ROBIN: Robust and Invisible Watermarks for Diffusion Models with Adversarial Optimization
Authors: Huayang Huang, Yu Wu, Qian Wang
NeurIPS 2024 | Conference PDF | Archive PDF | Plain Text | LLM Run Details
| Reproducibility Variable | Result | LLM Response |
|---|---|---|
| Research Type | Experimental | Experiments on various diffusion models demonstrate the watermark remains verifiable even under significant image tampering and shows superior invisibility compared to other state-of-the-art robust watermarking methods. |
| Researcher Affiliation | Academia | Huayang Huang1, Yu Wu1, , Qian Wang2 1School of Computer Science, Wuhan University 2School of Cyber Science and Engineering, Wuhan University {hyhuang,wuyucs,qianwang}@whu.edu.cn |
| Pseudocode | Yes | Algorithm 1 Adversarial Optimization Algorithm Input: Dataset X, P; max epoch N; hyper-parameters α, β, λ; watermark mask M Output: Optimized watermark pair wi, wp; |
| Open Source Code | Yes | The codes will be available at https://github.com/Hannah1102/ROBIN. |
| Open Datasets | Yes | For the latent diffusion model, we utilize the widely available Stable Diffusion-v2 [31] and the stable-diffusion-prompts dataset from Gustavosta [1]. We also test on a guided diffusion model [2] trained on the Image Net [12] |
| Dataset Splits | No | The paper states, "We optimize the watermark and the hiding prompt using 50 generated images," but does not provide explicit training, validation, and test dataset splits with percentages or sample counts for the main datasets used. |
| Hardware Specification | Yes | All experiments are conducted on an NVIDIA Ge Force RTX 3090 GPU. |
| Software Dependencies | No | The paper does not explicitly list specific software dependencies with version numbers (e.g., Python, PyTorch, or specific library versions). |
| Experiment Setup | Yes | We utilize 50 steps of deterministic sampling for both models. Stable Diffusion employs the second-order multistep DPM-Solver algorithm [23] with a default guidance scale of 7.5. Image Net diffusion model leverages the DDIM sampling algorithm [35]. We optimize the watermark and the hiding prompt using 50 generated images. The learning rates for the image watermark and prompt guidance are 0.8 and 5e-04, respectively, with a total of 1,000 optimization rounds. The default image watermark covers 70% of the image frequency domain. |