Watermarking is a tool for actively identifying and attributing the images generated by latent diffusion models. Existing methods face the dilemma of image quality and watermark robustness. Watermarks with superior image quality usually have inferior robustness against attacks such as blurring and JPEG compression, while watermarks with superior robustness usually significantly damage image quality. This dilemma stems from the traditional paradigm where watermarks are injected and detected in pixel space, relying on pixel perturbation for watermark detection and resilience against attacks. In this paper, we highlight that an effective solution to the problem is to both inject and detect watermarks in the latent diffusion space, and propose Latent Watermark with a progressive training strategy. It weakens the direct connection between quality and robustness and thus alleviates their contradiction. We conduct evaluations on two datasets and against 10 watermark attacks. Six metrics measure the image quality and watermark robustness. Results show that compared to the recently proposed methods such as StableSignature, StegaStamp, RoSteALS, LaWa, TreeRing, and DiffuseTrace, LW not only surpasses them in terms of robustness but also offers superior image quality. Our code will be available at https://github.com/RichardSunnyMeng/LatentWatermark.

翻译：水印是一种主动识别和归因于潜在扩散模型生成图像的工具。现有方法面临图像质量与水印鲁棒性之间的两难困境：具有优异图像质量的水印通常对模糊处理和JPEG压缩等攻击的鲁棒性较差，而具有优异鲁棒性的水印通常会显著损害图像质量。这一困境源于传统范式，即水印在像素空间中进行嵌入和检测，依赖像素扰动来实现水印检测并抵御攻击。本文指出，该问题的有效解决方案是在潜在扩散空间中进行水印的嵌入与检测，并提出了采用渐进式训练策略的潜在水印方法。该方法弱化了质量与鲁棒性之间的直接关联，从而缓解了二者之间的矛盾。我们在两个数据集上针对10种水印攻击进行了评估，使用六项指标衡量图像质量与水印鲁棒性。结果表明，与近期提出的StableSignature、StegaStamp、RoSteALS、LaWa、TreeRing及DiffuseTrace等方法相比，LW不仅在鲁棒性方面超越现有方法，同时提供了更优的图像质量。我们的代码将在https://github.com/RichardSunnyMeng/LatentWatermark 公开。