树轮水印：扩散图像的隐形和稳健指纹

摘要

将生成模型的输出添加水印是一项关键技术，用于追踪版权并防止AI生成内容可能带来的潜在危害。本文介绍了一种名为“树环水印”的新技术，可稳健地为扩散模型的输出生成指纹。与现有方法在采样后对图像进行事后修改不同，“树环水印”微妙地影响整个采样过程，从而生成一个对人类不可见的模型指纹。水印将一个模式嵌入到用于采样的初始噪声向量中。这些模式在傅立叶空间中结构化，使其对卷积、裁剪、膨胀、翻转和旋转保持不变。在图像生成后，通过反转扩散过程来检测水印信号，以检索噪声向量，然后检查其中是否嵌入了信号。我们证明这种技术可以轻松应用于任意扩散模型，包括文本条件的稳定扩散，作为一个插件，对FID损失微乎其微。我们的水印在图像空间中语义隐藏，比当前部署的水印替代方案更加稳健。代码可在github.com/YuxinWenRick/tree-ring-watermark找到。

English

Watermarking the outputs of generative models is a crucial technique for tracing copyright and preventing potential harm from AI-generated content. In this paper, we introduce a novel technique called Tree-Ring Watermarking that robustly fingerprints diffusion model outputs. Unlike existing methods that perform post-hoc modifications to images after sampling, Tree-Ring Watermarking subtly influences the entire sampling process, resulting in a model fingerprint that is invisible to humans. The watermark embeds a pattern into the initial noise vector used for sampling. These patterns are structured in Fourier space so that they are invariant to convolutions, crops, dilations, flips, and rotations. After image generation, the watermark signal is detected by inverting the diffusion process to retrieve the noise vector, which is then checked for the embedded signal. We demonstrate that this technique can be easily applied to arbitrary diffusion models, including text-conditioned Stable Diffusion, as a plug-in with negligible loss in FID. Our watermark is semantically hidden in the image space and is far more robust than watermarking alternatives that are currently deployed. Code is available at github.com/YuxinWenRick/tree-ring-watermark.

树轮水印：扩散图像的隐形和稳健指纹

Tree-Ring Watermarks: Fingerprints for Diffusion Images that are Invisible and Robust

摘要

Support