@inproceedings{
fang2024dero,
title={{DERO}: Diffusion-Model-Erasure Robust Watermarking},
author={Han Fang and Kejiang Chen and Yupeng Qiu and Zehua Ma and Weiming Zhang and Ee-Chien Chang},
booktitle={ACM Multimedia 2024},
year={2024},
url={https://openreview.net/forum?id=ktMvfLYFas}
}
The powerful denoising capability of the latent diffusion model creates new demands on the robustness of image watermarking algorithms, as attackers can erase the watermark by performing a forward diffusion, followed by backward denoising. While such denoising might introduce large distortion in the pixel domain, the image semantics remain similar. Unfortunately, most existing robust watermarking methods fail to tackle such an erasure attack since they are primarily designed for traditional channel distortions. To address such issues, this paper proposed DERO, a diffusion-model-erasure robust watermarking framework. Based on the frequency domain analysis of the diffusion model's denoising process, we designed a destruction and compensation noise layer (DCNL) to approximate the distortion effects caused by latent diffusion model erasure (LDE). In detail, DCNL consists of a multi-scale low-pass filtering and a white noise compensation process, where the high-frequency components of the image are first obliterated, and then full-frequency components are enriched with white noise. Such a process broadly simulates the LDE distortions. Besides, on the extraction side, we cascaded a pre-trained variational autoencoder before the decoder to extract the watermark in the latent domain, which closely adapts to the operation domain of the LDE process. Meanwhile, to improve the robustness of the decoder, we also design a latent feature augmentation (LFA) operation on the latent feature. Throughout the end-to-end training with the DCNL and LFA, DERO can successfully achieve robustness against LDE. Our experimental results demonstrate the effectiveness and the generalizability of the proposed framework. The LDE robustness is significantly improved from 75% with SOTA methods to an impressive 96% with DERO.
DERO: Diffusion-Model-Erasure Robust Watermarking
Han Fang Kejiang Chen Yupeng Qiu Zehua Ma Weiming Zhang Ee-Chien Chang