🤖 machine learning

Dynamics-Level Watermarking of Flow Matching Models with Random Codes

This paper introduces a dynamics-level watermarking technique for flow matching models that embeds messages into the velocity field via key-dependent perturbations during training, enabling reliable black-box detection without compromising generation quality.

Original authors: Shuchan Wang

Published 2026-05-18

📖 5 min read🧠 Deep dive

CC BY 4.0

Original authors: Shuchan Wang

Original paper licensed under CC BY 4.0 (http://creativecommons.org/licenses/by/4.0/). ✨ This is an AI-generated explanation of the paper below. It is not written or endorsed by the authors. For technical accuracy, refer to the original paper. Read full disclaimer

The Big Idea: Hiding a Secret in the "Flow" of Creation

Imagine you own a factory that builds custom toys. You want to prove that a specific toy came from your factory, even if someone else copies the toy's design or tries to hide your name.

Most current methods try to watermark these creations in two ways:

On the final toy: Putting a tiny, invisible sticker on the finished product. (Problem: If you sand the toy down or repaint it, the sticker is gone.)
In the factory blueprints: Hiding a secret code in the instructions the workers follow. (Problem: If someone steals the blueprints and changes a few numbers, the code breaks.)

This paper proposes a third, smarter way. Instead of hiding the secret in the toy or the blueprints, they hide it in the movement of the factory itself.

The Analogy: The River and the Boat

The paper focuses on a type of AI called Flow Matching. Think of this AI as a river that carries a boat (a random noise particle) from a starting point (Point A) to a destination (Point B, which is a real image like a cat or a number).

The Velocity Field: This is the current of the river. It tells the boat exactly how fast and in what direction to move at every single moment to get from A to B.
The Watermark: The researchers don't change the destination (the final image). They don't change the map (the blueprints). Instead, they add a tiny, rhythmic wiggle to the river's current.

Imagine the river usually flows straight. The researchers make the current wiggle back and forth like a sine wave (a smooth, rolling motion) as the boat travels.

The Secret: The pattern of the wiggle is the secret message.
The Magic: Because the wiggle goes forward and then backward perfectly, the boat ends up in the exact same spot it would have been without the wiggle. The final image looks perfect. The "wiggle" disappears from the final result, but it was there the whole time during the journey.

How It Works (The Simple Steps)

1. Training (Embedding the Secret)
When the AI is learning how to draw pictures, the researchers teach it to add this specific "wiggle" to the river current.

They give the AI a secret key (like a password).
Based on that key, the AI learns to wiggle the current in a specific pattern that corresponds to a message (e.g., "This model belongs to Company X").
Crucially, the wiggle is designed so that over the whole trip, it cancels itself out. The boat still arrives at the right place.

2. Detection (Finding the Secret)
You don't need to see the blueprints or the final image to find the secret. You just need to ask the AI, "Hey, if I'm at this spot in the river at this time, which way are you pushing me?"

The detector asks the AI thousands of these questions (black-box queries).
It listens for that specific rhythmic "wiggle" in the answers.
If the AI has the secret key, the detector can decode the message. If the AI doesn't have the key, the detector just hears random noise.

Why This Is Special (The 5 Superpowers)

The paper claims this method solves five big problems that other methods have:

It's Unbreakable by "Sanding": Since the secret is in the movement (the dynamics) and not the final picture, you can't remove it by editing the image. The "wiggle" is part of how the image is made.
It's Black-Box Friendly: You don't need to see the AI's internal code or weights. You just need to be able to ask it questions (like using an API).
It Keeps Quality: Because the wiggle cancels itself out over time, the final images look exactly as good as they would without the watermark. The paper tested this on images of numbers (MNIST) and small color photos (CIFAR-10), and the quality didn't drop.
It Needs a Key: If you don't have the secret key (the specific pattern of the wiggle), you can't find the message. It's like trying to hear a specific radio station without the frequency; you just hear static. The paper found that without the key, the detection rate was no better than guessing randomly.
It Can Carry Lots of Data: It's not just a "Yes/No" watermark. It can carry a whole message (like a serial number or a version ID) because they used a "codebook" of different wiggle patterns.

The Results

The researchers tested this on two types of AI models (a simple one called MLP and a complex one called UNet).

Success Rate: They could recover the secret message 100% of the time from watermarked models.
False Alarms: Clean models (without watermarks) were never mistaken for watermarked ones (0% false positives).
Quality: The images generated were just as good as the originals.

The Bottom Line

This paper introduces a way to stamp a secret, unremovable, high-quality signature directly into the "motion" of an AI as it creates things. It's like teaching a river to flow with a secret rhythm that only the owner can hear, ensuring that even if the water is poured into a new cup, the rhythm remains.

Technical Summary: Dynamics-Level Watermarking of Flow Matching Models with Random Codes

1. Problem Statement

The paper addresses the need for robust, verifiable ownership protection for generative models, specifically Flow Matching models. Existing watermarking paradigms suffer from specific limitations:

Output-level methods embed signals in generated samples but can be removed via post-processing and do not prove ownership of the model itself.
Weight-level methods embed bits in parameters but require white-box access and are fragile to fine-tuning or pruning.
Behavior-level (backdoor) methods support black-box verification but often introduce visible artifacts, statistical irregularities, or lack strong cryptographic keying (once a trigger is found, verification is trivial).

Furthermore, no prior work has embedded watermarks directly into the learned continuous dynamics (the velocity field) of a generative process. The authors pose the core question: Can a verifiable, keyed, multi-bit message be embedded directly into the velocity field of a flow matching model such that detection requires only black-box access, generation quality is preserved, and recovery is impossible without a secret key?

2. Methodology

Core Concept: Random Coding over Transport Dynamics

The authors formulate watermarking as random coding over a continuous channel. Instead of modifying weights or outputs, they treat the learned velocity field $v_\theta(x, t)$ as a high-dimensional continuous channel. A message is embedded by adding a key-dependent perturbation to this velocity field.

Construction of the Watermark Signal

The watermark signal $s_{K,m}(x, t)$ is constructed to satisfy three conditions: zero-mean over time (to preserve quality), approximate orthogonality (for message separation), and energy normalization.

Key ( $K$ ): Consists of a semi-orthogonal projection matrix $P \in \mathbb{R}^{D \times k}$ and a codebook $C = \{c_m\}$ of unit vectors in $\mathbb{R}^k$ .
Signal Definition: For a message $m$ , the signal is defined as:
$s_{K,m}(x, t) = \sin(2\pi t) \cdot P c_m$
Here, $P c_m$ embeds the codeword into the velocity space, while $\sin(2\pi t)$ acts as a temporal carrier.
Zero-Mean Property: The integral of $\sin(2\pi t)$ over $t \in [0, 1]$ is zero. Consequently, the perturbation integrates to zero along any generative trajectory, theoretically preserving the terminal distribution of generated samples.

Training Procedure (Embedding)

During Flow Matching training, the model is optimized to minimize a combined loss function:

Velocity Loss ( $L_{vel}$ ): Regresses the model's velocity $v_\theta$ against a watermarked target $\tilde{v} = u + \epsilon_0 s_{K,m}$ , where $u$ is the standard conditional velocity.
Watermark Loss ( $L_{wm}$ ): A regularization term that rewards the model for producing velocity vectors whose demodulated projection ( $\sin(2\pi t) P^T v_\theta$ ) aligns with the target codeword $c_m$ .

The theoretical analysis shows that the optimal predictor under this objective includes an effective watermark strength of $\epsilon_0 + \lambda/2$ .

Detection Procedure (Black-Box)

Detection requires only query access to the model's velocity field.

Querying: The detector samples $N$ random points $(x_i, t_i)$ and queries the model for velocities $v(x_i, t_i)$ .
Synchronous Demodulation: The detector projects the velocities into the latent code space ( $P^T v$ ) and multiplies by the temporal carrier $\sin(2\pi t_i)$ .
Averaging: The results are averaged to estimate the signature $\hat{s}$ .
Decoding: The message is recovered by finding the codeword $c_m$ in the codebook that maximizes the correlation with $\hat{s}$ .

Security and Capacity

Security: Without the secret key ( $P$ and $C$ ), an attacker faces a subspace search problem over the Grassmann manifold $Gr(k, D)$ and a non-identifiability problem regarding the basis of the subspace. Empirically, detection with a wrong key yields chance-level accuracy.
Capacity: The channel capacity scales linearly with the projection dimension $k$ and logarithmically with the number of queries $N$ .

3. Key Contributions

Dynamics-Level Embedding: First work to embed watermarks directly into the continuous velocity field of flow matching models, rather than weights or outputs.
Quality Preservation: Designed a perturbation that integrates to zero over trajectories, ensuring the generated distribution remains statistically indistinguishable from the unwatermarked version.
Keyed Security: Implemented a scheme where detection and message recovery strictly require a secret key (projection matrix and codebook); without it, accuracy drops to random guessing.
Multi-bit Capacity: Utilized a codebook construction to support multi-bit messages (beyond binary verification), enabling applications like owner identification and traitor tracing.
Empirical Validation: Validated the method on MNIST and CIFAR-10 using MLP and UNet architectures.

4. Experimental Results

The authors evaluated the method across various settings (MNIST/CIFAR-10, MLP/UNet, different training steps).

Detection Accuracy: Watermarked models achieved 100% message recovery across all tested configurations. Clean models (unwatermarked) yielded 0% false positives (or 2.5% in one specific case, below the random guess baseline of 3.1%).
Keyed Security: Attacks using a random projection matrix (wrong key) resulted in 0/50 correct recoveries, matching the random guess rate.
Statistical Separation: The separation between watermarked and clean model signatures was significant, with minimum separation exceeding 8.4 $\sigma$ (up to 25.5 $\sigma$ in some settings).
Quality Preservation: The Fréchet Inception Distance (FID) ratios between watermarked and clean models remained close to 1.0 $\times$ (ranging from 0.95 $\times$ to 1.10 $\times$ ). In some cases, watermarked models showed marginally lower FID, attributed to random training variation rather than the watermark itself.
Persistence: Extending training to 10,000 steps did not degrade watermark recovery.

5. Significance and Claims

The paper claims that dynamics-level watermarking provides a robust foundation for:

Model Ownership Verification: Proving ownership of a deployed model via black-box queries.
Traitor Tracing: Identifying specific copies of a model distributed to different customers.
Regulatory Compliance: Verifying the provenance of generative models.

The authors emphasize that their approach treats the learned velocity field as a continuous communication channel, a perspective that may have utility beyond watermarking. They explicitly state that while the method shows promise, deployment-scale evaluation and rigorous finite-sample analysis of the channel capacity are left for future work. The paper does not claim to solve watermarking for all generative model families, but specifically demonstrates efficacy within the Flow Matching framework.