Watermarking method for diffusion model output

doi:10.11772/j.issn.1001-9081.2025010006

Journal of Computer Applications ›› 2026, Vol. 46 ›› Issue (1): 161-168.DOI: 10.11772/j.issn.1001-9081.2025010006

• Cyber security • Previous Articles Next Articles

Watermarking method for diffusion model output

Yuan JIA¹, Deyu YUAN¹^,²(), Yuquan PAN¹, Anran WANG¹

^1.School of Information and Cyber Security，People's Security University of China，Beijing 100038，China
^2.Key Laboratory of Security Prevention Technology and Risk Assessment，Ministry of Public Security （People's Public Security University of China），Beijing 102623，China

Received:2025-01-06 Revised:2025-04-07 Accepted:2025-04-08 Online:2026-01-10 Published:2026-01-10
Contact: Deyu YUAN
About author:JIA Yuan， born in 2001， M. S. candidate. His research interests include model watermarking， network security.
PAN Yuquan， born in 2001， M. S. candidate. His research interests include social network analysis.
WANG Anran， born in 2001， M. S. candidate. His research interests include network security.
Supported by:
Key Project of Chinese Ministry of Public Security's Technical Research Plan(2024JSZ01)

面向扩散模型输出的水印方法

贾源¹, 袁得嵛¹^,²(), 潘语泉¹, 王安然¹

^1.中国人民公安大学信息网络安全学院，北京 100038
^2.安全防范技术与风险评估公安部重点实验室（中国人民公安大学），北京 102623

通讯作者: 袁得嵛
作者简介:贾源（2001—），男，山东潍坊人，硕士研究生，主要研究方向：模型水印、网络安全
潘语泉（2001—），男，山东济南人，硕士研究生，主要研究方向：社交网络分析
王安然（2001—），男，山东临沂人，硕士研究生，主要研究方向：网络安全。
基金资助:
公安部技术研究计划重点项目(2024JSZ01)

Abstract

Abstract:

To address the issue of image authenticity verification in deepfake detection and model copyright protection， a high-quality and highly robust watermarking method for diffusion model output， DeWM （Decoder-driven WaterMarking for diffusion model）， was proposed. Firstly， a decoder-driven watermark embedding network was proposed to realize direct sharing of encoder and decoder features， so as to produce watermarks with high robustness and invisibility. Then， a fine-tuning strategy was designed to fine-tune the pre-trained diffusion model's decoder， and embed a specific watermark into all generated images， thereby achieving simple and effective watermark embedding without changing the model architecture and diffusion process. Experimental results show that compared with Stable Signature method on the MS-COCO dataset， when the watermark bit-length is increased to 64 bits， the proposed method has the Peak Signal-to-Noise Ratio （PSNR） and Structure SIMilarity （SSIM） of the generated watermarked images improved by 14.87% and 9.41%， respectively. Moreover， the average bit accuracy of watermark extraction under cropping， brightness adjustment and image reconstruction is enhanced by than 3%， which demonstrates significantly improved robustness.

Key words: active detection, image watermarking, diffusion model, Artificial Intelligence Generative Content (AIGC)

摘要：

为了解决模型版权保护和深度伪造检测中的图像真实性验证问题，提出高质量和高鲁棒性的面向扩散模型输出的水印方法DeWM （Decoder-driven WaterMarking for diffusion model）。首先，提出一种由解码器驱动的水印嵌入网络来实现编码器和解码器特征的直接共享，从而生成有高鲁棒性和不可见性的水印；其次，设计一种微调策略来对预训练扩散模型的解码器进行微调，并使生成的所有图像隐含特定水印，从而在不改变模型架构和扩散过程的前提下，实现简单且有效的水印嵌入。实验结果表明，在MS-COCO数据集上与潜在扩散模型水印方法Stable Signature相比，在水印位数提高至64位时，所提方法生成的水印图像的峰值信噪比（PSNR）与结构相似度（SSIM）分别增加了14.87%和9.41%，且所提方法针对裁剪、亮度调整和图像重建攻击的水印提取的位精度平均提升了3%，鲁棒性显著提高。

关键词: 主动检测, 图像水印, 扩散模型, 人工智能生成内容

CLC Number:

TP309.7

Yuan JIA, Deyu YUAN, Yuquan PAN, Anran WANG. Watermarking method for diffusion model output[J]. Journal of Computer Applications, 2026, 46(1): 161-168.

贾源, 袁得嵛, 潘语泉, 王安然. 面向扩散模型输出的水印方法[J]. 《计算机应用》唯一官方网站, 2026, 46(1): 161-168.

Figures/Tables 10

Fig. 1 Framework of DeWM watermarking method for diffusion model output

Fig. 2 Structure of decoder

Fig. 3 Structure of encoder

Fig. 4 Comparison of original and watermarked images

Tab. 1 Comparison of DeWM and baseline methods on image generation quality and watermark robustness

主动检测方法	方法（水印位数）	图像质量			位精度（↑）
主动检测方法	方法（水印位数）	PSNR/dB（↑）	SSIM（↑）	FID（↓）	无变换	裁剪	JPEG压缩	亮度调整	图像重建	组合变换
水印后置嵌入方法	Dct-Dwt （48）^［14］	39.3	0.97	18.82	0.81	0.51	0.50	0.52	0.51	0.51
	SSL （48）^［17］	31.5	0.86	19.68	1.00	0.85	0.96	0.93	0.63	0.86
	FNNS （48）^［16］	32.2	0.92	19.07	0.94	0.93	0.87	0.93	0.68	0.89
	HiDDeN （48）^［15］	31.9	0.90	19.51	0.98	0.97	0.85	0.98	0.55	0.91
联合生成方法	Stable Signature （48）^［18］	28.9	0.85	19.40	0.99	0.95	0.93	0.96	0.79	0.93
	LaWa （48）^［20］	32.7	0.86	19.24	1.00	0.95	0.96	0.98	0.74	0.94
	AquaLoRA （48）^［22］	29.6	0.92	19.77	0.95	0.91	0.94	0.93	0.86	0.90
	DeWM （64）	33.2	0.93	18.93	1.00	0.97	0.93	0.98	0.83	0.94

Fig. 5 Image transformation demonstration

Fig. 6 Robustness of watermark under different image transformations

Fig. 7 Impact of watermark bit length on image quality and robustness

Tab. 2 Relationship between image quality and robustness under different weights

$λ i$	PSNR/dB	位精度（组合变换）
1.0	34.6	0.66
0.8	33.5	0.78
0.6	33.2	0.94
0.4	31.8	0.96
0.2	30.5	0.97

Tab. 2 Relationship between image quality and robustness under different weights

$λ i$	PSNR/dB	位精度（组合变换）
1.0	34.6	0.66
0.8	33.5	0.78
0.6	33.2	0.94
0.4	31.8	0.96
0.2	30.5	0.97

Tab. 3 Results of ablation experiments

方法	PSNR/dB	SSIM	位精度	位精度（组合变换）
DeWM	33.2	0.93	1.00	0.94
w/o de	30.3	0.88	0.99	0.92
w/o no	33.6	0.94	0.98	0.59

References 30

[1]	BETKER J， GOH G， JING L， et al. Improving image generation with better captions ［EB/OL］. ［2025-03-26］. .
[2]	SAHARIA C， CHAN W， SAXENA S， et al. Photorealistic text-to-image diffusion models with deep language understanding ［C］// Proceedings of the 36th International Conference on Neural Information Processing Systems. Red Hook： Curran Associates Inc.， 2022： 36479-36494.
[3]	ROMBACH R， BLATTMANN A， LORENZ D， et al. High-resolution image synthesis with latent diffusion models ［C］// Proceedings of the 2022 IEEE/CVF Conference on Computer Vision and Pattern Recognition. Piscataway： IEEE， 2022： 10674-10685.
[4]	BRUNDAGE M， AVIN S， CLARK J， et al. The malicious use of artificial intelligence： forecasting， prevention， and mitigation ［EB/OL］. ［2025-03-26］. .
[5]	NIRKIN Y， WOLF L， KELLER Y， et al. Deepfake detection based on discrepancies between faces and their context ［J］. IEEE Transactions on Pattern Analysis and Machine Intelligence， 2022， 44（10）： 6111-6121.
[6]	GUARNERA L， GIUDICE O， BATTIATO S. DeepFake detection by analyzing convolutional traces ［C］// Proceedings of the 2020 IEEE/CVF Conference on Computer Vision and Pattern Recognition Workshops. Piscataway： IEEE， 2020： 2841-2850.
[7]	MARRA F， GRAGNANIELLO D， VERDOLIVA L， et al. Do GANs leave artificial fingerprints？［C］// Proceedings of the 2019 IEEE Conference on Multimedia Information Processing and Retrieval. Piscataway： IEEE， 2019： 506-511.
[8]	YU N， DAVIS L S， FRITZ M. Attributing fake images to GANs： learning and analyzing GAN fingerprints ［C］// Proceedings of the 2019 IEEE/CVF International Conference on Computer Vision. Piscataway： IEEE， 2019： 7555-7565.
[9]	FRANK J， EISENHOFER T， SCHÖNHERR L， et al. Leveraging frequency analysis for deep fake image recognition ［C］// Proceedings of the 37th International Conference on Machine Learning. New York： JMLR.org， 2020： 3247-3258.
[10]	ZHANG X， KARAMAN S， CHANG S F. Detecting and simulating artifacts in GAN fake images ［C］// Proceedings of the 2019 IEEE International Workshop on Information Forensics and Security. Piscataway： IEEE， 2019： 1-6.
[11]	SEOW J W， LIM M K， PHAN R C W， et al. A comprehensive overview of Deepfake： generation， detection， datasets， and opportunities ［J］. Neurocomputing， 2022， 513： 351-371.
[12]	ZHAO Y， PANG T， DU C， et al. A recipe for watermarking diffusion models ［EB/OL］. ［2025-03-26］. .
[13]	YU N， SKRIPNIUK V， ABDELNABI S， et al. Artificial fingerprinting for generative models： rooting deepfake attribution in training data ［C］// Proceedings of the 2021 IEEE/CVF International Conference on Computer Vision. Piscataway： IEEE， 2021： 14428-14437.
[14]	COX I J， MILLER M W， BLOOM J A， et al. Digital watermarking and steganography ［M］. 2nd ed. San Francisco： Morgan Kaufmann， 2008.
[15]	ZHU J， KAPLAN R， JOHNSON J， et al. HiDDeN： hiding data with deep networks ［C］// Proceedings of the 2018 European Conference on Computer Vision， LNCS 11219. Cham： Springer， 2018： 682-697.
[16]	KISHORE V， CHEN X， WANG Y， et al. Fixed neural network steganography： train the images， not the network ［EB/OL］. ［2025-03-26］. .
[17]	FERNANDEZ P， SABLAYROLLES A， FURON T， et al. Watermarking images in self-supervised latent spaces ［C］// Proceedings of the 2022 IEEE International Conference on Acoustics， Speech and Signal Processing. Piscataway： IEEE， 2022： 3054-3058.
[18]	FERNANDEZ P， COUAIRON G， JÉGOU H， et al. The Stable Signature： rooting watermarks in latent diffusion models ［C］// Proceedings of the 2023 IEEE/CVF International Conference on Computer Vision. Piscataway： IEEE， 2023： 22409-22420.
[19]	WEN Y， KIRCHENBAUER J， GEIPING J， et al. Tree-ring watermarks： fingerprints for diffusion images that are invisible and robust ［C］// Proceedings of the 36th International Conference on Neural Information Processing Systems. Red Hook： Curran Associates Inc.， 2023： 58047-58063.
[20]	REZAEI A， AKBARI M， ALVAR S R， et al. LaWa： using latent space for in-generation image watermarking ［C］// Proceedings of the 2024 European Conference on Computer Vision， LNCS 15147. Cham： Springer， 2025： 118-136.
[21]	XIONG C， QIN C， FENG G， et al. Flexible and secure watermarking for latent diffusion model ［C］// Proceedings of the 31st ACM International Conference on Multimedia. New York： ACM， 2023： 1668-1676.
[22]	FENG W， ZHOU W， HE J， et al. AquaLoRA： toward white-box protection for customized stable diffusion models via watermark LoRA ［C］// Proceedings of the 41st International Conference on Machine Learning. New York： JMLR.org， 2024： 13423-13444.
[23]	HU J， SHEN L， SUN G. Squeeze-and-excitation networks ［C］// Proceedings of the 2018 IEEE/CVF Conference on Computer Vision and Pattern Recognition. Piscataway： IEEE， 2018： 7132-7141.
[24]	CZOLBE S， KRAUSE O， COX I， et al. A loss function for generative neural networks based on Watson's perceptual model ［C］// Proceedings of the 34th International Conference on Neural Information Processing Systems. Red Hook： Curran Associates Inc.， 2020： 2051-2061.
[25]	LIN T Y， MAIRE M， BELONGIE S， et al. Microsoft COCO： common objects in context ［C］// Proceedings of the 2014 European Conference on Computer Vision， LNCS 8693. Cham： Springer， 2014： 740-755.
[26]	LOSHCHILOV I， HUTTER F. Decoupled weight decay regularization ［EB/OL］. ［2025-03-26］. .
[27]	WANG Z， BOVIK A C， SHEIKH H R， et al. Image quality assessment： from error visibility to structural similarity ［J］. IEEE Transactions on Image Processing， 2004， 13（4）： 600-612.
[28]	HEUSEL M， RAMSAUER H， UNTERTHINER T， et al. GANs trained by a two time-scale update rule converge to a local Nash equilibrium ［C］// Proceedings of the 31st International Conference on Neural Information Processing Systems. Red Hook： Curran Associates Inc.， 2017： 6629-6640.
[29]	LI X. DiffWA： diffusion models for watermark attack ［C］// Proceedings of the 2023 International Conference on Integrated Intelligence and Communication Systems. Piscataway： IEEE， 2023： 1-8.
[30]	MARCEL S， RODRIGUEZ Y. Torchvision the machine-vision package of Torch ［C］// Proceedings of the 18th ACM International Conference on Multimedia. New York： ACM， 2010： 1485-1488.

Watermarking method for diffusion model output

面向扩散模型输出的水印方法

RichHTML

PDF

Knowledge

Abstract

Cite this article

share this article

Figures/Tables 10

References 30

Related Articles 12

Recommended Articles

Metrics

[1]	Xingjie FENG, Xingpeng BIAN, Xiaorong FENG, Xinglong WANG. Incremental missing value imputation algorithm for time series based on diffusion model [J]. Journal of Computer Applications, 2025, 45(8): 2582-2591.
[2]	Hailin XIAO, Xiangting KONG, Yu WANG, Di ZHOU, Xiaoming DAI. Image watermarking algorithm based on improved singular value decomposition and Haar wavelet transform [J]. Journal of Computer Applications, 2025, 45(3): 896-903.
[3]	Qiang LI, Shaoxiong BAI, Yuan XIONG, Wei YUAN. Privacy preserving localization of surveillance images based on large vision models [J]. Journal of Computer Applications, 2025, 45(3): 832-839.
[4]	Tianqi ZHANG, Shuang TAN, Xiwen SHEN, Juan TANG. Image watermarking method combining attention mechanism and multi-scale feature [J]. Journal of Computer Applications, 2025, 45(2): 616-623.
[5]	Chenyang LI, Long ZHANG, Qiusheng ZHENG, Shaohua QIAN. Multivariate controllable text generation based on diffusion sequences [J]. Journal of Computer Applications, 2024, 44(8): 2414-2420.
[6]	Jinsong XU, Ming ZHU, Zhiqiang LI, Shijie GUO. Location control method for generated objects by diffusion model with exciting and pooling attention [J]. Journal of Computer Applications, 2024, 44(4): 1093-1098.
[7]	Yusheng LIU, Xuezhong XIAO. High-fidelity image editing based on fine-tuning of diffusion model [J]. Journal of Computer Applications, 2024, 44(11): 3574-3580.
[8]	YANG Shuxin, LIANG Wen, ZHU Kaili. Reverse influence maximization algorithm in social networks [J]. Journal of Computer Applications, 2020, 40(7): 1944-1949.
[9]	ZHANG Yan-fang XIONG Hai-ling. Product diffusion study of fast moving consumer goods based on hybrid model of Bass and cellular automata models [J]. Journal of Computer Applications, 2011, 31(12): 3305-3308.
[10]	. Fake verification analysis of SVD-based image watermarking [J]. Journal of Computer Applications, 2010, 30(2): 517-520.
[11]	. Performance estimation scheme for histogram shifting based on reversible watermarking [J]. Journal of Computer Applications, 2010, 30(12): 3246-3251.
[12]	Jie ZHAO . Zero digital image watermarking method against rotation attack based on Contourlet transform [J]. Journal of Computer Applications, 2009, 29(3): 801-804.