CLaW: Codec-Guided Adaptive Latent Watermarking for Traceable Diffusion Image Generation

Huangchao Song; Lingyun Yu; Cong Li; Peiqi Jiang; Mingqi Fang; Hongtao Xie

cs.CVOct 29, 2026

CLaW: Codec-Guided Adaptive Latent Watermarking for Traceable Diffusion Image Generation

Authors: Huangchao Song, Lingyun Yu, Cong Li, Peiqi Jiang, Mingqi Fang, Hongtao Xie

Organizations: University of Science and Technology of China · Tianjin University

Abstract

With the rapid advancement of text-to-image diffusion models, increasingly realistic AI-generated content has raised serious concerns about misuse and copyright infringement. Digital watermarking offers a promising solution by enabling user-level traceability, yet existing methods remain difficult to deploy at scale, hindered by costly model retraining or detection, poor effectiveness-fidelity trade-offs, and limited robustness to image transformations. To address these challenges, we propose CLaW (Codec-guided Latent Watermarking), a robust and efficient watermarking framework for traceable diffusion image generation with frozen diffusion backbones and inversion-free detection. Specifically, CLaW first uses a pretrained watermark codec to map each watermark message to a latent residual, enabling low-cost sampling-time injection. Then, the residual is injected within a late denoising window, where image semantics are better preserved and the watermark signal is less perturbed by subsequent denoising updates, yielding a better balance between watermark effectiveness and image fidelity. Furthermore, we introduce a decoder-guided adaptive injection mechanism that uses decoding confidence as feedback to dynamically calibrate watermark strength, reinforcing weak watermark signals and improving robustness under image transformations. Extensive experiments show that CLaW preserves high visual fidelity and achieves state-of-the-art robustness under image transformations, enabling reliable user-level traceability.

Figures & tables

Figure 1: User-level traceability in image-generation services. (a) During generation, the platform assigns each user a unique watermark message and embeds it into the generated image, which may undergo common image transformations. (b) During detection, the watermark message is decoded from a suspicious image and matched against a registered-user database for attribution.

Figure 2: Overview of CLaW. (a) Pretraining a secret encoder $E_{s}$ and a secret decoder $D_{s}$ within the latent space of a frozen VAE: $E_{s}$ converts a user-specific payload into a latent residual, while $D_{s}$ recovers the payload from the decoded image. (b) During generation, CLaW keeps the diffusion backbone frozen and injects the residual in a late denoising window. The frozen decoder previews intermediate noisy latents and provides feedback to update the adaptive gain, which dynamically calibrates the watermark injection strength. (c) During detection, $D_{s}$ directly extracts the payload from a suspicious image and matches it against the registered user database for attribution.

Method	SD3.5-medium						FLUX.1-dev
Method	F1 $\uparrow$	F1 (Adv.) $\uparrow$	PSNR $\uparrow$	FID $\downarrow$	Gen. $\downarrow$	Det. $\downarrow$	F1 $\uparrow$	F1 (Adv.) $\uparrow$	PSNR $\uparrow$	FID $\downarrow$	Gen. $\downarrow$	Det. $\downarrow$
RivaGAN [ 27 ]	0.9914	0.9288	40.53	35.13	2.56	0.518	1.0000	0.9577	40.39	38.30	5.12	0.530
Gaussian Shading [ 22 ]	1.0000	0.8750	9.99	35.57	11.40	1.559	1.0000	0.8656	10.85	38.40	14.49	4.703
RingID [ 23 ]	0.9935	0.6213	8.56	35.38	2.23	1.589	0.9950	0.4473	11.09	38.74	4.57	4.658
PRC [ 38 ]	0.9712	0.5642	8.44	35.90	2.70	3.444	0.9975	0.5090	11.06	38.57	4.70	6.836
WIND [ 24 ]	0.9901	0.8665	8.31	36.26	2.34	2.241	0.9877	0.8658	10.78	39.31	4.61	4.846

Table 1: Main comparison on SD3.5-medium and FLUX.1-dev, evaluated with 1,000 generated images per method and backbone. We report watermark detection accuracy, image fidelity, and runtime. F1 is measured on clean generated images, while F1 (Adv.) reports the average F1 under common post-generation image transformations. Gen. and Det. denote mean seconds per image for watermarked generation and detection, respectively. Runtime standard deviations are reported in Appendix Table 11 , and full image-quality results are reported in Appendix Tables 12 and 13 .

Methods	Distortions
Methods	JPEG	Crop+Resize	Blur	Noise	Brightness	Mask	Overlay	Adaptive Noise	Avg.
F1 $\uparrow$
RivaGAN [ 27 ]	0.9189	0.9501	0.9213	0.9148	0.9496	0.9909	0.8318	0.9529	0.9288
Gaussian Shading [ 22 ]	1.0000	0.0000	1.0000	1.0000	1.0000	1.0000	1.0000	1.0000	0.8750
RingID [ 23 ]	0.5380	0.0060	0.6591	0.4639	0.9712	0.9401	0.4962	0.8956	0.6213
PRC [ 38 ]	0.7390	0.0000	0.0198	0.3333	0.9224	0.9236	0.7063	0.8694	0.5642

Table 2: Robustness on SD3.5-medium under common image transformations. F1 and AUC are reported for each transformation, and Avg. denotes the mean over the eight transformations.

Factor	Setting	SD3.5-medium				FLUX.1-dev
Factor	Setting	BitAcc $\uparrow$	BitAcc (Adv.) $\uparrow$	CLIP $\uparrow$	PSNR $\uparrow$	BitAcc $\uparrow$	BitAcc (Adv.) $\uparrow$	CLIP $\uparrow$	PSNR $\uparrow$
Steps	15	0.9875	0.9497	0.8594	39.3099	0.9975	0.9700	0.8597	39.4380
	25	0.9913	0.9591	0.8606	39.3239	0.9958	0.9676	0.8568	40.2712
	40	0.9929	0.9601	0.8626	39.7695	0.9973	0.9707	0.8571	40.8469
	50	0.9910	0.9582	0.8625	40.0539	0.9977	0.9708	0.8572	41.0504
CFG	5.0	0.9942	0.9676	0.8635	40.2391	0.9975	0.9718	0.8569	40.2328

Table 3: Robustness to variations in SD3.5-medium and FLUX.1-dev generation settings. We change one setting at a time from the default configuration. Default test settings are colored by green cells.

Method	Composite transformations			Restoration		Avg.
Method	Degradation	Editing	Geometric	Super-resolution	Denoising	Avg.
RivaGAN [ 27 ]	0.8877	0.5053	0.7406	0.3709	0.0392	0.5419
Gaussian Shading [ 22 ]	0.9847	1.0000	0.0000	1.0000	1.0000	0.7969
RingID [ 23 ]	0.0000	0.0000	0.0000	0.0000	0.0000	0.0000
PRC [ 38 ]	0.1304	0.4818	0.0000	0.7950	0.6207	0.4230
WIND [ 24 ]	0.9783	0.9804	0.0914	0.9934	0.9901	0.8071

Table 4: Robustness on SD3.5-medium under composite transformations and restoration. Mean F1 is reported for each group, and Avg. denotes the mean over all ten conditions. Higher is better.

Backbone	Method	$10^{4}$ users		$10^{5}$ users		$10^{6}$ users
Backbone	Method	Trace Acc.	Trace Acc. (Adv.)	Trace Acc.	Trace Acc. (Adv.)	Trace Acc.	Trace Acc. (Adv.)
SD3.5-medium	DWT-DCT-SVD [ 52 ]	0.9960	0.5090	0.9960	0.4768	0.9940	0.4464
	RivaGAN [ 27 ]	0.9950	0.9231	0.9920	0.9001	0.9870	0.8570
	CLaW (ours)	1.0000	0.9861	1.0000	0.9786	0.9980	0.9649
FLUX.1-dev	DWT-DCT-SVD [ 52 ]	1.0000	0.5610	1.0000	0.5251	1.0000	0.4866
	RivaGAN [ 27 ]	1.0000	0.9454	0.9990	0.9276	0.9970	0.8935

Table 5: User-level traceability with increasing registry sizes. Trace accuracy is computed by matching each decoded

48

-bit payload to a registry of candidate users. Higher is better.

Figure 3: Effect of injection timing. Cells denote denoising-window start/end pairs, with BitAcc on the left and PSNR on the right. The starred late-window setting balances recovery and fidelity.

Variant	SD3.5-medium						FLUX.1-dev
Variant	BitAcc	BitAcc (Adv.)	AUC	AUC (Adv.)	CLIP	PSNR	BitAcc	BitAcc (Adv.)	AUC	AUC (Adv.)	CLIP	PSNR
w/o Late Denoising	0.5595	0.5413	0.5468	0.5557	0.8702	57.54	0.6116	0.5727	0.7095	0.6309	0.8667	57.8904
w/o Adaptive Feedback	0.9825	0.9283	0.9993	0.9979	0.8702	42.18	0.9890	0.9384	1.0000	0.9996	0.8674	43.1592
w/o Terminal Anchor	0.9911	0.9521	1.0000	0.9997	0.8700	40.62	0.9952	0.9604	1.0000	1.0000	0.8675	41.6392
Full	0.9926	0.9595	1.0000	1.0000	0.8700	40.04	0.9971	0.9695	1.0000	1.0000	0.8677	41.0571

Table 6: Module ablation of CLaW on SD3.5-medium and FLUX.1-dev. Higher is better.

Appendix figures & tables13 assets

Supplementary material from the paper’s appendix.

Appendix

Attack	Parameter	Robustness Aspect
JPEG Compression	quality $=50$	compression-induced information loss
Crop $+$ Resize	crop ratio $=0.8$	geometric misalignment
Gaussian Blur	radius $=3$	high-frequency attenuation
Gaussian Noise	noise std. $\sigma=25$	additive pixel-level corruption
Brightness	factor $=1.5$	global photometric shift
Mask	mask ratio $=0.18$ , number of masks $=8$	partial spatial removal

Appendix

Table 7: Post-generation image attacks used for robustness evaluation. Each attack is applied before watermark detection and payload recovery.

Figure 4: Examples of post-generation image attacks on a FLUX.1-dev sample. The attacked results in the main text and supplementary tables are averaged over this perturbation suite.

Methods	Distortions
Methods	JPEG	Crop+Resize	Blur	Noise	Brightness	Mask	Overlay	Adaptive Noise	Avg.
F1 $\uparrow$
RivaGAN [ 27 ]	0.9189	0.9501	0.9213	0.9148	0.9496	0.9909	0.8318	0.9529	0.9288
Gaussian Shading [ 22 ]	1.0000	0.0000	1.0000	1.0000	1.0000	1.0000	1.0000	1.0000	0.8750
RingID [ 23 ]	0.5380	0.0060	0.6591	0.4639	0.9712	0.9401	0.4962	0.8956	0.6213
PRC [ 38 ]	0.7390	0.0000	0.0198	0.3333	0.9224	0.9236	0.7063	0.8694	0.5642

Appendix

Table 8: Full attack-wise robustness on SD3.5-medium under common image transformations. Results are grouped by metric, and Avg. denotes the mean over the eight transformations.

Methods	Distortions
Methods	JPEG	Crop+Resize	Blur	Noise	Brightness	Mask	Overlay	Adaptive Noise	Avg.
F1 $\uparrow$
RivaGAN [ 27 ]	0.9610	0.9899	0.9770	0.9501	0.9822	1.0000	0.8270	0.9744	0.9577
Gaussian Shading [ 22 ]	0.9975	0.0000	1.0000	0.9529	1.0000	1.0000	1.0000	0.9744	0.8656
RingID [ 23 ]	0.0100	0.0000	0.0000	0.0000	0.9610	0.9583	0.7421	0.9071	0.4473
PRC [ 38 ]	0.2063	0.0000	0.0000	0.0296	0.9717	0.9899	0.9501	0.9247	0.5090

Appendix

Table 9: Full attack-wise robustness on FLUX.1-dev under common image transformations. Results are grouped by metric, and Avg. denotes the mean over the eight transformations.

Method	SD3.5-medium			FLUX.1-dev
Method	F1 $\uparrow$	AUC $\uparrow$	BitAcc $\uparrow$	F1 $\uparrow$	AUC $\uparrow$	BitAcc $\uparrow$
RivaGAN [ 27 ]	0.7878	0.8250	0.9094	0.7097	0.7750	0.8828
Gaussian Shading [ 22 ]	1.0000	1.0000	0.9426	0.9899	0.9900	0.8077
RingID [ 23 ]	0.7879	0.8250	–	0.0000	0.5000	–
PRC [ 38 ]	0.7450	0.8000	–	0.0000	0.5000	–
WIND [ 24 ]	1.0000	1.0000	–	0.9615	0.9600	–

Appendix

Table 10: Robustness to denoising-based regeneration. The attack uses strength

0.15

20

regeneration steps, guidance scale

4.5

, and dataset prompts. Results are grouped by backbone.

Method	SD3.5-medium		FLUX.1-dev
Method	Gen. time (s)	Det. time (s)	Gen. time (s)	Det. time (s)
RivaGAN [ 27 ]	2.5617 $\,\pm\,$ 0.3592	0.5177 $\,\pm\,$ 0.0294	5.1161 $\,\pm\,$ 0.1984	0.5303 $\,\pm\,$ 0.0369
Gaussian Shading [ 22 ]	11.4012 $\,\pm\,$ 0.9618	1.5594 $\,\pm\,$ 0.2518	14.4887 $\,\pm\,$ 0.7680	4.7032 $\,\pm\,$ 0.0428
RingID [ 23 ]	2.2270 $\,\pm\,$ 0.3949	1.5889 $\,\pm\,$ 0.2624	4.5675 $\,\pm\,$ 0.0191	4.6583 $\,\pm\,$ 0.0238
PRC [ 38 ]	2.7029 $\,\pm\,$ 0.2068	3.4440 $\,\pm\,$ 0.4512	4.6993 $\,\pm\,$ 0.0314	6.8361 $\,\pm\,$ 0.8122
WIND [ 24 ]	2.3406 $\,\pm\,$ 0.3686	2.2410 $\,\pm\,$ 0.4159	4.6119 $\,\pm\,$ 0.0427	4.8455 $\,\pm\,$ 0.2438

Appendix

Table 11: Generation and detection efficiency on an H100 80G GPU. We report mean runtime with standard deviation. The detection time is measured per image after generation. Lower is better.

Method	CLIP	FID (vs. COCO)	PickScore	NIQE	PSNR	SSIM
RivaGAN [ 27 ]	0.8758	35.1276	22.2388	10.0031	40.5322	0.9820
Gaussian Shading [ 22 ]	0.8779	35.5688	22.2567	10.5437	9.9909	0.1838
RingID [ 23 ]	0.8755	35.3834	22.3202	10.0119	8.5606	0.2031
PRC [ 38 ]	0.8755	35.9001	22.3141	10.1161	8.4404	0.1960
WIND [ 24 ]	0.8760	36.2584	22.2901	10.8505	8.3103	0.1901
GaussMarker [ 40 ]	0.8760	36.4749	22.3337	10.5729	8.4976	0.2000

Appendix

Table 12: Full image-quality results on SD3.5-medium. Lower values indicate better performance for FID and NIQE, while higher values are better for CLIP, PickScore, PSNR, and SSIM.

Method	CLIP	FID (vs. COCO)	PickScore	NIQE	PSNR	SSIM
RivaGAN [ 27 ]	0.8693	38.3027	22.5825	9.3157	40.3885	0.9817
Gaussian Shading [ 22 ]	0.8650	38.3992	22.5498	9.3590	10.8475	0.3057
RingID [ 23 ]	0.8634	38.7425	22.5805	9.5687	11.0946	0.3212
PRC [ 38 ]	0.8629	38.5748	22.7049	9.5986	11.0556	0.3060
WIND [ 24 ]	0.8627	39.3105	22.4199	9.7733	10.7848	0.3106
GaussMarker [ 40 ]	0.8650	38.7848	22.6271	9.4042	11.2247	0.2999

Appendix

Table 13: Full image-quality results on FLUX.1-dev. Lower values indicate better performance for FID and NIQE, while higher values are better for CLIP, PickScore, PSNR, and SSIM.

Figure 5: Qualitative comparison on SD3.5-medium. Rows show the clean generation, baseline watermarked outputs, and CLaW outputs. Columns cover representative prompt categories, including urban scenes, still-life objects, portraits, and stylized images.

Figure 6: Qualitative comparison on FLUX.1-dev. Rows show the clean generation, baseline watermarked outputs, and CLaW outputs. Columns cover representative prompt categories, including urban scenes, still-life objects, portraits, and stylized images.

Backbone	Schedule	F1 $\uparrow$	F1 adv $\uparrow$	BitAcc $\uparrow$	BitAcc adv $\uparrow$	CLIP $\uparrow$	PSNR $\uparrow$	SSIM $\uparrow$
SD3.5-medium	cosine	1.0000	0.9921	0.9933	0.9629	0.8699	40.0530	0.9926
	flat	1.0000	0.9863	0.9913	0.9522	0.8700	39.7911	0.9928
	linear	1.0000	0.9914	0.9926	0.9598	0.8700	40.0424	0.9928
FLUX.1-dev	cosine	1.0000	0.9972	0.9979	0.9723	0.8677	41.0518	0.9947
	flat	1.0000	0.9959	0.9955	0.9635	0.8676	40.8491	0.9946
	linear	1.0000	0.9965	0.9971	0.9681	0.8677	41.0571	0.9948

Appendix

Table 14: Ablation of late-window injection schedules across backbones. Flat, linear, and cosine schedules are compared under the same injection window and adaptive controller.

Panel of Figure 7 — Figure 7: Additional CLaW design analysis. (a) PSNR–BitAcc Pareto curve under different watermark residual scales, with labels indicating tested scales. (b) t-SNE visualization of CLIP image features for clean generated images and watermarked generated images.

Method	Attribution Level	Generator Modification	Watermarking Mechanism
ProMark [ 57 ]	Concept-level	Diffusion model training	Concept-specific watermarks learned from watermarked training images
Stable Signature [ 17 ]	Model-level	VAE decoder fine-tuning	Fixed binary payload embedding through a fine-tuned VAE decoder
AquaLoRA [ 43 ]	Model-level	U-Net LoRA fine-tuning	Binary payload embedding through a diagonal scaling matrix in the watermark LoRA module
RivaGAN [ 27 ]	User-level	No diffusion/VAE update	Post-generation binary payload embedding with an attention-based encoder
SERUM [ 41 ]	User-level	No diffusion/VAE update	Initial-noise watermark embedding with separately trained pattern-specific detectors
CLaW (ours)	User-level	No diffusion/VAE update	Binary payload embedding via decoder-guided adaptive injection within a late denoising window

Appendix

Table 15: Conceptual comparison of CLaW and related watermarking methods.

Diffusion Model Watermarking

Diffusion model watermarking embeds detectable signals in generated content or models to support provenance, ownership verification, and attribution.

See all 48 papers

TraceMark-LDM: Authenticatable Watermarking for Latent Diffusion Models via Binary-Guided Rearrangement
Mar 30, 2025Wenhao Luo, Zhangyi Shen, Ye Yao +3Diffusion Model Watermarking Latent Diffusion Models
Hangzhou Dianzi University, Hangzhou, ZJ 310018, China · Nanchang University, Nanchang, JX 330031, China · School of Computer Science and Technology, Harbin Institute of Technology, Harbin 150001, China +1
Gaussian Shannon: High-Precision Diffusion Model Watermarking Based on Communication
Mar 27, 2026Yi Zhang, Hongbo Huang, Liang-Jie ZhangError-Correcting Codes Diffusion Model Watermarking
Center for AI Services Computing, College of Computer Science and Software Engineering, Shenzhen University
LVMark: Robust Watermark for Latent Video Diffusion Models
Dec 12, 2024Youngdong Jang, MinHyuk Jang, JaeHyeok Lee +4Diffusion Model Watermarking Video Diffusion Models
Department of Artificial Intelligence, Korea University, Seoul 02841, Republic of Korea · Google DeepMind, Mountain View, CA 94043, USA

Mar 30, 2025J/K move · Enter open · S save

TraceMark-LDM: Authenticatable Watermarking for Latent Diffusion Models via Binary-Guided Rearrangement

Wenhao Luo, Zhangyi Shen, Ye Yao, Feng Ding+2

Hangzhou Dianzi University, Hangzhou, ZJ 310018, China · Nanchang University, Nanchang, JX 330031, China · School of Computer Science and Technology, Harbin Institute of Technology, Harbin 150001, China+1

Diffusion Model Watermarking Latent Diffusion Models Robust Watermarking T2I Diffusion Models Diffusion Models

Open paper AskPDF arXiv

Image generation algorithms are increasingly integral to diverse aspects of human society, driven by their practical applications. However, insufficient oversight in artificial Intelligence generated content (AIGC) can facilitate the spread of malicious content and increase the risk of copyright infringement. Among the diverse range of image generation models, the Latent Diffusion Model (LDM) is currently the most widely used, dominating the majority of the Text-to-Image model market. Currently, most attribution methods for LDMs rely on directly embedding watermarks into the generated images or their intermediate noise, a practice that compromises both the quality and the robustness of the generated content. To address these limitations, we introduce TraceMark-LDM, an novel algorithm that integrates watermarking to attribute generated images while guaranteeing non-destructive performance. Unlike current methods, TraceMark-LDM leverages watermarks as guidance to rearrange random variables sampled from a Gaussian distribution. To mitigate potential deviations caused by inversion errors, the small absolute elements are grouped and rearranged. Additionally, we fine-tune the LDM encoder to enhance the robustness of the watermark. Experimental results show that images synthesized using TraceMark-LDM exhibit superior quality and attribution accuracy compared to state-of-the-art (SOTA) techniques. Notably, TraceMark-LDM demonstrates exceptional robustness against various common attack methods, consistently outperforming SOTA methods.

Abstract

Diffusion Model Watermarking

Explore similar work

TraceMark-LDM: Authenticatable Watermarking for Latent Diffusion Models via Binary-Guided Rearrangement

Gaussian Shannon: High-Precision Diffusion Model Watermarking Based on Communication

LVMark: Robust Watermark for Latent Video Diffusion Models