WaveMark: Robust Wavelet-Domain Image Watermarking for Diffusion Models

Jie Cao; Qi Li; Chaklam Cheong; Yutong Jin; Enze Yu; Zelin Zhang; Jianbing Ni

cs.CROct 9, 2026

WaveMark: Robust Wavelet-Domain Image Watermarking for Diffusion Models

Authors: Jie Cao, Qi Li, Chaklam Cheong, Yutong Jin, Enze Yu, Zelin Zhang, Jianbing Ni

Organizations: Department of Electrical and Computer Engineering, Queen’s University, Kingston, Canada · School of Computing, Queen’s University, Kingston, Canada · School of Computer Science, Nanjing University, Jiangsu, China

Abstract

Image watermarking enables provenance tracing for photorealistic images generated by diffusion models. However, state-of-the-art (SOTA) removal attacks can suppress embedded signals with little perceptual degradation. This vulnerability limits the effectiveness of watermarks for intellectual property protection and misuse attribution. We propose WaveMark, a novel wavelet-domain watermarking method that embeds messages in a diffusion model's initial noise. To support robust recovery from perturbed carriers, WaveMark distributes keyed replicas of message bits across spatial positions, wavelet orientations, and scales. Each carrier groups coefficients from four latent channels and encodes a randomized bit through magnitude projection, providing an explicit decoding margin. We evaluate WaveMark with SD2.1 on SDP and MS-COCO Captions under 14 attacks. WaveMark achieves 100.0% bit accuracy (BA) without attacks, while maintaining image quality comparable to the evaluated baselines. Under SOTA MarkNull and MarkNull-A, it retains over 88% BA, outperforming all baselines.

Figures & tables

Figure 1: Overview of the WaveMark framework.

Method	SDP				MS-COCO Captions
Method	BA (%) $\uparrow$	CLIP-Score $\uparrow$	CLIP-IQA $\uparrow$	FID $\downarrow$	BA (%) $\uparrow$	CLIP-Score $\uparrow$	CLIP-IQA $\uparrow$	FID $\downarrow$
SSig ${}_{\text{[ICCV'23]}}$	99.85	27.689	0.8452	155.680	99.69	26.021	0.8937	153.196
SleeperMark ${}_{\text{[CVPR'25]}}$	99.92	28.229	0.8796	169.536	99.50	26.381	0.8421	161.515
VINE ${}_{\text{[ICLR'25]}}$	99.84	27.066	0.9143	153.068	99.82	25.760	0.9422	151.344
GS ${}_{\text{[CVPR'24]}}$	100.0	27.701	0.9064	151.392	100.0	25.799	0.9479	141.264
PRC ${}_{\text{[ICLR'25]}}$	100.0	28.047	0.9104	156.512	100.0	26.034	0.9405	147.439

Table 1: Watermark performance and image quality on SDP and MS-COCO Captions, with 100 images per method per dataset.

Watermarking	Common image distortions					Regeneration-based attacks				Adversarial attacks
Watermarking	Noise	Blur	Crop	Contrast	JPEG	DA	VA	CtrlRegen+	NFPA	UnMarker	Imprint	NPA	MarkNull	MarkNull-A
SSig	95.08	84.33	99.16	98.04	85.13	48.50	62.79	46.63	48.50	92.18	45.83	47.25	49.33	45.63
SleeperMark	98.92	99.88	95.91	99.70	99.83	99.46	95.75	88.04	82.79	99.52	83.23	90.17	41.63	41.38
VINE	99.30	99.64	52.42	98.08	99.82	90.04	95.16	71.06	50.88	97.54	71.70	80.26	61.36	57.16
GS	99.59	100.0	99.72	99.99	99.97	99.68	98.76	93.35	51.16	99.83	28.16	49.27	36.49	74.74
PRC	70.64	82.18	66.94	80.35	78.83	69.38	66.51	59.42	50.13	91.46	46.45	49.89	47.41	54.48

Table 2: BA (%) of watermarking methods under various attacks.

Figure 2: Images generated by different watermarking methods using SD2.1 on two prompt datasets.

Explore similar work

FeatMark: Feature-level Watermark Protection against Mimicry Attacks with Diffusion Models
Sep 25, 2026Haoyang Li, Ruoxi Sun, Qingqing Ye +4Diffusion Model Watermarking Robust Watermarking
The Hong Kong Polytechnic University · CSIRO’s Data61 · Macquarie University
Breaking Watermarks in the Frequency Domain: A Modulated Diffusion Attack Framework
Apr 24, 2026Chunpeng Wang, Binyan Qu, Xiaoyu Wang +4Watermark Removal Diffusion Models
Qilu University of Technology (Shandong Academy of Sciences) Jinan, Shandong Province, China · Dalian Maritime University Dalian, Liaoning Province, China · Nanjing University of Science and Technology Nanjing, Jiangsu Province, China +1
SERUM: Simple, Efficient, Robust, and Unifying Marking for Diffusion-based Image Generation
Mar 11, 2026Jan Kociszewski, Hubert Jastrzębski, Tymoteusz Stępkowski +4Diffusion Model Watermarking Robust Watermarking
CISPA Helmholtz Center for Information Security

Sep 25, 2026J/K move · Enter open · S save

FeatMark: Feature-level Watermark Protection against Mimicry Attacks with Diffusion Models

Haoyang Li, Ruoxi Sun, Qingqing Ye, Benjamin Zi Hao Zhao+3

The Hong Kong Polytechnic University · CSIRO’s Data61 · Macquarie University

Diffusion Model Watermarking Robust Watermarking T2I Diffusion Models Adversarial Attacks Watermark Removal

Open paper AskPDF arXiv

Text-to-image diffusion models enable data-efficient "mimicry" attacks, wherein adversaries fine-tune the model on a handful of public photos to synthesize convincing forgeries of a target individual. A common countermeasure is to embed imperceptible, low-energy watermarks, yet recent studies show these signatures are brittle: modest post-processing or lightweight adversarial perturbations readily suppress detection, exposing a fundamental tension between imperceptibility and robustness. We introduce FeatMark, a watermarking framework that shifts from pixel-level, energy-starved perturbations to inconspicuous semantic features: small, scene-consistent micro-features that remain natural to humans while providing a stronger, machine-verifiable provenance signal. FeatMark builds domain-specific feature banks that encode each watermark as a compact concept program, pairing open-vocabulary semantic cues with reliable edit regions and instruction templates. It then automatically selects features that are both feasible and executable and injects them through modular, mask-guided concept editing, yielding highly localized, scene-consistent micro-edits that are difficult to perceive. We conduct extensive experiments across VGGFace2, CelebA-HQ, and WikiArt, evaluating against 10 strong watermark removal/purification attacks (including regeneration-style purification) and several bespoke adaptive attacks tailored to FeatMark, to assess perceptual fidelity, watermark detection accuracy, and robustness. We further demonstrate FeatMark's extensibility to video mimicry attacks. The results show FeatMark remains virtually impervious, withstanding all evaluated attacks with negligible bit-accuracy and fidelity degradation.

Abstract

Explore similar work

FeatMark: Feature-level Watermark Protection against Mimicry Attacks with Diffusion Models

Breaking Watermarks in the Frequency Domain: A Modulated Diffusion Attack Framework

SERUM: Simple, Efficient, Robust, and Unifying Marking for Diffusion-based Image Generation