AngelFingerprint: A Traceable, Explainable, and White-Box Stealthy Watermark for Text-Guided Image Editing

• URL: http://arxiv.org/abs/2609.04709v1
• Date: Fri, 04 Sep 2026 04:29:23 GMT
• Title: AngelFingerprint: A Traceable, Explainable, and White-Box Stealthy Watermark for Text-Guided Image Editing
• Abstract summary: We propose AngelFingerprint, a novel watermarking framework ensuring edit traceability, explainability, and white-box stealthiness.<n>It embeds the editing prompt's CLIP text embedding directly into the model's weights. An extractor then recovers this embedding from the image pixels alone.<n>On the MagicBrush dataset, our extractor achieves $86%$ top-1 accuracy in a 200-way prompt retrieval, versus $20%$ for prompt inversion.
• Score: 19.14048800395326
• License: http://creativecommons.org/licenses/by/4.0/
• Abstract: Text-guided diffusion editing raises disinformation concerns, making reliable image provenance essential. While watermarks are commonly used for this purpose, most methods carry a fixed ID that cannot explain what was changed and which prompt produced it. Furthermore, under open-source white-box access, attackers can easily locate and remove watermarks added as separate modules. Targeting this setting, we propose AngelFingerprint, a novel watermarking framework ensuring edit traceability, explainability, and white-box stealthiness. It integrates a LoRA into the diffusion model to embed the editing prompt's CLIP text embedding directly into the model's weights. An extractor then recovers this embedding from the image pixels alone. This semantic payload explains the edit, while the weight-integrated design makes it hard to detect and isolate even under full white-box access. Two techniques make this possible: a velocity-alignment anchor that preserves edit quality, and a specially designed frequency filter that keeps the watermark imperceptible yet recoverable and robust. On the MagicBrush dataset, our extractor achieves $86\%$ top-1 accuracy in a 200-way prompt retrieval, versus $20\%$ for prompt inversion.

Related papers

• Are Watermarked Images Editable? SafeMark for Watermark-Preserving Text-Guided Image Editing [16.57604502387633]
  SafeMark is a framework for watermark-preserving text-guided image manipulation.<n>It integrates watermark integrity into the editing process.<n>It is compatible with differentiable diffusion-based editors.
  arXiv  Detail & Related papers  (2026-05-19T08:08:40Z)
• CSGuard: Toward Forgery-Resistant Watermarking in Diffusion Models via Compressed Sensing Constraint [20.49818370567961]
  Latent-based diffusion model watermarking embeds watermarks into generated images' latent space to enable content attribution.<n>However, attackers can extract the watermark by inverting the watermarked image and re-generating it with an arbitrary prompt, thereby enabling false attribution on malicious content.<n>We propose the CSGuard, the first forgery-resistant watermarking schema that leverages compressed sensing to bind the watermarked image generation and verification to a secret matrix.
  arXiv  Detail & Related papers  (2026-05-02T14:54:09Z)
• Editing Away the Evidence: Diffusion-Based Image Manipulation and the Failure Modes of Robust Watermarking [0.3644540605358075]
  diffusion-based image editing injects noise and reconstructs images through a powerful generative prior.<n>We show that non-adversarial diffusion editing can unintentionally degrade or remove robust watermarks.<n>Results indicate that even routine semantic edits can significantly reduce watermark recoverability.
  arXiv  Detail & Related papers  (2026-03-13T12:46:27Z)
• SemBind: Binding Diffusion Watermarks to Semantics Against Black-Box Forgery Attacks [74.76909939060833]
  Black-box forgery attacks pose outsized risk to provenance and trust.<n>We propose SemBind, a framework for latent-based watermarks that resists black-box forgery.<n>We show that SemBind-enabled anti-forgery variants markedly reduce false acceptance under black-box forgery.
  arXiv  Detail & Related papers  (2026-01-28T07:02:40Z)
• Diffusion-Based Image Editing: An Unforeseen Adversary to Robust Invisible Watermarks [4.138397555991069]
  Powerful diffusion-based image generation and editing models can inadvertently remove or distort embedded watermarks.<n>We present a theoretical and empirical analysis demonstrating that diffusion-based image editing can effectively break state-of-the-art robust watermarks.<n>We propose a diffusion-driven attack that uses generative image regeneration to erase watermarks from a given image.
  arXiv  Detail & Related papers  (2025-11-05T16:20:29Z)
• FlashEdit: Decoupling Speed, Structure, and Semantics for Precise Image Editing [75.29825659756351]
  FlashEdit is a novel framework designed to enable high-fidelity, real-time image editing.<n>Its efficiency stems from three key innovations: (1) a One-Step Inversion-and-Editing (OSIE) pipeline that bypasses costly iterative processes; (2) a Background Shield (BG-Shield) technique that guarantees background preservation by selectively modifying features only within the edit region; and (3) a Sparsified Spatial Cross-Attention (SSCA) mechanism that ensures precise, localized edits by suppressing semantic leakage to the background.
  arXiv  Detail & Related papers  (2025-09-26T11:59:30Z)
• AquaLoRA: Toward White-box Protection for Customized Stable Diffusion Models via Watermark LoRA [67.68750063537482]
  Diffusion models have achieved remarkable success in generating high-quality images. Recent works aim to let SD models output watermarked content for post-hoc forensics. We propose textttmethod as the first implementation under this scenario.
  arXiv  Detail & Related papers  (2024-05-18T01:25:47Z)
• DeepEclipse: How to Break White-Box DNN-Watermarking Schemes [60.472676088146436]
  We present obfuscation techniques that significantly differ from the existing white-box watermarking removal schemes. DeepEclipse can evade watermark detection without prior knowledge of the underlying watermarking scheme. Our evaluation reveals that DeepEclipse excels in breaking multiple white-box watermarking schemes.
  arXiv  Detail & Related papers  (2024-03-06T10:24:47Z)
• Robust-Wide: Robust Watermarking against Instruction-driven Image Editing [21.69779516621288]
  Malicious users can easily exploit instruction-driven image editing to create fake images. We propose Robust-Wide, the first robust watermarking methodology against instruction-driven image editing. Experiments demonstrate that Robust-Wide can effectively extract the watermark from the edited image with a low bit error rate of nearly 2.6%.
  arXiv  Detail & Related papers  (2024-02-20T03:33:54Z)
• Tree-Ring Watermarks: Fingerprints for Diffusion Images that are Invisible and Robust [55.91987293510401]
  Watermarking the outputs of generative models is a crucial technique for tracing copyright and preventing potential harm from AI-generated content. We introduce a novel technique called Tree-Ring Watermarking that robustly fingerprints diffusion model outputs. Our watermark is semantically hidden in the image space and is far more robust than watermarking alternatives that are currently deployed.
  arXiv  Detail & Related papers  (2023-05-31T17:00:31Z)
• WDNet: Watermark-Decomposition Network for Visible Watermark Removal [61.14614115654322]
  The uncertainty of the size, shape, color and transparency of watermarks set a huge barrier for image-to-image translation techniques. We combine traditional watermarked image decomposition into a two-stage generator, called Watermark-Decomposition Network (WDNet) The decomposition formulation enables WDNet to separate watermarks from the images rather than simply removing them.
  arXiv  Detail & Related papers  (2020-12-14T15:07:35Z)

This list is automatically generated from the titles and abstracts of the papers in this site.

This site does not guarantee the quality of this site (including all information) and is not responsible for any consequences.