UniMark: Unified Adaptive Multi-bit Watermarking for Autoregressive Image Generators

• URL: http://arxiv.org/abs/2604.11843v1
• Date: Sun, 12 Apr 2026 16:22:24 GMT
• Title: UniMark: Unified Adaptive Multi-bit Watermarking for Autoregressive Image Generators
• Abstract summary: We propose a training-free, unified watermarking framework for autoregressive image generators.<n>method introduces three core components: textbf Semantic Grouping (ASG), textbfBlockwise Multi-bit.<n>Experiments on three AR models demonstrate that method achieves state-of-the-art performance in image quality (FID), watermark detection accuracy, and multi-bit message extraction.
• Score: 1.7507301683087861
• License: http://arxiv.org/licenses/nonexclusive-distrib/1.0/
• Abstract: Invisible watermarking for autoregressive (AR) image generation has recently gained attention as a means of protecting image ownership and tracing AI-generated content. However, existing approaches suffer from three key limitations: (1) they embed only zero-bit watermarks for binary verification, lacking the ability to convey multi-bit messages; (2) they rely on static codebook partitioning strategies that are vulnerable to security attacks once the partition is exposed; and (3) they are designed for specific AR architectures, failing to generalize across diverse AR paradigms. We propose \method{}, a training-free, unified watermarking framework for autoregressive image generators that addresses all three limitations. \method{} introduces three core components: \textbf{Adaptive Semantic Grouping (ASG)}, which dynamically partitions codebook entries based on semantic similarity and a secret key, ensuring both image quality preservation and security; \textbf{Block-wise Multi-bit Encoding (BME)}, which divides the token sequence into blocks and encodes different bits across blocks with error-correcting codes for reliable message transmission; and \textbf{a Unified Token-Replacement Interface (UTRI)} that abstracts the watermark embedding process to support both next-token prediction (e.g., LlamaGen) and next-scale prediction (e.g., VAR) paradigms. We provide theoretical analysis on detection error rates and embedding capacity. Extensive experiments on three AR models demonstrate that \method{} achieves state-of-the-art performance in image quality (FID), watermark detection accuracy, and multi-bit message extraction, while maintaining robustness against cropping, JPEG compression, Gaussian noise, blur, color jitter, and random erasing attacks.

Related papers

• SpreadMark: Robust Image Watermarking via Spread-Spectrum Embedding [35.24760637584417]
  We revisit spread-spectrum embedding, a classical watermarking principle, inside a modern neural post-hoc watermarking architecture.<n>Our starting point is a measurement: in existing encoder-decoder schemes each message bit occupies only a small fraction of the image.<n> SpreadMark spreads each bit as a dense pseudo-random codeword over the whole image and recovers it by matched-filtering a learned cover-suppressed chip representation.
  arXiv  Detail & Related papers  (2026-08-04T05:52:17Z)
• SKeDA: A Generative Watermarking Framework for Text-to-video Diffusion Models [40.540302276054376]
  We propose a generative watermarking framework tailored for text-to-video diffusion models.<n> SKeDA consists of two components: (1) Shuffle-Key-based Distribution-preserving Sampling (SKe) employs a single base pseudo-random binary sequence for watermark encryption and derives frame-level encryption sequences through permutation.<n>Extensive experiments demonstrate that SKeDA preserves high video generation quality and watermark robustness.
  arXiv  Detail & Related papers  (2026-02-27T06:18:03Z)
• Adapter Shield: A Unified Framework with Built-in Authentication for Preventing Unauthorized Zero-Shot Image-to-Image Generation [74.5813283875938]
  Zero-shot image-to-image generation poses substantial risks related to intellectual property violations.<n>This work presents Adapter Shield, the first universal and authentication-integrated solution aimed at defending personal images from misuse.<n>Our method surpasses existing state-of-the-art defenses in blocking unauthorized zero-shot image synthesis.
  arXiv  Detail & Related papers  (2025-11-25T04:49:16Z)
• Seg-VAR: Image Segmentation with Visual Autoregressive Modeling [60.79579744943664]
  We propose a novel framework that rethinks segmentation as a conditional autoregressive mask generation problem.<n>This is achieved by replacing the discriminative learning with the latent learning process.<n>Our method incorporates three core components: (1) an image encoder generating latent priors from input images, (2) a spatial-aware seglat (a latent expression of segmentation mask) encoder that maps segmentation masks into discrete latent tokens, and (3) a decoder reconstructing masks from these latents.
  arXiv  Detail & Related papers  (2025-11-16T13:36:19Z)
• T2SMark: Balancing Robustness and Diversity in Noise-as-Watermark for Diffusion Models [89.29541056113442]
  T2SMark is a two-stage watermarking scheme based on Tail-Truncated Sampling (TTS)<n>We evaluate T2SMark on diffusion models with both U-Net and DiT backbones.
  arXiv  Detail & Related papers  (2025-10-25T16:55:55Z)
• TokenAR: Multiple Subject Generation via Autoregressive Token-level enhancement [87.82338951215131]
  TokenAR is a simple but effective token-level enhancement mechanism to address reference identity confusion problem.<n>Instruct Token Injection plays as a role of extra visual feature container to inject detailed and complementary priors for reference tokens.<n>The identity-token disentanglement strategy (ITD) explicitly guides the token representations toward independently representing the features of each identity.
  arXiv  Detail & Related papers  (2025-10-18T03:36:26Z)
• $\f{D^3}$QE: Learning Discrete Distribution Discrepancy-aware Quantization Error for Autoregressive-Generated Image Detection [85.9202830503973]
  Visual autoregressive (AR) models generate images through discrete token prediction.<n>We propose to leverage Discrete Distribution Discrepancy-aware Quantization Error (D$3$QE) for autoregressive-generated image detection.
  arXiv  Detail & Related papers  (2025-10-07T13:02:27Z)
• RAM++: Robust Representation Learning via Adaptive Mask for All-in-One Image Restoration [94.49712266736141]
  RAM++ is a two-stage framework for all-in-one image restoration.<n>It integrates high-level semantic understanding with low-level texture generation.<n>It addresses the limitations of existing degradation-oriented methods in extreme scenarios.
  arXiv  Detail & Related papers  (2025-09-15T15:24:15Z)
• Towards Robust Red-Green Watermarking for Autoregressive Image Generators [17.784976310663104]
  In this paper, we explore the use of in-generation watermarks in autoregressive (AR) image models.<n>AR models generate images by autoregressively predicting a sequence of visual tokens that are then decoded into pixels.<n>Inspired by red-green watermarks for large language models, we examine token-level watermarking schemes that bias the next-token prediction.<n>We propose two novel watermarking methods that rely on visual token clustering to assign similar tokens to the same set.
  arXiv  Detail & Related papers  (2025-08-08T19:14:22Z)
• TAG-WM: Tamper-Aware Generative Image Watermarking via Diffusion Inversion Sensitivity [76.98973481600002]
  This paper proposes a Tamper-Aware Generative image WaterMarking method named TAG-WM.<n>The proposed method comprises four key modules: a dual-mark joint sampling (DMJS) algorithm for embedding copyright and localization watermarks into the latent space while preserving generative quality.<n>The experimental results demonstrate that TAG-WM achieves state-of-the-art performance in both tampering robustness and localization capability even under distortion.
  arXiv  Detail & Related papers  (2025-06-30T03:14:07Z)
• Watermarking Autoregressive Image Generation [4.335447827531541]
  Watermarking the outputs of generative models has emerged as a promising approach for tracking their provenance.<n>We present the first such approach by adapting language model watermarking techniques to this setting.<n>As our experiments demonstrate, our approach enables reliable and robust watermark detection with theoretically grounded p-values.
  arXiv  Detail & Related papers  (2025-06-19T14:25:51Z)
• RAW: A Robust and Agile Plug-and-Play Watermark Framework for AI-Generated Images with Provable Guarantees [33.61946642460661]
  This paper introduces a robust and agile watermark detection framework, dubbed as RAW. We employ a classifier that is jointly trained with the watermark to detect the presence of the watermark. We show that the framework provides provable guarantees regarding the false positive rate for misclassifying a watermarked image.
  arXiv  Detail & Related papers  (2024-01-23T22:00:49Z)
• Practical Deep Dispersed Watermarking with Synchronization and Fusion [10.633580224539337]
  We propose a practical deep textbfDispersed textbfWatermarking with textbfSynchronization and textbfFusion. Our blind watermarking can achieve better performance: averagely improve the bit accuracy by 5.28% and 5.93% against single and combined attacks, respectively.
  arXiv  Detail & Related papers  (2023-10-23T03:34:05Z)

This list is automatically generated from the titles and abstracts of the papers in this site.

This site does not guarantee the quality of this site (including all information) and is not responsible for any consequences.