Transferable Multi-Bit Watermarking Across Frozen Diffusion Models via Latent Consistency Bridges

• URL: http://arxiv.org/abs/2603.20304v1
• Date: Thu, 19 Mar 2026 13:13:34 GMT
• Title: Transferable Multi-Bit Watermarking Across Frozen Diffusion Models via Latent Consistency Bridges
• Abstract summary: We propose DiffMark, a plug-and-play watermarking method that offers single-pass multi-bit detection, per-image key flexibility, and cross-model transferability.<n>DiffMark also maintains competitive watermark robustness against distortion, regeneration, and adversarial attacks.
• Score: 1.189955933770711
• License: http://creativecommons.org/licenses/by-nc-nd/4.0/
• Abstract: As diffusion models (DMs) enable photorealistic image generation at unprecedented scale, watermarking techniques have become essential for provenance establishment and accountability. Existing methods face challenges: sampling-based approaches operate on frozen models but require costly $N$-step Denoising Diffusion Implicit Models (DDIM) inversion (typically N=50) for zero-bit-only detection; fine-tuning-based methods achieve fast multi-bit extraction but couple the watermark to a specific model checkpoint, requiring retraining for each architecture. We propose DiffMark, a plug-and-play watermarking method that offers three key advantages over existing approaches: single-pass multi-bit detection, per-image key flexibility, and cross-model transferability. Rather than encoding the watermark into the initial noise vector, DiffMark injects a persistent learned perturbation $δ$ at every denoising step of a completely frozen DM. The watermark signal accumulates in the final denoised latent $z_0$ and is recovered in a single forward pass. The central challenge of backpropagating gradients through a frozen UNet without traversing the full denoising chain is addressed by employing Latent Consistency Models (LCM) as a differentiable training bridge. This reduces the number of gradient steps from 50 DDIM to 4 LCM and enables a single-pass detection at 16.4 ms, a 45x speedup over sampling-based methods. Moreover, by this design, the encoder learns to map any runtime secret to a unique perturbation at inference time, providing genuine per-image key flexibility and transferability to unseen diffusion-based architectures without per-model fine-tuning. Although achieving these advantages, DiffMark also maintains competitive watermark robustness against distortion, regeneration, and adversarial attacks.

Related papers

• OSI: One-step Inversion Excels in Extracting Diffusion Watermarks [56.210696479553945]
  We propose One-step Inversion (OSI), a significantly faster and more accurate method for extracting Gaussian Shading style watermarks.<n>OSI reformulates watermark extraction as a learnable sign classification problem, which eliminates the need for precise regression of the initial noise.<n>Our OSI substantially outperforms the multi-step diffusion inversion method: it is 20x faster, achieves higher extraction accuracy, and doubles the watermark payload capacity.
  arXiv  Detail & Related papers  (2026-02-10T07:43:16Z)
• T2SMark: Balancing Robustness and Diversity in Noise-as-Watermark for Diffusion Models [89.29541056113442]
  T2SMark is a two-stage watermarking scheme based on Tail-Truncated Sampling (TTS)<n>We evaluate T2SMark on diffusion models with both U-Net and DiT backbones.
  arXiv  Detail & Related papers  (2025-10-25T16:55:55Z)
• OptMark: Robust Multi-bit Diffusion Watermarking via Inference Time Optimization [66.69924980864053]
  We propose OptMark, an optimization-based approach that embeds a robust multi-bit watermark into the intermediate latents of the diffusion denoising process.<n> OptMark strategically inserts a structural watermark early to resist generative attacks and a detail watermark late to withstand image transformations.<n> Experimental results demonstrate that OptMark achieves invisible multi-bit watermarking while ensuring robust resilience against valuemetric transformations, geometric transformations, editing, and regeneration attacks.
  arXiv  Detail & Related papers  (2025-08-29T15:50:59Z)
• DiffMark: Diffusion-based Robust Watermark Against Deepfakes [49.05095089309156]
  Deepfakes pose significant security and privacy threats through malicious facial manipulations.<n>Existing watermarking methods often lack sufficient robustness against Deepfake manipulations.<n>We propose a novel robust watermarking framework based on diffusion model, called DiffMark.
  arXiv  Detail & Related papers  (2025-07-02T07:29:33Z)
• GaussMarker: Robust Dual-Domain Watermark for Diffusion Models [9.403937469402871]
  GaussMarker efficiently achieves state-of-the-art performance under eight image distortions and four advanced attacks across three versions of Stable Diffusion.<n>This paper presents the first dual-domain DM watermarking approach using a pipelined injector to consistently embed watermarks in both the spatial and frequency domains.
  arXiv  Detail & Related papers  (2025-06-13T03:45:15Z)
• JIGMARK: A Black-Box Approach for Enhancing Image Watermarks against Diffusion Model Edits [76.25962336540226]
  JIGMARK is a first-of-its-kind watermarking technique that enhances robustness through contrastive learning. Our evaluation reveals that JIGMARK significantly surpasses existing watermarking solutions in resilience to diffusion-model edits.
  arXiv  Detail & Related papers  (2024-06-06T03:31:41Z)
• Consistency Trajectory Models: Learning Probability Flow ODE Trajectory of Diffusion [56.38386580040991]
  Consistency Trajectory Model (CTM) is a generalization of Consistency Models (CM) CTM enables the efficient combination of adversarial training and denoising score matching loss to enhance performance. Unlike CM, CTM's access to the score function can streamline the adoption of established controllable/conditional generation methods.
  arXiv  Detail & Related papers  (2023-10-01T05:07:17Z)

This list is automatically generated from the titles and abstracts of the papers in this site.

This site does not guarantee the quality of this site (including all information) and is not responsible for any consequences.