The availability and accessibility of diffusion models (DMs) have significantly increased in recent years, making them a popular tool for analyzing and predicting the spread of information, behaviors, or phenomena through a population. Particularly, text-to-image diffusion models (e.g., DALLE 2 and Latent Diffusion Models (LDMs) have gained significant attention in recent years for their ability to generate high-quality images and perform various image synthesis tasks. Despite their widespread adoption in many fields, DMs are often susceptible to various intellectual property violations. These can include not only copyright infringement but also more subtle forms of misappropriation, such as unauthorized use or modification of the model. Therefore, DM owners must be aware of these potential risks and take appropriate steps to protect their models. In this work, we are the first to protect the intellectual property of DMs. We propose a simple but effective watermarking scheme that injects the watermark into the DMs and can be verified by the pre-defined prompts. In particular, we propose two different watermarking methods, namely NAIVEWM and FIXEDWM. The NAIVEWM method injects the watermark into the LDMs and activates it using a prompt containing the watermark. On the other hand, the FIXEDWM is considered more advanced and stealthy compared to the NAIVEWM, as it can only activate the watermark when using a prompt containing a trigger in a fixed position. We conducted a rigorous evaluation of both approaches, demonstrating their effectiveness in watermark injection and verification with minimal impact on the LDM's functionality.

翻译：近年来，扩散模型（DMs）的可用性和可及性显著提升，使其成为分析及预测信息、行为或现象在群体中传播的流行工具。特别是文本到图像的扩散模型（例如DALLE 2和潜在扩散模型（LDMs）），因能生成高质量图像并执行多种图像合成任务，近年来备受关注。尽管DMs在众多领域被广泛采用，但其常面临各类知识产权侵犯风险。这些侵权形式不仅包括版权侵犯，还可能涉及更隐蔽的盗用行为，如未经授权使用或修改模型。因此，DM所有者必须意识到这些潜在风险，并采取适当措施保护其模型。本研究首次针对DMs的知识产权保护问题展开工作。我们提出一种简单高效的通用水印方案，该方案将水印注入DMs中，并可通过预定义提示进行验证。具体而言，我们提出了两种水印方法，即NAIVEWM和FIXEDWM。NAIVEWM方法将水印注入LDMs，并通过包含水印的提示激活水印；而FIXEDWM则被认为比NAIVEWM更先进且隐蔽，它仅在使用包含固定位置触发词的提示时激活水印。我们对这两种方法进行了严格评估，证明其在注入和验证水印时具有高效性，且对LDM功能的影响极小。