Technical Summary: Secure Seed-Based Multi-bit Watermarking for Diffusion Models from First Principles

Problem Statement

The rapid emergence of generative image models has spurred the development of specialized watermarking techniques, particularly "in-generation" methods like seed-based embedding. However, the authors argue that current evaluations in this field are fundamentally flawed because they rely heavily on empirical testing tied to specific model architectures (diffusion models, VAEs, schedulers) and inversion pipelines. This empirical dependence prevents clear, generalizable conclusions about the performance of watermarking schemes, especially regarding security.

Furthermore, existing definitions of "quality" and "robustness" are tied to the generative model, making it impossible to rank watermarking systems independently of the model used. Similarly, the distinction between cryptographic security and watermarking security is often blurred; schemes like Gaussian-Shading and PRC claim cryptographic security but fail to prevent "spoofing attacks" where an attacker can retrieve the embedded message without the secret key because the carrier (the seed) is not hidden.

Methodology

1. A Decoupled Evaluation Framework

The core methodological contribution is the decoupling of the model-dependent part (the inverse diffusion process) from the decision mechanism of the watermarking system. This allows for a rigorous theoretical analysis independent of the generative model. The authors propose a framework based on three key quantities:

• Capacity (Robustness): Instead of empirical robustness tests, the authors model the decision mechanism as a Binary Symmetric Channel (BSC) with a flip probability $p$. They define the robustness of the projection function $f$ by the variance $\sigma^2$ of the noise it introduces in the watermark space. The system's capacity is derived using Shannon's capacity formula for a BSC, $C_\sigma = 1 - h_2(p_k(\sigma))$, where $p_k(\sigma)$ is the channel characteristic mapping noise variance to bit-error rate.
• Fidelity (Quality): Moving away from empirical image metrics like FID or CLIP scores, which the authors argue are insufficient and model-dependent, they define fidelity as the Kullback-Leibler (KL) divergence between the standard Gaussian seed distribution (the cover distribution) and the watermarked seed distribution. A system is $\zeta$-faithful if $D_{KL}(\mathcal{N}(0, I_L) || Q(k,c)) \le \zeta$.
• Security: The authors distinguish between cryptographic security and watermarking security. They define a security ratio $\eta$, measuring the number of watermarked samples required for an attacker to estimate the secret key better than random guessing. They highlight that schemes failing to hide the codeword carrier (like Gaussian-Shading) have a security ratio of $\eta = 1/L$, making them vulnerable to Principal Component Analysis (PCA) attacks.

2. The SSB (Secure Seed-Based) Construction

Based on this framework, the authors propose SSB, a novel multi-bit watermarking method inspired by Voronoi modulation and nested lattices.

• Embedding: The method uses a secret key $U$ (a unitary matrix) to rotate the latent space. It employs two nested one-dimensional lattices: a coarse lattice $\Lambda_\Delta$ and a fine lattice $\Lambda_\delta$. The embedding algorithm samples a vector $z_u$ such that the coarse lattice function $\Lambda_\Delta(z_u)$ outputs the desired binary codeword $c$.
• Projection: The vector $z_u$ is projected back into the latent space using the secret key $U$ and a random noise component orthogonal to $U$, ensuring the resulting seed is valid for the diffusion process.
• Decoding: The detector projects the watermarked image back to the latent space, applies the rotation $U^\top$, and applies the coarse lattice function $\Lambda_\Delta$ to recover the codeword.

Key Contributions

1. Theoretical Framework: The paper introduces a formal evaluation framework that separates the watermarking decision mechanism from the generative model. This enables precise comparisons of watermarking systems based on a characteristic surface representing the trade-off between security, capacity, and fidelity, independent of the diffusion model used.
2. SSB Algorithm: The authors design SSB, a generalization of previous seed-based methods. By tuning the lattice parameters $(\Delta, \delta)$, SSB can operate across a wide range of the security-fidelity-capacity trade-off space. Notably, it can achieve perfect security (where the eigenvalues of the watermarked covariance matrix remain indistinguishable from the cover distribution) even while maintaining non-zero capacity.
3. Empirical Validation: The paper provides empirical validation of the theoretical assumptions. It demonstrates that the noise introduced by inverse diffusion can be accurately modeled as additive white Gaussian noise in the latent space and that the theoretical predictions for capacity and security align with empirical results for SSB, Gaussian-Shading, and PRC.

Results

• Theoretical vs. Empirical Alignment: Experiments using Sana, Z-Image, and Qwen diffusion models confirm that the theoretical model (BSC channel with Gaussian noise) accurately predicts the bit-error rates and capacity of the watermarking systems.
• Performance Comparison:
  • Gaussian-Shading and PRC: These existing methods are shown to have low security ratios ($\eta = 1/L$) because they do not hide the carrier, making them vulnerable to PCA attacks. They also exhibit suboptimal capacity-fidelity trade-offs.
  • SSB: The proposed method outperforms existing approaches by allowing the user to select a regime. For instance, a specific configuration $(\Delta=1.6, \delta=0)$ achieves perfect security ($\eta = +\infty$) while maintaining a viable capacity, a regime not achievable by previous methods.
• Robustness: The study quantifies the equivalent Gaussian noise variance ($\sigma^2$) introduced by common image operations (JPEG compression, cropping, brightness/contrast adjustments) across different diffusion models, providing a standardized metric for robustness.

Significance and Claims

The paper claims to shift the paradigm of watermarking research from ad-hoc empirical optimizations to design with theoretical guarantees. By decoupling the watermarking logic from the generative model, the authors argue that:

• It becomes possible to make definitive statements about the superiority of one watermarking system over another (e.g., "System A is more robust than System B") without needing to re-evaluate them against every new diffusion model.
• The field can move beyond conflating cryptographic security with watermarking security, addressing the specific threat of spoofing attacks where the carrier is exposed.
• The SSB method provides a flexible, theoretically grounded solution that can be tuned to meet specific requirements for security, capacity, and fidelity, offering a path toward modern watermarking systems that do not require costly, model-specific empirical evaluations for every new iteration.

The authors remain modest, noting that their analysis assumes a BSC model and that future work could explore the gap with AWGN models, improve the projection function (inverse diffusion), and extend the framework to 0-bit seed-based watermarking.