DeepFreqMark: End-To-End Learnable Frequency-Domain Watermarking with Spherical Attack Simulation for Latent Diffusion Models

DeepFreqMark is an end-to-end learnable frequency-domain watermarking framework for Latent Diffusion Models (LDMs) that addresses copyright infringement and misinformation concerns from AI-generated images. The paper states: The proliferation of AI-generated images produced by Latent Diffusion Models (LDMs) has raised critical concerns regarding copyright infringement and misinformation.

The proposed method replaces manual pattern engineering with a neural message encoder and decoder, overcoming limitations of existing frequency-domain watermarking methods that rely on handcrafted geometric patterns embedded exclusively in the Fast Fourier Transform (FFT) domain and suffer from limited capacity and rigid pattern designs.

The framework embeds watermarks in the initial Gaussian-noise latent prior to the reverse diffusion process, using either DCT or FFT domains. For the DCT domain, the encoder outputs a single-channel, real-valued watermark ∆DCT, which is injected directly into the DCT-transformed latent via: ZT′ = ZT ⊕ ∆DCT. For the FFT domain, the encoder outputs a two-channel, complex-valued watermark ∆FFT and enforces Hermitian Symmetry via F [M − k, N − l] = F [k, l] to guarantee real-valued spatial latents.

Training uses a joint loss function combining reconstruction loss (MSE between watermarked and original latents) and message loss (Binary Cross-Entropy between original and recovered messages), optimized as L = Lr + αLm.

A key innovation is the Slerp-based attack simulation, which addresses the computational bottleneck of DDIM inversion during training. The paper explains: "According to the Gaussian Annulus Theorem, the probability mass of a high-dimensional Gaussian distribution N (0, I) is heavily concentrated within a narrow spherical shell... simulating latent distortions via standard linear interpolation (Lerp) is mathematically flawed. The Slerp operation is defined as Slerp(zT′, zr, s) = sin((1 − s)omega)/sin(omega) zT′ + sin(somega)/sin(omega) zr, where zr is random Gaussian noise and s is uniformly sampled from U(0, S). This operates strictly on the spherical manifold and is mathematically guaranteed to preserve the unit variance and the underlying Gaussian profile of the noise."

Experimental results show significant robustness improvements. With S=0.6 attack simulation, the FFT model achieves an average BER of 0.3160% compared to 1.9757% without simulation, and the DCT model achieves 0.4722% versus 1.1076%. The paper reports: DeepFreqMark achieves significantly lower Bit Error Rates (BER) than baseline methods under real-world attacks and scales to 256 bits message capacity.

Compared to existing methods, DeepFreqMark achieves 99.68% accuracy with 32-bit capacity and 99.44% accuracy with 256-bit capacity, outperforming Tree-Rings (7.70% accuracy, 11 bits), RingID (94.20%, 11 bits), METR (85.45%, 16 bits), and HSQR (98.50%, 72 bits).

The paper also investigates attack strength effects, finding that increasing the maximum attack strength S generally leads to a reduction in BER with S=0.9 achieving the lowest BER, but the visual quality of the generated images degrades as S increases, with noticeable distortion when S ≥ 0.8. For message length scalability, BER scales proportionally with the message length; the BER remains below 1.5% for both the DCT and FFT models for payloads up to 128 bits.

The FFT approach demonstrates superior robustness over DCT because FFT provides the encoder with magnitude and phase components, granting greater degrees of freedom and the mandatory Hermitian Symmetry required for real-valued latents introduces structural redundancy in the FFT spectrum, granting the decoder natural resilience against magnitude-distorting and quantization attacks.

Qualitative results confirm that models trained without attack simulation (S = 0) produce images that are slightly more coherent with the unwatermarked baseline, but their embedded signals are more vulnerable to attacks, while S=0.6 yields images that maintain high semantic fidelity to the original prompt while improving watermark resilience. The framework also maintains visual diversity across different watermark messages for the same prompt, confirming the framework does not converge to a rigid, fixed embedding pattern, thereby enabling a vast and unique message space for provenance tracking.

Improvements to AI systems:

1. Robust latent-space watermarking module for diffusion models: Integrate a learnable encoder–decoder pair that operates directly on the initial Gaussian noise latent (before reverse diffusion) using DCT or FFT domains. This replaces fragile, handcrafted frequency patterns with neural embeddings, enabling high-capacity (up to 256-bit) provenance tracking with <1.5% BER under real-world attacks (e.g., JPEG compression, cropping, noise).

2. Slerp-based adversarial training for diffusion models: Replace naive linear interpolation (Lerp) in attack simulation with spherical linear interpolation (Slerp) on the Gaussian annulus. This mathematically preserves the latent’s unit variance and Gaussian profile, allowing the model to learn invariance to latent-space perturbations without the computational cost of DDIM inversion. The improved system can train watermark robustness up to 6x faster while achieving lower BER (e.g., 0.316% vs 1.976% for FFT at S=0.6).

3. Adaptive attack-strength scheduling: Implement a curriculum where the maximum Slerp attack strength S is gradually increased during training (e.g., from 0 to 0.6, then fine-tuned at 0.9). This balances watermark robustness (lower BER) against visual fidelity, preventing the distortion seen at S≥0.8. The improved system can automatically select the optimal S per prompt or application, maintaining high image quality while maximizing traceability.

4. Frequency-domain redundancy exploitation for error correction: Use the Hermitian Symmetry constraint in FFT-based watermarking as a built-in error-correction mechanism. The decoder can leverage the mirrored spectrum to recover messages even when magnitude or quantization attacks corrupt parts of the spectrum. This improves the system’s resilience to signal-processing attacks without extra redundancy overhead.

5. Message-conditioned latent diversity: Train the encoder to produce distinct, non-rigid watermark patterns for different messages (as confirmed by qualitative results). The improved system can embed a vast, unique message space (e.g., 2 256 possibilities) for per-user or per-generation tracking, enabling forensic tracing of AI-generated content at scale.

What the improved AI system can do:

• Provenance verification: Embed and recover 256-bit unique identifiers in AI-generated images with 99.44% accuracy, even after common edits (resizing, compression, filtering), enabling reliable copyright enforcement and misinformation tracing.

• Real-time watermarking without quality loss: Inject watermarks during the latent sampling step (no post-hoc processing), preserving high visual fidelity (no noticeable distortion at S≤0.6) while making the watermark inseparable from the generation process.

• Scalable deployment: Train once with Slerp-based augmentation, then deploy across different LDM architectures (Stable Diffusion, etc.) with minimal fine-tuning, supporting batch generation with per-image unique watermarks.

• Attack-aware generation: Automatically adjust watermark robustness based on the expected threat model (e.g., social media compression vs. malicious cropping) by tuning S during inference, offering a tunable trade-off between imperceptibility and resilience.

• Forensic analysis tool: Decode watermarks from images without access to the original latent, enabling third-party verification of AI-generated content provenance, which is critical for regulatory compliance and content authenticity standards.

The proliferation of AI-generated images produced by Latent Diffusion Models (LDMs) has raised critical concerns regarding copyright infringement and misinformation. Although existing frequency-domain watermarking methods embed handcrafted geometric patterns into the initial latent noise prior to generation, they suffer from limited capacity and rigid pattern designs. We propose DeepFreqMark, an end-to-end learnable frequency-domain watermarking framework that replaces manual pattern engineering with a neural message encoder and decoder. To circumvent the computational bottleneck caused by Denoising Diffusion Implicit Model (DDIM) inversion during training, we introduce a Spherical Linear Interpolation (Slerp)-based attack simulation. This approach operates directly on the noise latent while strictly preserving the Gaussian variance. Extensive experiments demonstrate that DeepFreqMark achieves significantly lower Bit Error Rates (BER) than baseline methods under real-world attacks and scales to 256 bits message capacity. Our source code is available at https://github.com/chenhsiu48/DeepFreqMark.