Watermarking images is critical for tracking image provenance and claiming ownership. With the advent of generative models, such as stable diffusion, able to create fake but realistic images, watermarking has become particularly important, e.g., to make generated images reliably identifiable. Unfortunately, the very same stable diffusion technology can remove watermarks injected using existing methods. To address this problem, we present a ZoDiac, which uses a pre-trained stable diffusion model to inject a watermark into the trainable latent space, resulting in watermarks that can be reliably detected in the latent vector, even when attacked. We evaluate ZoDiac on three benchmarks, MS-COCO, DiffusionDB, and WikiArt, and find that ZoDiac is robust against state-of-the-art watermark attacks, with a watermark detection rate over 98% and a false positive rate below 6.4%, outperforming state-of-the-art watermarking methods. Our research demonstrates that stable diffusion is a promising approach to robust watermarking, able to withstand even stable-diffusion-based attacks.

翻译：图像水印对于追踪图像来源和声明所有权至关重要。随着生成模型（如稳定扩散）能够生成逼真的虚假图像，水印技术变得尤为重要——例如确保生成的图像可被可靠识别。然而，这种稳定扩散技术本身可被用于移除现有方法注入的水印。为解决这一问题，我们提出ZoDiac方法，利用预训练的稳定扩散模型将水印注入可训练的潜在空间中，使得即使遭受攻击，水印仍可在潜在向量中被可靠检测。我们在MS-COCO、DiffusionDB和WikiArt三个基准数据集上评估ZoDiac，发现其对现有最先进水印攻击具有鲁棒性：水印检测率超过98%，假阳性率低于6.4%，性能优于当前最优水印方法。我们的研究表明，稳定扩散是实现鲁棒性水印的可行方案，甚至能抵御基于稳定扩散的攻击。