ML Security PapersNoisePrints: Distortion-Free Watermarks for Authorship in Private Diffusion Models
Nir Goren 1, Oren Katzir 1, Abhinav Nakarmi 2, Eyal Ronen 1, Mahmood Sharif 1, Or Patashnik 1
Published on arXiv
2510.13793
Output Integrity Attack
OWASP ML Top 10 — ML09
Key Finding
Efficient authorship verification using only the secret seed and generated output, demonstrated across multiple state-of-the-art image and video diffusion models without requiring model weight access.
NoisePrints
Novel technique introduced
With the rapid adoption of diffusion models for visual content generation, proving authorship and protecting copyright have become critical. This challenge is particularly important when model owners keep their models private and may be unwilling or unable to handle authorship issues, making third-party verification essential. A natural solution is to embed watermarks for later verification. However, existing methods require access to model weights and rely on computationally heavy procedures, rendering them impractical and non-scalable. To address these challenges, we propose , a lightweight watermarking scheme that utilizes the random seed used to initialize the diffusion process as a proof of authorship without modifying the generation process. Our key observation is that the initial noise derived from a seed is highly correlated with the generated visual content. By incorporating a hash function into the noise sampling process, we further ensure that recovering a valid seed from the content is infeasible. We also show that sampling an alternative seed that passes verification is infeasible, and demonstrate the robustness of our method under various manipulations. Finally, we show how to use cryptographic zero-knowledge proofs to prove ownership without revealing the seed. By keeping the seed secret, we increase the difficulty of watermark removal. In our experiments, we validate NoisePrints on multiple state-of-the-art diffusion models for images and videos, demonstrating efficient verification using only the seed and output, without requiring access to model weights.
Key Contributions
- Distortion-free watermarking scheme that uses the diffusion initialization seed as a proof of authorship, requiring no modification to the generation process or access to model weights.
- Hash-augmented noise sampling process that makes recovering a valid seed from content computationally infeasible, increasing robustness against watermark removal.
- Integration of cryptographic zero-knowledge proofs to enable privacy-preserving ownership verification without revealing the secret seed.
🛡️ Threat Analysis
Proposes a content provenance scheme that establishes authorship of diffusion-generated images and videos by leveraging the correlation between the secret random seed and generated output — this is output integrity and content watermarking, not model IP watermarking (the model weights are never modified and the method works without accessing them).