樹輪浮水印：擴散影像的隱形且堅固指紋

摘要

對生成模型的輸出進行浮水印處理是一項重要技術，用於追蹤版權並防止AI生成內容可能帶來的損害。本文介紹了一種名為樹環浮水印的新技術，可穩健地對擴散模型的輸出進行指紋識別。與現有方法在採樣後對圖像進行事後修改不同，樹環浮水印微妙地影響整個採樣過程，從而產生對人類不可見的模型指紋。浮水印將一個模式嵌入到用於採樣的初始噪聲向量中。這些模式在傅立葉空間中結構化，使其對卷積、裁剪、膨脹、翻轉和旋轉保持不變。在圖像生成後，通過反轉擴散過程來檢測浮水印信號，以檢索噪聲向量，然後檢查嵌入的信號。我們展示了這種技術可以輕鬆應用於任意擴散模型，包括文本條件穩定擴散，作為一個插件，幾乎不會導致FID損失。我們的浮水印在圖像空間中語義隱藏，比目前部署的浮水印替代方案更加穩健。代碼可在github.com/YuxinWenRick/tree-ring-watermark找到。

English

Watermarking the outputs of generative models is a crucial technique for tracing copyright and preventing potential harm from AI-generated content. In this paper, we introduce a novel technique called Tree-Ring Watermarking that robustly fingerprints diffusion model outputs. Unlike existing methods that perform post-hoc modifications to images after sampling, Tree-Ring Watermarking subtly influences the entire sampling process, resulting in a model fingerprint that is invisible to humans. The watermark embeds a pattern into the initial noise vector used for sampling. These patterns are structured in Fourier space so that they are invariant to convolutions, crops, dilations, flips, and rotations. After image generation, the watermark signal is detected by inverting the diffusion process to retrieve the noise vector, which is then checked for the embedded signal. We demonstrate that this technique can be easily applied to arbitrary diffusion models, including text-conditioned Stable Diffusion, as a plug-in with negligible loss in FID. Our watermark is semantically hidden in the image space and is far more robust than watermarking alternatives that are currently deployed. Code is available at github.com/YuxinWenRick/tree-ring-watermark.

樹輪浮水印：擴散影像的隱形且堅固指紋

Tree-Ring Watermarks: Fingerprints for Diffusion Images that are Invisible and Robust

摘要

Support