NullGuard: Null-Space Embedding for Driftless Invisible Image Watermarking

ICLR 2026 Conference Submission25099 Authors

Keywords: Gen Image Watermark, Invisible Watermark

TL;DR: NullGuard introduces a training-free, cryptographically personalized watermarking method for diffusion models that embeds an imperceptible watermark in the Jacobian null-space, achieving high robustness and fidelity without semantic drift.

Abstract: Recent progress in text-to-image diffusion highlights the need for invisible, tamper-resilient watermarking that maintains both visual fidelity and prompt alignment. Existing approaches often compromise on robustness, imperceptibility, or scalability, with many introducing semantic drift that weakens provenance guarantees. To address this, we introduce \emph{NullGuard}, a training-free, plug-and-play watermarking framework that embeds cryptographically keyed signals in the null-space of pretrained diffusion Jacobians, using user-specific rotations to define imperceptible directions. A lightweight Gauss–Newton pivot refinement, constrained by a perceptual mask, perturbs only watermark-relevant components while preserving global semantics, and a likelihood-ratio test detects watermarks without DDIM inversion, achieving up to 99\% detection accuracy under attacks such as cropping, blurring, and JPEG compression, with PSNR $\ge$ 45 dB. Extensive evaluations on MS-COCO and DiffusionDB demonstrate that NullGuard surpasses state-of-the-art (SOTA) methods in robustness, invisibility, and semantic alignment, offering a scalable foundation for provenance-aware diffusion governance. Anonymous Code: https://anonymous.4open.science/r/NullGuard-7766.

Primary Area: alignment, fairness, safety, privacy, and societal considerations

Submission Number: 25099