Radioactive Watermarks in Diffusion and Autoregressive Image Generative Models

2025-06-30

AI Summary

To address the problem that generated images, when illicitly used for training downstream models, cause watermark degradation or removal—particularly undermining copyright enforcement—this paper proposes the first radiative watermarking method tailored for autoregressive image models (IARs). Unlike diffusion models (DMs), where watermark embedding in the latent space is prone to erosion during fine-tuning or distillation, our approach leverages the sequential modeling nature and latent representation structure of IARs. Inspired by watermarking techniques for large language models, we design a persistent, generation-time watermark embedding mechanism that ensures strong robustness against model retraining. Experiments demonstrate that the watermark remains highly detectable even after the watermarked images are used to train downstream IARs—significantly improving traceability and copyright controllability of generated content. This work establishes a novel paradigm for provenance tracking of synthetic imagery.

Technology Category

• Computer Vision: Diffusion Models for Vision
• Machine Learning: Large Multimodal Models (LMMs)
• Natural Language Processing: Language Grounding & Multi-modal NLP

Application Category

• Search and Retrieval-Augmented AI: Retrieval-Augmented Generation (RAG) and multi-modal RAG
• User Modeling, Personalization and Recommendation: Attacks and countermeasures in recommendation systems
• Semantics and Knowledge: Methods to enhance, augment, integrate or synergize semantic models such as knowledge graphs and LLMs

Abstract

Image generative models have become increasingly popular, but training them requires large datasets that are costly to collect and curate. To circumvent these costs, some parties may exploit existing models by using the generated images as training data for their own models. In general, watermarking is a valuable tool for detecting unauthorized use of generated images. However, when these images are used to train a new model, watermarking can only enable detection if the watermark persists through training and remains identifiable in the outputs of the newly trained model - a property known as radioactivity. We analyze the radioactivity of watermarks in images generated by diffusion models (DMs) and image autoregressive models (IARs). We find that existing watermarking methods for DMs fail to retain radioactivity, as watermarks are either erased during encoding into the latent space or lost in the noising-denoising process (during the training in the latent space). Meanwhile, despite IARs having recently surpassed DMs in image generation quality and efficiency, no radioactive watermarking methods have been proposed for them. To overcome this limitation, we propose the first watermarking method tailored for IARs and with radioactivity in mind - drawing inspiration from techniques in large language models (LLMs), which share IARs' autoregressive paradigm. Our extensive experimental evaluation highlights our method's effectiveness in preserving radioactivity within IARs, enabling robust provenance tracking, and preventing unauthorized use of their generated images.

Problem

• Detecting unauthorized use of generated images in new models
• Analyzing watermark radioactivity in diffusion and autoregressive models
• Developing radioactive watermarking for autoregressive image models

Innovation

• Radioactive watermarking for autoregressive image models
• Inspired by LLM techniques for watermark persistence
• Ensures provenance tracking in generated images