ML Security PapersALIEN: Analytic Latent Watermarking for Controllable Generation
Liangqi Lei 1, Keke Gai 1, Jing Yu 2, Liehuang Zhu 1, Qi Wu 3
Published on arXiv
2602.06101
Output Integrity Attack
OWASP ML Top 10 — ML09
Key Finding
ALIEN-Q outperforms state-of-the-art by 33.1% on quality metrics and ALIEN-R achieves 14.0% better robustness across 15 threat conditions compared to prior latent watermarking methods.
ALIEN
Novel technique introduced
Watermarking is a technical alternative to safeguarding intellectual property and reducing misuse. Existing methods focus on optimizing watermarked latent variables to balance watermark robustness and fidelity, as Latent diffusion models (LDMs) are considered a powerful tool for generative tasks. However, reliance on computationally intensive heuristic optimization for iterative signal refinement results in high training overhead and local optima entrapment.To address these issues, we propose an \underline{A}na\underline{l}ytical Watermark\underline{i}ng Framework for Controllabl\underline{e} Generatio\underline{n} (ALIEN). We develop the first analytical derivation of the time-dependent modulation coefficient that guides the diffusion of watermark residuals to achieve controllable watermark embedding pattern.Experimental results show that ALIEN-Q outperforms the state-of-the-art by 33.1\% across 5 quality metrics, and ALIEN-R demonstrates 14.0\% improved robustness against generative variant and stability threats compared to the state-of-the-art across 15 distinct conditions. Code can be available at https://anonymous.4open.science/r/ALIEN/.
Key Contributions
- First analytical derivation of a time-dependent modulation coefficient guiding watermark residual diffusion in latent diffusion models, eliminating heuristic iterative optimization
- ALIEN-Q variant: 33.1% improvement over SOTA across 5 image quality metrics
- ALIEN-R variant: 14.0% improved robustness against generative variant and stability threats across 15 distinct attack conditions
🛡️ Threat Analysis
Watermarks are embedded in the latent space of diffusion model outputs (generated images/content) to track provenance and reduce misuse — this is content output watermarking, not model-weight IP protection. The robustness evaluation against 'generative variant and stability threats' addresses watermark removal/evasion attacks on content integrity.