Watermarking the outputs of generative models is a crucial technique for tracing copyright and preventing potential harm from AI-generated content. In this paper, we introduce a novel technique called Tree-Ring Watermarking that robustly fingerprints diffusion model outputs. Unlike existing methods that perform post-hoc modifications to images after sampling, Tree-Ring Watermarking subtly influences the entire sampling process, resulting in a model fingerprint that is invisible to humans. The watermark embeds a pattern into the initial noise vector used for sampling. These patterns are structured in Fourier space so that they are invariant to convolutions, crops, dilations, flips, and rotations. After image generation, the watermark signal is detected by inverting the diffusion process to retrieve the noise vector, which is then checked for the embedded signal. We demonstrate that this technique can be easily applied to arbitrary diffusion models, including text-conditioned Stable Diffusion, as a plug-in with negligible loss in FID. Our watermark is semantically hidden in the image space and is far more robust than watermarking alternatives that are currently deployed. Code is available at github.com/YuxinWenRick/tree-ring-watermark.

翻译：对生成模型输出进行水印处理是一项关键技术，用于追溯版权并防止AI生成内容可能带来的危害。本文提出一种名为树轮水印（Tree-Ring Watermarking）的新技术，可对扩散模型输出进行鲁棒性指纹识别。与现有方法在采样后对图像进行后处理修改不同，树轮水印巧妙影响整个采样过程，生成人类视觉不可见的模型指纹。该水印将特定模式嵌入用于采样的初始噪声向量中，这些模式在傅里叶空间结构化设计，使其对卷积、裁剪、膨胀、翻转和旋转等操作具有不变性。图像生成后，通过逆向扩散过程重构噪声向量并检测其中嵌入的指纹信号。实验表明，该技术可作为即插即用模块轻松应用于任意扩散模型（包括文本条件控制的Stable Diffusion），且对FID分数的损耗可忽略不计。该水印在图像空间中实现语义级隐藏，其鲁棒性远超当前部署的其他水印方案。代码已开源：github.com/YuxinWenRick/tree-ring-watermark。