---
title: Hermitian Symmetric Fourier Watermarking (SFW)
url: https://www.emergentmind.com/topics/hermitian-symmetric-fourier-watermarking-sfw
type: topic
---

# Hermitian Symmetric Fourier Watermarking (SFW)

Hermitian Symmetric Fourier Watermarking (SFW) is a watermark embedding framework for semantic watermarking in latent diffusion models (LDMs) that enforces Hermitian symmetry in the latent Fourier domain so that the inverse Fourier transform yields a valid real-valued latent signal without discarding watermark information. It was introduced to address what the authors identify as a specific failure mode of prior latent-Fourier semantic watermarking methods: loss of frequency integrity caused by modifying Fourier coefficients in ways that violate Hermitian symmetry and then discarding the imaginary component after inverse FFT. In the reported formulation, SFW is paired with a center-aware embedding strategy for improved cropping robustness and is applied to existing semantic watermarking schemes rather than presented as an entirely separate watermark family [2509.07647].

## 1. Problem setting and motivating failure mode

SFW is situated in semantic watermarking for latent diffusion models, specifically in methods that embed a watermark directly into the latent noise or latent representation used during generation. The workflow considered is: start from latent noise, apply a Fourier transform, insert a structured watermark pattern into a designated Fourier-domain key region, inverse transform back to the latent domain, and generate the image from that watermarked latent. At detection time, an observed image is inverted back into latent space using DDIM inversion, and the latent Fourier key region is examined. The paper characterizes this as a merged-in-generation scheme because watermarking is built into generation itself and adds effectively no post-hoc processing time [2509.07647].

The practical motivation is robustness to regeneration attacks. The evaluation includes VAE-based compression/regeneration using Bmshj18 and Cheng20, and diffusion-based regeneration using the attack of Zhao et al. The stated rationale is that conventional invisible image-domain watermarks are often low-level pixel perturbations that are washed out when the image is re-synthesized, whereas semantic watermarking embeds information into a representation tied to the image’s generated structure in latent space, making it more robust to semantic-preserving transformations, including regeneration [2509.07647].

The central failure mode addressed by SFW is the loss of frequency integrity in prior semantic latent-Fourier methods such as Tree-Ring, RingID, and Zodiac. The paper states that these baselines modify Fourier coefficients without preserving Hermitian symmetry and then retain only the real component after inverse FFT. The reported consequences are twofold: detection and retrieval degrade because the intended watermark pattern is no longer faithfully represented in the frequency domain after inverse transform and reconstruction, and generative quality degrades because the latent noise no longer matches the expected statistics of a real-valued latent noise sample as cleanly. More specifically, the paper states that the real component of the embedded key region retains only partial information, while the imaginary component is almost entirely lost, yielding an “empty key region” there [2509.07647].

This diagnosis makes detectability a question of physical consistency in addition to recognizability. Detection is performed by comparing the extracted Fourier-domain key region with reference keys using \(L_1\) distance. If the embedded spectral pattern is structurally corrupted by inverse transformation and projection back to a real latent, the reference–query alignment weakens, signal energy is lost from the imaginary branch, and the distance gap between matched and unmatched keys shrinks. A plausible implication is that SFW should be understood not merely as stronger signal insertion, but as a constraint that preserves the watermark as a valid spectral object after real-valued reconstruction.

## 2. Hermitian symmetry and frequency integrity

The core principle of SFW is explicit enforcement of Hermitian symmetry of the Fourier coefficients. For a real-valued spatial-domain signal, the 2D discrete Fourier transform must satisfy conjugate symmetry:
\[
F[M-k, N-l] = \overline{F[k,l]},
\]
where \(F\) is the discrete Fourier transform, \(M,N\) are the spatial dimensions, and \(\overline{(\cdot)}\) denotes complex conjugation. This means that every Fourier coefficient must be paired with its conjugate-reflected counterpart around the DC center. If the condition is violated, the inverse Fourier transform is generally complex-valued, but the latent noise supplied to the diffusion model must be real-valued. Prior methods addressed that incompatibility by discarding the imaginary component after inverse transform, which, according to the paper, destroys part of the watermark [2509.07647].

The paper also gives a statistical consistency argument. Real latent noise in the spatial domain is modeled as
\[
f[m,n] \sim \mathcal{N}(0,\sigma^2),
\]
with corresponding Fourier-domain coefficients
\[
F[k,l] \sim \mathcal{CN}(0, MN\sigma^2).
\]
The claim is that real Gaussian latent noise naturally maps to a complex Gaussian spectrum with Hermitian structure. If watermarking preserves that structure, the inverse FFT remains statistically consistent with a real Gaussian latent; if not, truncating imaginary components distorts that consistency [2509.07647].

Not every Fourier location is freely assignable. The paper notes that the imaginary part at the DC center must be zero, and if the dimensions are even, the imaginary components at Nyquist-related self-conjugate points must also be zero. For even \(M,N\), the constrained points are
\[
(0,0),\quad \left(\frac{M}{2},0\right),\quad \left(0,\frac{N}{2}\right),\quad \left(\frac{M}{2},\frac{N}{2}\right).
\]
The authors therefore recommend embedding while avoiding the DC axis as much as possible [2509.07647].

SFW is described as using a free half-region in Fourier space: one half can be designed freely, while the other half is determined by Hermitian symmetry. The paper does not print a general master equation for every conjugate pair, but this is the stated construction logic. This suggests a generic implementation pattern in which an assignment in the free half-region induces its conjugate counterpart in the mirrored half-region. The significance of that constraint is operational rather than purely formal: it preserves both real and imaginary watermark information in a structurally valid way, enables full complex-domain detection, and is intended to improve both retrievability and image fidelity relative to non-Hermitian baselines [2509.07647].

## 3. Embedding framework, variants, and center-aware region selection

SFW is presented as a framework or design principle that can be attached to existing semantic latent-Fourier watermark schemes. The paper explicitly augments Tree-Ring into Hermitian Symmetric Tree-Ring (HSTR) and develops Hermitian Symmetric QR code embedding (HSQR) from RingID-style structured encoding ideas. Unchanged components include the general LDM generation pipeline, DDIM inversion for detection, \(L_1\)-based key matching, the merged-in-generation paradigm, and use of latent Fourier-domain key regions. Modified components are watermark pattern construction, Fourier coefficient placement, symmetry handling, and the central-region embedding choice [2509.07647].

The experimental channel assignments are specific. Tree-Ring is embedded into channel 3 with radius 14. RingID uses a tree-ring pattern in channel 3 with radius range 3–14 plus a Gaussian noise key in channel 0. Both proposed SFW methods follow RingID in using a Gaussian noise key in channel 0. HSQR embeds the QR code in channel 3 [2509.07647].

For HSTR, the underlying Tree-Ring concept is retained, but the embedding is modified so that the Fourier pattern obeys Hermitian symmetry and can use both real and imaginary detection coherently. The paper does not provide an exact low-level numeric synthesis equation for HSTR, stating instead that it “impose[s] the Hermitian symmetry condition directly on the watermark patterns.” That wording limits the precision of reconstruction, but it clearly identifies symmetry enforcement as the defining design change [2509.07647].

HSQR is the most explicit SFW instance. A message is encoded as a version-1 QR code of size \(21\times 21\) cells, with error correction level H and capacity up to 72 bits. The QR code is split in half and embedded separately into the real component of the free half-region and the imaginary component of the free half-region. Each QR cell is represented by multiple Fourier pixels, such as a \(2\times 2\) block, to increase embedded information, reduce errors statistically, and improve robustness. The embedding rule is sign modulation:
\[
\operatorname{HSQR}(\tilde{x}, c) =
\begin{cases}
+|F(\tilde{x}, c)|, & \text{if } \operatorname{QR}(x)=1 \\
-|F(\tilde{x}, c)|, & \text{if } \operatorname{QR}(x)=0,
\end{cases}
\]
where \(x\) denotes QR-code coordinates, \(\tilde{x}\) mapped coordinates in the Fourier embedding region, and \(c\in\{\mathrm{Re},\mathrm{Im}\}\). The paper also states that, “to maintain symmetry while avoiding numerical instability, the embedding region is positioned one pixel to the right of the vertical DC axis” [2509.07647].

The center-aware embedding strategy is a complementary region-selection procedure designed to reduce vulnerability to cropping. Existing baselines Fourier-transform the entire latent spatial matrix before embedding. The proposed strategy instead applies the Fourier transform only to the central spatial area before embedding. For latent spatial dimension \(64\), the authors use the central \(44\times 44\) region. The mechanism is procedural rather than analytic: select the central \(44\times 44\) latent-space region, apply the Fourier transform there, embed the watermark there, inverse transform, and place it back. The paper presents this as a general strategy attachable to semantic watermarking schemes, not something specific to SFW alone [2509.07647].

## 4. Detection, verification, and identification

The detection pipeline begins with a clean or attacked image, applies VAE encoding and DDIM inversion to estimate latent noise, computes the Fourier transform of the recovered latent, extracts the watermark key region, and compares it with reference keys using \(L_1\) distance. The paper explicitly states that \(L_1\) is computed only in the key region of the complex Fourier domain. Verification asks whether a watermark is present; identification asks which watermark or message was embedded [2509.07647].

For verification, the paper defines \(\hat{w}\) as the extracted watermarked latent Fourier key, \(\hat{u}\) as the extracted unwatermarked or null latent Fourier key, and \(w\) as the reference watermark key, with verification based on the distance contrast
\[
d(\hat{w},w)\neq d(\hat{u},w).
\]
Operationally, the system computes a distance to the reference and thresholds it. The principal verification metric for semantic methods is TPR@1%FPR, with AUC and maximum verification accuracy reported in the supplement [2509.07647].

For identification, given candidate reference keys \(w_i\), prediction is nearest-key retrieval:
\[
\hat{i}=\arg\min_i d(\hat{w}, w_i).
\]
Performance is measured by Identification Accuracy or Perfect Match Rate, and identification uses 2,048 keys unless otherwise stated [2509.07647].

HSQR uses an explicit signed-template detector. The ground-truth QR binary pattern is converted into
\[
\operatorname{QR^*}(\tilde{x}, c)=
\begin{cases}
+\Lambda, & \text{if } \operatorname{QR}(x)=1 \\
-\Lambda, & \text{if } \operatorname{QR}(x)=0,
\end{cases}
\]
where \(\Lambda\) is a fixed encoding amplitude. In the experiments, \(\Lambda=45\), which the paper explains by noting that it matches the approximate standard deviation of real and imaginary components in the Fourier domain of a \(64\times 64\) normal Gaussian latent vector, approximately \(\sqrt{64^2/2}\) [2509.07647].

The paper’s ablation study is central to the claimed detection mechanism. It reports four cases:

| Case | Method | Vrf | Idf |
|---|---|---:|---:|
| A | Tree-Ring, no frequency integrity, 2 detection regions | 0.653 | 0.114 |
| B | Tree-Ring, no frequency integrity, real only | 0.805 | 0.416 |
| C | HSTR, SFW, 1 region | 0.936 | 0.775 |
| D | HSTR, SFW, 2 regions | 0.971 | 0.889 |

The stated interpretation is that without SFW, adding imaginary-domain detection hurts, whereas with SFW, using both real and imaginary components gives the best performance. This is one of the clearest demonstrations in the paper that frequency integrity and full complex-domain detection are linked rather than separable engineering choices [2509.07647].

## 5. Experimental setup and reported performance

All reported experiments are conducted with Stable Diffusion v2-1-base at image resolution \(512\times 512\), CFG scale 7.5, DDIM generation steps 50, and DDIM inversion steps 50. Prompts or captions come from MS-COCO 2017 training captions with 5,000 captions, DiffusionDB with 1,001 sampled prompts from the 2M subset, and the Stable-Diffusion-Prompts test set with 8,192 prompts. For detection, the paper uses 1,000 watermarked images per dataset; verification uses 1,000 pairs of watermarked and unwatermarked images; and identification uses 1,000 watermarked images [2509.07647].

The evaluation covers 11 attacks. Signal-processing attacks are brightness adjustment from 0 to 7, contrast factor 0.5, JPEG quality 25, Gaussian blur radius 5, Gaussian noise \(\sigma=0.05\), and BM3D denoising \(\sigma=0.1\). Regeneration attacks are VAE-B (Bmshj18), quality 3; VAE-C (Cheng20), quality 3; and a diffusion-based regeneration attack with 60 denoising steps. Cropping attacks are center crop scale 0.5 and random crop scale 0.7. Supplementary studies vary diffusion attack strength with \(t^*\in\{20,60,100,140,180\}\) and crop scale from 0.2 to 0.8 [2509.07647].

The headline verification results show strong gains for HSTR over Tree-Ring and parity of HSQR with RingID. On MS-COCO average verification, Tree-Ring is reported at 0.655 and HSTR at 0.971; on SD-Prompts, Tree-Ring at 0.641 and HSTR at 0.963; on DiffusionDB, Tree-Ring at 0.622 and HSTR at 0.956. HSQR reaches verification on par with RingID, with MS-COCO average 0.997, SD-Prompts average 0.995, and DiffusionDB average 0.995 [2509.07647].

Identification results are more dramatic. On MS-COCO average identification, Tree-Ring is reported at 0.114, HSTR at 0.889, RingID at 0.964, and HSQR at 0.985. On SD-Prompts, the corresponding values are 0.110, 0.893, 0.962, and 0.988. On DiffusionDB, they are 0.108, 0.889, 0.956, and 0.984. Under diffusion regeneration on MS-COCO identification, Tree-Ring is reported at 0.054, HSTR at 0.971, RingID at 0.998, and HSQR at 0.999. Under stronger supplementary diffusion attacks at noise step 180, Tree-Ring falls to 0.012, HSTR remains at 0.781, RingID at 0.990, and HSQR at 0.997 [2509.07647].

Cropping robustness is tied to center-aware embedding. For MS-COCO center crop and random crop identification, RingID is reported at 0.874 and 0.978, while HSTR and HSQR both reach 1.000 and 1.000 in the main-crop setting. In the supplementary crop-scale study at center crop scale 0.2, RingID is 0.153, HSTR 0.818, and HSQR 0.555; at random crop scale 0.2, RingID is 0.496, HSTR 0.489, and HSQR 0.955. The paper summarizes that at moderate crop scales \( \ge 0.3\), HSTR and HSQR are almost perfect [2509.07647].

Image fidelity is reported using FID against 5,000 MS-COCO ground-truth images and CLIP score using OpenCLIP-ViT/G. Tree-Ring has FID 26.418 and CLIP 0.326; RingID 27.052 and 0.324; HSTR 25.062 and 0.329; and HSQR 24.895 and 0.330. The paper therefore presents the SFW-based methods as achieving not only stronger detectability but also the best image quality metrics among the semantic merged-in-generation methods tested [2509.07647].

## 6. Technical interpretation, scope, and relation to broader Fourier watermarking

The paper’s technical interpretation is that a real latent image or noise sample cannot have an arbitrary complex Fourier spectrum; its spectrum must be conjugate-symmetric. If a watermark violates that condition, inverse FFT no longer corresponds to a valid real latent, and discarding the imaginary part amounts to projection onto an inconsistent subspace. The authors explicitly connect this projection to destruction of intended structure, particular damage to the imaginary watermark branch, weaker contrast between correct and incorrect keys, and worse identification. Supplementary Gaussianity evidence is used to support this account: Tree-Ring latent standard deviation is reported as 0.9620 versus 1.0000 for HSTR, the KS p-value improves from 0.2404 to 0.4227, and the KS failure rate drops from 0.234 to 0.071 [2509.07647].

Several limitations are noted or implied. The method is not aimed at tamper localization or malicious peripheral editing detection. Extreme cropping still degrades performance. Capacity is not unlimited: average identification for HSTR declines from 0.960 at low capacity to 0.862 at highest capacity, RingID from 0.995 to 0.888, and HSQR from 0.993 to 0.981. All experiments are confined to Stable Diffusion v2-1-base, so broader generalization beyond LDMs is proposed but not experimentally verified. Some design choices remain procedural rather than fully formalized, including center-aware embedding as selection of a central \(44\times 44\) region rather than an optimization-derived mask [2509.07647].

A practical advantage emphasized in the paper is computational overhead. SFW methods remain merged-in-generation and add no additional processing time beyond standard generation. The supplementary processing-time table reports 0.00 s/img for HSTR and 0.00 s/img for HSQR, in contrast to Zodiac at 7.36 m/img [2509.07647].

Within the broader history of Fourier-domain watermarking, SFW belongs to a line of methods that derive robustness from spectral structure, but its specific contribution is the insistence that semantic watermarking in a real-valued latent pipeline must satisfy the same Hermitian constraints as any real signal spectrum. Earlier Fourier and holographic watermarking methods for printed documents, such as digital Fourier hologram embedding, similarly rely on conjugate-structured constructions and real-valued printable outputs, although they do not formulate watermark insertion as explicit Hermitian-pair embedding in the host Fourier domain. In that earlier setting, the hologram cross-term
\[
H(\xi,\eta)=G_m^*(\xi,\eta)R(\xi,\eta)+G_m(\xi,\eta)R^*(\xi,\eta)
\]
is a real-valued conjugate-structured quantity that yields symmetric twin-image reconstructions, which is mathematically adjacent to, but not identical with, the explicit symmetry enforcement of SFW [1306.5066].

A common misconception would be to treat SFW as merely another watermark pattern. The paper instead frames it as a frequency-integrity-preserving framework for latent Fourier-domain semantic watermarking. Another possible misconception is that the improvement comes mainly from center-aware embedding. The supplementary disentanglement reported in the paper indicates otherwise: the Tree-Ring baseline without SFW and without center-aware embedding has average identification 0.114; adding SFW only raises it to 0.777; adding both SFW and center-aware embedding raises it further to 0.889. On that evidence, SFW is the larger contributor to signal, regeneration robustness, and fidelity, while center-aware embedding mainly lifts crop robustness [2509.07647].

Source: https://www.emergentmind.com/topics/hermitian-symmetric-fourier-watermarking-sfw