NoisePrints: Distortion-Free Watermarks for Authorship in Private Diffusion Models

AI summary

Overview

Research area: Computer vision / generative modeling security — watermarking and authorship verification for diffusion and flow-based image and video generation.

Technical level: Advanced. The paper combines diffusion/flow model internals (latent diffusion, deterministic samplers, DDIM inversion), cryptographic primitives (one-way hash functions, zero-knowledge proofs), and high-dimensional probability (concentration of measure, spherical-cap bounds).

Scope: The paper introduces and empirically validates a seed-based, distortion-free watermarking scheme that allows third-party verification of authorship of diffusion-generated images and videos using only a seed and the generated output, without access to the model's weights.

What This Paper Is About

Proving that a generative model produced a particular image or video is hard when the model is private: the model owner may be unwilling or unable to help, and existing watermarking methods need access to model weights plus computationally heavy inversion procedures. NoisePrints treats the random seed that initializes the diffusion process as the watermark itself, since the initial Gaussian noise leaves a measurable imprint on the generated content. A verifier can therefore check authorship by computing a simple correlation between the seed-derived noise and the content's latent embedding, with no modification to generation and no inversion.

Key Contributions

1. A distortion-free, seed-based watermark. NoisePrints uses the random seed — hashed through a fixed cryptographic hash function and passed to the PRNG — as the authorship proof. The generation process is never altered, so the output distribution is preserved and the watermark introduces no distortion.

2. Lightweight, model-free verification. Verification reduces to a cosine similarity between the public VAE encoder's latent embedding of the content and the noise derived from the claimed seed. Unlike inversion-based baselines (WIND, PRC, GS), it needs no access to diffusion model weights and no iterative denoising passes at verification time.

3. A formal security analysis plus a dispute protocol. The paper derives an analytic false-positive bound and threshold rule targeting an FPR of 2^-128, and introduces a dispute protocol with "self check" and "cross check" that handles injection-only attacks and geometric transformations by allowing claimants to submit a transformation from a public family.

4. Zero-knowledge proof extension. The scheme is extended with a ZKP so ownership can be demonstrated without revealing the seed, binding the proof to a public string (e.g., a description of the image and its owner) concatenated with a private random value before hashing.

Main Findings

• Reliability across five models at FPR = 2^-128. Mean NoisePrint scores far exceed the analytically derived thresholds: SD2.0 (latent dim 16,384) mean 0.482 ± 0.088 vs. threshold 0.101739, pass rate 1.00; SDXL (65,536) 0.431 ± 0.070 vs. 0.051000, pass rate 0.99; Flux.1-schnell (262,144) 0.197 ± 0.056 vs. 0.025500, pass rate 0.99; Flux.1-dev (262,144) 0.202 ± 0.055 vs. 0.025500, pass rate 0.99; Wan2.1 (1,297,920) 0.0678 ± 0.0247 vs. 0.011460, pass rate 1.0.

• False-positive probability decays exponentially in latent dimension. The paper derives Pr[φ ≥ τ] = ½ I_{1−τ²}((d−1)/2, 1/2) ≤ exp(−((d−1)/2) τ²), so accidental collisions become negligible in the high-dimensional embeddings used by current image models and, an order of magnitude larger, video models. Threshold selection follows τ = √(1 − a*), where a* solves ½ I_a((d−1)/2, 1/2) = δ.

• Large verification speedups. Replacing inversion with a cosine similarity gives an end-to-end speedup of ×14 to ×213 over inversion-based baselines, depending on the model. On a single RTX 3090, cosine similarity takes 0.182 ± 0.045 ms (SD2.0), 0.090 ± 0.018 ms (SDXL), 0.098 ± 0.005 ms (Flux-dev), 0.100 ± 0.011 ms (Flux-schnell) and 0.097 ± 0.010 ms (Wan2.1-1.3B), against inversion times of 3.234 ± 0.075 s, 12.704 ± 0.303 s, 33.594 ± 0.245 s, 6.673 ± 0.055 s and 91.473 ± 0.164 s respectively.

• Robustness to basic image processing. Across six corruption types at three severity levels each — brightness (×2, ×3, ×4), contrast (×2, ×3, ×4), Gaussian blur (radius 2, 4, 6 pixels), Gaussian noise (σ 0.1, 0.2, 0.3), JPEG compression (quality 25, 15, 10) and resize (0.30, 0.25, 0.20) — the method achieves TPR above 0.9 at FPR 2^-128 for images that retain reasonable perceptual quality, matching or outperforming prior methods. At Gaussian noise σ = 0.2, PSNR drops to 14.8–14.9 while TPR at FPR 2^-128 is already close to 1.0.

• WIND is more robust under severe distortion, but that regime is less meaningful. WIND shows TPR near 1.0 at Gaussian blur r = 6 and Gaussian noise σ = 0.3, but at those levels the images are heavily distorted and diverge from a well-trained model's outputs.

• Strong performance against regeneration attacks. Under SDEdit-style regeneration at noise levels 0.2, 0.4 and 0.6 — applied with SDXL to images originally generated by SD2.0, simulating the private-weights scenario — the method surpasses prior methods and, importantly, these attacks preserve perceptual quality, making them a more realistic threat.

• Resilience to a targeted inversion attack. An optimization-based DDIM inversion attack runs 100 optimization steps with w ∈ {0.3, 0.4, 0.5}, using either SD1.4 for initial noise estimation or the original SD2.0 model, with an empty prompt, 50 steps and no CFG. These attacks are more effective than regeneration or image transformations but still leave NoisePrints outperforming all baselines by a large margin.

• Geometric transformations resolved by the dispute protocol. For rotation and crop-and-scale, after re-alignment using an estimated inverse transform, 100% of images pass the verification threshold at FPR = 2^-128.

• Random seed guessing is infeasible. Under the null hypothesis that the noise and the image embedding are independent unit vectors, a false positive requires the noise to fall in a spherical cap of angular radius arccos(τ); the exponential decay in d makes forging a passing seed computationally infeasible at the 2^-128 target.

• One consistent outlier. A single consistent outlier appears across three models, corresponding to a prompt discussed in Appendix G.

Methodology in Plain English

The starting point is an empirical observation: in diffusion and flow models, the initial Gaussian noise used to begin generation remains strongly correlated with the final generated content, far more than an unrelated noise sample would be. The authors connect this to optimal transport — the noise-to-data mapping in the probability flow ODE coincides with the optimal transport map for many common distributions, and reducing transport cost under a quadratic cost corresponds to increasing the dot product.

The scheme works as follows. A producer generates content as usual, starting from a seed. The seed is first passed through a fixed cryptographic one-way hash function, and the result initializes the PRNG that draws the Gaussian noise. Because the hash is pre-image resistant, no one can recover the seed from the content. The producer keeps the seed secret and eventually presents the pair (content, seed) to a verifier.

The verifier, using only public primitives — the PRNG specification, a black-box VAE encoder, and a calibrated threshold — encodes the content into a latent vector, regenerates the noise deterministically from the claimed seed, and computes their cosine similarity, called the NoisePrint score. If it exceeds the threshold τ, the claim is accepted. Since the noise is a random high-dimensional Gaussian vector, an incorrect seed yields an almost-orthogonal vector and fails.

For harder cases, the authors add two mechanisms. The dispute protocol lets each claimant submit a triplet of content, seed and an optional transformation from a public family (e.g., rotations or crops); a valid owner passes both a self check on their own content and a cross check against the opponent's content after applying their transformation. The zero-knowledge extension wraps the whole comparison in a circuit whose public input is the image and whose private witness is the seed, and it splits the seed into a public descriptive string (identifying the image and its owner) and a private random value so that proofs are bound to a specific claimant.

Evaluation covers SD2.0 base, SDXL-base, Flux-dev and Flux-schnell for images and Wan2.1 for video, using prompts from Gustavo (2022) and a subset of VBench2.0 prompts for video. Perceptual similarity under attack is measured with SSIM, PSNR and LPIPS.

Why This Matters

Impact on research. The paper shifts watermark verification away from inversion-based pipelines, which dominate prior noise-space watermarking work, and shows that a plain correlation test can serve as a statistically decisive authorship signal when the latent dimension is large. It also makes explicit an impossibility-informed scoping decision — since perfect robustness against adversarial, quality-preserving edits is unattainable, the authors scope claims to bounded, perceptual-preserving manipulations — and provides an analytic false-positive bound suitable for cryptographic-grade error targets.

Real-world applications:

• Independent creators and small organizations without the trusted infrastructure of major AI providers can assert ownership of content they generated.
• Copyright dispute resolution, where a third party verifier adjudicates competing claims using the dispute protocol's self and cross checks.
• Provenance tracking for video content, where verification cost is a practical barrier and the method's sub-millisecond comparison is most valuable.
• Acting as a fast first-pass filter that complements heavier watermarking schemes, reducing reliance on costly inversion or optimization in deployment.

Industry relevance. The method requires no changes to generation, preserves output quality, needs no training or fine-tuning, and keeps model weights private, which suits API-only or proprietary fine-tuned models. The sub-millisecond verification cost makes large-scale verification tractable, and the zero-knowledge extension lets an owner prove authorship without exposing the seed, which matters because seed leakage could let an adversary claim ownership or mount more targeted attacks.

Future Directions

• Extending the approach to real images and exploring whether spatial distribution of correlation can support real/fake detection in open-world scenarios, for example by highlighting foreground-background inconsistencies.
• Broadening the dispute protocol beyond the currently restricted set of geometric transformations, since stronger manipulations remain an open possibility.
• Making the scheme work when the VAE itself is private, which currently requires the cooperation of the model provider so the verifier can encode images.
• Integrating NoisePrints with the owner-only setting of WIND, either for direct seed-image verification when the seed is known or as a lightweight pre-filter in WIND's two-stage pipeline when it is not.
• Tightening or generalizing the theoretical link to optimal transport; the authors refrain from asserting a universal bound on expected cosine similarity for arbitrary targets and rely on empirical observation on image and video data.

Target Audience

Researchers working on generative model security, watermarking, provenance and intellectual property for diffusion and flow models; practitioners building authorship or content-provenance systems for image and video generation APIs; and cryptography-adjacent engineers interested in zero-knowledge proofs applied to model-generated content. The paper is most useful to readers comfortable with latent diffusion mechanics, high-dimensional statistics and basic cryptographic primitives; the empirical results and protocol descriptions are nonetheless readable by a broader technical audience.

Authors’ abstract

With the rapid adoption of diffusion models for visual content generation, proving authorship and protecting copyright have become critical. This challenge is particularly important when model owners keep their models private and may be unwilling or unable to handle authorship issues, making third-party verification essential. A natural solution is to embed watermarks for later verification. However, existing methods require access to model weights and rely on computationally heavy procedures, rendering them impractical and non-scalable. To address these challenges, we propose NoisePrints, a lightweight watermarking scheme that utilizes the random seed used to initialize the diffusion process as a proof of authorship without modifying the generation process. Our key observation is that the initial noise derived from a seed is highly correlated with the generated visual content. By incorporating a hash function into the noise sampling process, we further ensure that recovering a valid seed from the content is infeasible. We also show that sampling an alternative seed that passes verification is infeasible, and demonstrate the robustness of our method under various manipulations. Finally, we show how to use cryptographic zero-knowledge proofs to prove ownership without revealing the seed. By keeping the seed secret, we increase the difficulty of watermark removal. In our experiments, we validate NoisePrints on multiple state-of-the-art diffusion models for images and videos, demonstrating efficient verification using only the seed and output, without requiring access to model weights.