ROBIN: Robust and Invisible Watermarks for Diffusion Models with Adversarial Optimization
This work addresses the problem of ownership protection and misuse mitigation for generative content creators, offering an incremental improvement over existing watermarking techniques.
The paper tackles the challenge of balancing robustness and concealment in watermarking for diffusion models by introducing an adversarial optimization method to actively hide watermarks, resulting in watermarks that remain verifiable under significant tampering and show superior invisibility compared to state-of-the-art methods.
Watermarking generative content serves as a vital tool for authentication, ownership protection, and mitigation of potential misuse. Existing watermarking methods face the challenge of balancing robustness and concealment. They empirically inject a watermark that is both invisible and robust and passively achieve concealment by limiting the strength of the watermark, thus reducing the robustness. In this paper, we propose to explicitly introduce a watermark hiding process to actively achieve concealment, thus allowing the embedding of stronger watermarks. To be specific, we implant a robust watermark in an intermediate diffusion state and then guide the model to hide the watermark in the final generated image. We employ an adversarial optimization algorithm to produce the optimal hiding prompt guiding signal for each watermark. The prompt embedding is optimized to minimize artifacts in the generated image, while the watermark is optimized to achieve maximum strength. The watermark can be verified by reversing the generation process. Experiments on various diffusion models demonstrate the watermark remains verifiable even under significant image tampering and shows superior invisibility compared to other state-of-the-art robust watermarking methods. Code is available at https://github.com/Hannah1102/ROBIN.