UniMark: Unified Adaptive Multi-bit Watermarking for Autoregressive Image Generators

Yigit Yilmaz; Elena Petrova; Mehmet Kaya; Lucia Rossi; Amir Rahman

cs.CVApr 12, 2026

UniMark: Unified Adaptive Multi-bit Watermarking for Autoregressive Image Generators

Authors: Yigit Yilmaz, Elena Petrova, Mehmet Kaya, Lucia Rossi, Amir Rahman

Organizations: Bandırma Onyedi Eylül University

Abstract

Invisible watermarking for autoregressive (AR) image generation has recently gained attention as a means of protecting image ownership and tracing AI-generated content. However, existing approaches suffer from three key limitations: (1) they embed only zero-bit watermarks for binary verification, lacking the ability to convey multi-bit messages; (2) they rely on static codebook partitioning strategies that are vulnerable to security attacks once the partition is exposed; and (3) they are designed for specific AR architectures, failing to generalize across diverse AR paradigms. We propose \method{}, a training-free, unified watermarking framework for autoregressive image generators that addresses all three limitations. \method{} introduces three core components: Adaptive Semantic Grouping (ASG), which dynamically partitions codebook entries based on semantic similarity and a secret key, ensuring both image quality preservation and security; Block-wise Multi-bit Encoding (BME), which divides the token sequence into blocks and encodes different bits across blocks with error-correcting codes for reliable message transmission; and a Unified Token-Replacement Interface (UTRI) that abstracts the watermark embedding process to support both next-token prediction (e.g., LlamaGen) and next-scale prediction (e.g., VAR) paradigms. We provide theoretical analysis on detection error rates and embedding capacity. Extensive experiments on three AR models demonstrate that \method{} achieves state-of-the-art performance in image quality (FID), watermark detection accuracy, and multi-bit message extraction, while maintaining robustness against cropping, JPEG compression, Gaussian noise, blur, color jitter, and random erasing attacks.

Figures & tables

Model	Method	FID $\downarrow$	$\Delta$ FID	PSNR $\uparrow$	SSIM $\uparrow$
LlamaGen	No watermark	3.75	–	–	–
	IndexMark	3.91	0.16	38.2	0.981
	AR-Watermark	4.12	0.37	36.8	0.972
	UniMark (ours)	3.82	0.07	39.1	0.985
VAR	No watermark	2.95	–	–	–
	IndexMark	3.18	0.23	37.5	0.978

Table 1: Image quality comparison across AR models.

\Delta

FID denotes the FID increase compared to unwatermarked generation.

Method	LlamaGen	VAR	Open-MAGVIT2
IndexMark	99.7%	99.9%	99.5%
AR-Watermark	99.2%	99.6%	98.8%
UniMark (ours)	99.8%	99.9%	99.7%

Table 2: Zero-bit watermark detection (TPR@FPR=1%).

Message length	LlamaGen	VAR	Open-MAGVIT2
$B=16$ bits	99.8	99.9	99.7
$B=32$ bits	99.2	99.6	99.1
$B=48$ bits	97.5	98.8	97.1
$B=64$ bits	95.3	97.2	94.8

Table 3: Multi-bit extraction accuracy (%) of UniMark for different message lengths

B

Method	Metric	JPEG	Noise	Blur	Crop	Color
IndexMark	TPR	96.2	94.8	97.1	88.5	97.8
IndexMark	Bit Acc.	–	–	–	–	–
AR-Watermark	TPR	93.1	91.2	95.3	82.6	95.1
AR-Watermark	Bit Acc.	–	–	–	–	–
UniMark	TPR	97.5	96.1	98.2	91.3	98.5
UniMark	Bit Acc.	96.8	95.2	97.5	89.6	97.9

Table 4: Robustness evaluation on LlamaGen under various attacks. We report zero-bit TPR@FPR=1% and 32-bit extraction accuracy.

$\gamma$	FID $\downarrow$	$\Delta$ FID	TPR	Bit Acc.
0.3	3.78	0.03	97.2	95.8
0.4	3.80	0.05	99.1	98.5
0.5	3.82	0.07	99.8	99.2
0.6	3.87	0.12	99.9	99.5
0.7	3.95	0.20	99.9	99.7

Table 5: Effect of green ratio

\gamma

on LlamaGen.

Variant	FID $\downarrow$	TPR	Bit Acc.
UniMark (full)	3.82	99.8	99.2
w/o ASG (static partition)	3.91	99.5	98.8
w/o BME (zero-bit only)	3.80	99.8	–
w/o Error Correction	3.82	99.8	93.6

Table 6: Component ablation on LlamaGen (

B=32

bits).

Figure 3: Parameter sensitivity analysis: effect of green ratio

\gamma

on (a) FID, (b) TPR@FPR=1%, and (c) 32-bit extraction accuracy.

Figure 4: Security analysis: (a) green ratio distributions under correct/wrong keys; (b) forgery success rate vs. partition exposure fraction.

Figure 5: Efficiency analysis: (a) absolute time comparison (log scale); (b) relative overhead percentage.

Figure 6: Attack strength analysis: (a) JPEG quality, (b) Gaussian noise

\sigma

, (c) crop ratio vs. detection and extraction performance.

Appendix figures & tables3 assets

Supplementary material from the paper’s appendix.

Appendix

$B$	BCH Code	$n$	$t$	Rate
16	BCH(31, 16, 7)	31	3	0.516
32	BCH(63, 36, 5)	63	2	0.571
48	BCH(63, 51, 5)	63	2	0.810
64	BCH(127, 64, 21)	127	10	0.504

Appendix

Table 13

Metric	JPEG	Noise	Blur	Crop	Color
TPR@1%	98.2	97.5	98.8	93.6	99.1
Bit Acc.	97.5	96.8	98.1	91.2	98.3

Appendix

Table 7: Robustness evaluation of UniMark on VAR (32-bit message).

Metric	JPEG	Noise	Blur	Crop	Color
TPR@1%	96.8	95.3	97.5	89.8	98.0
Bit Acc.	96.1	94.5	96.9	88.3	97.2

Appendix

Table 8: Robustness evaluation of UniMark on Open-MAGVIT2 (32-bit message).

Explore similar work

On the Robustness of Watermarking for Autoregressive Image Generation
Apr 13, 2026Andreas Müller, Denis Lukovnikov, Shingo Kodama +5Watermark Removal Robust Watermarking
Ruhr University Bochum · Middlebury College · New York University +2
ADD for Multi-Bit Image Watermarking
Apr 13, 2026An Luo, Jie DingRobust Watermarking
School of Statistics, University of Minnesota
MarkNull: Model-Agnostic Watermark Removal in AI-Generated Images via On-Manifold Latent Manipulation
Aug 10, 2026Jie Cao, Qi Li, Zelin Zhang +4Watermark Removal Robust Watermarking
Queen’s University, Canada · University of Waterloo, Canada

Apr 13, 2026J/K move · Enter open · S save

On the Robustness of Watermarking for Autoregressive Image Generation

Andreas Müller, Denis Lukovnikov, Shingo Kodama, Minh Pham+4

Ruhr University Bochum · Middlebury College · New York University+2

Watermark Removal Robust Watermarking Autoregressive Image Generation

Open paper AskPDF arXiv

The proliferation of autoregressive (AR) image generators demands reliable detection and attribution of their outputs to mitigate misinformation, and to filter synthetic images from training data to prevent model collapse. To address this need, watermarking techniques, specifically designed for AR models, embed a subtle signal at generation time, enabling downstream verification through a corresponding watermark detector. In this work, we study these schemes and demonstrate their vulnerability to both watermark removal and forgery attacks. We assess existing attacks and further introduce three new attacks: (i) a vector-quantized regeneration removal attack, (ii) adversarial optimization-based attack, and (iii) a frequency injection attack. Our evaluation reveals that removal and forgery attacks can be effective with access to a single watermarked reference image and without access to original model parameters or watermarking secrets. Our findings indicate that existing watermarking schemes for AR image generation do not reliably support synthetic content detection for dataset filtering. Moreover, they enable Watermark Mimicry, whereby authentic images can be manipulated to imitate a generator's watermark and trigger false detection to prevent their inclusion in future model training.

Abstract

Explore similar work

On the Robustness of Watermarking for Autoregressive Image Generation

ADD for Multi-Bit Image Watermarking

MarkNull: Model-Agnostic Watermark Removal in AI-Generated Images via On-Manifold Latent Manipulation