ML Security PapersPhaseMark: A Post-hoc, Optimization-Free Watermarking of AI-generated Images in the Latent Frequency Domain
Published on arXiv
2601.13128
Output Integrity Attack
OWASP ML Top 10 — ML09
Key Finding
PhaseMark achieves state-of-the-art resilience against regeneration attacks while being thousands of times faster than optimization-based post-hoc watermarking methods such as ZoDiac and FreqMark.
PhaseMark
Novel technique introduced
The proliferation of hyper-realistic images from Latent Diffusion Models (LDMs) demands robust watermarking, yet existing post-hoc methods are prohibitively slow due to iterative optimization or inversion processes. We introduce PhaseMark, a single-shot, optimization-free framework that directly modulates the phase in the VAE latent frequency domain. This approach makes PhaseMark thousands of times faster than optimization-based techniques while achieving state-of-the-art resilience against severe attacks, including regeneration, without degrading image quality. We analyze four modulation variants, revealing a clear performance-quality trade-off. PhaseMark demonstrates a new paradigm where efficient, resilient watermarking is achieved by exploiting intrinsic latent properties.
Key Contributions
- Single-shot, optimization-free post-hoc watermarking via direct phase modulation in the VAE latent frequency domain, thousands of times faster than prior optimization-based methods
- Four modulation variants (APM, PCQ, IPS, SPS) spanning absolute vs. relative phase and hard vs. soft modulation, with a systematic analysis of the performance-quality trade-off
- State-of-the-art resilience against severe attacks including regeneration without perceptible image quality degradation
🛡️ Threat Analysis
PhaseMark embeds watermarks in AI-generated image OUTPUTS (not model weights) to establish content provenance and authenticate LDM-generated images — classic output integrity / content watermarking. Resilience against regeneration attacks (a watermark removal threat) further confirms ML09.