Ethical concerns surrounding copyright protection and inappropriate content generation pose challenges for the practical implementation of diffusion models. One effective solution involves watermarking the generated images. However, existing methods often compromise the model performance or require additional training, which is undesirable for operators and users. To address this issue, we propose Gaussian Shading, a diffusion model watermarking technique that is both performance-lossless and training-free, while serving the dual purpose of copyright protection and tracing of offending content. Our watermark embedding is free of model parameter modifications and thus is plug-and-play. We map the watermark to latent representations following a standard Gaussian distribution, which is indistinguishable from latent representations obtained from the non-watermarked diffusion model. Therefore we can achieve watermark embedding with lossless performance, for which we also provide theoretical proof. Furthermore, since the watermark is intricately linked with image semantics, it exhibits resilience to lossy processing and erasure attempts. The watermark can be extracted by Denoising Diffusion Implicit Models (DDIM) inversion and inverse sampling. We evaluate Gaussian Shading on multiple versions of Stable Diffusion, and the results demonstrate that Gaussian Shading not only is performance-lossless but also outperforms existing methods in terms of robustness.

翻译：围绕版权保护与不当内容生成的伦理问题，对扩散模型的实际应用构成了挑战。一种有效的解决方案是对生成的图像添加水印。然而，现有方法往往以牺牲模型性能为代价或需要额外训练，这对运营者和用户而言并不理想。为解决这一问题，我们提出高斯着色（Gaussian Shading），这是一种兼具性能无损与无需训练特性的扩散模型水印技术，同时实现版权保护与违规内容溯源的双重目的。我们的水印嵌入无需修改模型参数，因此可直接即插即用。我们将水印映射为服从标准高斯分布的潜在表示，使其与非水印扩散模型生成的潜在表示不可区分，从而以性能无损的方式实现水印嵌入，并为此提供了理论证明。此外，由于水印与图像语义紧密关联，其对有损处理和擦除尝试具有鲁棒性。水印可通过去噪扩散隐式模型（DDIM）反演与逆采样提取。我们在多个版本的Stable Diffusion上对高斯着色进行了评估，结果表明该方法不仅性能无损，在鲁棒性方面也优于现有方法。