Noiseprint: Forensics and Diffusion Watermarks

Updated 2 April 2026

Noiseprint is a dual-domain concept denoting CNN-extracted camera fingerprints with model-specific artifacts and cryptographic, distortion-free watermarks in diffusion models.
In image forensics, the CNN-based extraction of noiseprints enhances forgery localization and camera model attribution by isolating subtle, periodic in-camera processing artifacts.
For diffusion models, noiseprint watermarks use deterministic seeds to embed verifiable signatures without distorting output quality, ensuring robust and fast content verification.

Noiseprint is a term encompassing two distinct technical domains: (1) a family of camera model fingerprints used in multimedia forensics, extracted via convolutional neural networks (CNNs) to isolate model-specific artifacts in digital images, and (2) cryptographically secure, distortion-free watermarks for authorship verification in private diffusion and generative models, leveraging the deterministic correlation between the initial random seed and the generated content. This article systematically reviews both the forensic (camera-based) and generative (diffusion-based) interpretations, delineating their methodologies, theoretical underpinnings, applications, empirical performance, and limitations.

1. Camera Model Noiseprint: Definition and Extraction

Noiseprint in the context of multimedia image forensics refers to a residual signal, extracted using a dedicated CNN, that enhances periodic artifacts introduced by in-camera processing pipelines (e.g., demosaicing, CFA interpolation, JPEG quantization) while suppressing high-level semantic content. Unlike Photo Response Non-Uniformity (PRNU), which is a device-unique, noise-like fingerprint due to photon-to-electron non-uniformity in the sensor, the noiseprint captures model-specific, spatially structured, and strongly repeatable artifacts shared across all devices of a given camera model (Cozzolino et al., 2018, Cozzolino et al., 2020, Cozzolino et al., 2018).

Extraction employs a Siamese CNN architecture with DnCNN-style layers (20 convolutional layers, ReLU/BatcNorm), trained to minimize the Euclidean distance between residual maps of patches from the same model and spatial location while maximizing the distance otherwise. The training loss combines a pairwise contrastive or logistic loss with a spectral regularizer enforcing rich, periodic structure in the extracted residuals.

Given an image $I$ , the trained network $f_\theta$ outputs the noiseprint $R = f_\theta(I)$ , which is full-image sized and can be interpreted as a model-dependent artifact map.
The training protocol leverages minibatches organized as groups of patches with controlled positional and model identity for positive/negative sampling.

2. Noiseprint in Diffusion Models: Distortion-Free Watermarking

A second, unrelated use of the term arises in generative modeling, specifically in authorship watermarking for diffusion and flow-based models (Goren et al., 15 Oct 2025). Here, "NoisePrints" are not spatial residuals but refer to the high-dimensional Gaussian noise vector $\epsilon$ deterministically generated from a random seed $s$ (after hashing with a collision-resistant function $h$ and expanding with a public PRNG). The central observation is that this $\epsilon$ strongly correlates with the latent representation $z$ of the generated image $x$ under a public encoder $E$ .

The seed $f_\theta$ 0 acts as a cryptographic watermark; given $f_\theta$ 1 and $f_\theta$ 2, any verifier can compute $f_\theta$ 3 and test whether $f_\theta$ 4 aligns with $f_\theta$ 5 via normalized inner product

$f_\theta$ 6

The verification protocol accepts if $f_\theta$ 7 for a pre-chosen threshold $f_\theta$ 8 targeting a negligible false-positive rate (e.g., $f_\theta$ 9).

This approach is inversion-free, model-agnostic, and does not distort the generative output or require access to private model weights.

3. Forensic Applications: Forgery Localization and Device/Model Attribution

The original (CNN-based) noiseprint has broad applications in digital image forensics, especially forgery localization and camera identification. Key methodologies include:

Forgery localization: By computing the local Euclidean distance (or cross-correlation) between a noiseprint extracted from a test image and the reference noiseprint for a claimed camera model, one generates pixel-wise heatmaps highlighting tampered regions. This approach outperforms traditional PRNU-based localization notably in pixel-wise accuracy and robustness to reference scarcity (Cozzolino et al., 2018). Typical protocol:
1. Compute reference noiseprint as the mean residual over a set of clean, aligned images for a camera model.
2. Extract the test image noiseprint.
3. Compute a sliding-window distance map, thresholded for localization.
Device/model source identification: Fusion of noiseprint (model-level, robust, periodic) with PRNU (device-level, unique but weak) using linear SVMs, Fisher’s Linear Discriminant (FLD), or likelihood-ratio testing yields substantial gains both in challenging scenarios (small crops, heavy JPEG compression, few references) and in overall accuracy (Cozzolino et al., 2020).

In all cases, noiseprint-based approaches require only a single test image, generalize to small regions or cropped images, and maintain discriminative power under severe compression or processing.

4. Security, Robustness, and Theoretical Guarantees

Forensic Noiseprint

Signal properties: Within a camera model, noiseprints correlate tightly; between models, mean squared error (MSE) is large. Device-device variability within a model is negligible (Cozzolino et al., 2020).
Robustness: Noiseprints retain periodic artifacts and discriminative power on small image patches (down to $R = f_\theta(I)$ 0), compressed images (JPEG QF=80–90), and after moderate post-processing (Cozzolino et al., 2018).
Limitations: Not device-unique; susceptible to geometric misalignment unless training/test registration is enforced.

Diffusion NoisePrint (Watermark)

Security: Given cryptographically strong PRNG and hash, producing a forged seed or removal attack (i.e., tamper content to disrupt the cosine correlation metric while maintaining perceptual similarity) is computationally infeasible. For a threshold $R = f_\theta(I)$ 1 yielding a false positive rate $R = f_\theta(I)$ 2, the spherical cap formula yields expected adversarial cost of $R = f_\theta(I)$ 3 trials (Goren et al., 15 Oct 2025).
Robustness: Watermark survives standard image corruptions (JPEG, blur, Gaussian noise) and mild denoising/editing operations as long as perceptual similarity (measured by SSIM, PSNR, LPIPS) is maintained above quality thresholds.
Limitations: Requires access to a public encoder (e.g., VAE); is currently limited in geometric invariance (affine transformations only). Cases with near-constant latents (minimalistic images) may see reduced correlation, posing a risk of false negatives.

5. Empirical Performance

Forensic Noiseprint

On a diverse forensics benchmark (9 datasets), the noiseprint approach achieves average F1 $R = f_\theta(I)$ 4 0.444 and MCC $R = f_\theta(I)$ 5 0.403, outperforming all 15 reference methods. On challenging small-patch or highly compressed images, noiseprint-based fusion with PRNU recovers most of the drop in device identification accuracy inherent to PRNU-only methods (Cozzolino et al., 2018, Cozzolino et al., 2020, Cozzolino et al., 2018).
For forgery localization, noiseprint yields AUC scores up to 0.97 and F1 scores significantly surpassing PRNU (see table below, spliced image test) (Cozzolino et al., 2018):

Method	AUC	F1	F1-oracle
Lukas/PRNU	0.876	0.499	0.572
Verdoliva 2014	0.926	0.580	0.707
Noiseprint	0.967	0.724	0.850

Single-reference noiseprint attains results superior to PRNU with hundreds of references.

Diffusion NoisePrint

On state-of-the-art models (SD2.0, SDXL, Flux-dev, Wan2.1), the noiseprint-based watermark achieves negligible false positive rates ( $R = f_\theta(I)$ 6), perfect or near-perfect verification rates, runtime overhead $R = f_\theta(I)$ 7ms, and robustness rates $R = f_\theta(I)$ 890% under strong perceptual attacks for SSIM $R = f_\theta(I)$ 9 (Goren et al., 15 Oct 2025).
Comparison to inversion-based watermarking demonstrates several orders of magnitude speedup in verification and greater robustness against post-generation transformations.

6. Limitations, Variants, and Open Directions

Forensic noiseprint: Cannot uniquely identify devices; highly textured regions may yield false signals; geometric misalignment requires explicit handling. Open research includes geometry-invariant architectures, CNN fusion with PRNU for full camera/device forensics, and application to multipurpose digital forensics (e.g., satellite, video, deepfakes).
Diffusion noiseprint: Restricted by VAE access and geometric invariance; does not generalize to real-vs-fake discrimination for natural images without explicit marking. Zero-knowledge extensions are supported via SNARK-based succinct proofs at sub-second cost, offering provable privacy/non-repudiation in public verification settings (Goren et al., 15 Oct 2025).

A plausible implication is that both domains of noiseprint—camera model and diffusion watermark—point toward robust, scalable, noninvasive methods for digital provenance, benefiting both forensic and copyright applications.

7. References and Primary Works

"Noiseprint: a CNN-based camera model fingerprint" (Cozzolino et al., 2018) (Cozzolino & Verdoliva)
"Combining PRNU and noiseprint for robust and efficient device source identification" (Cozzolino et al., 2020)
"Camera-based Image Forgery Localization using Convolutional Neural Networks" (Cozzolino et al., 2018)
"NoisePrints: Distortion-Free Watermarks for Authorship in Private Diffusion Models" (Goren et al., 15 Oct 2025)