7 ms·

Tree-Ring Watermark: Invisible Robust Fingerprints of Diffusion Images

97 points by anjel 3y ago

davideg 3y ago
GitHub repo with code: https://github.com/YuxinWenRick/tree-ring-watermark https://github.com/YuxinWenRick/tree-ring-watermark
cs702 3y ago
Nice. If the work holds up to scrutiny, it's immediately useful for many.
- refulgentis 3y ago
  Who?
  - chii 3y ago
    People who want to treat AI generated works differently, even tho by objective examination, it is not differentiable from a man made one.
    - ptero 3y ago
      The sister thread notes that this requires inverting the process, so it is likely only useful to those hosting the particular AI model; not an outside person who wants to check if a specific image is AI generated.
    - dheera 3y ago
      That doesn't work for that purpose because nothing mandates that AI-generated works be watermarked, and latent diffusion models are easily run on a desktop GPU now.
    - bawolff 3y ago
      That seems silly though as presumably that is a different set of people then those generating the images. Any security system that requires the adversary to be on board is doomed to fail. If the adversary was willing to play by the rules you wouldn't need a security system.
- thot_experiment 3y ago
  also like... why would I voluntarily watermark my images that I want to pass off as "real art" (my personal stance is that AI art is absolutely real art)
  - prox 3y ago
    I would argue that AI works are expressions like a poem or a song. The word “art” has a diluted meaning, it means everything and nothing in common parlance. “Real” art has to have certain attributes like a certain timelessness and character, something that can only be really be ascertained after a certain time has passed. I feel that if you never studied art or never really learned or did the effort on studying it, and gone to the processes of art creation, most people probably aren’t making art. It still can be beautiful, creative, meaningful but “real” art, something that adds to the cultural lexicon, probably not. The book “But is it art?” by Cynthia Freeland I can recommend.
    - thot_experiment 3y ago
      I've done some thousands of hours of practice, my fingers are covered in watercolor paint as I type this. I don't know how to tell if I'm an artist or not, maybe I haven't done any art? I rarely try to say anything at all, I just like to see if I can make a thing I imagine real. I do wonder about it, I'm not being snarky. AI seems like a tool that can be used to make art, I think all that takes is a human trying to elicit a response in another human. Typing into a prompt box and setting some sliders, then picking the output I like... is it different from setting my shutter speed and framing a shot? What if I shoot on a phone where that's all automated, is the art the environment I put myself in? What if I take a hundred random abstract snaps and pick the best 3 and arrange them together in a triptych? Is the argument that the arrangement is the art, and the photography isn't? It just seems so absurd to me that AI can't make art, sure maybe not on it's own, but a paintbrush or a camera can't make art on it's own either, the human wielding it can.
      - prox 3y ago
        You are touching on a big subject, far too big to really touch upon in a comment (hence the book recommend) I studied art formally. I had the chance to meet and be tutored by some really incredible artists. At some point I had to choose another path that led my foray into frontend development and UX. It is indeed in the human context and character where great artists come from. Some artists can read the zeitgeist and extract a meaningful and masterly done work that defies the status quo. One of my teachers framed it “It’s like the olympics and you try to jump just that bit higher and raise the bar. And you don’t know if you are doing that unless you try.” So yeah, the human, their process, their ability to discern what is visually needed, their cultural context, their ability to be autonomous when it is called for, those are hallmarks of significance. Now the AI generator can help you iterate ideas (like you have to choose photos after a shoot) , but you are still the director, you still have to know what to pass and what to embrace. Some artists are not known until long after. For instance there was a street photographer who did street photography long before it was known as such. Now those works are seen as very significant. This is someone who tapped into something and showed a new way of looking.
BugsJustFindMe 3y ago
> the watermark signal is detected by inverting the diffusion process Which, by definition, requires you to know in advance the exact process and parameters that were used? That seems untenable.
- jdiff 3y ago
  That seems to be the point. Sure, anyone can inject their own noise into the initial image, but the best place to be for that would be the people hosting the model. A host could watermark their service and be able to identify images that they'd produced down the line in a way that the end user can't remove and can't perceive.
  - BugsJustFindMe 3y ago
    "I need to protect the copyright of my AI generated image" is some big lol thought process. If that's all this is then it's not nearly as useful as claimed.
    - onesphere 3y ago
      Couldn’t you just hash your image and share your proven ownership?
    - singleshot_ 3y ago
      Yeah, it seems like exactly the wrong thing to be watermarking. I'd much prefer to be able to verify that something was human-generated, but of course that ship has sailed.
    - jdiff 3y ago
      Didn't say anything about copyright, in the US at least that's already been ruled on saying that the raw output of one of these models is not copyrightable. Being able to trace something back to a service can be useful anyway. Imagine stuffing metadata in there, such as the prompt or the identity of the user who generated it. It'd be a powerful tool to combat everything from generated CSAM to political disinformation. If nothing else, a nice ghost story to tell the AI kiddies around the campfire.
fnordpiglet 3y ago
It’s fascinating that it’s robust to noise injections, especially lossy compression and blurring. I suppose it makes sense given the latent space water mark presumably makes global changes to the significant features even if imperceptible. It feels like this might be possible to use as a upscaling technique to inject the watermark into existing photographs without directly manipulating the photographic content.
- XorNot 3y ago
  I'm skeptical this survives very long: these diffusor systems are noise removal systems, this is just inventing a noise injection they currently haven't had to deal with. Particularly if the idea is it leads to a big change in the latent space representation as the mode of action, the question to ask is how hard is it for another system to learn what that latent space anomaly looks like and remove it?
classicmotto 3y ago
So just blurring the image and resharpening using AI can remove the watermark, right? Asking just in case i need to steal some AI generated artwork few years down the line.
- anigbrowl 3y ago
  No need, AI generated imagery isn't copyrightable.
  - thot_experiment 3y ago
    incorrect, AI generated imagery has weaker copyright protections as of right now, but there is limited precedent, this stuff will need to be argued up and down the courts before we know exactly how copyrightable it is (but it's absolutely not zero) fwiw i think copyright should be greatly weakened in general, just correcting you on the facts
    - anigbrowl 3y ago
      As of right now it isn't. Any legal fact is subject to change in the future pursuant to litigation or legislation.
    - wokwokwok 3y ago
      ? Anything might happen in the future, but the current guidance is not ambiguous. https://www.copyright.gov/ai/ai_policy_guidance.pdf https://www.copyright.gov/ai/ai_policy_guidance.pdf (It’s not copyrightable in the US) > fwiw i think Doesn’t really seem relevant, legally speaking, and unless there’s a specific precedent you’d care to share, you are not correcting the parent post, you are simply incorrect.
      - wongarsu 3y ago
        > It’s not copyrightable in the US That's document is about guidance about works applying to be registered at the Copyright office. Which is a process made largely redundant in 1978 by automatic copyright assignment. Now the Copyright Office may be of the opinion that copyright doesn't apply, but apart from registrations (or passing new regulations, which they didn't do) they can only give an expert's opinion. To decide how existing laws and regulations apply is the job of the courts.
pdntspa 3y ago
And, once again, people seek to add additional, unnecessary steps and abstractions to perfectly fine processes, because of contrived bullshit ("copyright!") Stop abstracting input away from output. Attribution here is a fools errand built on overbearing, unjust, and misinterpreted concerns over copyright, the relevance of which have yet to be proven in a legal sense. This is going to give The Man yet another way to suppress actors they don't like. Repeat it with me, folks: YOU CANNOT CONTROL THAT WHICH HAS BEEN RELEASED TO THE PUBLIC. If you do not want things (people/their agents) to perceive your works, then keep them private.
- JohnFen 3y ago
  > If you do not want things (people/their agents) to perceive your works, then keep them private. That's the problem that copyright is intended to address. Without it, too many people do exactly that and society suffers. Modern copyright is insufferable and desperately needs fixing. But the concept exists in order to address a different real problem. Without copyright, we still need a solution to that problem.
  - pdntspa 3y ago
    Does it though? With the sheer volume of creatives nowadays, combined with industry that seems to love nothing more than whoring itself out for maximum accessibility/customer base/sales, we live in a world where creative people create for the sheer sake and joy of creating. I would like to think that many of these folks would still create should copyright not have existed. Maybe in the old world, where something as simple as literacy was at a premium, but in this new world? I'd bet the lack of copyright would filter out so much mediocrity and lowest-common-denominator filth
    - JohnFen 3y ago
      You might be right, but I'm dubious. > but in this new world? This "new world" isn't actually all that new, though. I guess depending on when you count it as starting -- you brought up literacy being a premium in the "old world", which was largely a very long time ago, before the concept of copyright existed.
altairprime 3y ago
Is the watermark carried forward through — that is, expressed in the subsequent output of — a diffusion kernel trained on watermarked images?
esjeon 3y ago
I wonder how deep watermarks would perform against attacks using Image2Image. Running an image through I2I as-is would be able to destroy the watermark with minimal/minor changes, and out-painting may significantly impact certain watermarking methods by wrapping images with random contents.
- avereveard 3y ago
  With control net guidance it's going to be even easier to maintain the image extracting the idea from the noise
regularfry 3y ago
This reminds me of an early-2000s product (maybe earlier? Not sure) which used a frequency-domain manipulation of some sort to overlay a watermark on physical print. The idea was you could point your webcam at a magazine page and be whisked off to some website or other. It pre-dated the ubiquity of QR codes, and it was diffuse across the entire page rather than being a discrete visual element. It probably died off because not enough people had webcams and nobody had the custom software installed. It came to mind because the `Watermarked x_t` image on page two reminds me of the overlaid noise pattern, which you could just make out on the page. I think they must have been doing something similar in frequency space. Is this ringing any bells for anyone? I've tried googling but I just can't find evidence of it ever existing.
herschel113 3y ago
They have a strange idea of "invisible" - the watermarked image is totally different from the other algorithms examples. So this watermark is not visible by itself, but the images it is on are different from non-watermarked ones. Huh.

97 points by anjel 3y ago

GitHub repo with code: https://github.com/YuxinWenRick/tree-ring-watermark https://github.com/YuxinWenRick/tree-ring-watermark

cs702 3y ago

Nice. If the work holds up to scrutiny, it's immediately useful for many.

refulgentis 3y ago
Who?
- chii 3y ago
  People who want to treat AI generated works differently, even tho by objective examination, it is not differentiable from a man made one.
  - ptero 3y ago
    The sister thread notes that this requires inverting the process, so it is likely only useful to those hosting the particular AI model; not an outside person who wants to check if a specific image is AI generated.
  - dheera 3y ago
    That doesn't work for that purpose because nothing mandates that AI-generated works be watermarked, and latent diffusion models are easily run on a desktop GPU now.
  - bawolff 3y ago
    That seems silly though as presumably that is a different set of people then those generating the images. Any security system that requires the adversary to be on board is doomed to fail. If the adversary was willing to play by the rules you wouldn't need a security system.
thot_experiment 3y ago
also like... why would I voluntarily watermark my images that I want to pass off as "real art" (my personal stance is that AI art is absolutely real art)
- prox 3y ago
  I would argue that AI works are expressions like a poem or a song. The word “art” has a diluted meaning, it means everything and nothing in common parlance. “Real” art has to have certain attributes like a certain timelessness and character, something that can only be really be ascertained after a certain time has passed. I feel that if you never studied art or never really learned or did the effort on studying it, and gone to the processes of art creation, most people probably aren’t making art. It still can be beautiful, creative, meaningful but “real” art, something that adds to the cultural lexicon, probably not. The book “But is it art?” by Cynthia Freeland I can recommend.
  - thot_experiment 3y ago
    I've done some thousands of hours of practice, my fingers are covered in watercolor paint as I type this. I don't know how to tell if I'm an artist or not, maybe I haven't done any art? I rarely try to say anything at all, I just like to see if I can make a thing I imagine real. I do wonder about it, I'm not being snarky. AI seems like a tool that can be used to make art, I think all that takes is a human trying to elicit a response in another human. Typing into a prompt box and setting some sliders, then picking the output I like... is it different from setting my shutter speed and framing a shot? What if I shoot on a phone where that's all automated, is the art the environment I put myself in? What if I take a hundred random abstract snaps and pick the best 3 and arrange them together in a triptych? Is the argument that the arrangement is the art, and the photography isn't? It just seems so absurd to me that AI can't make art, sure maybe not on it's own, but a paintbrush or a camera can't make art on it's own either, the human wielding it can.
    - prox 3y ago
      You are touching on a big subject, far too big to really touch upon in a comment (hence the book recommend) I studied art formally. I had the chance to meet and be tutored by some really incredible artists. At some point I had to choose another path that led my foray into frontend development and UX. It is indeed in the human context and character where great artists come from. Some artists can read the zeitgeist and extract a meaningful and masterly done work that defies the status quo. One of my teachers framed it “It’s like the olympics and you try to jump just that bit higher and raise the bar. And you don’t know if you are doing that unless you try.” So yeah, the human, their process, their ability to discern what is visually needed, their cultural context, their ability to be autonomous when it is called for, those are hallmarks of significance. Now the AI generator can help you iterate ideas (like you have to choose photos after a shoot) , but you are still the director, you still have to know what to pass and what to embrace. Some artists are not known until long after. For instance there was a street photographer who did street photography long before it was known as such. Now those works are seen as very significant. This is someone who tapped into something and showed a new way of looking.

BugsJustFindMe 3y ago

> the watermark signal is detected by inverting the diffusion process Which, by definition, requires you to know in advance the exact process and parameters that were used? That seems untenable.

jdiff 3y ago
That seems to be the point. Sure, anyone can inject their own noise into the initial image, but the best place to be for that would be the people hosting the model. A host could watermark their service and be able to identify images that they'd produced down the line in a way that the end user can't remove and can't perceive.
- BugsJustFindMe 3y ago
  "I need to protect the copyright of my AI generated image" is some big lol thought process. If that's all this is then it's not nearly as useful as claimed.
  - onesphere 3y ago
    Couldn’t you just hash your image and share your proven ownership?
  - singleshot_ 3y ago
    Yeah, it seems like exactly the wrong thing to be watermarking. I'd much prefer to be able to verify that something was human-generated, but of course that ship has sailed.
  - jdiff 3y ago
    Didn't say anything about copyright, in the US at least that's already been ruled on saying that the raw output of one of these models is not copyrightable. Being able to trace something back to a service can be useful anyway. Imagine stuffing metadata in there, such as the prompt or the identity of the user who generated it. It'd be a powerful tool to combat everything from generated CSAM to political disinformation. If nothing else, a nice ghost story to tell the AI kiddies around the campfire.

fnordpiglet 3y ago

It’s fascinating that it’s robust to noise injections, especially lossy compression and blurring. I suppose it makes sense given the latent space water mark presumably makes global changes to the significant features even if imperceptible. It feels like this might be possible to use as a upscaling technique to inject the watermark into existing photographs without directly manipulating the photographic content.

XorNot 3y ago
I'm skeptical this survives very long: these diffusor systems are noise removal systems, this is just inventing a noise injection they currently haven't had to deal with. Particularly if the idea is it leads to a big change in the latent space representation as the mode of action, the question to ask is how hard is it for another system to learn what that latent space anomaly looks like and remove it?

classicmotto 3y ago

So just blurring the image and resharpening using AI can remove the watermark, right? Asking just in case i need to steal some AI generated artwork few years down the line.

anigbrowl 3y ago
No need, AI generated imagery isn't copyrightable.
- thot_experiment 3y ago
  incorrect, AI generated imagery has weaker copyright protections as of right now, but there is limited precedent, this stuff will need to be argued up and down the courts before we know exactly how copyrightable it is (but it's absolutely not zero) fwiw i think copyright should be greatly weakened in general, just correcting you on the facts
  - anigbrowl 3y ago
    As of right now it isn't. Any legal fact is subject to change in the future pursuant to litigation or legislation.
  - wokwokwok 3y ago
    ? Anything might happen in the future, but the current guidance is not ambiguous. https://www.copyright.gov/ai/ai_policy_guidance.pdf https://www.copyright.gov/ai/ai_policy_guidance.pdf (It’s not copyrightable in the US) > fwiw i think Doesn’t really seem relevant, legally speaking, and unless there’s a specific precedent you’d care to share, you are not correcting the parent post, you are simply incorrect.
    - wongarsu 3y ago
      > It’s not copyrightable in the US That's document is about guidance about works applying to be registered at the Copyright office. Which is a process made largely redundant in 1978 by automatic copyright assignment. Now the Copyright Office may be of the opinion that copyright doesn't apply, but apart from registrations (or passing new regulations, which they didn't do) they can only give an expert's opinion. To decide how existing laws and regulations apply is the job of the courts.

pdntspa 3y ago

And, once again, people seek to add additional, unnecessary steps and abstractions to perfectly fine processes, because of contrived bullshit ("copyright!") Stop abstracting input away from output. Attribution here is a fools errand built on overbearing, unjust, and misinterpreted concerns over copyright, the relevance of which have yet to be proven in a legal sense. This is going to give The Man yet another way to suppress actors they don't like. Repeat it with me, folks: YOU CANNOT CONTROL THAT WHICH HAS BEEN RELEASED TO THE PUBLIC. If you do not want things (people/their agents) to perceive your works, then keep them private.

JohnFen 3y ago
> If you do not want things (people/their agents) to perceive your works, then keep them private. That's the problem that copyright is intended to address. Without it, too many people do exactly that and society suffers. Modern copyright is insufferable and desperately needs fixing. But the concept exists in order to address a different real problem. Without copyright, we still need a solution to that problem.
- pdntspa 3y ago
  Does it though? With the sheer volume of creatives nowadays, combined with industry that seems to love nothing more than whoring itself out for maximum accessibility/customer base/sales, we live in a world where creative people create for the sheer sake and joy of creating. I would like to think that many of these folks would still create should copyright not have existed. Maybe in the old world, where something as simple as literacy was at a premium, but in this new world? I'd bet the lack of copyright would filter out so much mediocrity and lowest-common-denominator filth
  - JohnFen 3y ago
    You might be right, but I'm dubious. > but in this new world? This "new world" isn't actually all that new, though. I guess depending on when you count it as starting -- you brought up literacy being a premium in the "old world", which was largely a very long time ago, before the concept of copyright existed.

altairprime 3y ago

Is the watermark carried forward through — that is, expressed in the subsequent output of — a diffusion kernel trained on watermarked images?

esjeon 3y ago

I wonder how deep watermarks would perform against attacks using Image2Image. Running an image through I2I as-is would be able to destroy the watermark with minimal/minor changes, and out-painting may significantly impact certain watermarking methods by wrapping images with random contents.

avereveard 3y ago
With control net guidance it's going to be even easier to maintain the image extracting the idea from the noise

regularfry 3y ago

This reminds me of an early-2000s product (maybe earlier? Not sure) which used a frequency-domain manipulation of some sort to overlay a watermark on physical print. The idea was you could point your webcam at a magazine page and be whisked off to some website or other. It pre-dated the ubiquity of QR codes, and it was diffuse across the entire page rather than being a discrete visual element. It probably died off because not enough people had webcams and nobody had the custom software installed. It came to mind because the `Watermarked x_t` image on page two reminds me of the overlaid noise pattern, which you could just make out on the page. I think they must have been doing something similar in frequency space. Is this ringing any bells for anyone? I've tried googling but I just can't find evidence of it ever existing.

herschel113 3y ago

They have a strange idea of "invisible" - the watermarked image is totally different from the other algorithms examples. So this watermark is not visible by itself, but the images it is on are different from non-watermarked ones. Huh.