Watermarking in Diffusion Model: Gaussian Shading with Exact Diffusion Inversion via Coupled Transformations (EDICT)
Krishna Panthi
School of Computing, Clemson Universitykpanthi@clemson.edu
Images rendered using EDICT vs. without using EDICT with same prompts.
| Using EDICT |  |  |  |  |  |
| Not using EDICT |  |  |  |  |  |
Summary
This research implements Exact Diffusion Inversion via Coupled Transformation (EDICT) [1] with the Gaussian Shading [2] watermarking technique for stable diffusion models. The results show a slight improvement in the performance of Gaussian Shading. The implementation is tested on manipulated images after watermarking, and results in the table below shows better performance for most image manipulation methods, except for ColorJitter and Salt & Pepper Noise. For more details, please refer to the paper.Results
Table 1. The following table shows the results obtained by testing our method against the baseline. It demonstrates that when EDICT is used, performance improves or remains consistent across all image manipulation methods, except when brightness is increased (ColorJitter) and when Salt & Pepper noise is added.- TPR: True Precision Rate with fixed false positive rate of 1e-6
- mean_acc: Mean bit accuracy
- std_acc: Standard deviation on bit accuracy
| Image Manipulations | TPR_detection ↑ | TPR_traceability ↑ | mean_acc (higher is better) ↑ | std_acc (smaller is better) ↓ | ||||
|---|---|---|---|---|---|---|---|---|
| Default | EDICT | Default | EDICT | Default | EDICT | Default | EDICT | |
| ColorJitter (f = 6) | 0.979 | 0.959 | 0.957 | 0.934 | 0.952 | 0.939 | 0.092 | 0.107 |
| GauBlur (r=4) | 1 | 1 | 1 | 1 | 0.985 | 0.988 | 0.020 | 0.015 |
| GauNoise | 0.995 | 0.998 | 0.986 | 0.995 | 0.954 | 0.971 | 0.070 | 0.053 |
| Identity | 1 | 1 | 1 | 1 | 1 | 1 | 0.0 | 0.0 |
| Jpeg (QF 25) | 1 | 1 | 1 | 1 | 0.987 | 0.987 | 0.031 | 0.032 |
| MedBlur (k=7) | 1 | 1 | 1 | 1 | 1 | 1 | 0.005 | 0.002 |
| RandomCrop (60%) | 1 | 1 | 1 | 1 | 0.975 | 0.976 | 0.017 | 0.013 |
| RandomDrop (80%) | 1 | 1 | 0.998 | 1 | 0.966 | 0.969 | 0.029 | 0.013 |
| Resize (25%) | 1 | 1 | 1 | 1 | 0.999 | 1 | 0.010 | 0.003 |
| S&PNoise (p=0.05) | 1 | 1 | 0.999 | 1 | 0.935 | 0.934 | 0.071 | 0.067 |
- Detection: (image generated by this model)
- Traceability: (image generated by this user)
- Experiments conducted with stable diffusion v2.1 with [Gustavosta/Stable-Diffusion-Prompts] (1000 prompts/images).
- Watermark capacity: 256 bits
References
[1]Wallace, Bram, Akash Gokul, and Nikhil Naik. "Edict: Exact diffusion inversion via coupled transformations." Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition. 2023.
[2]Yang, Zijin, et al. "Gaussian Shading: Provable Performance-Lossless Image Watermarking for Diffusion Models." Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition. 2024.