Watermarking images is critical for tracking image provenance and claiming
ownership. With the advent of generative models, such as stable diffusion, able
to create fake but realistic images, watermarking has become particularly
important, e.g., to make generated images reliably identifiable. Unfortunately,
the very same stable diffusion technology can remove watermarks injected using
existing methods. To address this problem, we present a ZoDiac, which uses a
pre-trained stable diffusion model to inject a watermark into the trainable
latent space, resulting in watermarks that can be reliably detected in the
latent vector, even when attacked. We evaluate ZoDiac on three benchmarks,
MS-COCO, DiffusionDB, and WikiArt, and find that ZoDiac is robust against
state-of-the-art watermark attacks, with a watermark detection rate over 98%
and a false positive rate below 6.4%, outperforming state-of-the-art
watermarking methods. Our research demonstrates that stable diffusion is a
promising approach to robust watermarking, able to withstand even
stable-diffusion-based attacks.

ZoDiac 使用预训练的稳定扩散模型将水印注入可训练的潜空间，从而产生出在向量空间中可靠检测到的水印，对抗各种水印攻击具有 98% 以上的检测率和不超过 6.4% 的误判率，并超越先进的水印处理方法，展示了稳定扩散作为一种强大的鲁棒水印处理方法的潜力。

稳定扩散的鲁棒图像水印技术

Robust Image Watermarking using Stable Diffusion

The malicious applications of deep forgery, represented by face swapping,
have introduced security threats such as misinformation dissemination and
identity fraud. While some research has proposed the use of robust watermarking
methods to trace the copyright of facial images for post-event traceability,
these methods cannot effectively prevent the generation of forgeries at the
source and curb their dissemination. To address this problem, we propose a
novel comprehensive active defense mechanism that combines traceability and
adversariality, called Dual Defense. Dual Defense invisibly embeds a single
robust watermark within the target face to actively respond to sudden cases of
malicious face swapping. It disrupts the output of the face swapping model
while maintaining the integrity of watermark information throughout the entire
dissemination process. This allows for watermark extraction at any stage of
image tracking for traceability. Specifically, we introduce a watermark
embedding network based on original-domain feature impersonation attack. This
network learns robust adversarial features of target facial images and embeds
watermarks, seeking a well-balanced trade-off between watermark invisibility,
adversariality, and traceability through perceptual adversarial encoding
strategies. Extensive experiments demonstrate that Dual Defense achieves
optimal overall defense success rates and exhibits promising universality in
anti-face swapping tasks and dataset generalization ability. It maintains
impressive adversariality and traceability in both original and robust
settings, surpassing current forgery defense methods that possess only one of
these capabilities, including CMUA-Watermark, Anti-Forgery, FakeTagger, or PGD
methods.

通过结合可追踪性和对抗性的新型全面主动防御机制 Dual Defense，将单一强大的水印隐式嵌入目标人脸，有效应对恶意人脸交换而引起的安全威胁，保持水印信息的完整性，具备优异的对抗性和可追踪性，并超越当前的防伪方法。