Protecting the copyright of user-generated AI images is an emerging challenge as AIGC becomes pervasive in creative workflows. Existing watermarking methods (1) remain vulnerable to real-world adversarial threats, often forced to trade off between defenses against spoofing and removal attacks; and (2) cannot support semantic-level tamper localization. We introduce PAI, a training-free inherent watermarking framework for AIGC copyright protection, plug-and-play with diffusion-based AIGC services. PAI simultaneously provides three key functionalities: robust ownership verification, attack detection, and semantic-level tampering localization. Unlike existing inherent watermark methods that only embed watermarks at noise initialization of diffusion models, we design a novel key-conditioned deflection mechanism that subtly steers the denoising trajectory according to the user key. Such trajectory-level coupling further strengthens the semantic entanglement of identity and content, thereby further enhancing robustness against real-world threats. Moreover, we also provide a theoretical analysis proving that only the valid key can pass verification. Experiments across 12 attack methods show that PAI achieves 98.43\% verification accuracy, improving over SOTA methods by 37.25\% on average, and retains strong tampering localization performance even against advanced AIGC edits. Our code is available at https://github.com/QingyuLiu/PAI.

翻译：随着AIGC在创意工作流程中的普及，保护用户生成AI图像的版权已成为新兴挑战。现有水印方法存在两大局限：(1) 仍易受现实世界对抗性威胁影响，常被迫在防伪造与防去除攻击之间进行权衡；(2) 无法支持语义级篡改定位。本文提出PAI——一种免训练的固有水印框架，可与基于扩散的AIGC服务即插即用。PAI同步提供三大核心功能：鲁棒所有权验证、攻击检测及语义级篡改定位。区别于现有仅将水印嵌入扩散模型噪声初始化的固有水印方法，我们设计了一种新颖的密钥条件偏转机制，能根据用户密钥精妙引导去噪轨迹。这种轨迹级耦合进一步强化了身份与内容的语义纠缠，从而显著提升对现实威胁的鲁棒性。此外，我们通过理论分析证明仅有效密钥可通过验证。在12种攻击方法上的实验表明，PAI实现了98.43%的验证准确率，较现有最优方法平均提升37.25%，即使面对高级AIGC编辑仍保持强大的篡改定位性能。代码已开源：https://github.com/QingyuLiu/PAI。