CLaW: Codec-Guided Adaptive Latent Watermarking for Traceable Diffusion Image Generation

AI summary

Overview

Research area: Computer vision / generative AI security — digital watermarking for text-to-image diffusion models.

Technical level: Advanced. The paper assumes familiarity with latent diffusion sampling, VAEs, flow-matching backbones, and multi-bit watermark decoding.

Scope: CLaW is a training-light watermarking framework that injects a user-specific 48-bit payload into the latent denoising trajectory of a frozen diffusion model, then recovers it without diffusion inversion for user-level attribution.

What This Paper Is About

Diffusion models such as SD3.5-medium and FLUX.1-dev can now produce images realistic enough to be misused, and services need a way to trace a redistributed image back to the specific user account that generated it. Existing watermarking approaches force a bad trade-off: diffusion-native methods like Stable Signature require retraining the model, sampling-time methods like RingID and WIND need expensive diffusion inversion at detection time, and post-hoc learned encoders like RivaGAN embed the signal after generation so it breaks under common image transformations. CLaW's goal is to embed a recoverable per-user payload during sampling with a frozen backbone, preserve image quality, and stay robust after compression, cropping, editing, and even screen capture.

Key Contributions

1. Codec-guided latent watermarking framework. A pretrained secret encoder/decoder pair (following the latent-watermarking paradigm of AquaLoRA) maps each user payload to a latent residual and decodes it from an image. Both the codec and the diffusion backbone stay frozen, so injection happens at sampling time with no diffusion-model retraining and detection needs no inversion.

2. Late-denoising-window injection. The residual is injected only inside a late window of the sampling trajectory (parameterized by start/end fractions), with optional flat, linear, or cosine schedules and a terminal anchor. This is designed to preserve image semantics while preventing the watermark from being washed out by later denoising updates.

3. Decoder-guided adaptive injection. The frozen decoder "previews" intermediate noisy latents, computes a soft confidence that the target payload is recoverable, and increases the injection gain when confidence falls below a target — so easy prompts get less signal and hard prompts get more.

4. User-level attribution protocol. Detection produces a bit string that is matched by maximum bit agreement against a registry of registered user payloads, with an acceptance threshold derived from a binomial false-positive criterion. Attribution is evaluated at registries of 10^4, 10^5, and 10^6 users.

Main Findings

• Best attacked F1 among compared methods on both backbones. CLaW reaches clean F1 of 1.0000 and attacked F1 of 0.9922 on SD3.5-medium and 0.9968 on FLUX.1-dev, versus 0.9288 / 0.9577 for RivaGAN, 0.8750 / 0.8656 for Gaussian Shading, 0.6213 / 0.4473 for RingID, 0.5642 / 0.5090 for PRC, 0.8665 / 0.8658 for WIND, 0.8744 / 0.8737 for GaussMarker, and 0.6636 / 0.5351 for SFW.

• Highest PSNR among watermarked methods. PSNR is 41.25 (SD3.5-medium) and 41.06 (FLUX.1-dev), with FID of 35.70 and 38.37. Many diffusion-watermarking baselines keep high clean F1 but drop to PSNR around 8–14 (e.g., Gaussian Shading 9.99, RingID 8.56, WIND 8.31 on SD3.5-medium).

• Low detection cost. Mean detection time is 0.0115 s per image on SD3.5-medium and 0.0104 s on FLUX.1-dev, from a single frozen-decoder forward pass, compared with 0.518 s for RivaGAN on SD3.5-medium and 1.559 s for Gaussian Shading. Generation overhead is 1.93 s and 4.73 s per image respectively.

• Consistent per-attack robustness. On SD3.5-medium across eight transformations (JPEG, crop-and-resize, blur, noise, brightness, mask, overlay, adaptive noise) every CLaW F1 is above 0.96, with an average F1 of 0.9922 and average AUC of 0.9924. Its weakest case is brightness (F1 0.9616). Gaussian Shading, GaussMarker, and WIND collapse on crop-and-resize (F1 0.0000, 0.0000, and 0.0271).

• SERUM is the closest competitor under standard attacks. On the SD3.5-medium per-attack table, SERUM reaches an average F1 of 0.9822 and AUC of 0.9827.

• Best average under composite and restoration attacks. Across ten conditions CLaW averages 0.9066 F1 (degradation 0.9873, editing 0.8293, geometric 0.8030, super-resolution 0.9473, denoising 0.9848), the highest overall. Gaussian Shading and GaussMarker score 1.0000 on editing and restoration but 0.0000 on geometric processing; RivaGAN averages 0.5419.

• Survives screen capture. Recovering payloads from 100 images per condition gives mean BitAcc of 99.04% for desktop screenshots and 84.21% for phone photographs of a screen, with no manual cropping or geometric correction.

• Stable at million-user scale. With 48-bit payloads, CLaW keeps attacked trace accuracy of 0.9861 / 0.9786 / 0.9649 at 10^4 / 10^5 / 10^6 users on SD3.5-medium and 0.9936 / 0.9896 / 0.9803 on FLUX.1-dev. RivaGAN falls to 0.8570 / 0.8935 and DWT-DCT-SVD to 0.4464 / 0.4866 at 10^6 users.

• Low open-set false attribution. With 10^6 registered users and thresholds calibrated on 6,000 unwatermarked images (tested on another 6,000 unwatermarked images from COCO2017 and SD3.5-medium, plus 1,000 watermarked images), five runs give a mean registry-level FPR of 0.0500% at 98.5% trace accuracy with 44/48 matching bits. Raising the threshold to 45/48 drops FPR to 0.0100% at 97.3% trace accuracy.

• Robust to generation settings. BitAcc stays high when varying denoising steps (15, 25, 40, 50), CFG scale (5.0, 7.5, 10.0), and resolution (512×512, 1024×1024); CFG has the most visible effect on attacked BitAcc.

• Ablation confirms late injection is essential. Removing the late denoising window drops attacked BitAcc from 0.9595 to 0.5413 on SD3.5-medium (from 0.9695 to 0.5727 on FLUX.1-dev); its PSNR of 57.54 mainly reflects a barely embedded payload. Removing adaptive feedback costs attacked BitAcc (0.9283 on SD3.5-medium), and removing the terminal anchor costs a smaller amount (0.9521).

Methodology in Plain English

CLaW splits the problem into a one-time training phase and a cheap per-image phase.

Step 1 — Train a codec, then freeze it. A small encoder turns a 48-bit user payload into a latent residual; a matching decoder turns an image back into payload bits. It is trained so that bits survive an augmentation layer, while two visual regularizers (LPIPS and the Peak Regional Variation Loss from AquaLoRA) keep the residual invisible. After pretraining, both halves are frozen and never touch the diffusion model's weights.

Step 2 — Inject late and lightly. At generation time the residual is scaled into scheduler units and added to the noisy latent, but only in the final portion of the trajectory — the main experiments use the last 10% of steps with a linear schedule and a lightweight terminal anchor. Adding the signal early would damage semantics and get eroded by the remaining denoising updates.

Step 3 — Let the decoder decide how hard to push. At selected steps (governed by a preview stride), the latent is decoded with the VAE and passed through the frozen secret decoder, which reports how confidently the target payload would already be read. If that confidence is below a target, the gain is raised in proportion to the gap, clipped to a bounded range; otherwise it stays at 1. This spends watermark strength where it is needed instead of applying one fixed strength to every prompt.

Step 4 — Detect and attribute without inversion. After generation, the same frozen decoder reads a bit string from a suspicious image in a single forward pass. The platform counts matching bits against each registered user's payload, picks the best match, and accepts the attribution only if the match count clears a binomial-calibrated threshold.

Evaluation uses the open-source MarkDiffusion protocol on SD3.5-medium and FLUX.1-dev, with shared 1,000-image test sets and matched seeds per method and backbone, measuring F1, accuracy, BitAcc, CLIP, FID, PSNR, and SSIM.

Why This Matters

For research: CLaW shows that a watermark does not have to live in the initial noise or in a fine-tuned decoder — a learned residual injected in a late window can be both more robust and less damaging to fidelity. The formulation of detection confidence as a closed-loop control signal during sampling is a reusable idea for other latent-space interventions.

Real-world applications:

• Attributing a leaked or misused image from a commercial text-to-image API back to the account that generated it, at registries of 10^6 users.
• Copyright and provenance tracking for creative platforms where images get recompressed, cropped, and reposted.
• Detecting screen-captured or photographed content, relevant to leak tracing from previews and streaming demos.
• Media forensics and platform-level authenticity labeling, where images arrive after unknown editing pipelines.

Industry relevance: The framework needs no diffusion-backbone retraining, adds roughly seconds-level generation overhead that is comparable to existing baselines, and detects in about a hundredth of a second per image — properties that matter for deploying watermarking at API scale rather than in a lab. It also supports a payload interface rather than only binary "is this AI-generated" detection, which is what user-level accountability requires.

Future Directions

• Channel-aware injection. The authors state their current limitation directly: residuals are applied uniformly across latent channels. They propose placing watermark energy in channels that are more robust and less perceptually sensitive.
• Closing the editing and geometric gaps. Editing (0.8293) and geometric processing (0.8030) are the weakest composite categories compared with degradation (0.9873) and denoising (0.9848) — natural targets for stronger schedule or codec design.
• Handling binary-detection baselines fairly. The traceability comparison excludes several methods that only do binary detection; a shared payload interface would allow a fuller comparison.
• Tuning the adaptive controller. The target confidence, gain coefficient, clipping range, and preview stride are control parameters whose sensitivity is not fully explored in the main text, and the appendix sections on algorithm details are where such analyses would sit.

Target Audience

Researchers and engineers working on generative-model security, watermarking, and content provenance — particularly those deploying text-to-image services who need per-user attribution rather than a binary AI-image detector. It is also relevant to practitioners of latent-space control in diffusion sampling, since the decoder-guided gain mechanism generalizes beyond watermarking. Readers without a diffusion background will find the math in Sections 3.2–3.4 heavy, though the high-level strategy is accessible.

Authors’ abstract

With the rapid advancement of text-to-image diffusion models, increasingly realistic AI-generated content has raised serious concerns about misuse and copyright infringement. Digital watermarking offers a promising solution by enabling user-level traceability, yet existing methods remain difficult to deploy at scale, hindered by costly model retraining or detection, poor effectiveness-fidelity trade-offs, and limited robustness to image transformations. To address these challenges, we propose CLaW (Codec-guided Latent Watermarking), a robust and efficient watermarking framework for traceable diffusion image generation with frozen diffusion backbones and inversion-free detection. Specifically, CLaW first uses a pretrained watermark codec to map each watermark message to a latent residual, enabling low-cost sampling-time injection. Then, the residual is injected within a late denoising window, where image semantics are better preserved and the watermark signal is less perturbed by subsequent denoising updates, yielding a better balance between watermark effectiveness and image fidelity. Furthermore, we introduce a decoder-guided adaptive injection mechanism that uses decoding confidence as feedback to dynamically calibrate watermark strength, reinforcing weak watermark signals and improving robustness under image transformations. Extensive experiments show that CLaW preserves high visual fidelity and achieves state-of-the-art robustness under image transformations, enabling reliable user-level traceability.