← 研踪 PaperTrailarXiv:2611.08985 · v1
NotaryMark: Multi-Bit Watermarking for Black-Box DatasetUsage Auditing in Text-to-Image Diffusion Models
首次提交 2026-11-06 12:56
版本更新 2026-11-06 12:56
雷达观测 2026-11-09 11:19
摘要
As generative artificial intelligence (AI) models increasingly require data, more publicly available yet licensed data is being harvested and used without authorization. Although several previous studies have proposed watermarking methods for dataset copyright auditing, their applicability to the text-to-image (T2I) setting remains notably limited. The core drawback is that watermarks embedded by existing techniques are often treated as noise and are gradually filtered out and attenuated during the latent noising-denoising process of diffusion model training. We propose NotaryMark, to our knowledge the first multi-bit watermarking method specifically designed for black-box auditing of T2I training dataset use. The core idea of NotaryMark is to align the watermark with the latent denoising of diffusion models, thereby overcoming the signal decay that plagues existing multi-bit methods during sampling. We evaluate NotaryMark across three datasets and three diffusion models spanning watermark capacities from 8 to 1024 bits. With a watermark capacity below 32 bits, it achieves a high average bit accuracy of 0.85-0.90. With a watermark capacity exceeding 32 bits, it maintains bit accuracy between 0.67 and 0.80, consistently outperforming existing multi-bit watermark methods whose bit accuracy is around 0.42-0.60. Furthermore, we design a voting-based aggregation scheme to boost the bit accuracy with a modest budget of 30 queries. Building on this, we incorporate error-correcting codes to enable reliable decoding and tracing of the embedded identifier information. Robustness evaluation against fifteen evasion attacks spanning seven categories shows that NotaryMark remains robust under most evaluated settings, while stronger attacks generally suppress watermark evidence only at the cost of substantial utility degradation, demonstrating its practical reliability against malicious tampering.
作者备注：Accepted to ACM CCS 2026
观测到的版本
相邻记录可能跳过中间版本；首次发现 v2 及以上也会标为版本更新。
v1 · 2026-11-06 12:56 · 最新观测版本
NotaryMark: Multi-Bit Watermarking for Black-Box DatasetUsage Auditing in Text-to-Image Diffusion Models
As generative artificial intelligence (AI) models increasingly require data, more publicly available yet licensed data is being harvested and used without authorization. Although several previous studies have proposed watermarking methods for dataset copyright auditing, their applicability to the text-to-image (T2I) setting remains notably limited. The core drawback is that watermarks embedded by existing techniques are often treated as noise and are gradually filtered out and attenuated during the latent noising-denoising process of diffusion model training. We propose NotaryMark, to our knowledge the first multi-bit watermarking method specifically designed for black-box auditing of T2I training dataset use. The core idea of NotaryMark is to align the watermark with the latent denoising of diffusion models, thereby overcoming the signal decay that plagues existing multi-bit methods during sampling. We evaluate NotaryMark across three datasets and three diffusion models spanning watermark capacities from 8 to 1024 bits. With a watermark capacity below 32 bits, it achieves a high average bit accuracy of 0.85-0.90. With a watermark capacity exceeding 32 bits, it maintains bit accuracy between 0.67 and 0.80, consistently outperforming existing multi-bit watermark methods whose bit accuracy is around 0.42-0.60. Furthermore, we design a voting-based aggregation scheme to boost the bit accuracy with a modest budget of 30 queries. Building on this, we incorporate error-correcting codes to enable reliable decoding and tracing of the embedded identifier information. Robustness evaluation against fifteen evasion attacks spanning seven categories shows that NotaryMark remains robust under most evaluated settings, while stronger attacks generally suppress watermark evidence only at the cost of substantial utility degradation, demonstrating its practical reliability against malicious tampering.
查看此版本解读 →查看此版本原文 ↗