title: Tree-Ring Watermarks: Fingerprints for Diffusion Images that are
    Invisible and Robust
summary: Watermarking the outputs of generative models is a crucial technique for
  tracing copyright and preventing potential harm from AI-generated content. In
  this paper, we introduce a novel technique called Tree-Ring Watermarking that
  robustly fingerprints diffusion model outputs. Unlike existing methods that
  perform post-hoc modifications to images after sampling, Tree-Ring Watermarking
  subtly influences the entire sampling process, resulting in a model fingerprint
  that is invisible to humans. The watermark embeds a pattern into the initial
  noise vector used for sampling. These patterns are structured in Fourier space
  so that they are invariant to convolutions, crops, dilations, flips, and
  rotations. After image generation, the watermark signal is detected by
  inverting the diffusion process to retrieve the noise vector, which is then
  checked for the embedded signal. We demonstrate that this technique can be
  easily applied to arbitrary diffusion models, including text-conditioned Stable
  Diffusion, as a plug-in with negligible loss in FID. Our watermark is
  semantically hidden in the image space and is far more robust than watermarking
  alternatives that are currently deployed. Code is available at
  github.com/YuxinWenRick/tree-ring-watermark.
paper_authors._id: 6477ec65168cb428e01195b2
paper_authors.name: Yuxin Wen
paper_authors.status: claimed_verified
paper_authors.statusLastChangedAt: 2023-06-01T05:54:42.869Z
paper_authors._id: 62cda27d248f9e6bc20c4261
paper_authors.avatarUrl: /avatars/907b9464071ff7ed1ff064331595f12f.svg
paper_authors.fullname: Yuxin Wen
paper_authors.type: user
paper_authors.user: ywen
paper_authors._id: 6477ec65168cb428e01195b3
paper_authors.name: John Kirchenbauer
paper_authors.status: admin_assigned
paper_authors.statusLastChangedAt: 2023-06-01T08:05:55.217Z
paper_authors._id: 63d98af1897746d6496177df
paper_authors.avatarUrl: /avatars/c5d0031c796a3c11bcb0d01b959168dc.svg
paper_authors.fullname: John Kirchenbauer
paper_authors.type: user
paper_authors.user: jwkirchenbauer
paper_authors._id: 6477ec65168cb428e01195b4
paper_authors.name: Jonas Geiping
paper_authors.status: admin_assigned
paper_authors.statusLastChangedAt: 2023-06-01T08:06:48.444Z
paper_authors._id: 63d86dbf3130cadcaf8bdd11
paper_authors.avatarUrl: /avatars/29d79a0c6dcec01111ef192fecd0fa7a.svg
paper_authors.fullname: Jonas Geiping
paper_authors.type: user
paper_authors.user: JonasGeiping
paper_authors._id: 6477ec65168cb428e01195b5
paper_authors.name: Tom Goldstein
paper_authors.status: admin_assigned
paper_authors.statusLastChangedAt: 2023-06-01T08:07:24.092Z
paper_authors._id: 6381ca7d65dc156aba0b933d
paper_authors.avatarUrl: /avatars/84dfdca8e1cd6fbf50d6fb2a6f1b488d.svg
paper_authors.fullname: Tom Goldstein
paper_authors.type: user
paper_authors.user: tomgoldstein
paper_title: Tree-Ring Watermarks: Fingerprints for Diffusion Images that are
    Invisible and Robust
paper_summary: Watermarking the outputs of generative models is a crucial technique for
  tracing copyright and preventing potential harm from AI-generated content. In
  this paper, we introduce a novel technique called Tree-Ring Watermarking that
  robustly fingerprints diffusion model outputs. Unlike existing methods that
  perform post-hoc modifications to images after sampling, Tree-Ring Watermarking
  subtly influences the entire sampling process, resulting in a model fingerprint
  that is invisible to humans. The watermark embeds a pattern into the initial
  noise vector used for sampling. These patterns are structured in Fourier space
  so that they are invariant to convolutions, crops, dilations, flips, and
  rotations. After image generation, the watermark signal is detected by
  inverting the diffusion process to retrieve the noise vector, which is then
  checked for the embedded signal. We demonstrate that this technique can be
  easily applied to arbitrary diffusion models, including text-conditioned Stable
  Diffusion, as a plug-in with negligible loss in FID. Our watermark is
  semantically hidden in the image space and is far more robust than watermarking
  alternatives that are currently deployed. Code is available at
  github.com/YuxinWenRick/tree-ring-watermark.
paper_ai_keywords: diffusion model outputs Tree-Ring Watermarking sampling process noise vector Fourier space convolutions crops dilations flips rotations inverting the diffusion process FID text-conditioned Stable Diffusion image space