Codec-guided latent watermarking achieves high-fidelity, robust traceability in diffusion images
The claim
CLaW provides robust, high-fidelity watermarks for diffusion-generated images without model retraining
Published as: “CLaW: Codec-Guided Adaptive Latent Watermarking for Traceable Diffusion Image Generation”
So what
Enables scalable, low-cost user-level attribution for AI-generated images, facilitating provenance tracking in real-world deployment.
The five-minute version
CLaW attains the highest attacked F1 scores among evaluated methods (0.9922 on SD3.5-medium and 0.9968 on FLUX.1-dev) while also achieving the best PSNR, indicating superior robustness without sacrificing visual quality. It injects a codec-derived latent residual late in the denoising process and adapts watermark strength using decoder confidence, enabling inversion-free detection with a frozen diffusion backbone. Generation overhead is modest and detection is extremely fast (≈0.01 s), though the generation time is higher than some lightweight baselines. The paper provides extensive benchmarks on two diffusion models with 1,000-image test sets.
What they found 3
- Highest attacked F1 and best PSNR among baselines
“CLaW achieves the highest average F1 under image transformations among the methods evaluated on each backbone, reaching 0.9922 and 0.9968, respectively, while preserving the best PSNR among watermarked methods.”
- Consistently high robustness across transformations
“CLaW remains robust across all perturbations, with every F1 score above 0.96, showing that its robustness is consistent across transformations rather than limited to a few specific attacks.”
- Fast inversion-free detection
“CLaW adds only a small generation overhead and uses a single frozen-decoder forward pass for detection, making it substantially faster than baseline detectors.”
What undercuts it the paper’s own results
- CLaW (ours) 1.0000 0.9922 41.25 35.70 1.93 0.0115
Stated limits 1
- A current limitation is that CLaW applies watermark residuals uniformly across latent channels.
What’s new here 4
- Uses a pretrained watermark codec to map messages to latent residuals, allowing sampling-time injection without retraining the diffusion model.
- Injects the residual only in a late denoising window to preserve image semantics and retain watermark signal.
- Employs decoder-guided adaptive injection that calibrates watermark strength based on intermediate decoding confidence.
- Provides inversion-free detection via a single frozen-decoder forward pass.
Artifacts & methods 7
- CLaWsystem
- watermark codecprimitive
- latent residual injectionprimitive
- decoder-guided adaptive injectionsystem
- SD3.5-mediumdataset
- FLUX.1-devdataset
- MarkDiffusion frameworkevaluation