OptMark: Robust Multi-bit Diffusion Watermarking via Inference Time Optimization (2508.21727v1)

Abstract: Watermarking diffusion-generated images is crucial for copyright protection and user tracking. However, current diffusion watermarking methods face significant limitations: zero-bit watermarking systems lack the capacity for large-scale user tracking, while multi-bit methods are highly sensitive to certain image transformations or generative attacks, resulting in a lack of comprehensive robustness. In this paper, we propose OptMark, an optimization-based approach that embeds a robust multi-bit watermark into the intermediate latents of the diffusion denoising process. OptMark strategically inserts a structural watermark early to resist generative attacks and a detail watermark late to withstand image transformations, with tailored regularization terms to preserve image quality and ensure imperceptibility. To address the challenge of memory consumption growing linearly with the number of denoising steps during optimization, OptMark incorporates adjoint gradient methods, reducing memory usage from O(N) to O(1). Experimental results demonstrate that OptMark achieves invisible multi-bit watermarking while ensuring robust resilience against valuemetric transformations, geometric transformations, editing, and regeneration attacks.

• The paper presents a dual-watermarking strategy that embeds structural and detail watermarks during diffusion denoising to achieve high robustness against transformations.
• It employs inference-time optimization with adjoint gradient methods to minimize memory usage while maintaining watermark fidelity.
• Extensive experiments show that OptMark preserves image quality, validated by FID and CLIP metrics, and outperforms existing watermarking techniques.

OptMark: Robust Multi-bit Diffusion Watermarking via Inference Time Optimization

Introduction

The paper introduces "OptMark," an innovative approach to embedding robust multi-bit watermarks within images generated through diffusion models. This method addresses key limitations in existing watermarking techniques, particularly in robustness against large-scale image transformations and generative attacks while preserving image quality. OptMark leverages inference-time optimization during the diffusion denoising process to strategically inject structural and detail watermarks at different stages, ensuring resilience and imperceptibility.

Figure 1: Pipeline of our end-to-end optimized OptMark.

Methodology

Dual Watermarking Mechanism

The core of OptMark is its dual watermarking system, which introduces watermarks at two critical stages of the diffusion process. The structural watermark is embedded at the initial step, providing resistance against generative attacks. Meanwhile, the detail watermark is added at a later denoising stage to withstand physical image alterations such as cropping and resizing.

Figure 2: OptMark’s imprinting process consists of two sequential stages: first, a structure watermark is injected into the initial latent state of generation; then, a detail watermark is embedded at an intermediate timestep. These complementary watermarks work in concert to maximize overall robustness.

Optimization Approach

OptMark employs an inference-time optimization strategy. Using adjoint gradient methods significantly reduces memory consumption, making it feasible to optimize watermarks across multiple denoising steps. This approach ensures that the computational requirements do not exponentially grow with the complexity of the diffusion process.

Image Quality Preservation

To maintain high image quality, OptMark incorporates several quality-preserving components. These include specialized embedding strategies and constraints to regulate statistical properties of the watermarks, ensuring minimal perceptual impact. The model is designed to keep the latent distribution as close as possible to the original, unaltered distribution.

Figure 3: Predicted Guidance Noise during generation.

Experiments and Results

The experimental evaluation of OptMark demonstrates superior performance compared to existing methods like SSL Watermark, Gaussian Shading, and AquaLoRA. These comparisons showcase OptMark's robustness under various transformations, including geometric, valuemetric, and regeneration attacks.

Robustness Analysis

OptMark achieved high watermark detection accuracy across different types of transformations, outperforming competitors in maintaining watermark integrity after substantial image modifications. This robustness can be attributed to the dual-watermark strategy and optimized embedding techniques, which effectively embed and protect the multi-bit information across diverse scenarios.

Image Quality Assessment

Quantitatively and qualitatively, images generated with OptMark show negligible degradation in quality. Metrics such as FID and CLIP scores indicate that OptMark preserves both visual fidelity and alignment with textual prompts, maintaining the integrity and perceptual quality of the output images.

Figure 4: Qualitative comparison of image quality between SSL Watermark and OptMark.

Conclusion

OptMark sets a new standard for diffusion model watermarking by successfully balancing robustness against manipulations and high visual fidelity. Its dual-watermark mechanism and inference-time optimization showcase a flexible and efficient approach that can be adapted to various diffusion models and applications, reflecting strong potential for practical deployment in content protection and copyright verification systems.

By addressing key challenges in digital watermarking, OptMark represents a significant advancement in the field, offering a sophisticated solution capable of preserving both the functionality and aesthetics of AI-generated content. Future work might explore further enhancements in extraction robustness without compromising on memory efficiency or watermark capacity.