無需訓練的自回歸圖像生成浮水印技術

Training-Free Watermarking for Autoregressive Image Generation

May 20, 2025

作者: Yu Tong, Zihao Pan, Shuai Yang, Kaiyang Zhou

cs.AI

摘要

隱形圖像水印技術能夠有效保護圖像所有權，防止視覺生成模型的惡意濫用。然而，現有的生成式水印方法主要針對擴散模型設計，而自迴歸圖像生成模型的水印技術仍處於探索不足的狀態。我們提出了IndexMark，這是一種無需訓練的自迴歸圖像生成模型水印框架。IndexMark的靈感來自於代碼本的冗餘特性：用相似索引替換自迴歸生成的索引，所產生的視覺差異微乎其微。IndexMark的核心組件是一個簡單而有效的匹配後替換方法，該方法基於代碼本中的代碼相似性精心挑選水印標記，並通過代碼替換促進水印標記的使用，從而實現了在不影響圖像質量的前提下嵌入水印。水印驗證通過計算生成圖像中水印標記的比例來實現，並通過索引編碼器進一步提升驗證精度。此外，我們引入了一種輔助驗證方案，以增強對裁剪攻擊的魯棒性。實驗結果表明，IndexMark在圖像質量和驗證準確性方面達到了最先進的水平，並且對多種干擾（包括裁剪、噪聲、高斯模糊、隨機擦除、色彩抖動和JPEG壓縮）展現出良好的魯棒性。

English

Invisible image watermarking can protect image ownership and prevent malicious misuse of visual generative models. However, existing generative watermarking methods are mainly designed for diffusion models while watermarking for autoregressive image generation models remains largely underexplored. We propose IndexMark, a training-free watermarking framework for autoregressive image generation models. IndexMark is inspired by the redundancy property of the codebook: replacing autoregressively generated indices with similar indices produces negligible visual differences. The core component in IndexMark is a simple yet effective match-then-replace method, which carefully selects watermark tokens from the codebook based on token similarity, and promotes the use of watermark tokens through token replacement, thereby embedding the watermark without affecting the image quality. Watermark verification is achieved by calculating the proportion of watermark tokens in generated images, with precision further improved by an Index Encoder. Furthermore, we introduce an auxiliary validation scheme to enhance robustness against cropping attacks. Experiments demonstrate that IndexMark achieves state-of-the-art performance in terms of image quality and verification accuracy, and exhibits robustness against various perturbations, including cropping, noises, Gaussian blur, random erasing, color jittering, and JPEG compression.