Attack-Resilient Image Watermarking Using Stable Diffusion
Authors: Lijun Zhang, Xiao Liu, Antoni Martin, Cindy Bearfield, Yuriy Brun, Hui Guan
NeurIPS 2024 | Conference PDF | Archive PDF | Plain Text | LLM Run Details
| Reproducibility Variable | Result | LLM Response |
|---|---|---|
| Research Type | Experimental | We evaluate Zo Diac on three benchmarks, MS-COCO, Diffusion DB, and Wiki Art, and find that Zo Diac is robust against state-of-the-art watermark attacks, with a watermark detection rate above 98% and a false positive rate below 6.4%, outperforming state-of-the-art watermarking methods. |
| Researcher Affiliation | Collaboration | Lijun Zhang University of Massachusetts Amherst, MA 01003-9264 lijunzhang@cs.umass.edu Xiao Liu University of Massachusetts Amherst, MA 01003-9264 xiaoliu1990@umass.edu Antoni Viros Martin IBM Watson Yorktown Heights, NY 10598 aviros@ibm.com Cindy Xiong Bearfield Georgia Institute of Technology Atlanta, GA 30332 cxiong@gatech.edu Yuriy Brun University of Massachusetts Amherst, MA 01003-9264 brun@cs.umass.edu Hui Guan University of Massachusetts Amherst, MA 01003-9264 huiguan@cs.umass.edu |
| Pseudocode | Yes | Algorithm 1 Zo Diac-Watermarking Require: original image x0, watermark W Require: pre-trained diffusion model G, and its inversion G Require: diffusion steps T, latent update steps N Require: SSIM threshold s Ensure: watermarked image x0 1: ZT G (x0) 2: for i = 1 to N do 3: ˆx0 G(ZT W) 4: Take gradient descent on ZT L(x0, ˆx0) {Eq. (6)} 5: end for 6: x0 = ˆx0 + γ(x0 ˆx0) {Eq. (7)} 7: Search γ [0, 1] s.t. S( x0, x0) s {Eq. (8)} 8: return x0 |
| Open Source Code | Yes | Zo Diac is open-sourced and available at https://github.com/zhanglijun95/Zo Diac. |
| Open Datasets | Yes | Our evaluation uses images from three domains, photographs, AI-generated images, and visual artwork. For each domain, we randomly sample 500 images from well-established benchmarks, including MS-COCO [23], Diffusion DB, and Wiki Art. |
| Dataset Splits | No | The paper uses pre-trained models and evaluates its method on sampled images from established benchmarks, but it does not specify explicit training, validation, and test splits for its own experimental setup or model training. |
| Hardware Specification | Yes | All the experiments are conducted with 1 NVIDIA RTX8000. |
| Software Dependencies | No | The paper mentions using a "pre-trained stable diffusion model stable-diffusion-2-1-base" and the "Adam optimizer [20]", but it does not provide specific version numbers for software libraries, programming languages, or other dependencies required for reproduction (e.g., Python version, PyTorch version). |
| Experiment Setup | Yes | Zo Diac Settings. We use the pre-trained stable diffusion model stable-diffusion-2-1-base [29] with 50 denoising steps. We optimize the trainable latent vector for a maximum of 100 iterations using the Adam optimizer [20]. It takes 45.4 255.9s to watermark one image (details see Appendix D). We calibrate the weights for the SSIM loss λs and the perceptual loss λp to 0.1 and 0.01, respectively, to balance the scales of the various loss components. We set the watermark injecting channel ic to be the last channel of the latent representation and the watermark radius d to 10. To balance the image quality and detectability of the watermark, we set the SSIM threshold s to 0.92 and the detection threshold p to 0.9, except where explicitly noted otherwise. |