Hiding in the Phase: A Provably Robust Watermark for Diffusion Models

Seongdo Kim, Wooyeol Baek, Jinseong Kim, Haechan Shin, Hankyeol Lee, Jongyoo Kim

Keywords: Diffusion Models, Watermark

TL;DR: We identify a vulnerability in existing watermarks: their reliance on a uniform structural constraint, making them susceptible to mechanism-targeted attacks. PQIM circumvents this by embedding information in phase domain.

Abstract: Recent advances in diffusion models have necessitated robust methods for image watermarking. While state-of-the-art semantic watermarks offer impressive robustness, they share a fundamental, unaddressed vulnerability: reliance on uniformly applied structural constraints. Such architectural uniformity creates a predictable attack surface, enabling mechanism-targeted attacks that exploit the embedding rules rather than the secret key. To address this critical vulnerability, we introduce Phase-Quantization Invisible Marking (PQIM), a training-free semantic framework that combines structural heterogeneity with provable robustness. PQIM's strength is twofold. First, PQIM uses a cryptographic key to generate a sparse, pseudo-random embedding subspace, eliminating global, predictable structures and encodes the watermark via distributed phase-only modulation. Second, we prove that the bit error rate decreases exponentially with redundancy (Theorem 1), providing an information-theoretic guarantee of robustness. Extensive experiments show that PQIM achieves strong robustness and competitive performance compared to existing methods against a wide array of attacks, while maintaining a favourable fidelity-robustness trade-off compared to existing methods.

Primary Area: generative models

Submission Number: 24676