PRC-Based Watermarking Scheme

• PRC-based watermarking scheme is a cryptographic method that embeds unforgeable markers into digital outputs using pseudorandom error-correcting codes.
• It combines rigorous error correction with challenge–response techniques in hardware and generative models to ensure high-capacity, robust watermarking against noise and attacks.
• Recent research reveals trade-offs between strong security guarantees and practical vulnerabilities, prompting parameter hardening and improved key generation techniques.

A PRC-based watermarking scheme is a cryptographic protocol that embeds unforgeable markers into digital objects, particularly generative model outputs, using pseudorandom error-correcting codes (PRCs). PRC-based approaches combine rigorous undetectability guarantees with error correction, enabling robust and high-capacity watermarking for both hardware IP (e.g., digital circuits) and AI-generated content (e.g., images, text). The field encompasses both hardware (e.g., challenge–response-based signature generation for tamper detection) and content provenance in generative models (where the watermark is embedded directly into model randomness). Recent developments have elevated PRC-based watermarking to the forefront of both security guarantees and attack resiliency, but ongoing research has also exposed concrete vulnerabilities and open questions regarding security margins as implemented in practice (Nair et al., 2020, Gunn et al., 9 Oct 2024, Wang et al., 19 Dec 2025).

1. Theoretical Basis of Pseudorandom Error-Correcting Code Watermarking

PRC schemes are predicated on the cryptographic hardness of distinguishing output codewords from purely random vectors, combined with error-correcting capabilities enabling robust message recovery despite moderate noise or perturbations. Formally, a PRC is a triple of PPT algorithms: $$(\mathsf{KeyGen},\,\mathsf{Encode},\,\mathsf{Decode})$$ with the following properties:

• Robustness: For a secret/public keypair, a codeword $\mathsf{Encode}(\cdot)$, and noise channel $E$, the decoder recovers the watermark with overwhelming probability, i.e.

$$\Pr[\mathsf{Decode}(sk,\tilde{x})=1] \ge 1-\mathrm{negl}(\lambda)$$

• Undetectability: No polynomial-time adversary with just the public key can distinguish a PRC-encoded output $x$ from uniform random $u \in \{0,1\}^n$ with non-negligible advantage:

$$\left| \Pr[\mathcal{A}^{\mathsf{Encode}(\cdot)}(pk)=1] - \Pr[\mathcal{A}^{\mathcal{U}(\cdot)}(pk)=1] \right| \le \mathrm{negl}(\lambda)$$

These properties are typically instantiated using LDPC-PRC constructions, linking performance to hardness assumptions such as Learning Parity with Noise (LPN) (Gunn et al., 9 Oct 2024, Wang et al., 19 Dec 2025).

2. PRC-Based Watermark Embedding in Generative Models

PRC-based watermarking in generative image models (GIMs) operates by deterministically manipulating the model’s intrinsic randomness according to the PRC codeword:

• Key Generation: (Pseudo)random sparse parity-check matrix construction, one-time pad sampling, and formation of a generator matrix $G$ such that $PG = 0$.
• Encoding: For message $m$, a random $x$, error vector $e$, and pad $z$,

$$c = \mathrm{otp} \oplus (m\|x)G \oplus e \in \mathbb{F}_2^n$$

• Watermark Injection: In diffusion models with latent noise vector $y \in \mathbb{R}^n$, the signed latent is:

$$\tilde{z}_i^{(T)} = (-1)^{c_i} \cdot |y_i|,\; 1\leq i\leq n$$

• Output Generation: The manipulated latent $\tilde{z}^{(T)}$ is passed through the standard model sampler to produce a watermarked image (Gunn et al., 9 Oct 2024, Wang et al., 19 Dec 2025). A similar bit-hijacking process is used for LLM text generation, with $x$ mapped blockwise into token-level randomness.

3. Detection, Decoding, and Robustness

Extraction and detection require inverting the generative process (e.g., via DDIM-inversion for diffusion models) to recover the latent or codeword, and then:

1. Removing the one-time pad: $y = x + z$.
2. Computing syndromes: $u = Py$.
3. Thresholding the count of syndrome zeros to decide presence of a watermark:

$\#\{i : (P(y))_i=0\} \ge (\frac{1}{2}+r^{-1/4})r$

Soft-decision decoding and belief-propagation (e.g., OSS-BP) enable high-fidelity message extraction under moderate perturbation.

Robustness: For $t=3, n=16384$, watermark detection accuracy remains $>99\%$ for JPEG compression down to PSNR ≈ 28 dB. Decoding maintains high bit-accuracy even under moderate noise attacks (Gunn et al., 9 Oct 2024). The error-correcting structure provides resilience to additive Gaussian noise, JPEG, and common image processing attacks.

Undetectability Guarantee: Under the assumed hardness of distinguishing PRC codewords from random, no poly-time adversary can differentiate watermarked from non-watermarked outputs beyond negligible bias (Gunn et al., 9 Oct 2024).

4. Security Analysis and Cryptanalytic Attacks

Recent analysis (Wang et al., 19 Dec 2025) identifies three classes of attacks that challenge both undetectability and robustness in practical PRC-based watermarking:

• Partial Secret-Key Recovery: Meet-in-the-middle and information-set decoding techniques can recover low-weight secret rows in the parity-check matrix, reducing undetectability at $n$ and $t$ found in contemporary generative models (work factor ≈ $2^{21-22}$ for standard parameters).
• Weak-Key Distinguisher: LDPC-PRC requires careful key generation. Keys with duplicate rows in the generator matrix enable efficient discrimination through correlated codeword positions, nullifying undetectability.
• Noise-Overlay Attack: By overlaying adversarial noise on watermarked outputs, an attacker can drive the decoding error rate past the code's radius, invalidating robustness with expected complexity ≈ $2^{73}$ for typical $g$, still far from 128-bit security goals.

No parameter combination compatible with current model size and token/latent length achieves conventional 128-bit cryptographic security; meet-in-the-middle or weak-key attacks are feasible for practical deployments. This suggests a fundamental gap between theoretical and realizable security margins in deployed PRC-based watermarking systems (Wang et al., 19 Dec 2025).

5. Recommended Defenses and Implementation Strategies

Several mitigation strategies have been developed:

• Parameter Hardening: Increasing codeword length $n$, parity sparsity $t$, and dimension $g$ can exponentially raise attack complexity, but is limited by physical constraints of LLM and GIM architecture (e.g., token or latent vector length caps).
• Revised Key Generation: Eliminating weak keys by random sampling and Gaussian elimination ensures independence among generator rows, robustly foiling the weak-key attack.
• Algorithmic Tuning: Removing unnecessary belief-propagation steps and increasing parity sparsity $t = \Omega(\log n)$ can suppress polynomial-time attacks exploiting small $t$.
• Noise Parameters: Directly controlling the model-owner noise injection ($\eta$) increases practical resilience against overlay attacks.

Nonetheless, the currently achievable security levels (<128-bit) indicate ongoing need for more scalable and fundamentally attack-resistant constructions (Wang et al., 19 Dec 2025).

6. Hardware PRC-Based Watermarking: The SIGNED Scheme

In hardware domains, PRC concepts underpin the SIGNED challenge–response watermarking protocol (Nair et al., 2020), which operates by extracting and compressing circuit response signatures:

• Sensitive Region Sampling: Algorithmically selects high-switching, high-fan-in, and spatially distributed nets via k-means clustering and activity metrics.
• Signature Construction: Challenge vectors are chosen to maximize dynamic activity of sampled nets. Responses are XOR-compacted to form the signature.
• Embedding: Minimal additional hardware (k XOR gates, small control logic) is used to extract signatures with negligible (<0.2%) area and power overhead in real-world benchmarks.
• Verification: Re-application of challenge vectors and comparison of response digest enables both IP provenance confirmation and fine-grained tamper/Trojan detection (detection rate 87.6% for as few as 5 gate modifications; scales to 100% for ≥0.5% netlist changes).
• Logic Locking Integration: SENSOR and watermark sharing reduces hardware overhead and strengthens resistance to adversarial modification, as removal of detection logic disrupts both authentication and device functionality.

This approach demonstrates high robustness to both removal and structural attacks and admits efficient verification workflows compatible with industrial design practices (Nair et al., 2020).

7. Performance Evaluation and Practical Considerations

Empirical analyses confirm that PRC-based schemes, both in GIM/LLM and hardware/IP contexts, provide:

• High message capacity: Up to 2500 bits can be encoded with negligible BER in GIMs without attack; 512 bits remains robust under aggressive image postprocessing (Gunn et al., 9 Oct 2024).
• Minimal quality degradation: Across FID, CLIP, and LPIPS metrics in image watermarking, the quality gap between watermarked and baseline images is statistically insignificant.
• Low computational overhead: Detection and decoding are efficient (≈1s for inversion and $O(rn)$ parity checks; sub-second BP decoding for $k=512$), requiring no model retraining or fine-tuning.

However, demonstrated cryptanalytic vulnerabilities at standard parameters, and the fundamental limits imposed by host model architecture, necessitate ongoing parameter tuning, careful key management, and prospective architectural advances for long-term, wide-scale adoption (Wang et al., 19 Dec 2025).