On the Information-Theoretic Limits of Latent-Space Watermarking Through Pretrained Generators

Jinwan Jeon; Minju Lee; Sung Hoon Lim

cs.ITSep 21, 2026

On the Information-Theoretic Limits of Latent-Space Watermarking Through Pretrained Generators

Authors: Jinwan Jeon, Minju Lee, Sung Hoon Lim

Organizations: Hallym University, CHUNCHEON-SI, GANGWON-DO, South Korea

Abstract

We study latent-space watermarking through a pretrained generator using a prescribed latent-to-output stochastic mapping, called the renderer. A watermark encoder selects the latent input using a message and secret key. For every message and semantic context, the released output must have exactly the desired conditional output distribution. For finite alphabets, we derive rate--key inner and outer bounds and characterize the coding and coordination requirements for realizing watermark communication through the prescribed latent interface. When the target output distribution of the generator uniquely determines the corresponding latent input distribution through the renderer, a strengthened converse yields the capacity region; the same region governs explicit preservation of the pretrained latent distribution. We extend the analysis to general jointly Gaussian models and identify a sufficient statistic of the latent that captures both the watermark-bearing information available at the generated output and the latent coordination required to preserve its target distribution. For the vector Gaussian model, we further characterize the optimal allocation of the secret-key resource across the resulting modes. Finally, we turn to an emerging robustness threat that is particularly natural in generative watermarking: an adversary can regenerate the released sample to obtain a fresh realization of the same underlying content while attenuating or destroying the embedded watermark. We incorporate this robustness axis into our framework and characterize the one-pass compound capacity of the scalar Gaussian model when the semantic context is known to the encoder but hidden from the detector, while the regeneration attack may depend on that context. Extending the analysis to multiple rounds of repeated canonical regeneration, we characterize the resulting watermark-capacity decay.

Explore similar work

Jul 14, 2026cs.CR

Watermark Forensics for Generative Models: An Information-Theoretic Perspective

A watermark in a generative model's output is usually asked only whether a text is machine-made. The same mark can do more: attribute it to the user who produced it, extract a hidden payload, or localize the part that survives editing. These form a forensic ladder, and we ask what each rung costs in the sample length

n

. One object organizes the answers. Let

S

be the secret the mark carries (a user's identity or payload), and let the information profile

ν(t)=I(S;X_t\mid X_{<t})

record how much the

t

-th token reveals about

S

given the earlier ones. Its total mass pays for attribution and extraction; how that mass is spread pays for localization; and detection alone is paid for not by information but by presence, the distance from the marked to the unmarked distribution. The literature's two quality models, a mark subtle on every token and one that stamps a few tokens loudly, are two incomparable ways of capping this profile. Our main theorem settles the ladder's entropy column. For statistically distortion-free schemes, attributing a text to one of

N

users costs

Θ(\log N/h)

tokens over every stationary-ergodic source of entropy rate

h

, sharp to a

(1+o(1))

factor: to our knowledge the first tight entropy-rate law for multi-user attribution (via exact alignment). The natural collision-counting analysis overcharges without bound; only a decoder thresholding each candidate by its own realized surprisal attains the rate while almost never implicating an innocent user. A matching converse makes the law two-sided, and extraction of an

\ell

-bit payload costs

Θ(\ell/h)

. Two gaps are real, not modeling artifacts: a

Θ(\log N)

-token window in which a text is provably machine-made yet unattributable, and a footprint-resolution uncertainty principle. Experiments on GPT-2, Pythia-410M, and Qwen2.5 recover the predicted constants.

Xiaoyu Li, Zheng Gao, Xiaoyan Feng +3

University of New South Wales · 2Griffith University

Watermarks Multi-Bit Watermarking Information-Theoretic Limits Digital Forensics Entropy Generative Models

Ask PDF

Jul 24, 2026cs.CV

Correlation-Aware and Gaussianity-Preserving Robust Latent Angular Watermarking for Diffusion Models

Latent domain watermarking for diffusion models embeds watermarks directly into the latent prior, enjoying non-intrusiveness to model parameters and seamless integration with the generation process. However, due to the violation of latent Gaussianity or sensitivity to normal and malicious perturbations during latent inversion, existing methods are prone to watermark detection or removal attacks. A further overlooked problem is the violation of the i.i.d. latent condition after watermarking, which leads to latent correlation degradation and generation fidelity loss. Although this has been externally measured by FID, the internal correlation structure has yet to be rigorously characterized. To address the above issues, and motivated by the rotation-invariant property of isotropic Gaussian, we propose \textit{Latent Angular Watermarking (LAW)}, which encodes watermark bits as antipodal angles (

\pmπ/2

relative to a reference pair) between disjoint pairs of latent elements while preserving the Gaussianity. The antipodal (

π

-separation) encoding maximizes geometric separation between bit values, and we prove that the decoding angular-error variance is proportional to the norm of the latent pair, i.e.,

\operatorname{var}(Δφ) \propto 1/ρ^2

. We further propose a magnitude-driven variant, LAW-M, which anchors watermark bits in the most geometrically stable latent dimensions, yielding additional robustness gains. Theoretically, we provide a rigorous characterization of the induced correlation degradation, deriving in closed form the autocorrelation structure of the watermarked latent and proving that correlations are confined to a sparse, structured set of off-diagonal elements with fixed

\pmπ/4

values.

Yebin Zheng, Haonan An, Guang Hua +2

Department of Infocomm Technology Singapore Institute of Technology · Department of Computer Science City University of Hong Kong · School of Electrical and Electronic Engineering Nanyang Technological University

Watermarks Multi-Bit Watermarking Diffusion Models

Ask PDF

Jul 2, 2026cs.CV

BiSLW: Bi-Spectral Latent Watermarking for Generative Diffusion Models

Diffusion-based generative models have transformed visual content synthesis, yet they remain vulnerable to unauthorized usage and lack reliable attribution methods. Existing watermarking techniques often treat latent tensors as static spatial feature maps or depend on pixel-domain modification, and most do not explicitly leverage the internal frequency structure of the latent space for dual-band redundant embedding, leaving them susceptible to the stochastic nature of diffusion and regeneration attacks. We introduce BiSLW, a trainable bi-spectral latent watermarking framework that jointly embeds aligned identity signals across complementary spectral bands of the decoded diffusion latent using learned encoders and decoders, going beyond fixed-pattern frequency approaches. We leverage the inherent frequency structure of diffusion latents to design a dual-band watermarking framework. Low-frequency components encode global semantics, while high-frequency components capture fine texture. We exploit this structure to embed watermarks across complementary spectral bands. The watermark is independently injected into both bands via learned encoders and recombined before decoding, ensuring it becomes intrinsic to the generative trajectory. Dual spectral decoders recover the watermark from each band, while a cross-band consistency constraint enforces alignment between semantic and textural embeddings. Experiments show that BiSLW achieves a strong balance between perceptual fidelity and robustness, improving PSNR by over 3 dB compared to prior latent diffusion watermarking methods while preserving near-perfect bit accuracy under aggressive regeneration and common distortions, all with negligible computational overhead.

Aryan Pandit

PDPM Indian Institute of Information Technology, Jabalpur, India

Watermarks Diffusion Models

Ask PDF