Embedding Watermarks in Diffusion Process for Model Intellectual Property Protection

Jijia Yang,Sen Peng,Xiaohua Jia

2024-10-30

Abstract:In practical application, the widespread deployment of diffusion models often necessitates substantial investment in training. As diffusion models find increasingly diverse applications, concerns about potential misuse highlight the imperative for robust intellectual property protection. Current protection strategies either employ backdoor-based methods, integrating a watermark task as a simpler training objective with the main model task, or embedding watermarks directly into the final output samples. However, the former approach is fragile compared to existing backdoor defense techniques, while the latter fundamentally alters the expected output. In this work, we introduce a novel watermarking framework by embedding the watermark into the whole diffusion process, and theoretically ensure that our final output samples contain no additional information. Furthermore, we utilize statistical algorithms to verify the watermark from internally generated model samples without necessitating triggers as conditions. Detailed theoretical analysis and experimental validation demonstrate the effectiveness of our proposed method.

Computer Vision and Pattern Recognition,Cryptography and Security

What problem does this paper attempt to address?

### Problems the Paper Attempts to Solve

This paper aims to address the issue of intellectual property protection for Diffusion Models (DMs) in practical applications. With the widespread deployment of diffusion models in various application scenarios, unauthorized copying, reverse engineering, or exploiting the proprietary features of these models pose significant threats to model owners. Existing protection strategies either rely on backdoor attack methods, embedding the watermark task as a simple training objective within the main task of the model, or directly embed watermarks in the final output samples. However, the former method is easily removed by existing backdoor defense techniques, while the latter fundamentally alters the expected output.

To overcome these limitations, the authors propose a new watermarking framework that embeds watermarks throughout the entire diffusion process and theoretically ensures that the final output samples do not contain additional information. Additionally, the authors utilize statistical algorithms to verify the watermark from samples generated within the model without requiring trigger conditions. Through detailed theoretical analysis and experimental validation, the effectiveness of the proposed method is demonstrated.