LoRA into the diffusion model to embed the editing prompt's CLIP text embedding directly into the model's weights. An extractor then recovers this embedding from the image pixels alone. This semantic payload explains the edit, while the weight-integrated design makes it hard to detect and isolate even under full white-box access. Two techniques make this possible: a velocity-alignment anchor that preserves edit quality, and a specially designed frequency filter that keeps the watermark imperceptible yet recoverable and robust. On the MagicBrush dataset, our extractor achieves 86% top-1 accuracy in a 200-way prompt retrieval, versus 20% for prompt inversion.
Bo-Han Kung, Futa Waseda, Ching-Chun Chang +2
National Taiwan University, Taiwan · National Institute of Informatics, Japan