Shallow Diffuse: Robust and Invisible Watermarking through Low-Dimensional Subspaces in Diffusion Models

Wenda Li*, Huijie Zhang*, Qing Qu

*Indicates Equal Contribution
Paper Code arXiv
MY ALT TEXT
Overview of Shallow Diffuse for T2I diffusion models. The server scenario (top left) illustrates watermark embedding during generation using CFG, while the user scenario (bottom left) demonstrates post-generation watermark embedding via DDIM inversion. In both scenarios, the watermark is applied within a low-dimensional subspace (top right), where most of the watermark resides in the null space of \( \boldsymbol{J}_{\boldsymbol{\theta}, t} \) due to its low dimensionality. The adversarial detection (bottom right) highlights the watermark's robustness, enabling the detector to retrieve the watermark even under adversarial attacks.

Abstract

The widespread use of AI-generated content from diffusion models has raised significant concerns regarding misinformation and copyright infringement. Watermarking is a crucial technique for identifying these AI-generated images and preventing their misuse. In this paper, we introduce Shallow Diffuse, a new watermarking technique that embeds robust and invisible watermarks into diffusion model outputs. Unlike existing approaches that integrate watermarking throughout the entire diffusion sampling process, Shallow Diffuse decouples these steps by leveraging the presence of a low-dimensional subspace in the image generation process. This method ensures that a substantial portion of the watermark lies in the null space of this subspace, effectively separating it from the image generation process. Our theoretical and empirical analyses show that this decoupling strategy greatly enhances the consistency of data generation and the detectability of the watermark. Extensive experiments further validate that Shallow Diffuse outperforms existing watermarking methods in terms of consistency.

Limitations of Previous Methods

Comparison between Tree-Ring Watermarks, RingID and Shallow Diffuse. (Top) On the left are the original images, and on the right are the corresponding watermarked images generated using three techniques: Tree-Ring, RingID, and Shallow Diffuse. For each technique, we sampled watermarks using two distinct random seeds and obtained the respective watermarked images. (Bottom) Trade-off between consistency (measured by PSNR, SSIM, LPIPS) and robustness (measured by TPR@1%FPR) for Tree-Ring Watermarks, RingID, and Shallow Diffuse.

Shallow Diffuse Inject Watermarks into
Low-dimensional Subspace

Analysis

Experiments

Table 1: Generation quality, consistency and watermark robustness under the server scenario. Bold indicates the best overall performance; Underline denotes the best among diffusion-based methods.
Table 2: Generation consistency and watermark robustness under the user scenario. Bold indicates the best overall performance; Underline denotes the best among diffusion-based methods.
Generation consistency in user scenarios. We compare the visualization quality of our method against DwtDct, DwtdctSvd, RivaGAN, Stegastamp, Stable Signature, Tree Ring, Gaussian Shading, and RingID across the DiffusionDB, and COCO datasets.

BibTeX

@article{li2024shallow,
        title={Shallow Diffuse: Robust and Invisible Watermarking through Low-Dimensional Subspaces in Diffusion Models},
        author={Li, Wenda and Zhang, Huijie and Qu, Qing},
        journal={arXiv preprint arXiv:2410.21088},
        year={2024}}