IRIS: Visual-Semantic Binding for Forgery-Resistant Watermarking of Diffusion Images

2026-08-04

AI Summary

This work addresses the vulnerability of existing diffusion model watermarking schemes, which are easily transferable to non-generated images and lack strong binding to image semantics, rendering them susceptible to forgery. To overcome these limitations, the authors propose IRIS—a training-free watermarking method that embeds a one-time circular identifier at the end of the generation trajectory, derived jointly from image semantic content and a secret key, thereby achieving genuine visual-semantic binding for the first time. By backfilling the trajectory after semantic stabilization and incorporating normalized encoding, IRIS uniquely satisfies the conflicting requirements of sensitivity to semantic manipulation and robustness against common perturbations. Experiments demonstrate that IRIS achieves high detection accuracy across three prompt-based datasets, maintains near-perceptual indistinguishability from unwatermarked images, and effectively resists both watermark transplantation and regeneration attacks.

Abstract

Most in-generation diffusion watermarks embed patterns independent of the image that carries them, and attackers transplant the marks onto images the generator did not produce, resulting in forgery. Binding the mark to visual semantics prevents such transplantation, yet existing bindings anchor to a proxy image rather than the image they mark. Realizing visual-semantic binding inside generation faces two challenges. The mark derives from the image itself yet enters the sampling trajectory before that image exists, and may itself shift the semantics it binds. The binding also meets opposite sensitivity demands, breaking under semantic change while holding through common processing. We present IRIS, a training-free watermarking scheme that embeds an Intrinsic Ring Identifier from Semantics. IRIS reads a content code from the non-watermarked generated image, derives a one-time ring from the code and a secret key, returns to the final low-noise steps of the same trajectory and blends the ring in, after the semantics it binds are settled. To meet the opposite sensitivity demands, the code is read through a canonicalization shared between embedding and detection, holding through common distortions and mild regeneration while flipping under semantic change. Detection recomputes the ring from the query image and the key alone, and the mark therefore fails on a foreign or spliced image, with acceptance tracking semantic displacement. On three prompt datasets IRIS detects reliably and stays close to its same-seed non-watermarked counterpart, a fidelity prior in-generation marks do not reach. While forgeries transfer fixed-pattern marks and regeneration strips post-hoc marks, IRIS alone among the compared marks withstands both.

Problem

• watermarking
• diffusion models
• visual-semantic binding
• forgery resistance
• image generation

Innovation

• visual-semantic binding
• diffusion watermarking
• forgery-resistant
• training-free
• intrinsic identifier