Technical Summary: AnchorMark

Problem Statement

Inversion-based watermarking for diffusion models embeds payloads directly into the initial latent space, allowing watermarks to be formed during image generation and recovered via diffusion inversion without retraining the generator. While effective against common non-geometric distortions, these methods suffer a fundamental failure mode under rotation attacks.

Existing inversion-based multi-bit schemes associate payload bits with spatially indexed latent carriers. When an image is rotated, the spatial correspondence between the recovered latent and the expected bit positions is disrupted. Prior approaches to this issue fall into two categories:

1. Learned synchronizers: These use auxiliary networks to estimate transformations but require additional training and may depend on specific architectures or attack distributions.
2. Rotation-invariant spectral designs: These suppress orientation sensitivity to detect watermark presence but fail to recover the ordered correspondence required for multi-bit payload tracing.

Consequently, there is a lack of a lightweight, modular, and training-free mechanism to synchronize inversion-based watermarks under geometric transformations.

Methodology: AnchorMark

The authors propose AnchorMark, a training-free, robust inversion-based watermarking framework. The core of the method relies on a newly identified structural property of diffusion latent spaces termed Rotation Synchrony.

1. Rotation Synchrony

The paper establishes that an image-domain rotation induces the same angular rotation in the recovered initial latent. Formally, for a generated image $I$ rotated by angle $\alpha$, the recovered initial latent $\hat{x}_T(\alpha)$ approximately satisfies:
$$\hat{x}_T(\alpha) \approx R_\alpha x_T$$
where $R_\alpha$ is the rotation operator and $x_T$ is the original initial latent. The deviation from this ideal relation is bounded by residuals arising from VAE encoding, diffusion inversion dynamics, and the generation-inversion cycle. Empirical validation confirms that matching the recovered latent against rotated references yields a minimum distance near the ground-truth rotation angle.

2. Multi-Frequency Phase Anchor

To exploit Rotation Synchrony for synchronization, AnchorMark embeds a compact multi-frequency phase anchor into the central region of the initial latent, spatially decoupled from the payload region.

• Construction: The anchor consists of sine-cosine channel pairs encoding angular frequencies ($k_j$). This design converts spatial rotation into a predictable analytic phase response ($k_j \alpha$).
• Injection: The anchor is injected using statistics-calibrated injection. The template is standardized to match the mean and standard deviation of the original latent patch and fused via a mixing parameter $\lambda$, followed by recalibration to restore per-channel moments. This minimizes distribution shift and preserves image quality.

3. Hierarchical Synchronization and Recovery

The extraction process employs a two-stage hierarchical strategy:

1. Anchor-Guided Global Registration: The detector reconstructs the reference anchor and performs a coarse-to-fine search over candidate rotation angles. It minimizes the normalized matching loss between the recovered anchor and the rotated reference anchor to estimate the dominant rotation angle.
2. Payload-Guided Local Refinement: To address residual misalignment caused by interpolation or inversion noise, the system defines a local candidate set around the initial estimate. It refines the angle by maximizing the verification confidence of the underlying watermark decoder on the payload region. The final payload is extracted using this refined angle.

Key Contributions

1. Identification of Rotation Synchrony: The authors formalize the property that image-space rotations induce corresponding angular rotations in the recovered initial latent, providing a theoretical basis for latent-space synchronization.
2. AnchorMark Framework: A training-free, robust inversion-based watermarking method that combines a compact multi-frequency phase anchor with statistics-calibrated injection and a hierarchical (coarse-to-fine) registration strategy.
3. Empirical Validation: Extensive experiments demonstrate that AnchorMark significantly improves bit accuracy under rotation and combined attacks while maintaining visual quality and semantic fidelity.

Experimental Results

The method was evaluated on Stable Diffusion (v1.5, v2.1, v3.5) and FLUX.1-dev models.

• Rotation Robustness: Under rotation attacks ranging from $\pm 5^\circ$ to $\pm 60^\circ$, AnchorMark restored high bit accuracy for baseline methods that otherwise failed. For instance, when applied to ShapeMark, AnchorMark achieved near-perfect recovery (Acc $\approx$ 1.00) across all tested angles, whereas the baseline ShapeMark dropped to random guessing levels ($\approx$ 0.50) at larger angles. Similarly, Gaussian Shading saw its detection rate (TPR) recover from near-zero to $\approx$ 0.99.
• Combined Attacks: AnchorMark maintained stable performance (TPR > 0.99, Acc > 0.94) when rotation was combined with resizing, JPEG compression, Gaussian noise, and median blur across multiple diffusion backbones.
• Image Quality: The introduction of the anchor resulted in limited impact on image quality, with FID and CLIP-Score changes remaining comparable to the base methods.
• Ablation Studies: The study confirmed that the multi-frequency design (combining low-frequency robustness and high-frequency discrimination) outperforms single-frequency or random anchors, reducing angle estimation error to less than $0.5^\circ$.

Significance and Claims

The paper claims that latent-space synchronization is an effective mechanism for robust inversion-based watermarking under geometric transformations. By leveraging the inherent Rotation Synchrony property, AnchorMark provides a modular, training-free solution that can be applied to existing inversion-based watermarking schemes without modifying the underlying diffusion model or retraining the generator. The method successfully addresses the critical gap of multi-bit payload recovery under rotation, enabling reliable content provenance and copyright protection in scenarios involving geometric distortions.