AngelFingerprint: A Traceable, Explainable, and White-Box Stealthy Watermark for Text-Guided Image Editing

Bo-Han Kung; Futa Waseda; Ching-Chun Chang; Isao Echizen; Shang-Tse Chen

cs.CVSep 4, 2026

AngelFingerprint: A Traceable, Explainable, and White-Box Stealthy Watermark for Text-Guided Image Editing

Authors: Bo-Han Kung, Futa Waseda, Ching-Chun Chang, Isao Echizen, Shang-Tse Chen

Organizations: National Taiwan University, Taiwan · National Institute of Informatics, Japan

Abstract

Text-guided diffusion editing raises disinformation concerns, making reliable image provenance essential. While watermarks are commonly used for this purpose, most methods carry a fixed ID that cannot explain what was changed and which prompt produced it. Furthermore, under open-source white-box access, attackers can easily locate and remove watermarks added as separate modules. Targeting this setting, we propose AngelFingerprint, a novel watermarking framework ensuring edit traceability, explainability, and white-box stealthiness. It integrates a LoRA into the diffusion model to embed the editing prompt's CLIP text embedding directly into the model's weights. An extractor then recovers this embedding from the image pixels alone. This semantic payload explains the edit, while the weight-integrated design makes it hard to detect and isolate even under full white-box access. Two techniques make this possible: a velocity-alignment anchor that preserves edit quality, and a specially designed frequency filter that keeps the watermark imperceptible yet recoverable and robust. On the MagicBrush dataset, our extractor achieves $86\%$ top-1 accuracy in a 200-way prompt retrieval, versus $20\%$ for prompt inversion.

Figures & tables

Figure 1: Overview of AngelFingerprint. Part A shows the training pipeline. A LoRA imprints the prompt embedding; then an extractor recovers it. Part B shows the inference scenario: a white-box user can inspect the whole pipeline, find no watermarking module, and run the model without noticing the backdoor. Part C compares AngelFingerprint with prior watermarks.

Method	Watermark carrier	Payload	Capacity	White-box stealthy	Recovers prompt
Non-semantic payload watermarks
Stable Signature ( 2023 )	VAE decoder weights	fixed bit string	$\scriptstyle\sim$ 48 bits	Partial	No
Tree-Ring ( 2023b )	initial latent noise	detection key	zero-bit	No	No
Gaussian Shading ( 2024 )	initial latent noise	fixed bit string	256 bits	No	No
Spherical ( 2026 )	initial latent noise	fixed bit string	512 bits	No	No
SEAL ( 2025 )	initial latent noise	semantics-derived key	zero-bit	No	No

Table 1: Positioning of AngelFingerprint among watermarks for diffusion models. Methods are grouped by whether their payload carries recoverable semantic content. To the best of our knowledge, ours is the only method that is both white-box stealthy and prompt-recovering. White-box stealthy indicates keeping the same architecture and computation as the original, so the watermark is inherently difficult to detect or isolate.

	Embedding similarity			Retrieval
Method	$\cos_{\mathrm{p}}\uparrow$	$\cos_{\mathrm{off}}$	$\Delta_{\cos}\uparrow$	Top-1 $\uparrow$	Top-1 off	$\Delta_{\mathrm{T1}}\uparrow$	Top-5 $\uparrow$	Top-10 $\uparrow$	MRR $\uparrow$
BLIP-2 ( Li et al. 2023 )	0.550	0.430	0.120	0.215	0.330	$-0.115$	0.510	0.650	0.354
PromptStealer ( Shen et al. 2024 )	0.099	0.005	0.094	0.215	0.350	$-0.135$	0.495	0.570	0.342
Florence-2 ( Xiao et al. 2024 )	0.158	0.026	0.132	0.225	0.315	$-0.090$	0.505	0.660	0.363
VGD ( Kim et al. 2025 )	0.385	0.301	0.084	0.160	0.305	$-0.145$	0.405	0.490	0.277
Ours (UltraEdit)	0.750	0.378	0.372	0.655	0.005	${+0.650}$	0.950	0.970	0.780

Table 2: Prompt recovery from the watermarked image, and the watermark’s contribution to it. The subscript “

\mathrm{off}

” marks the value on the unwatermarked image (LoRA disabled).

\cos_{\mathrm{p}}

is the cosine between the recovered embedding and the true prompt embedding.

\Delta_{\cos}{=}\cos_{\mathrm{p}}{-}\cos_{\mathrm{off}}

and

\Delta_{\mathrm{T1}}{=}

Top-1

-

Top-1 off are how much the watermark adds to the cosine and to Top-1. Retrieval is over a pool of

N{=}200

MagicBrush prompts.

† The DreamSim values of TreeRing ( 2023b ) and AquaLoRA ( 2024 ) (SD1.5, 48-bit) are 0.301 and 0.201, respectively
	Visual fidelity (LoRA on vs. off)						Retrieval
Method / extractor-input filter	DreamSim $\downarrow$	LPIPS $\downarrow$	PSNR $\uparrow$	SSIM $\uparrow$	FID $\downarrow$	KID $\downarrow$	Top-1 $\uparrow$
w/o any filter	0.319 $\pm$ 0.092	0.366 $\pm$ 0.060	20.85 $\pm$ 1.64	0.650 $\pm$ 0.095	156.2	0.0093 $\pm$ 0.0053	0.605
Gaussian high-pass ( $\sigma{=}2$ )	0.222 $\pm$ 0.091	0.297 $\pm$ 0.062	22.92 $\pm$ 2.12	0.704 $\pm$ 0.097	133.6	0.0085 $\pm$ 0.0037	0.805
JPEG mid-band mask (ours)	0.221 $\pm$ 0.083 †	0.299 $\pm$ 0.062	22.91 $\pm$ 2.02	0.704 $\pm$ 0.095	132.1	0.0032 $\pm$ 0.0029	0.860

Table 3: This table demonstrates the imperceptibility of the watermark. We measure the visual similarity between the watermarked image (LoRA on) and the original output image (LoRA off) using different metrics.

Figure 2: Qualitative watermarked edits under deployment sampling. The watermark leaves only a faint, grid-like texture, hard to spot without close inspection.

	FID $\downarrow$	KID $\downarrow$ ( $\times 10^{-3}$ )
Vanilla SD3 w/o LoRA	158.6	8.47 $\pm$ 2.79
No filter	181.3	26.57 $\pm$ 5.07
Gaussian high-pass	173.1	24.59 $\pm$ 3.98
JPEG mid-band mask	164.8	13.62 $\pm$ 3.18

Table 4: We measure the visual fidelity of the generated images with respect to real images in the MagicBrush target set. The baseline is the vanilla SD3 without LoRA. It illustrates the importance of the filter, where it makes the generated images of LoRA more similar to the original.

Figure 3: Robustness of the watermark under post-processing attacks. The proposed watermark is robust against most post-processing attacks. If the post-processing operation does not destroy the mid-frequency band, the watermark survives. Resizing is the main threat to the proposed design, because it resamples the frequency components. Nevertheless, the watermark is robust to mild photometric attacks, such as color jitter, Gaussian noise, and JPEG compression.

Figure 4: Open-set verification on a real photograph. We edit it with AngelFingerprint using the prompt “change the tree into cherry blossom,” then recover the embedding and score candidate sentences against it by cosine similarity. Only the true prompt and semantically similar sentences score high, while unrelated sentences stay low. The recovered embedding is thus semantically meaningful, so a verifier can identify the edit without knowing the exact wording.

Appendix figures & tables9 assets

Supplementary material from the paper’s appendix.

Appendix

Figure A1: Visualization of the band-pass filtered signal. The first row shows the source image, the second row shows the watermarked image before filtering, and the third row shows the filtered image. The filter removes most semantic content, preventing the extractor from using image content as a shortcut.

Method	no WM	WM	$\Delta$	no WM	WM	$\Delta$
	Top-1			MRR
BLIP-2 ( Li et al. 2023 )	0.330	0.215	$-0.115$	0.455	0.354	$-0.101$
PromptStealer ( Shen et al. 2024 )	0.350	0.215	$-0.135$	0.464	0.342	$-0.122$
Florence-2 ( Xiao et al. 2024 )	0.315	0.225	$-0.090$	0.444	0.363	$-0.081$
VGD ( Kim et al. 2025 )	0.305	0.160	$-0.145$	0.409	0.277	$-0.132$
Ours (extractor)	0.000	0.860	$\mathbf{+0.860}$	0.034	0.917	$\mathbf{+0.883}$

Appendix

Table A1: Isolating the watermark channel. “no WM” scores each method on the unwatermarked image (LoRA disabled); “WM” scores it on the deployed watermarked image.

\Delta

is the gain the watermark provides to that reader. Only our extractor can read the injected watermark signal (

\Delta{=}{+}0.860

); the baseline methods cannot exploit it (

\Delta{<}0

), confirming the watermark is a private signal and is invisible to content-based recovery. Our extractor also scores near-zero on the unwatermarked image, i.e. it reads the injected signal rather than image content.

		Retrieval				Embedding		Retention %
Attack	Level	Top-1	Top-5	Top-10	MRR	$\cos_{\mathrm{p}}$	$\cos_{\mathrm{gap}}$	Ret ${}_{1}\uparrow$	Ret ${}_{\mathrm{gap}}\uparrow$
Clean	–	0.860	0.990	1.000	0.917	+0.802	+0.438	100	100
Color jitter	$s{=}0.1$	0.845	0.985	0.995	0.909	+0.800	+0.435	98	99
	$s{=}0.2$	0.845	0.985	0.995	0.909	+0.798	+0.433	98	99
	$s{=}0.3$	0.830	0.980	0.990	0.900	+0.796	+0.431	97	98
	$s{=}0.4$	0.835	0.980	0.990	0.902	+0.794	+0.429	97	98

Appendix

Table A2: Post-processing robustness of the watermark.

\cos_{\mathrm{p}}

is the cosine similarity between recovered embedding and the true prompt embedding, and

\cos_{\mathrm{gap}}

is its separation margin. Ret 1 and Ret gap denote Top-1 and margin retention relative to the clean model (%). Cropping and JPEG compression are the most common operations on shared images, and the watermark survives both. It is fragile only to resizing, which desynchronizes the DCT band.

Figure A2: The four JPEG band-pass filter masks tested in our ablation. A wider passband is not always better; the $26/64$ mask gives the best overall performance.

Figure A3: Distribution of the first word of each editing instruction in MagicBrush. Most instructions begin with an imperative edit verb.

	train	dev
edit turns	8,807	528
unique sessions	4,512	266
mean turns / session	1.95	1.98
max turns / session	3	3
mean instruction words	6.5	6.5
median instruction words	6	6

Appendix

Table A5: MagicBrush statistics used in this work. We use each edit turn independently and ignore the target image; the instruction is the sole extraction target.

Figure A4: Distribution of extractor-output norms for watermarked images, LoRA-off images, and natural photographs.

Signal	A vs B	A vs C	A vs B+C
$\lVert\hat{e}\rVert_{2}$	1.0000	1.0000	1.0000

Appendix

Table A6: Watermark presence detection. ROC-AUC of the extractor-output norm when separating watermarked images (A) from unwatermarked negatives: the same pipeline with the LoRA off (B), natural photographs (C), and their union (B+C).

Group	mean	std	5th %	95th %
A (watermarked)	40.34	7.69	27.82	53.79
B (LoRA off)	7.06	1.43	5.41	10.08
C (natural)	6.73	1.19	5.31	8.92

Appendix

Table A7: Distribution of the extractor-output norm

\lVert\hat{e}\rVert_{2}

across the three groups. The watermarked and unwatermarked ranges do not overlap: the

5

th percentile of A is about three times the

95

th percentile of B.

AI-Generated Image Watermarking

See all 24 papers

Are Watermarked Images Editable? SafeMark for Watermark-Preserving Text-Guided Image Editing
May 19, 2026Xiaodong Wu, Qi Li, Xiangman Li +3Diffusion Model Watermarking Text-Guided Image Editing
Queen’s University · University of Waterloo
NullEdit: Stealthy Image Protection via VLM Condition Redirection
Aug 11, 2026Weiyao Huang, Liqin Wang, Ziqi Sheng +1VLM Robustness Representation Steering
School of Computer Science and Engineering, Sun Yat-sen University, Guangzhou, China
FeatMark: Feature-level Watermark Protection against Mimicry Attacks with Diffusion Models
Sep 25, 2026Haoyang Li, Ruoxi Sun, Qingqing Ye +4AI-Generated Image Watermarking Diffusion Model Watermarking
The Hong Kong Polytechnic University · CSIRO’s Data61 · Macquarie University

May 19, 2026J/K move · Enter open · S save

Are Watermarked Images Editable? SafeMark for Watermark-Preserving Text-Guided Image Editing

Xiaodong Wu, Qi Li, Xiangman Li, Zelin Zhang+2

Queen’s University · University of Waterloo

Diffusion Model Watermarking Text-Guided Image Editing Robust Watermarking Diffusion-Based Image Editing Image Editing AI-Generated Image Watermarking

Open paper AskPDF arXiv

This paper investigates a fundamental yet underexplored question: can watermarked images remain editable without compromising watermark integrity? We propose SafeMark, a framework for watermark-preserving text-guided image manipulation that explicitly integrates watermark integrity into the editing process. Specifically, SafeMark adds a thresholded watermark-decoding loss directly to the diffusion editor's training objective, fine-tuning the editor so that semantically valid edits also preserve the embedded watermark at the final output. This design admits a clean information-theoretic justification: maintaining high bit-accuracy on the edited image lower-bounds the mutual information that the editor channel preserves between watermark and edited output, the quantity that fundamentally controls watermark recoverability. SafeMark is compatible with differentiable diffusion-based editors, and requires no architectural modification. Extensive evaluations across multiple datasets, text-guided editing methods, and post-edit distortion settings demonstrate that SafeMark achieves high watermark bit accuracy across diverse editing settings while maintaining high-quality semantic edits, without sacrificing robustness to common post-edit distortions. These results demonstrate that semantic editability and watermark integrity are fundamentally compatible, enabling trustworthy image provenance in generative editing pipelines.

Abstract

AI-Generated Image Watermarking

Explore similar work

Are Watermarked Images Editable? SafeMark for Watermark-Preserving Text-Guided Image Editing

NullEdit: Stealthy Image Protection via VLM Condition Redirection

FeatMark: Feature-level Watermark Protection against Mimicry Attacks with Diffusion Models