Rel-Zero: Harnessing Patch-Pair Invariance for Robust Zero-Watermarking Against AI Editing

Pengzhen Chen; Yanwei Liu; Xiaoyan Gu; Xiaojun Chen; Wu Liu; Weiping Wang

cs.CVMar 18, 2026

Rel-Zero: Harnessing Patch-Pair Invariance for Robust Zero-Watermarking Against AI Editing

Authors: Pengzhen Chen, Yanwei Liu, Xiaoyan Gu, Xiaojun Chen, Wu Liu, Weiping Wang

Organizations: Institute of Information Engineering, Chinese Academy of Sciences · School of Cyber Security, University of Chinese Academy of Sciences · State Key Laboratory of Cyberspace Security Defense · University of Science and Technology of China

Abstract

Recent advancements in diffusion-based image editing pose a significant threat to the authenticity of digital visual content. Traditional embedding-based watermarking methods often introduce perceptible perturbations to maintain robustness, inevitably compromising visual fidelity. Meanwhile, existing zero-watermarking approaches, typically relying on global image features, struggle to withstand sophisticated manipulations. In this work, we uncover a key observation: while individual image patches undergo substantial alterations during AI-based editing, the relational distance between patch pairs remains relatively invariant. Leveraging this property, we propose Relational Zero-Watermarking (Rel-Zero), a novel framework that requires no modification to the original image but derives a unique zero-watermark from these editing-invariant patch relations. By grounding the watermark in intrinsic structural consistency rather than absolute appearance, Rel-Zero provides a non-invasive yet resilient mechanism for content authentication. Extensive experiments demonstrate that Rel-Zero achieves substantially improved robustness across diverse editing models and manipulations compared to prior zero-watermarking approaches.

Figures & tables

Figure 1: Analysis of Relational Stability. We reveal a key insight: Patch-pair distance tends to be preserved after AI editing. This invariant property can be extracted as a zero-watermark. Here we present the patch-pair distance of RGB vectors in original images (first row) and edited images (second row) across five main editing models. The last row illustrates the distance difference between pre-edit and post-edit with a color scale spanning [-0.2,0.2].

Panel of Figure 2 — Figure 2: Analysis of Relational Stability.

Figure 3: Framework of the proposed Rel-Zero. (a) Stable Patch Pair Identification. To train a predictor capable of identifying patch pairs with invariant distance relationships, we first construct training targets. A pretrained VAE is employed to simulate generative edits. Features of the original and VAE-modified images are extracted using a ViT to obtain patch-wise features $\mathcal{F}$ and $\mathcal{\hat{F}}$ . Pairwise distance is computed on both feature maps, and their differences are measured to identify the most stable top- $K$ pairs surviving edits, which serve as the ground-truth pairs $\mathcal{E}_{g}$ . (b) Patch Relational Learning. Given an input image, ViT features are extracted and all patch pairs are densely formed to construct fully-connected pairs $\mathcal{E}$ . A learnable pair predictor $\Phi$ then estimates the stability scores of each pair, which are trained to align with the ground-truth pairs $\mathcal{E}_{g}$ from (a). During inference (i.e., watermark generation and verification), only the module in (b) is required to generate relational zero-watermarks $\mathcal{E}_{p}$ .

Figure 4: Visualization of pre-edit and post-edit extracted watermarks.

Method	PSNR(dB) $\uparrow$	SSIM $\uparrow$	LPIPS $\downarrow$	TPR@(0.1%FPR)(%) $\uparrow$
				Regeneration	Global Editing		Local Editing		Common Distortions
				Det	Pix2Pix	Magic	Ultra	CtrlN	Cropout	Scaling	Contrast	Brightness	Gaussian
Embedding Watermarking
DWT-DCT [ 1 ]	40.38	0.9705	0.0136	0.09	0.04	0.05	0.32	0.56	10.35	6.78	30.18	51.88	12.45
Robust-Wide [ 14 ]	41.93	0.9908	0.0034	90.41	97.23	81.97	80.45	82.11	95.31	96.45	98.93	98.89	98.12
VINE [ 24 ]	37.34	0.9934	0.0063	99.98	97.46	94.58	99.96	93.04	54.87	76.43	98.43	97.90	98.37

Table 1: Comparison of visual fidelity (PSNR, SSIM, LPIPS) and robustness (TPR@(0.1%FPR)) between Rel-Zero and baseline methods. Zero-watermarking methods do not modify image pixels, thus their PSNR metrics are marked as “–”. Abbreviations: Det (Deterministic Regeneration), Pix2Pix (InstructPix2Pix), Ultra (UltraEdit), CtrlN (ControlNet-Inpainting).

Figure 5: Watermark similarity distribution of different images.

Panel of Figure 6 — Figure 6: Analysis on the number of top- $K$ pairs and the patch count $N$ . Robustness is evaluated over all edit types.

Model Configuration	TPR@(0.1%FPR)
-Ours (ViT + MLP)	97.43
- ViT $\rightarrow$ ResNet-18	84.13
- ViT $\rightarrow$ ResNet-50	85.21
- MLP $\rightarrow$ Transformer+MLP	92.11
- MLP $\rightarrow$ GAT+MLP	94.45

Table 2: Component ablation study. TPR@(0.1%FPR) over ControlNet-Inpainting.

Figure 1: PCA visualization of ViT patch embeddings before and after generative editing or VAE reconstruction. Both transformations cause similar displacement patterns: only patches in drastically semantically edited regions move noticeably, while most patches remain stable. The similarity of these trajectories demonstrates that VAE reconstruction effectively mimics edit-induced feature changes.

Method	Salt & Pepper		JPEG		Rotation
Method	S&P-1	S&P-2	Q = 90	Q = 50	Rot- $3^{\circ}$	Rot- $5^{\circ}$
Embedding Watermarking
DWT-DCT [ 1 ]	85.56	80.21	68.53	70.21	0.02	0.05
Robust-Wide [ 14 ]	98.89	98.55	93.55	95.76	2.43	3.56
VINE [ 24 ]	100.00	100.00	99.45	99.56	5.43	6.78
Zero Watermarking

Table 2: Robustness under common distortions measured by TPR@(0.1%FPR). We report results under Salt&Pepper noise, JPEG compression, and small-angle rotation.

Figure 2: Correlation between patch–pair ViT features distance before and after editing. Distance aligns strongly with a fitted linear model $M_{\text{after}}\approx\alpha\,M_{\text{before}}$ , confirming that ViT patch–pair relationships remain stable and support our relational watermark extraction.

Figure 3: ViT Self-Similarity Matrix stability under editing. First row: SSM before editing. Second row: SSM after editing. Right: Residual $|M_{\text{after}}-M_{\text{before}}|$ . The near-zero residual indicates that the relational geometry of ViT patch features is preserved up to a global scale.

Figure 4: Visual comparison of embedding-based watermarking and zero-watermarking. From left to right: original image, embedding-based watermarked image, residue highlighting injected perturbations, and our zero-watermarking visualization. Unlike embedding-based methods, zero-watermarking introduces no pixel-level noise , preserving perfect perceptual fidelity. Zoom in to see the detailed difference.

Robust Watermarking

Robust watermarking embeds or verifies ownership and provenance signals that survive editing, compression, model changes, and deliberate removal.

See all 207 papers

WaterVIB: Learning Minimal Sufficient Watermark Representations via Variational Information Bottleneck
Feb 25, 2026Haoyuan He, Yu Zheng, Jie Zhou +1Robust Watermarking
Department of Automation, Tsinghua University.
Are Watermarked Images Editable? SafeMark for Watermark-Preserving Text-Guided Image Editing
May 19, 2026Xiaodong Wu, Qi Li, Xiangman Li +3Diffusion Model Watermarking Text-Guided Image Editing
Queen’s University · University of Waterloo
AngelFingerprint: A Traceable, Explainable, and White-Box Stealthy Watermark for Text-Guided Image Editing
Sep 4, 2026Bo-Han Kung, Futa Waseda, Ching-Chun Chang +2AI-Generated Image Watermarking Diffusion Model Watermarking
National Taiwan University, Taiwan · National Institute of Informatics, Japan

Feb 25, 2026J/K move · Enter open · S save

WaterVIB: Learning Minimal Sufficient Watermark Representations via Variational Information Bottleneck

Haoyuan He, Yu Zheng, Jie Zhou, Jiwen Lu

Department of Automation, Tsinghua University.

Robust Watermarking

Open paper AskPDF arXiv

Robust watermarking is critical for intellectual property protection, whereas existing methods face a severe vulnerability against regeneration-based AIGC attacks. We identify that existing methods fail because they entangle the watermark with high-frequency cover texture, which is susceptible to being rewritten during generative purification. To address this, we propose WaterVIB, a theoretically grounded framework that reformulates the encoder as an information sieve via the Variational Information Bottleneck. Instead of overfitting to fragile cover details, our approach forces the model to learn a Minimal Sufficient Statistic of the message. This effectively filters out redundant cover nuances prone to generative shifts, retaining only the essential signal invariant to regeneration. We theoretically prove that optimizing this bottleneck is a necessary condition for robustness against distribution-shifting attacks. Extensive experiments demonstrate that WaterVIB significantly outperforms state-of-the-art methods, achieving superior zero-shot resilience against unknown diffusion-based editing.

Abstract

Robust Watermarking

Explore similar work

WaterVIB: Learning Minimal Sufficient Watermark Representations via Variational Information Bottleneck

Are Watermarked Images Editable? SafeMark for Watermark-Preserving Text-Guided Image Editing

AngelFingerprint: A Traceable, Explainable, and White-Box Stealthy Watermark for Text-Guided Image Editing