Technical Summary: DASMark

Problem Statement

The proliferation of text-to-image diffusion models has enabled the creation of highly realistic images, raising significant concerns regarding deepfakes and deceptive visual content. While passive forensic methods exist to detect synthetic content, they often struggle with generalization across different generators and fail to establish specific model or user provenance. Active watermarking offers a solution by embedding identifiable signals at the source; however, existing diffusion watermarking methods face critical limitations:

1. Geometric Vulnerability: Geometric attacks (e.g., rotation, cropping, stretching) disrupt the spatial correspondence between extracted and reference watermarks, leading to identification failures even if the watermark information survives.
2. Scalability vs. Robustness Trade-off: Methods like Tree-Ring and RingID use structured patterns (e.g., Fourier rings) that are robust to rotation but struggle with large-scale user identification (many keys) and can introduce circular artifacts affecting image quality.
3. Computational Overhead: Current state-of-the-art methods like WIND rely on rotation and sliding-window searches to compensate for geometric misalignment, incurring significant computational costs and memory usage, particularly as the user identity space scales.

Methodology

The authors propose DASMark, a diffusion image watermarking framework designed for robust model verification and scalable user identification under geometric attacks. The core innovation is a dual-anchor geometric synchronization mechanism that operates without modifying pretrained generator weights.

1. Watermark Generation

• User-Specific Initial Noise: Each user is assigned a unique identifier ($u_i$) which, combined with a model-specific master key ($\kappa_A$), generates a reproducible initial noise vector ($z_T^{(u_i)}$) via HMAC and Gaussian sampling. This noise serves as the identity carrier.
• Dual-Anchor Embedding: To enable geometric synchronization, two spatially separated localization anchors are embedded into the initial noise using orthogonal channel codes ($c_A$ and $c_B$).
  • The anchors are placed in the upper-left and lower-right regions of the latent grid.
  • They utilize 2D Gaussian templates with orthogonal channel codes to ensure distinguishable responses across the latent channels while minimizing interference.
  • The embedding modifies only the projection of the noise along the specific channel code, preserving orthogonal components to minimize impact on image quality.

2. Watermark Detection & Synchronization

The detection pipeline does not require retraining the diffusion model and consists of the following steps:

• Latent Inversion: A suspicious image is encoded into the latent space and inverted using deterministic DDIM (without text conditioning) to recover the estimated initial latent ($\hat{z}_T$).
• Dual-Anchor Localization Network: A dedicated neural network ($F_\theta$) predicts the transformed positions of the two anchors within the inverted latent.
  • Architecture: The network employs a three-branch stem to extract features from individual anchor response maps and a joint feature map. It utilizes multi-scale geometry blocks, global attention mechanisms, and cross-resolution fusion to handle varying spatial scales and global context.
  • Coordinate Estimation: Instead of non-differentiable peak selection, the network uses a differentiable spatial expectation (based on DSNT) to estimate anchor centers, allowing for end-to-end optimization.
• Geometric Alignment: Based on the predicted anchor centers, the system estimates the geometric transformation (rotation or crop-and-stretch) and aligns the inverted latent back to the reference coordinate system.
  • Rotation: Calculated via the angle between the reference and predicted anchor vectors.
  • Crop-and-Stretch: Estimated via scale factors and midpoints of the anchor pairs.
  • A validity mask is generated to exclude regions lost during cropping.
• Verification and Identification: The aligned latent is matched against user-specific reference noises using masked cosine similarity.
  • Verification: Determines if the image originated from the protected model.
  • Identification: Identifies the specific user by finding the best-matching key in the database.

Key Contributions

1. Dual-Anchor Framework: Introduction of a diffusion watermarking framework that utilizes reproducible user-specific initial noise and orthogonally coded dual anchors to restore latent spatial correspondence under geometric attacks.
2. Learning-Based Synchronization: Development of a localization and synchronization pipeline that derives geometric transformation parameters from predicted anchor positions, enabling spatial alignment of latent noise without modifying the generator.
3. Cross-Model Compatibility: Demonstration that the localization network trained on one diffusion model (SD 2.1) can be applied to other models (SD 2.0, 1.5, 1.4) without additional training.

Experimental Results

The authors evaluated DASMark against baselines (Tree-Ring, RingID, WIND) using Stable Diffusion 2.1 and various attack scenarios.

• Model Verification: DASMark achieved an average verification AUC of 0.999 and a TPR@1%FPR of 0.998 across clean and attacked conditions, outperforming baselines, particularly under rotation and crop-and-stretch attacks.
• User Identification:
  • With 200,000 candidate identities, DASMark achieved an average identification accuracy of 99.7%.
  • Under rotation, it outperformed WIND by 11.0 percentage points.
  • Under crop-and-stretch, it outperformed WIND by 18.6 percentage points.
  • Performance remained stable as the key space expanded, whereas WIND's accuracy degraded significantly with larger key spaces under geometric attacks.
• Image Quality: The method preserved image quality, achieving a CLIP-Score (0.364) and FID (25.78) comparable to the unwatermarked baseline and superior to methods like RingID and WIND, which exhibited visible circular artifacts.
• Computational Efficiency: DASMark demonstrated significantly lower end-to-end runtime and GPU memory usage compared to WIND. For 200,000 keys, DASMark required 0.975 seconds and 15.96 GB of memory, compared to WIND's 6.721 seconds and 22.84 GB. Doubling the key space increased DASMark's runtime by only 19.3%, versus 56.6% for WIND.

Significance and Claims

The paper claims that DASMark provides a robust solution for active deepfake detection by enabling reliable model verification and scalable user identification even when images undergo geometric distortions. By decoupling the synchronization mechanism from the generator weights and utilizing a dual-anchor approach, the method overcomes the limitations of previous ring-based or search-heavy methods. The authors assert that their approach supports provenance tracing for services controlling image generation, offering a practical balance between robustness, scalability, image quality, and computational efficiency.

The authors modestly note that future work will address sensitivity to aggressive cropping and combinations of geometric distortions with brightness adjustments, as well as extending synchronization to more complex transformations.