Are Watermarks For Diffusion Models Radioactive?

Jan Dubiński, Michel Meintz, Franziska Boenisch, Adam Dziedzic

Track: tiny / short paper (3-5 pages)

Keywords: diffusion models, watermarking, radioactivity

TL;DR: We investigate the radioactivity of watermarks in diffusion models, i.e., whether it is possible to detect if a model was trained on watermarked data, and find that current watermarking methods for diffusion models are not radioactive.

Abstract:

As generative artificial intelligence (AI) models become increasingly widespread, ensuring transparency and provenance in AI-generated content has become a critical challenge. Watermarking techniques have been proposed to embed imperceptible yet detectable signals in AI-generated images, enabling provenance tracking and copyright enforcement. However, a second party can repurpose images generated by an existing model to train their own diffusion model, potentially disregarding the ownership rights of the original model creator.
Recent research in language models has explored the concept of watermark \textit{radioactivity}, where embedded signals persist when training or fine-tuning a new model, enabling the detection of models trained on watermarked data. In this work, we investigate whether similar persistence occurs in diffusion models. Our findings reveal that none of the tested watermarking methods transfer their signal when used for fine-tuning a second model. This means that images generated by this new model exhibit detection results for the watermarks of the original model indistinguishable from random guessing. These results indicate that existing techniques are insufficient for ensuring watermark propagation through the model derivation chain and that novel approaches are needed to achieve effective and resilient watermark transfer in diffusion models.

Presenter: ~Michel_Meintz1

Format: Yes, the presenting author will attend in person if this work is accepted to the workshop.

Funding: Yes, the presenting author of this submission falls under ICLR’s funding aims, and funding would significantly impact their ability to attend the workshop in person.

Anonymization: This submission has been anonymized for double-blind review via the removal of identifying information such as names, affiliations, and identifying URLs.

Submission Number: 44