\section{Introduction}
\label{sec:intro}


Deep generative models (DGMs), such as diffusion models~\citep{sohl2015deep,ho2020denoising}, have shown remarkable success in various vision tasks, 
including text-to-image generation~\citep{rombach2022high}, 
image editing~\citep{choi2023custom,shi2024dragdiffusion}, and style transfer~\citep{kim2022diffusionclip}. 
% In addition, these models~\cite{} also demonstrated an impressive {personalization} ability~\citep{}. 
Moreover, these models exhibit impressive personalization capabilities~\citep{gal2022image,ruiz2023dreambooth}.
% For instance, in DreamBooth~\citep{}, 
% by fine-tuning with a few representative reference images, diffusion model is able to learn personalized images with high fidelity. 
For example, DreamBooth~\citep{ruiz2023dreambooth} fine-tunes diffusion models using a few representative reference images, enabling the generation of personalized images with high fidelity.
% Such power greatly reduces the cost of articifical intelligence (AI)-assisted generation for personalized use, opening the door for more diverse AI-driven applications~\citep{}. 
This capability significantly reduces the cost of AI-assisted personalized generation, paving the way for a wider range of AI-driven applications~\citep{yang2023diffusion}.

However, these advances also introduce new risks. 
Artists and photographers frequently share their works online for promotional purposes.
Yet, off-the-shelf AI tools enable malicious users to obtain unauthorized copies without purchasing rights or to directly plagiarize art styles by fine-tuning personalized models using these images~\citep{van2023anti,liu2024metacloak}. 
These threats greatly undermine the profits of art creators~\citep{shan2023glaze}.

% Nonetheless, these advances also pose new threats. 
% Artists and photographers often post their art works online for promotion. 
% However, the plug-and-play AI-tools also allow malicious users to obtain unauthorized copies without purchasing the rights, or directly plagiarize their art styles  by fine-tuning personalized models with these images\citep{}. Such threats have greatly undermined the profits and copyright of art creators. 

Recent studies developed \textit{adversarial attacks} to defend against unauthorized use of AI tools~\citep{salman2023raising,shan2023glaze,liang2023mist,van2023anti}. 
% been conducted to defend against unauthorized use, by developing \textit{adversarial attacks} against
% the deep learning models that AI tools rely on~\citep{}. 
These methods learn \textit{invisible perturbations }to {disrupt} the image generation process in DGMs like diffusion models. 
For example,~\cite{salman2023raising} push the latent codes of text-to-image diffusion models toward unrelated targets, 
and AdvDM~\citep{liang2023adversarial} minimizes the likelihood of perturbed images from diffusion models to degrade their performance on them. 
Poisoning attacks have also been used to trick fine-tuning based DreamBooth into learning false correlations, preventing it from capturing desired styles~\citep{van2023anti}, and MetaCloak~\citep{liu2024metacloak} incorporated meta-learning to attack an ensemble of diffusion models, improving the poisoning transferability.
% Conceptually, these approaches learn perturbations to \textit{mislead} the image generation process of DGMs such as diffusion models. 
% To name a few,~\cite{} attacked the encoder/decoder of a text-to-image diffusion model to push its latent codes towards an unrelated dummy target (e.g. a black image), and AdvDM~\citep{} targeted on diffusion models and minimized the likelihood of perturbed images. 
% To further defend against fine-tuning based personalization with copyrighted images,~\cite{} leveraged poisoning attacks to trick DreamBooth into learning false correlation, thereby failing to capture desired styles. Built upon this framework, MetaCloak~\citep{} further incorporated meta-learning~\citep{} to attack an ensemble of diffusion models, thereby achieving better transferability. 

Although effective on targeted models, these invisible attack-based solutions heavily rely on adversarial vulnerabilities, resulting in two key limitations. 
First, the \textit{adversarial attack-based} mechanism makes them fall short to generalize well to broader DGMs~\citep{huang2020metapoison,liu2024metacloak}.
Specifically, their performance on black-box DGMs is largely unpredictable~\citep{demontis2019adversarial}, and on white-box DGMs, they only provide \textit{short-term} protection: when facing new DGMs, the perturbation must also be updated or retrained~\citep{xue2024rethinking}. 
Second, their \textit{invisibility} inherently limits their strength from two aspects.
On one hand, invisible watermarks are prone to distortion and purification attacks~\citep{athalye2018synthesizing,liu2024metacloak,zhao2024can}. 
On the other, since these protections are designed to be invisible, they cannot prevent direct misuse such as scraping copyrighted content for commercial use without authorization. 


% Despite being effective on their targeted models, these attack-based approaches rely on the models' adversarial vulnerability, and suffer from notable degradation when transferring to others~\citep{}. 
% Consequently, these approaches have several limitations. First, their performance on black-box AI tools are largely unpredictable due to the attack nature~\citep{}. Second, on white-box settings,
% they can still only offer \textit{short-term} protections.
% Once an underlying model of an AI tool is updated or replaced by new techniques, protections that attack the model need update or retrain accordingly as well. 
% Third, these approaches cannot defend against direct misuse. For example, malicious users may scrape copyrighted content for commercial uses without purchasing rights. However, this misuse does not rely on any AI tools, as a result, existing attack-based methods do not provide any protection. 



In response, 
we propose a new paradigm for copyright protection.
Our approach revisits the visible watermark, a traditional tool for copyright protection. 
We demonstrate that \textit{visible} watermarks offer strong protection: 
with clear copyright information displayed, 
the image becomes largely unusable. 
Additionally, 
when a prominent visible watermark is present, 
AI tools like DreamBooth learn the watermark pattern due to their backdoor mechanism~\citep{rawat2022devil,pan2023trojan,chou2023backdoor}, resulting in unsatisfactory outputs.
Finally, our protection is agnostic to misuse:
unlike attack-based methods, visible watermarking does not target specific misuses or DGMs, thus providing a universal protection.


Another advantage of visible watermarking is its robustness to distortion attack, such as JPEG compression and Gaussian blur, that can easily compromise its invisible counterpart~\citep{athalye2018synthesizing,zhao2024can}. 
The existence of \textit{watermark removal} as \textit{targeted} attack on visible watermarking also poses a significant challenge~\citep{liu2021wdnet,liang2021visible,lugmayr2022repaint,liu2023aipo}. 
Since standard mechanism that adds visible watermarks in a consistent way can be bypassed by specialized attacks~\citep{dekel2017effectiveness}, and 
manually placing watermarks in appropriate areas~\citep{voyatzis1999use} can be labor-intensive and not scalable, we propose {\name}, which \textit{learns} a visible watermark that is hard to remove in an automated way.
\textit{To our best knowledge, this is the first learning-based visible watermark for copyright protection of human-created content in the AI era.
This new exploration is a key contributions.}

Formally, 
{\name} transforms watermark removal into an inpainting problem of reconstructing the watermarked area,
and learns a watermark to make the reconstruction harder. 
This entails a bi-level optimization. 
The lower-level optimization reconstructs the watermarked area, 
and the upper-level optimization adjusts the watermark to push the reconstruction away from the original image. 
Through this formulation, 
{\name} identifies a hard-to-reconstruct region of the image, 
usually containing rich visual details. 
Importantly, This region is an \textit{intrinsic} characteristic of the image, 
allowing {\name} to create watermarks that are \textit{inherently} hard to remove, regardless of the removal method used. 
\textit{The new hard-to-remove watermark formulation as a universal copyright protection is also a key contribution of this work.}





% In execution, {\name} leverages some pre-trained generative model as a \textit{prior} to guide lower-level optimization solving. 
% Nonetheless, this generative prior render the bi-level problem NP-hard to solve~\citep{}, due to the intractability of how watermark affects the lower-level optimal solution where a deep neural network (DNN) involves. 
% We follow previous works~\citep{} and resort to meta-learning for an approximate solution, which replaces the exact solution in the lower-level problem by an approximate one that takes $K$ gradient descent steps from the initial value.
% By expressing the gradients as functions of the watermark, 
% the approximation solution can be written as an explicit function of the watermark. 
% However, this solution requires $K$ to be small~\citep{}, coming at a cost of deviated approximation. 
% Remarkably,~\cite{liu2023aipo} showed that using a special family of generative prior, the lower-level optimization can be replaced by a series of subproblems, each of which \textit{by nature} can be solved within a few steps.
% By further replace the lower-level optimization with this series of subproblems, we derive a new effective solution for watermark learning. 
% \textit{This new bi-level solver is another main contribution of this work}. 
% Sec \ref{sec:method} details these results. 



In execution, {\name} uses a pre-trained generative model as a \textit{prior} to guide lower-level optimization~\citep{bora2017compressed,asim2020invertible,ongie2020deep}. 
However, this generative prior makes the bi-level problem NP-hard~\citep{lei2019inverting,sinha2017review}, 
due to the complexity of how the watermark impacts the lower-level optimal solution involving a deep neural network (DNN).
Following prior work~\citep{huang2020metapoison,liu2024metacloak}, we use meta-learning~\citep{finn2017model} for an approximate solution, 
replacing the exact lower-level solution with one that takes $K$ gradient descent steps from the initial value~\citep{finn2017model}.
Expressing the gradients as functions of the watermark allows the approximation to be written as an explicit function of the watermark. 
Meta-learning requires $K$ to be small, usually leading to approximation errors~\citep{huang2020metapoison,geiping2020witches}.
Nonetheless, recent work showed that a special family of deep generative priors allows the lower-level optimization to be replaced by a series of subproblems, each solvable \textit{in a few steps}~\citep{liu2023aipo}. 
Built upon this, 
we derive a new, effective solution to learn watermark. 
\textit{This new bi-level solver is our third contribution.}









Our paper is organized as follows. 
Sec \ref{sec:method} discusses the {\name} formulation and its approximate solution.
% Sec \ref{sec:experiment} evaluates {\name} for watermarking a variety of image datasets and tests its reliability using diverse watermark removal methods. 
Sec \ref{sec:experiment} evaluates {\name}'s performance on various image sets and tests its robustness against different watermark removers.
 Sec \ref{sec:related} reviews related works, and Sec \ref{sec:conclusion} conclude the paper.
