On the Intrinsic Limited Robustness of Latent-Based Watermarking

Cheng-Han Yeh; Kuan-chun Yu; Cheng-Chang Tsai; Chun-Shien Lu

cs.LGOct 6, 2026

On the Intrinsic Limited Robustness of Latent-Based Watermarking

Authors: Cheng-Han Yeh, Kuan-chun Yu, Cheng-Chang Tsai, Chun-Shien Lu

Organizations: Institute of Information Science Academia Sinica Taipei, Taiwan (ROC)

Abstract

Existing latent-based watermarking methods for diffusion models have overestimated their robustness to image distortions, including geometric transformations such as rotation, scaling, and translation (RST). Moreover, this paradigm of watermarking approaches may suffer from inherent limitations arising from the domain in which the watermark is embedded. In this paper, we provide the first theoretical analysis explaining why these methods lack invariance to perturbations. By relaxing the invariant relation, we derive a maximum perturbation bound that characterizes the relationship between pixel-space perturbations and their corresponding effects in latent space. In addition, we present the first analytical formulation that captures all components of practical detection mechanisms. Finally, we conduct experiments to validate the theoretical findings and the limitations of latent-based watermarking methods. Our theoretical and empirical results indicate that, under the current design paradigm, latent-based watermarking methods intrinsically exhibit limited robustness. We conclude by providing the analytical tool and design guidelines that future research could follow.

Figures & tables

Watermarking Methods	$\mathcal{M}$ / $\mathcal{W}$	$\mathscr{F}^{-1}$ / $\mathscr{F}$	$f_{\theta}$ / $f^{-1}_{\theta}$	$\mathcal{G}_{\phi_{g}}$ / $\mathcal{E}_{\phi_{e}}$
Tree-Ring (TR) [ 48 ]	$\checkmark$ / $\checkmark$	$\checkmark$ / $\checkmark$	$\checkmark$ / $\checkmark$	$\checkmark$ / $\checkmark$
RingID [ 4 ]	$\checkmark$ / $\checkmark$	$\checkmark$ / $\checkmark$	$\checkmark$ / $\checkmark$	$\checkmark$ / $\checkmark$
HSQR/TR [ 20 ]	$\checkmark$ / $\checkmark$	$\checkmark$ / $\checkmark$	$\checkmark$ / $\checkmark$	$\checkmark$ / $\checkmark$
Gaussian Shading (GS) [ 52 ]	$\times$ / $\checkmark$	$\times$ / $\times$	$\checkmark$ / $\checkmark$	$\checkmark$ / $\checkmark$
PRC Watermark (PRCW) [ 12 ]	$\times$ / $\checkmark$	$\times$ / $\times$	$\checkmark$ / $\checkmark$	$\checkmark$ / $\checkmark$
WIND [ 2 ]	$\times$ / $\checkmark$	$\times$ / $\times$	$\checkmark$ / $\checkmark$	$\checkmark$ / $\checkmark$

Table 1: Comparison of different watermarking schemes with operations involved in the generation and detection processes.

*

denotes the use of the noise layer for fine-tuning the network model or extra modules.

\dagger

denotes the extra module for compensating for or correcting the errors caused by perturbations.

\triangle

denotes the need for modifications of the reverse process. The “

\times

number” indicates the number of modules used in the generation or detection process.

Panel of Figure 2 — Figure 2 : Effects of different perturbations on $\|\mathbf{w}-\hat{\mathbf{w}}^{\prime}\|$ . From left to right, the perturbations were set with different parameters (Param). Watermark: Tree-Ring. Thresholds: 77.12 (1e-2 FPR).

Panel of Figure 4 — Figure 4 : Effects of different perturbations on $\|\mathbf{w}-\hat{\mathbf{w}}^{\prime}\|$ . From left to right, the perturbations were set with different parameters (Param). Watermark: HSQR. Thresholds: 68.52 (1e-2 FPR).

Figure 5 : Experimental thresholds for different perturbations on $\|\mathbf{w}-\hat{\mathbf{w}}^{\prime}\|$ , each with different parameters on x-axis. The y-axis represents the potential threat that $\hat{\mathbf{w}}^{\prime}$ is getting far from $\mathbf{w}$ , which corresponds to Eq. ( 7 ). Watermarking method: Tree-Ring.

Appendix figures & tables26 assets

Supplementary material from the paper’s appendix.

Appendix

Figure 6 : Coefficients $\eta_{t},\kappa_{t},\kappa_{t}/\eta_{t}$ of all time steps, under the linear noise schedule.

Panel of Figure 7 — Figure 7 : Visual explanation of $\mathcal{B}$ . (a) The tolerance constraint is described in Sec. 3.4 . (b) The constraint only considers the $y_{1}$ -axis (corresponding to watermark and detection on the Channel 3 in Tree-Ring [ 48 ] ), leaving other dimensions unbounded. As long as the $\ell_{1}$ distance between any points and $\mathbf{y}$ (centre) on the $y_{1}$ -axis is below a certain threshold ${\tau}$ (corresponding to falling within the two planes in the figure), it is considered to be in $\mathcal{B}$ . (c) This constraint considers the $y_{1}$ - and $y_{2}$ -axes, respectively (corresponding to the Channels 0 and 3 in RingID [ 4 ] ), leaving the $y_{3}$ -axes unbounded. The constraint requires calculating the $\ell_{1}$ distance between any point and $\mathbf{y}$ on $y_{1}$ - and $y_{2}$ -axes, respectively, in a dimension-wise manner, and then takes the minimum of these two values. A point is considered to fall in $\mathcal{B}$ if this minimum value is below a certain threshold ${\tau}$ (corresponding to falling within the cross-shaped region in the figure).

Panel of Figure 8 — Figure 8 : (a) Distribution Shift in latent space. The norm of watermarked images will shift away from $\mathbf{0}$ . By injecting a larger-norm watermark in latent representation, it is easier to distinguish whether an image is from a normal distribution. Also, the allowed perturbation will be larger since the latent representations of perturbed images will fall within the gap between the unwatermarked and watermarked latents. However, they are still away from the unwatermarked latent. (b) The distribution of the $\ell_{2}$ -norm of samples from each normal distribution. These distributions follow the $\chi$ distribution. The shaded areas represent the 0.3 and 99.7 percentiles for each distribution.

Panel of Figure 9 — Figure 9 : Histograms of distance. When comparing the latent of the attacked images to samples from the normal distribution ( e.g. , unwatermarked latent), we find that the attacked latent still maintains a certain distance from the unwatermarked latent, especially for the removal attack case. Here, “gtwm” means “ground-truth watermark”; “wm” means “watermarked images”; and “unwm” means “unwatermarked images”. (Best viewed in a color display)

Panel of Figure 11 — Figure 11 : The effects of different perturbations on $\|\mathbf{w}-\hat{\mathbf{w}}^{\prime}\|$ . From left to right, the perturbations are set with different parameters (Param). Watermark: Tree-Ring. Thresholds: 77.12 (1e-2 FPR).

Panel of Figure 13 — Figure 13 : The effects of different perturbations on $\|\mathbf{w}-\hat{\mathbf{w}}^{\prime}\|$ . From left to right, the perturbations are set with different parameters (Param). Watermark: HSQR. Thresholds: 68.52 (1e-2 FPR).

Panel of Figure 15 — Figure 15 : The effects of different perturbations on $\|\mathbf{w}-\hat{\mathbf{w}}^{\prime}\|_{H}$ . From left to right, the perturbations are set with different parameters (Param). Watermark: PRCW decoding component (1e-2 FPR). In this case, the number of bits is $\left\lceil\log_{2}(1/10^{-2})\right\rceil=7$ .

Panel of Figure 17 — Figure 17 : The effects of different perturbations by Eq. ( H ). From left to right, the perturbations are set with different parameters (Param). Watermark: PRCW detection component (1e-2 FPR).

Panel of Figure 19 — Figure 19 : The effects of different perturbations on $\|\mathbf{w}-\hat{\mathbf{w}}^{\prime}\|_{H}$ . From left to right, the perturbations are set with different parameters (Param). Watermark: PRCW decoding component (1e-5 FPR). In this case, the number of bits is $\left\lceil\log_{2}(1/10^{-5})\right\rceil=17$ .

Panel of Figure 21 — Figure 21 : The effects of different perturbations by Eq. ( H ). From left to right, the perturbations are set with different parameters (Param). Watermark: PRCW detection component (1e-5 FPR).

WM Method	Tree-Ring		RingID		HSQR		HSTR
	mean	max	mean	max	mean	max	mean	max
$t=10$	55.36	62.38	29.34	45.37	43.17	48.91	19.94	25.93
$t=30$	53.96	60.62	26.31	45.52	41.69	47.76	17.48	24.95
$t=50$	53.72	60.53	25.63	45.91	41.33	47.53	16.94	24.86
$t=70$	53.58	60.28	25.36	44.42	41.30	47.75	16.68	23.88
$t=90$	53.52	60.16	25.03	43.66	41.19	47.75	16.55	23.54

Appendix

Table 2: Effects of different number of inference time steps on

\|\mathbf{w}-\hat{\mathbf{w}}^{\prime}\|

. The number of inference time steps were set to 10, 30, 50 (default), 70, and 90. We present the mean and the maximum values of a set of

\|\mathbf{w}-\hat{\mathbf{w}}^{\prime}\|

Panel of Figure 23 — Figure 23 : Effects of different number of inference time steps on $\|\mathbf{w}-\hat{\mathbf{w}}^{\prime}\|$ . From left to right, the number of inference time steps (Num Steps) were set to 10, 30, 50 (default), 70, and 90.

Panel of Figure 25 — Figure 25 : Effects of different perturbations on $\|\mathbf{w}-\hat{\mathbf{w}}^{\prime}\|$ . Watermark: RingID. Thresholds: 73.0 (1e-2 FPR).

Panel of Figure 27 — Figure 27 : Effects of different perturbations on $\|\mathbf{w}-\hat{\mathbf{w}}^{\prime}\|$ . Watermark: RingID with channel 0 pattern multiplied by $2$ and $\alpha=128$ . Thresholds: 119.85 (1e-2 FPR).

WM Methods	FID ( $\downarrow$ )
RingID	45.31
RingID-2-128	428.68
HSTR	45.32
HSTR-2-2	187.77

Appendix

Table 3: The FID score of watermark methods with different magnitude

\|\mathbf{w}\|

Panel of Figure 29 — Figure 29 : The effects of different perturbations on $\|\mathbf{w}-\hat{\mathbf{w}}^{\prime}\|$ . From left to right, the perturbations are set with different parameters (Param). Watermark: RingID. Thresholds: 73.0 (1e-2 FPR).

Panel of Figure 31 — Figure 31 : The effects of different perturbations on $\|\mathbf{w}-\hat{\mathbf{w}}^{\prime}\|$ . From left to right, the perturbations are set with different parameters (Param). Watermark: RingID with channel 0 pattern multiplied by $2$ and $\alpha=128$ (RingID-2-128). Thresholds: 119.85 (1e-2 FPR).

Panel of Figure 33 — Figure 33 : The effects of different perturbations on $\|\mathbf{w}-\hat{\mathbf{w}}^{\prime}\|$ . From left to right, the perturbations are set with different parameters (Param). Watermark: RingID with $\alpha=128$ (RingID-1-128). Thresholds: 73.51 (1e-2 FPR).

Panel of Figure 35 — Figure 35 : The effects of different perturbations on $\|\mathbf{w}-\hat{\mathbf{w}}^{\prime}\|$ . From left to right, the perturbations are set with different parameters (Param). Watermark: HSTR. Thresholds: 50.39 (1e-2 FPR).

Panel of Figure 37 — Figure 37 : The effects of different perturbations on $\|\mathbf{w}-\hat{\mathbf{w}}^{\prime}\|$ . From left to right, the perturbations are set with different parameters (Param). Watermark: HSTR with channels 0 and 3 pattern multiplied by $2$ (HSTR-2-2). Thresholds: 82.15 (1e-2 FPR).

Figure 38 : The experimental thresholds for different perturbations on $\|\mathbf{w}-\hat{\mathbf{w}}^{\prime}\|$ , each with different parameters on x-axis. The value on y-axis represents the potential threat that $\hat{\mathbf{w}}^{\prime}$ is getting far from $\mathbf{w}$ , which corresponds to Eq. ( 7 ). Watermark: RingID.

Figure 39 : The experimental thresholds for different perturbations on $\|\mathbf{w}-\hat{\mathbf{w}}^{\prime}\|$ , each with different parameters on x-axis. The value on y-axis represents the potential threat that $\hat{\mathbf{w}}^{\prime}$ is getting far from $\mathbf{w}$ , which corresponds to Eq. ( 7 ). Watermark: HSQR.

Attack	AUC	ACC	TPR@0.01FPR
Median filter 2x2	1.0000	1.0000	1.0000
Median filter 3x3	1.0000	1.0000	1.0000
Median filter 4x4	1.0000	0.9995	0.9990
Gaussian filter 3x3	1.0000	1.0000	1.0000
JPEG 90	1.0000	1.0000	1.0000
JPEG 80	1.0000	1.0000	1.0000

Appendix

Table 4 : Attacker: StirMark 3.1.79. Defense: Tree-Ring [ 48 ] (watermark: ring). Diffusion model: LDM. Number of testing images: watermarked: 1000 / unwatermarked: 1000. Generated image size: 3x512x512. Latent size: 4x64x64.

Attack	AUC	ACC	TPR@0.01FPR
Linear (1.007, 0.010, 0.010, 1.012)	1.0000	1.0000	1.0000
Linear (1.010, 0.013, 0.009, 1.011)	1.0000	1.0000	1.0000
Linear (1.013, 0.008, 0.011, 1.008)	1.0000	1.0000	1.0000
Aspect ratio change (0.80, 1.00)	0.6752	0.6300	0.0650
Aspect ratio change (0.90, 1.00)	0.9999	0.9955	0.9990
Aspect ratio change (1.00, 0.80)	0.9206	0.8400	0.4470

Appendix

Table 5 : Attacker: StirMark 3.1.79. Defense: Tree-Ring [ 48 ] (watermark: ring). Diffusion model: LDM. Number of testing images: watermarked: 1000 / unwatermarked: 1000. Generated image size: 3x512x512. Latent size: 4x64x64.

Attack	AUC	ACC	TPR@0.01FPR
Median filter 2x2	1.0000	1.0000	1.0000
Median filter 3x3	1.0000	1.0000	1.0000
Median filter 4x4	1.0000	1.0000	1.0000
Gaussian filter 3x3	1.0000	1.0000	1.0000
JPEG 90	1.0000	1.0000	1.0000
JPEG 80	1.0000	1.0000	1.0000

Appendix

Table 6 : Attacker: StirMark 3.1.79. Defense: RingID [ 4 ] (watermark: ring & noise). Diffusion model: LDM. Number of testing images: watermarked: 1000 / unwatermarked: 1000. Generated image size: 3x512x512. Latent size: 4x64x64.

Attack	AUC	ACC	TPR@0.01FPR
Linear (1.007, 0.010, 0.010, 1.012)	1.0000	1.0000	1.0000
Linear (1.010, 0.013, 0.009, 1.011)	1.0000	1.0000	1.0000
Linear (1.013, 0.008, 0.011, 1.008)	1.0000	1.0000	1.0000
Aspect ratio change (0.80, 1.00)	0.9996	0.9920	0.9920
Aspect ratio change (0.90, 1.00)	1.0000	1.0000	1.0000
Aspect ratio change (1.00, 0.80)	0.9999	0.9935	0.9950

Appendix

Table 7 : Attacker: StirMark 3.1.79. Defense: RingID [ 4 ] (watermark: ring & noise). Diffusion model: LDM. Number of testing images: watermarked: 1000 / unwatermarked: 1000. Generated image size: 3x512x512. Latent size: 4x64x64.

Explore similar work

Correlation-Aware and Gaussianity-Preserving Robust Latent Angular Watermarking for Diffusion Models
Jul 24, 2026Yebin Zheng, Haonan An, Guang Hua +2Watermarks Multi-Bit Watermarking
Department of Infocomm Technology Singapore Institute of Technology · Department of Computer Science City University of Hong Kong · School of Electrical and Electronic Engineering Nanyang Technological University
Exploring Weaknesses of Generative Image Watermarks against Latent Frequency Masking
Oct 1, 2026Kirill Aistov, Khaled Abud, Irina Serzhenko +8Watermarks Multi-Bit Watermarking
MSU AI Institute, Moscow, Russia · Trusted AI Research Center RAS, Moscow, Russia
BiSLW: Bi-Spectral Latent Watermarking for Generative Diffusion Models
Jul 2, 2026Aryan PanditWatermarks Diffusion Models
PDPM Indian Institute of Information Technology, Jabalpur, India

Jul 24, 2026, cs.CVJ/K move · Enter open · S save

Correlation-Aware and Gaussianity-Preserving Robust Latent Angular Watermarking for Diffusion Models

Yebin Zheng, Haonan An, Guang Hua, Zhiping Lin+1

Department of Infocomm Technology Singapore Institute of Technology · Department of Computer Science City University of Hong Kong · School of Electrical and Electronic Engineering Nanyang Technological University

Watermarks Multi-Bit Watermarking Diffusion Models

Open paper AskPDF arXiv

Latent domain watermarking for diffusion models embeds watermarks directly into the latent prior, enjoying non-intrusiveness to model parameters and seamless integration with the generation process. However, due to the violation of latent Gaussianity or sensitivity to normal and malicious perturbations during latent inversion, existing methods are prone to watermark detection or removal attacks. A further overlooked problem is the violation of the i.i.d. latent condition after watermarking, which leads to latent correlation degradation and generation fidelity loss. Although this has been externally measured by FID, the internal correlation structure has yet to be rigorously characterized. To address the above issues, and motivated by the rotation-invariant property of isotropic Gaussian, we propose \textit{Latent Angular Watermarking (LAW)}, which encodes watermark bits as antipodal angles (

\pmπ/2

relative to a reference pair) between disjoint pairs of latent elements while preserving the Gaussianity. The antipodal (

π

-separation) encoding maximizes geometric separation between bit values, and we prove that the decoding angular-error variance is proportional to the norm of the latent pair, i.e.,

\operatorname{var}(Δφ) \propto 1/ρ^2

. We further propose a magnitude-driven variant, LAW-M, which anchors watermark bits in the most geometrically stable latent dimensions, yielding additional robustness gains. Theoretically, we provide a rigorous characterization of the induced correlation degradation, deriving in closed form the autocorrelation structure of the watermarked latent and proving that correlations are confined to a sparse, structured set of off-diagonal elements with fixed

\pmπ/4

values.

Abstract

Explore similar work

Correlation-Aware and Gaussianity-Preserving Robust Latent Angular Watermarking for Diffusion Models

Exploring Weaknesses of Generative Image Watermarks against Latent Frequency Masking

BiSLW: Bi-Spectral Latent Watermarking for Generative Diffusion Models