Training-free diffusion watermarking decodes 94.6% under regeneration attacks
The claim
The proposed framework can embed 32-128 bits into arbitrary images and achieve 94.6% decode rate against CtrlRegen+ attacks while detecting forgeries with 98.8% accuracy
Published as: “Attack-Resilient Multi-Bit Image Watermarking Framework via Latent Coordinate Sign Clamping”
So what
Provides a deployable, post-hoc multi-bit watermarking and forgery-detection solution that can protect provenance of both natural and AI-generated images without retraining models.
The five-minute version
The paper shows a training-free watermarking framework that embeds 32- to 128-bit payloads into arbitrary images with high visual quality (SSIM ≈ 0.92) and achieves a 94.6% exact 32-bit decode rate against regeneration attacks (CtrlRegen+), plus 98.8% forgery-detection accuracy using a CLIP-based fuzzy commitment. Evidence comes from experiments on 1,500 images across three benchmarks, comparing against several prior methods.
What they found 2
- 94.6% exact 32-bit decode rate against CtrlRegen+ regeneration attack
“our method achieves a 94.6% exact 32-bit decode rate on 500 MS-COCO images.”
- 98.8% forgery detection using CLIP + Reed-Solomon fuzzy commitment
“CLIP + RS fuzzy commit 1210/1225 (98.8%)”
What undercuts it the paper’s own results
- Decode rate drops to 55.4% at an aggressive regeneration setting (t = 0.5)
- PSNR of 28.8 dB is lower than Xiong et al.'s 32.5 dB, indicating a visual quality trade-off
- Cheng20 decode rate of 91.7% is numerically lower than ZoDiac’s reported 98.6% (different metric)
Stated limits 2
- At an aggressive setting of t = 0.5, the decode rate drops to 55.4%.
- Our lower PSNR (28.8 dB vs. 32.5 dB for Xiong et al.) represents the inherent cost of post-hoc asset modification.
What’s new here 4
- Enables post-hoc, training-free multi-bit watermarking for existing images via diffusion latent space overcompleteness
- Integrates a three-layer decoder with Chase decoding that boosts robustness under strong attacks
- Adds a dual-layer forgery defense combining perceptual hashing and a CLIP-based Reed-Solomon fuzzy commitment
- Demonstrates scalability to 128-bit payloads while maintaining visual fidelity
Artifacts & methods 8
- latent coordinate sign clampingprimitive
- three-layer decoding pipeline (magnitude-weighted majority voting, BCH, Chase decoding)system
- BCH(63,36,t=5) outer codeprimitive
- Reed-Solomon fuzzy commitment over CLIP featuressystem
- Steganalysis-resistant noise camouflage layersystem
- MS-COCOdataset
- DiffusionDBdataset
- WikiArtdataset