arXiv Papers of Watermarking

Abstract:
Significant advancements in deep learning have been made possible by the utilization of large datasets, underscoring the critical importance of copyright protection. Adding meticulously designed perturbations to examples, making them unlearnable has become a crucial approach for safeguarding data copyright. Existing methods for creating unlearnable examples overlook the risk of data leakage, which can threaten data ownership. Thus, copyright protection in deep learning faces two main threats: illegal model training and malicious data leakage. We investigate that these two threats cannot be solved by straightforwardly combining existing availability attacks and watermarking techniques as their negative interaction effects. Therefore, in this paper, we propose a novel copyright protection mechanism for the aforementioned security concerns. Considering that the prevention of unauthorized model training requires powerful generalizability of unlearnable perturbations, we generate perturbations to induce the model to learn uncorrelated features of input images. It works by minimizing the mutual information of the input and output of the model. On the other hand, to eliminate the side impact of unlearnable perturbations on the watermark extraction, we design a dual extraction strategy by using two distinct watermark extractors. Extensive experiments on the image datasets ImageNet, CIFAR10, and Pets show that our proposed method could provide comprehensive copyright protection to images. The code is available at https://github.com/Yeah21/ReversibleUnlearnableExamples.

Abstract:
Inversion‑based watermarking is a promising approach to authenticate diffusion‑generated images, yet practical use is bottlenecked by inversion that is both slow and error‑prone. While the primary challenge in the watermarking setting is robustness against external distortions, existing approaches over‑optimize internal truncation error, and because that error scales with the sampler step size, they are inherently confined to high‑NFE (number of function evaluations) regimes that cannot meet the dual demands of speed and robustness. In this work, we have two key observations: (i) the inversion trajectory has markedly lower curvature than the forward generation path does, making it highly compressible and amenable to low‑NFE approximation; and (ii) in inversion for watermark verification, the trade‑off between speed and truncation error is less critical, since external distortions dominate the error. A faster inverter provides a dual benefit: it is not only more efficient, but it also enables end‑to‑end adversarial training to directly target robustness, a task that is computationally prohibitive for the original, lengthy inversion trajectories. Building on this, we propose FARI (Fast Asymmetric Robust Inversion), a one‑step inversion framework paired with lightweight adversarial LoRA fine‑tuning of the denoiser for watermark extraction. While consolidation slightly increases internal error, FARI delivers large gains in both speed and robustness: with approximately 20 minutes of fine‑tuning on a single NVIDIA RTX A6000 GPU, it surpasses 50‑step DDIM inversion on watermark‑verification robustness while dramatically reducing inference time. Code and pretrained models are available at https://github.com/0xD009/FARI.

Abstract:
Large language model (LLM)‑based text‑to‑speech (TTS) models have achieved remarkable voice cloning capabilities, raising concerns about potential deepfake misuse. Speech watermarking mitigates this by embedding traceable information into generated speech. Mainstream watermarking methods operate at the signal level (waveform or spectrogram), rendering the watermark vulnerable to generative attacks (e.g., neural codec and vocoder). To address this, we propose DuraMark, a robust information‑level watermarking framework. It utilizes syllable duration editing to achieve watermark embedding. Specifically, DuraMark integrates a duration‑controllable LLM‑based TTS model to edit syllable durations during synthesis, coupled with a duration extractor to extract these durations for detection. Experiments demonstrate DuraMark's superior robustness against generative attacks, significantly outperforming signal‑level baselines. Audio samples are available at https://muzw.github.io/duramark_demo/.

Abstract:
Large‑scale text‑to‑image (T2I) diffusion models have enabled unprecedented creative applications, but their unauthorized use has raised serious intellectual property concerns, making model ownership verification (MOV) increasingly critical. We find that existing backdoor‑based diffusion watermarking methods often (implicitly) assume a "faithful" verification process, namely, that the verifier can query a suspicious model and obtain the faithful watermark response to complete MOV. However, in practice, adversaries may intentionally or unintentionally damage potential watermark signals, significantly degrading verification reliability. To address this issue, we propose Cert‑LAS, the first certified MOV method for T2I models based on layer‑adaptive smoothing. In general, Cert‑LAS embeds specified watermarks using diffusion classifiers and an LFS‑guided layer‑adaptive noise, and verifies ownership by examining whether the suspected model exhibits significantly stronger watermark responses compared to unwatermarked references through hypothesis testing. We further prove that, under certain conditions, our Cert‑LAS can still achieve reliable verification even in the presence of malicious removal attacks. Extensive experiments validate the effectiveness of Cert‑LAS and its resistance to adaptive attacks. Our code is available at https://github.com/Leyi‑Qi/Cert‑LAS.

Abstract:
Large language models (LLMs) have made fluent essay writing, code drafting, and quiz answering instantly available to students at every level, from secondary school through graduate study. Many educators do not object to LLM use \emphper~se; what they need to detect is the case in which a student pastes the assignment prompt into a chatbot and submits the model's reply verbatim, without engaging with the work. Existing post‑hoc AI‑text detectors remain unreliable and have been shown to penalise non‑native English writers, while output‑side watermarks require cooperation from the model provider. We propose an alternative that the educator controls directly: an input‑side watermark in which an invisible instruction is embedded inside the visible assignment prompt itself. An LLM that ingests the prompt verbatim quietly reads the hidden instruction and writes a tell‑tale signature into its reply, exposing the copy‑and‑paste pathway specifically. We describe SteganoPrompt, a single‑page, zero‑dependency web tool that encodes an arbitrary printable‑ASCII payload into the deprecated Unicode Tags block (\textttU+E0000‑‑\textttU+E007F). The encoded string is visually identical to the original, survives common copy‑paste channels (Word, Google Docs, PDF, Markdown, Slack, e‑mail, the major learning‑management systems), and is reliably tokenized by frontier models. We evaluate compliance across seven LLM families and a representative set of educational content channels. The work is informed by my experience as a graduate teaching assistant for an undergraduate software engineering course at the George Washington University. The tool is released under the MIT licence at \urlhttps://ezharjan.github.io/SteganoPrompt/.

Abstract:
We introduce a dynamics‑level approach to watermarking generative models. Rather than embedding signals into model weights or outputs, we embed the watermark directly into the learned continuous dynamics ‑‑ the velocity field of a flow matching model. We formulate this as random coding over a continuous channel: a key‑dependent perturbation is added during training, and the message is recovered at detection time from black‑box queries. The perturbation is designed to leave the generated distribution unchanged. Experiments on MNIST and CIFAR‑10 across different architectures confirm reliable message recovery, preserved generation quality, and chance‑level decoding accuracy without the secret key.

Abstract:
Graph neural networks (GNNs) deployed as cloud services can be stolen through model‑extraction attacks, which train a surrogate from query responses to reproduce the target's behavior, and a growing line of ownership defenses tries to prevent or trace such theft. This paper asks two questions: how hard is it to steal a GNN, and can we stop it? Prior work cannot answer either, because experiments use inconsistent datasets, threat models, and metrics. We introduce GraphIP‑Bench, a unified benchmark that evaluates both sides under a single black‑box protocol. GraphIP‑Bench integrates twelve extraction attacks, twelve defenses spanning watermarking, output perturbation, and query‑pattern detection, ten public graphs covering homophilic, heterophilic, and large‑scale regimes, three GNN backbones, and three graph‑learning tasks. It reports fidelity, task utility, ownership verification, and computational cost on shared splits, queries, and budgets. We further add a joint attack‑and‑defense track that runs every attack on every defended target and measures watermark verification on the resulting surrogate, exposing how much protection a defense retains after extraction. The empirical picture is clear: stealing a GNN is easy at medium query budgets and most defenses do not change this; several watermarks verify reliably on the protected model but lose most of their verification signal on the extracted surrogate, exposing a gap that single‑model evaluations miss; and heterophilic graphs are systematically harder to steal, while a cross‑architecture mismatch between target and surrogate reduces but does not prevent extraction. We release GraphIP‑Bench with reproducible scripts and configurations, and integrate the attacks and defenses into the PyGIP library. Code: https://github.com/LabRAI/GraphIP‑Bench. Library: https://labrai.github.io/PyGIP/index.html.

Abstract:
In recent trends, one can observe Large Language Models (LLMs) are exposed to backdoor attacks where vicious triggers added during training or model editing to elicit harmful outputs on specific input patterns while maintaining clean performance on normal inputs. Legitimate watermarks used as ownership signatures share similar mechanisms to backdoors, creating a critical challenge: detecting and eliminating unknown backdoors without compromising watermark integrity. Existing defenses require prior knowledge of triggers or their payloads, depend on clean reference models, or sacrifice model utility without preserving the watermark. To address these limitations we introduce BackFlush and its variants, a unified framework for backdoor detection and elimination while preserving watermarks. We establish two novel observations: Backdoor Flushing Phenomenon, where injecting and unlearning auxiliary data eliminates pre established backdoors, and Backdoor Susceptibility Amplification, enabling constant time detection independent of vocabulary size. BackFlush employs Rotation based Parameter Editing (RoPE) Unlearning, a technique that preserves watermarks while eliminating backdoors by rotating the embeddings. Comprehensive evaluation across diverse trigger types over different architectures demonstrates BackFlush achieves approximately 1%Attack Success Rate (ASR), approximately 99% clean accuracy (CACC), and preserved watermarking capabilities in the realm where no existing method simultaneously provides these alongside maintaining model utility comparable to clean baselines. Codes are available at https://github.com/JagadeeshAI/BackFlush IJCNN.git.

Abstract:
Watermarking for large language models (LLMs) is a promising approach for detecting LLM‑generated text and enabling responsible deployment. However, existing watermarking methods are often vulnerable to semantic‑invariant attacks, such as paraphrasing. We propose PASA, a principled, robust, and distortion‑free watermarking algorithm that embeds and detects a watermark at the semantic level. PASA operates on semantic clusters in a latent embedding space and constructs a distributional dependency between token and auxiliary sequences via shared randomness synchronized by a secret key and semantic history. This design is grounded in our theoretical framework that characterizes a jointly optimal embedding‑detection pair, achieving the fundamental trade‑offs among detection accuracy, robustness, and distortion. Evaluations across multiple LLMs and semantic‑invariant attacks demonstrate that PASA remains robust even under strong paraphrasing attacks while preserving high text quality, outperforming standard vocabulary‑space baselines. Ablation studies further validate the effectiveness of our hyperparameter choices. Webpage: https://ai‑kunkun.github.io/PASA_page/.

Abstract:
The rapid advancement of generative AI has underscored the critical need for identifying image ownership and protecting copyrights. This makes post‑processing image watermarking an essential tool ‑‑ it involves embedding a specific watermark message into an image, with successful verification if a similar message can be decoded from the watermarked image. However, this method is susceptible to both adversarial attacks that manipulate the watermarked image to yield an unverified message upon decoding, and the proposed identity leakage‑related attacks (e.g., forging watermarked images). The threat of identity leakage is particularly exacerbated in both empirical and certified robust watermarking methods. To defend against the aforementioned attacks, we propose W‑IR, the first image watermarking framework that simultaneously incorporates identity protection and robustness. To enhance model robustness, we introduce a novel randomized smoothing technique as part of a robust watermarking, that offers certified robustness against perturbations across two distinct transformation spaces: pixel‑level and coordinate‑level. Moreover, to further mitigate identity leakage, we propose a new strategy based on residual information loss, aimed at minimizing the mutual information between the residual and watermarked images. Our work strikes a superior balance between robustness and identity leakage mitigation. Extensive experiments demonstrate that our W‑IR framework achieves high certified accuracy for authenticity while effectively reducing identity leakage. \footnoteThe code is available at https://github.com/holdrain/W‑I‑R.

Abstract:
The widespread open‑sourcing of advanced recommendation algorithms and the rising threat of model extraction attacks have made safeguarding the intellectual property of recommender systems an imperative task. While watermarking serves as a potent defense, existing methods primarily rely on forcing models to memorize pre‑defined interaction patterns. Such memorization‑based approaches often require excessive synthetic data injection and are vulnerable to removal attacks due to their detectable statistical deviations from natural user behavior. To address these limitations, we propose GREW, a novel Green‑REd Watermarking framework for recommender systems. GREW leverages a secret key to partition the item space into "green" items for soft promotion and "red" items as anchors, thereby shifting the paradigm from fragile memorization to a stealthy, key‑controlled output bias. By integrating watermark signals directly into the intrinsic ranking process, GREW employs three recommendation‑tailored modules: (1) Semantic‑Consistent Hashing, which utilizes the secret key to cluster green items for performance‑aware stealthiness; (2) Decision‑Aligned Masking, which confines signal injection to the competitive item subset to preserve ranking logic; and (3) Confidence‑Aware Scaling, which dynamically modulates injection intensity based on model uncertainty. Ownership verification is performed via statistical hypothesis testing on aggregated black‑box outputs, enabled by the keyed re‑partitioning of the item space. Experiments on multiple base models demonstrate that GREW achieves strong ownership verification and robustness against extraction attacks compared to existing baselines while requiring no data injection. Our code is available at https://github.com/Loche2/GREW.

Abstract:
As AI generative models evolve at unprecedented speed, image attribution has become a moving target. New diffusion, adversarial and autoregressive generators appear almost monthly, making existing watermark, classifier and inversion methods obsolete upon release. The core problem lies not in model recognition, but in the inability to adapt attribution itself. We introduce IncreFA, a framework that redefines attribution as a structured incremental learning problem, allowing the system to learn continuously as new generative models emerge. IncreFA departs from conventional incremental learning by exploiting the hierarchical relationships among generative architectures and coupling them with continual adaptation. It integrates two mutually reinforcing mechanisms: (1) Hierarchical Constraints, which encode architectural hierarchies through learnable orthogonal priors to disentangle family‑level invariants from model‑specific idiosyncrasies; and (2) a Latent Memory Bank, which replays compact latent exemplars and mixes them to generate pseudo‑unseen samples, stabilising representation drift and enhancing open‑set awareness. On the newly constructed Incremental Attribution Benchmark (IABench) covering 28 generative models released between 2022 and 2025, IncreFA achieves state‑of‑the‑art attribution accuracy and 98.93% unseen detection under a temporally ordered open‑set protocol. Code will be available at https://github.com/Ant0ny44/IncreFA.

Abstract:
The public accessibility of large vision‑language models (LVLMs) raises serious concerns about unauthorized model reuse and intellectual property infringement. Existing ownership verification methods often rely on semantically abnormal queries or out‑of‑distribution responses as fingerprints, which can be easily detected and removed by adversaries. We expose this vulnerability through a Semantic Divergence Attack (SDA), which identifies and filters fingerprint queries by measuring semantic divergence between a suspect model and a reference model, showing that existing fingerprints are not semantic‑preserving and are therefore easy to detect and bypass. To address these limitations, we propose SIF (Semantically In‑Distribution Fingerprints), a non‑intrusive ownership verification framework that requires no parameter modification. SIF introduces Semantic‑Aligned Fingerprint Distillation (SAFD), which transfers text watermarking signals into the visual modality to produce semantically coherent yet fingerprinted responses. In addition, Robust‑Fingerprint Optimization (RFO) enhances robustness by simulating worst‑case representation perturbations, making the fingerprints resilient to model modifications such as fine‑tuning and quantization. Extensive experiments on LLaVA‑1.5 and Qwen2.5‑VL demonstrate that SIF achieves strong stealthiness and robustness, providing a practical solution for LVLM copyright protection. Code is available at https://github.com/UCF‑ML‑Research/SIF‑VLM‑Fingerprint

Abstract:
As large language models become standard backends for content generation, practical provenance increasingly requires multi‑bit watermarking. In provider‑internal deployments, a key requirement is message symmetry: the message itself should not systematically affect either text quality or verification outcomes. Vocabulary‑partition watermarks can break message symmetry in low‑entropy decoding: some messages are assigned most of the probability mass, while others are forced to use tail tokens. This makes embedding quality and message decoding accuracy message‑dependent. We propose QuantileMark, a white‑box multi‑bit watermark that embeds messages within the continuous cumulative probability interval [0, 1). At each step, QuantileMark partitions this interval into M equal‑mass bins and samples strictly from the bin assigned to the target symbol, ensuring a fixed 1/M probability budget regardless of context entropy. For detection, the verifier reconstructs the same partition under teacher forcing, computes posteriors over latent bins, and aggregates evidence for verification. We prove message‑unbiasedness, a property ensuring that the base distribution is recovered when averaging over messages. This provides a theoretical foundation for generation‑side symmetry, while the equal‑mass design additionally promotes uniform evidence strength across messages on the detection side. Empirical results on C4 continuation and LFQA show improved multi‑bit recovery and detection robustness over strong baselines, with negligible impact on generation quality. Our code is available at GitHub (https://github.com/zzzjunlin/QuantileMark).

Abstract:
Watermarking provides a critical safeguard for large language model (LLM) services by facilitating the detection of LLM‑generated text. Correspondingly, stealing watermark algorithms (SWAs) derive watermark information from watermarked texts generated by victim LLMs to craft highly targeted adversarial attacks, which compromise the reliability of watermarks. Existing SWAs rely on fixed strategies, overlooking the non‑uniform distribution of stolen watermark information and the dynamic nature of real‑world LLM generation processes. To address these limitations, we propose Adaptive Stealing (AS), a novel SWA featuring enhanced design flexibility through Position‑Based Seal Construction and Adaptive Selection modules. AS operates by defining multiple attack perspectives derived from distinct activation states of contextually ordered tokens. During attack execution, AS dynamically selects the optimal perspective based on watermark compatibility, generation priority, and dynamic generation relevance. Our experiments demonstrate that AS significantly increases steal efficiency against target watermarks under identical experimental conditions. These findings highlight the need for more robust LLM watermarks to withstand potential attacks. We release our code to the community for future research\footnotehttps://github.com/DrankXs/AdaptiveStealingWatermark.

Abstract:
The rapid growth of generative AI has introduced new challenges in content moderation and digital forensics. In particular, benign AI‑generated images can be paired with harmful or misleading text, creating difficult‑to‑detect misuse. This contextual misuse undermines the traditional moderation framework and complicates attribution, as synthetic images typically lack persistent metadata or device signatures. We introduce a steganography enabled attribution framework that embeds cryptographically signed identifiers into images at creation time and uses multimodal harmful content detection as a trigger for attribution verification. Our system evaluates five watermarking methods across spatial, frequency, and wavelet domains. It also integrates a CLIP‑based fusion model for multimodal harmful‑content detection. Experiments demonstrate that spread‑spectrum watermarking, especially in the wavelet domain, provides strong robustness under blur distortions, and our multimodal fusion detector achieves an AUC‑ROC of 0.99, enabling reliable cross‑modal attribution verification. These components form an end‑to‑end forensic pipeline that enables reliable tracing of harmful deployments of AI‑generated imagery, supporting accountability in modern synthetic media environments. Our code is available at GitHub: https://github.com/bli1/steganography

Abstract:
Multi‑bit watermarking has emerged as a promising solution for embedding imperceptible binary messages into Large Language Model (LLM)‑generated text, enabling reliable attribution and tracing of malicious usage of LLMs. Despite recent progress, existing methods still face key limitations: some become computationally infeasible for large messages, while others suffer from a poor trade‑off between text quality and decoding accuracy. Moreover, the decoding accuracy of existing methods drops significantly when the number of tokens in the generated text is limited, a condition that frequently arises in practical usage. To address these challenges, we propose \textscXMark, a novel method for encoding and decoding binary messages in LLM‑generated texts. The unique design of \textscXMark's encoder produces a less distorted logit distribution for watermarked token generation, preserving text quality, and also enables its tailored decoder to reliably recover the encoded message with limited tokens. Extensive experiments across diverse downstream tasks show that \textscXMark significantly improves decoding accuracy while preserving the quality of watermarked text, outperforming prior methods. The code is at https://github.com/JiiahaoXU/XMark.

Abstract:
Diffusion models generate high‑quality images but pose serious risks like copyright violation and disinformation. Watermarking is a key defense for tracing and authenticating AI‑generated content. However, existing methods rely on threshold‑based detection, which only supports fuzzy matching and cannot recover structured watermark data bit‑exactly, making them unsuitable for offline verification or applications requiring lossless metadata (e.g., licensing instructions). To address this problem, in this paper, we propose Gaussian Shannon, a watermarking framework that treats the diffusion process as a noisy communication channel and enables both robust tracing and exact bit recovery. Our method embeds watermarks in the initial Gaussian noise without fine‑tuning or quality loss. We identify two types of channel interference, namely local bit flips and global stochastic distortions, and design a cascaded defense combining error‑correcting codes and majority voting. This ensures reliable end‑to‑end transmission of semantic payloads. Experiments across three Stable Diffusion variants and seven perturbation types show that Gaussian Shannon achieves state‑of‑the‑art bit‑level accuracy while maintaining a high true positive rate, enabling trustworthy rights attribution in real‑world deployment. The source code have been made available at: https://github.com/Rambo‑Yi/Gaussian‑Shannon

Abstract:
With the rapid advancement of AIGC technologies, image forensics will encounter unprecedented challenges. Traditional methods are incapable of dealing with increasingly realistic images generated by rapidly evolving image generation techniques. To facilitate the identification of AI‑generated images and the attribution of their source models, generative image watermarking and AI‑generated image attribution have emerged as key research focuses in recent years. However, existing methods are model‑dependent, requiring access to the generative models and lacking generality and scalability to new and unseen generators. To address these limitations, this work presents a new paradigm for AI‑generated image attribution by formulating it as an instance retrieval problem instead of a conventional image classification problem. We propose an efficient model‑agnostic framework, called Low‑bIt‑plane‑based Deepfake Attribution (LIDA). The input to LIDA is produced by Low‑Bit Fingerprint Generation module, while the training involves Unsupervised Pre‑Training followed by subsequent Few‑Shot Attribution Adaptation. Comprehensive experiments demonstrate that LIDA achieves state‑of‑the‑art performance for both Deepfake detection and image attribution under zero‑ and few‑shot settings. The code is at https://github.com/hongsong‑wang/LIDA

Abstract:
Artificial Intelligence Generated Content (AIGC), particularly video generation with diffusion models, has been advanced rapidly. Invisible watermarking is a key technology for protecting AI‑generated videos and tracing harmful content, and thus plays a crucial role in AI safety. Beyond post‑processing watermarks which inevitably degrade video quality, recent studies have proposed distortion‑free in‑generation watermarking for video diffusion models. However, existing in‑generation approaches are non‑blind: they require maintaining all the message‑key pairs and performing template‑based matching during extraction, which incurs prohibitive computational costs at scale. Moreover, when applied to modern video diffusion models with causal 3D Variational Autoencoders (VAEs), their robustness against temporal disturbance becomes extremely weak. To overcome these challenges, we propose SIGMark, a Scalable In‑Generation watermarking framework with blind extraction for video diffusion. To achieve blind‑extraction, we propose to generate watermarked initial noise using a Global set of Frame‑wise PseudoRandom Coding keys (GF‑PRC), reducing the cost of storing large‑scale information while preserving noise distribution and diversity for distortion‑free watermarking. To enhance robustness, we further design a Segment Group‑Ordering module (SGO) tailored to causal 3D VAEs, ensuring robust watermark inversion during extraction under temporal disturbance. Comprehensive experiments on modern diffusion models show that SIGMark achieves very high bit‑accuracy during extraction under both temporal and spatial disturbances with minimal overhead, demonstrating its scalability and robustness. Our project is available at https://jeremyzhao1998.github.io/SIGMark‑release/.

Abstract:
In this paper, we highlight a critical threat posed by emerging neural models: data plagiarism. We demonstrate how modern neural models (e.g., diffusion models) can replicate copyrighted images, even when protected by advanced watermarking techniques. To expose vulnerabilities in copyright protection and facilitate future research, we propose a general approach to neural plagiarism that can either forge replicas of copyrighted data or introduce copyright ambiguity. Our method, based on "anchors and shims", employs inverse latents as anchors and finds shim perturbations that gradually deviate the anchor latents, thereby evading watermark or copyright detection. By applying perturbations to the cross‑attention mechanism at different timesteps, our approach induces varying degrees of semantic modification in copyrighted images, enabling it to bypass protections ranging from visible trademarks and signatures to invisible watermarks. Notably, our method is a purely gradient‑based search that requires no additional training or fine‑tuning. Experiments on MS‑COCO and real‑world copyrighted images show that diffusion models can replicate copyrighted images, underscoring the urgent need for countermeasures against neural plagiarism.

Abstract:
With the rapid advancement of deepfake technology, malicious face manipulations pose a significant threat to personal privacy and social security. However, existing proactive forensics methods typically treat deepfake detection, tampering localization, and source tracing as independent tasks, lacking a unified framework to address them jointly. To bridge this gap, we propose a unified proactive forensics framework that jointly addresses these three core tasks. Our core framework adopts an innovative 152‑dimensional landmark‑identity watermark termed LIDMark, which structurally interweaves facial landmarks with a unique source identifier. To robustly extract the LIDMark, we design a novel Factorized‑Head Decoder (FHD). Its architecture factorizes the shared backbone features into two specialized heads (i.e., regression and classification), robustly reconstructing the embedded landmarks and identifier, respectively, even when subjected to severe distortion or tampering. This design realizes an "all‑in‑one" trifunctional forensic solution: the regression head underlies an "intrinsic‑extrinsic" consistency check for detection and localization, while the classification head robustly decodes the source identifier for tracing. Extensive experiments show that the proposed LIDMark framework provides a unified, robust, and imperceptible solution for the detection, localization, and tracing of deepfake content. The code is available at https://github.com/vpsg‑research/LIDMark.

Abstract:
Graph neural networks (GNNs) have demonstrated superior performance in various applications, such as recommendation systems and financial risk management. However, deploying large‑scale GNN models locally is particularly challenging for users, as it requires significant computational resources and extensive property data. Consequently, Machine Learning as a Service (MLaaS) has become increasingly popular, offering a convenient way to deploy and access various models, including GNNs. However, an emerging threat known as Model Extraction Attacks (MEAs) presents significant risks, as adversaries can readily obtain surrogate GNN models exhibiting similar functionality. Specifically, attackers repeatedly query the target model using subgraph inputs to collect corresponding responses. These input‑output pairs are subsequently utilized to train their own surrogate models at minimal cost. Many techniques have been proposed to defend against MEAs, but most are limited to specific output levels (e.g., embedding or label) and suffer from inherent technical drawbacks. To address these limitations, we propose a novel ownership verification framework CITED which is a first‑of‑its‑kind method to achieve ownership verification on both embedding and label levels. Moreover, CITED is a novel signature‑based method that neither harms downstream performance nor introduces auxiliary models that reduce efficiency, while still outperforming all watermarking and fingerprinting approaches. Extensive experiments demonstrate the effectiveness and robustness of our CITED framework. Code is available at: https://github.com/LabRAI/CITED.

Abstract:
Knowledge distillation is a widely adopted technique for transferring capabilities from LLMs to smaller, more efficient student models. However, unauthorized use of knowledge distillation takes unfair advantage of the considerable effort and cost put into developing frontier models. We investigate methods for modifying teacher‑generated reasoning traces to achieve two objectives that deter unauthorized distillation: (1) \emphanti‑distillation, or degrading the training usefulness of query responses, and (2) \emphAPI watermarking, which embeds verifiable signatures in student models. We introduce several approaches for dynamically rewriting a teacher's reasoning outputs while preserving answer correctness and semantic coherence. Two of these leverage the rewriting capabilities of LLMs, while others use gradient‑based techniques. Our experiments show that a simple instruction‑based rewriting approach achieves a strong anti‑distillation effect while maintaining or even improving teacher performance. Furthermore, we show that our rewriting approach also enables embedding watermarks that can be reliably detected with essentially no false alarms. Our code is available at https://github.com/xhOwenMa/trace‑rewriting.

Abstract:
In federated learning (FL), K clients jointly train a model without sharing raw data. Because each participant invests data and compute, clients need mechanisms to later prove the provenance of a jointly trained model. Model watermarking embeds a hidden signal in the weights, but naive approaches either do not scale with many clients as per‑client watermarks dilute as K grows, or give any individual client the ability to verify and potentially remove the watermark. We introduce (t,K)‑threshold watermarking: clients collaboratively embed a shared watermark during training, while only coalitions of at least t clients can reconstruct the watermark key and verify a suspect model. We secret‑share the watermark key τ so that coalitions of fewer than t clients cannot reconstruct it, and verification can be performed without revealing τ in the clear. We instantiate our protocol in the white‑box setting and evaluate it on image classification tasks on both IID and non‑IID partitions, as well as language models fine‑tuning setting. Our watermark remains detectable at scale (K=128) with minimal accuracy loss and stays above the detection threshold (z\ge 4) under attacks including adaptive fine‑tuning using up to 20% of the training data. Code is available at https://github.com/tameemalaa/collaborative‑threshold‑watermark.

Abstract:
Watermarking methods have always been effective means of protecting intellectual property, yet they face significant challenges. Although existing deep learning‑based watermarking systems can hide watermarks in images with minimal impact on image quality, they often lack robustness when encountering image corruptions during transmission, which undermines their practical application value. To this end, we propose a high‑quality and robust watermark framework based on the diffusion model. Our method first converts the clean image into inversion noise through a null‑text optimization process, and after optimizing the inversion noise in the latent space, it produces a high‑quality watermarked image through an iterative denoising process of the diffusion model. The iterative denoising process serves as a powerful purification mechanism, ensuring both the visual quality of the watermarked image and enhancing the robustness of the watermark against various corruptions. To prevent the optimizing of inversion noise from distorting the original semantics of the image, we specifically introduced self‑attention constraints and pseudo‑mask strategies. Extensive experimental results demonstrate the superior performance of our method against various image corruptions. In particular, our method outperforms the stable signature method by an average of 10% across 12 different image transformations on COCO datasets. Our codes are available at https://github.com/920927/ONRW.

Abstract:
Annotating medical data for training AI models is often costly and limited due to the shortage of specialists with relevant clinical expertise. This challenge is further compounded by privacy and ethical concerns associated with sensitive patient information. As a result, well‑trained medical segmentation models on private datasets constitute valuable intellectual property requiring robust protection mechanisms. Existing model protection techniques primarily focus on classification and generative tasks, while segmentation models‑crucial to medical image analysis‑remain largely underexplored. In this paper, we propose a novel, stealthy, and harmless method, StealthMark, for verifying the ownership of medical segmentation models under black‑box conditions. Our approach subtly modulates model uncertainty without altering the final segmentation outputs, thereby preserving the model's performance. To enable ownership verification, we incorporate model‑agnostic explanation methods, e.g. LIME, to extract feature attributions from the model outputs. Under specific triggering conditions, these explanations reveal a distinct and verifiable watermark. We further design the watermark as a QR code to facilitate robust and recognizable ownership claims. We conducted extensive experiments across four medical imaging datasets and five mainstream segmentation models. The results demonstrate the effectiveness, stealthiness, and harmlessness of our method on the original model's segmentation performance. For example, when applied to the SAM model, StealthMark consistently achieved ASR above 95% across various datasets while maintaining less than a 1% drop in Dice and AUC scores, significantly outperforming backdoor‑based watermarking methods and highlighting its strong potential for practical deployment. Our implementation code is made available at: https://github.com/Qinkaiyu/StealthMark.

Abstract:
Existing approaches for watermarking AI‑generated images often rely on post‑hoc methods applied in pixel space, introducing computational overhead and potential visual artifacts. In this work, we explore latent space watermarking and introduce DistSeal, a unified approach for latent watermarking that works across both diffusion and autoregressive models. Our approach works by training post‑hoc watermarking models in the latent space of generative models. We demonstrate that these latent watermarkers can be effectively distilled either into the generative model itself or into the latent decoder, enabling in‑model watermarking. The resulting latent watermarks achieve competitive robustness while offering similar imperceptibility and up to 20x speedup compared to pixel‑space baselines. Our experiments further reveal that distilling latent watermarkers outperforms distilling pixel‑space ones, providing a solution that is both more efficient and more robust.

Abstract:
Protecting the copyright of user‑generated AI images is an emerging challenge as AIGC becomes pervasive in creative workflows. Existing watermarking methods (1) remain vulnerable to real‑world adversarial threats, often forced to trade off between defenses against spoofing and removal attacks; and (2) cannot support semantic‑level tamper localization. We introduce PAI, a training‑free inherent watermarking framework for AIGC copyright protection, plug‑and‑play with diffusion‑based AIGC services. PAI simultaneously provides three key functionalities: robust ownership verification, attack detection, and semantic‑level tampering localization. Unlike existing inherent watermark methods that only embed watermarks at noise initialization of diffusion models, we design a novel key‑conditioned deflection mechanism that subtly steers the denoising trajectory according to the user key. Such trajectory‑level coupling further strengthens the semantic entanglement of identity and content, thereby further enhancing robustness against real‑world threats. Moreover, we also provide a theoretical analysis proving that only the valid key can pass verification. Experiments across 12 attack methods show that PAI achieves 98.43% verification accuracy, improving over SOTA methods by 37.25% on average, and retains strong tampering localization performance even against advanced AIGC edits. Our code is available at https://github.com/QingyuLiu/PAI.

Abstract:
LLM‑based agents are increasingly deployed to autonomously solve complex tasks, raising urgent needs for IP protection and regulatory provenance. While content watermarking effectively attributes LLM‑generated outputs, it fails to directly identify the high‑level planning behaviors (e.g., tool and subgoal choices) that govern multi‑step execution. Critically, watermarking at the planning‑behavior layer faces unique challenges: minor distributional deviations in decision‑making can compound during long‑term agent operation, degrading utility, and many agents operate as black boxes that are difficult to intervene in directly. To bridge this gap, we propose AgentMark, a behavioral watermarking framework that embeds multi‑bit identifiers into planning decisions while preserving utility. It operates by eliciting an explicit behavior distribution from the agent and applying distribution‑preserving conditional sampling, enabling deployment under black‑box APIs while remaining compatible with action‑layer content watermarking. Experiments across embodied, tool‑use, and social environments demonstrate practical multi‑bit capacity, robust recovery from partial logs, and utility preservation. The code is available at https://github.com/Tooooa/AgentMark.

Abstract:
Generation‑time text watermarking embeds statistical signals into text for traceability of AI‑generated content. We explore post‑hoc watermarking where an LLM rewrites existing text while applying generation‑time watermarking, to protect copyrighted documents, or detect their use in training or RAG via watermark radioactivity. Unlike generation‑time approaches, which is constrained by how LLMs are served, this setting offers additional degrees of freedom for both generation and detection. We investigate how allocating compute (through larger rephrasing models, beam search, multi‑candidate generation, or entropy filtering at detection) affects the quality‑detectability trade‑off. Our strategies achieve strong detectability and semantic fidelity on open‑ended text such as books. Among our findings, the simple Gumbel‑max scheme surprisingly outperforms more recent alternatives under nucleus sampling, and most methods benefit significantly from beam search. However, most approaches struggle when watermarking verifiable text such as code, where we counterintuitively find that smaller models outperform larger ones. This study reveals both the potential and limitations of post‑hoc watermarking, laying groundwork for practical applications and future research.

Abstract:
Invisible watermarking is essential for tracing the provenance of digital content. However, training state‑of‑the‑art models remains notoriously difficult, with current approaches often struggling to balance robustness against true imperceptibility. This work introduces Pixel Seal, which sets a new state‑of‑the‑art for image and video watermarking. We first identify three fundamental issues of existing methods: (i) the reliance on proxy perceptual losses such as MSE and LPIPS that fail to mimic human perception and result in visible watermark artifacts; (ii) the optimization instability caused by conflicting objectives, which necessitates exhaustive hyperparameter tuning; and (iii) reduced robustness and imperceptibility of watermarks when scaling models to high‑resolution images and videos. To overcome these issues, we first propose an adversarial‑only training paradigm that eliminates unreliable pixel‑wise imperceptibility losses. Second, we introduce a three‑stage training schedule that stabilizes convergence by decoupling robustness and imperceptibility. Third, we address the resolution gap via high‑resolution adaptation, employing JND‑based attenuation and training‑time inference simulation to eliminate upscaling artifacts. We thoroughly evaluate the robustness and imperceptibility of Pixel Seal on different image types and across a wide range of transformations, and show clear improvements over the state‑of‑the‑art. We finally demonstrate that the model efficiently adapts to video via temporal watermark pooling, positioning Pixel Seal as a practical and scalable solution for reliable provenance in real‑world image and video settings.

Abstract:
Deep Neural Networks (DNNs), as valuable intellectual property, face unauthorized use. Existing protections, such as digital watermarking, are largely passive; they provide only post‑hoc ownership verification and cannot actively prevent the illicit use of a stolen model. This work proposes a proactive protection scheme, dubbed ``Authority Backdoor," which embeds access constraints directly into the model. In particular, the scheme utilizes a backdoor learning framework to intrinsically lock a model's utility, such that it performs normally only in the presence of a specific trigger (e.g., a hardware fingerprint). But in its absence, the DNN's performance degrades to be useless. To further enhance the security of the proposed authority scheme, the certifiable robustness is integrated to prevent an adaptive attacker from removing the implanted backdoor. The resulting framework establishes a secure authority mechanism for DNNs, combining access control with certifiable robustness against adversarial attacks. Extensive experiments on diverse architectures and datasets validate the effectiveness and certifiable robustness of the proposed framework.

Abstract:
3D Gaussian Splatting (3DGS) has emerged as a powerful representation for 3D scenes, widely adopted due to its exceptional efficiency and high‑fidelity visual quality. Given the significant value of 3DGS assets, recent works have introduced specialized watermarking schemes to ensure copyright protection and ownership verification. However, can existing 3D Gaussian watermarking approaches genuinely guarantee robust protection of the 3D assets? In this paper, for the first time, we systematically explore and validate possible vulnerabilities of 3DGS watermarking frameworks. We demonstrate that conventional watermark removal techniques designed for 2D images do not effectively generalize to the 3DGS scenario due to the specialized rendering pipeline and unique attributes of each gaussian primitives. Motivated by this insight, we propose GSPure, the first watermark purification framework specifically for 3DGS watermarking representations. By analyzing view‑dependent rendering contributions and exploiting geometrically accurate feature clustering, GSPure precisely isolates and effectively removes watermark‑related Gaussian primitives while preserving scene integrity. Extensive experiments demonstrate that our GSPure achieves the best watermark purification performance, reducing watermark PSNR by up to 16.34dB while minimizing degradation to original scene fidelity with less than 1dB PSNR loss. Moreover, it consistently outperforms existing methods in both effectiveness and generalization. Our code is available at https://github.com/insightlab‑CG‑3DV/GSPure.

Abstract:
Text‑to‑image (T2I) generative models such as Stable Diffusion and FLUX can synthesize realistic, high‑quality images directly from textual prompts. The resulting image quality depends critically on well‑crafted prompts that specify both subjects and stylistic modifiers, which have become valuable digital assets. However, the rising value and ubiquity of high‑quality prompts expose them to security and intellectual‑property risks. One key threat is the prompt stealing attack, i.e., the task of recovering the textual prompt that generated a given image. Prompt stealing enables unauthorized extraction and reuse of carefully engineered prompts, yet it can also support beneficial applications such as data attribution, model provenance analysis, and watermarking validation. Existing approaches often assume white‑box gradient access, require large‑scale labeled datasets for supervised training, or rely solely on captioning without explicit optimization, limiting their practicality and adaptability. To address these challenges, we propose PROMPTMINER, a black‑box prompt stealing framework that decouples the task into two phases: (1) a reinforcement learning‑based optimization phase to reconstruct the primary subject, and (2) a fuzzing‑driven search phase to recover stylistic modifiers. Experiments across multiple datasets and diffusion backbones demonstrate that PROMPTMINER achieves superior results, with CLIP similarity up to 0.958 and textual alignment with SBERT up to 0.751, surpassing all baselines. Even when applied to in‑the‑wild images with unknown generators, it outperforms the strongest baseline by 7.5 percent in CLIP similarity, demonstrating better generalization. Finally, PROMPTMINER maintains strong performance under defensive perturbations, highlighting remarkable robustness. Code: https://github.com/aaFrostnova/PromptMiner

Abstract:
Low‑Rank Adaptation (LoRA) offers an efficient paradigm for customizing diffusion models, but its ease of redistribution raises concerns over unauthorized use and the generation of untraceable content. Existing watermarking techniques either target base models or verify LoRA modules themselves, yet they fail to propagate watermarks to generated images, leaving a critical gap in traceability. Moreover, traceability watermarking designed for base models is not tightly coupled with stylization and often introduces visual degradation or high false‑positive detection rates. To address these limitations, we propose AuthenLoRA, a unified watermarking framework that embeds imperceptible, traceable watermarks directly into the LoRA training process while preserving stylization quality. AuthenLoRA employs a dual‑objective optimization strategy that jointly learns the target style distribution and the watermark‑induced distribution shift, ensuring that any image generated with the watermarked LoRA reliably carries the watermark. We further design an expanded LoRA architecture for enhanced multi‑scale adaptation and introduce a zero‑message regularization mechanism that substantially reduces false positives during watermark verification. Extensive experiments demonstrate that AuthenLoRA achieves high‑fidelity stylization, robust watermark propagation, and significantly lower false‑positive rates compared with existing approaches. Open‑source implementation is available at: https://github.com/ShiFangming0823/AuthenLoRA

Abstract:
Large language models now draft news, legal analyses, and software code with human‑level fluency. At the same time, regulations such as the EU AI Act mandate that each synthetic passage carry an imperceptible, machine‑verifiable mark for provenance. Conventional logit‑based watermarks satisfy this requirement by selecting a pseudorandom green vocabulary at every decoding step and boosting its logits, yet the random split can exclude the highest‑probability token and thus erode fluency. WaterMod mitigates this limitation through a probability‑aware modular rule. The vocabulary is first sorted in descending model probability; the resulting ranks are then partitioned by the residue rank mod k, which distributes adjacent‑and therefore semantically similar‑tokens across different classes. A fixed bias of small magnitude is applied to one selected class. In the zero‑bit setting (k=2), an entropy‑adaptive gate selects either the even or the odd parity as the green list. Because the top two ranks fall into different parities, this choice embeds a detectable signal while guaranteeing that at least one high‑probability token remains available for sampling. In the multi‑bit regime (k>2), the current payload digit d selects the color class whose ranks satisfy rank mod k = d. Biasing the logits of that class embeds exactly one base‑k digit per decoding step, thereby enabling fine‑grained provenance tracing. The same modular arithmetic therefore supports both binary attribution and rich payloads. Experimental results demonstrate that WaterMod consistently attains strong watermark detection performance while maintaining generation quality in both zero‑bit and multi‑bit settings. This robustness holds across a range of tasks, including natural language generation, mathematical reasoning, and code synthesis. Our code and data are available at https://github.com/Shinwoo‑Park/WaterMod.

Abstract:
Large Language Models (LLMs) are widely adopted, but their high training cost leads many developers to fine‑tune existing open‑source models. While most adhere to open‑source licenses, some falsely claim original training despite clear derivation from public models, raising pressing concerns about intellectual property protection and the need to verify model provenance. In this paper, we propose GhostSpec, a lightweight yet effective method for verifying LLM lineage without access to training data or modification of model behavior. Our approach constructs compact and robust fingerprints by applying singular value decomposition (SVD) to invariant products of internal attention weight matrices. Unlike watermarking or output‑based methods, GhostSpec is fully data‑free, non‑invasive, and computationally efficient. Extensive experiments show it is robust to fine‑tuning, pruning, expansion, and adversarial transformations, reliably tracing lineage with minimal overhead. By offering a practical solution for model verification, our method contributes to intellectual property protection and fosters a transparent, trustworthy LLM ecosystem. Our code is available at https://github.com/DX0369/GhostSpec.

Abstract:
Diffusion models have advanced rapidly in recent years, producing high‑fidelity images while raising concerns about intellectual property protection and the misuse of generative AI. Image watermarking for diffusion models, particularly Noise‑as‑Watermark (NaW) methods, encode watermark as specific standard Gaussian noise vector for image generation, embedding the infomation seamlessly while maintaining image quality. For detection, the generation process is inverted to recover the initial noise vector containing the watermark before extraction. However, existing NaW methods struggle to balance watermark robustness with generation diversity. Some methods achieve strong robustness by heavily constraining initial noise sampling, which degrades user experience, while others preserve diversity but prove too fragile for real‑world deployment. To address this issue, we propose T2SMark, a two‑stage watermarking scheme based on Tail‑Truncated Sampling (TTS). Unlike prior methods that simply map bits to positive or negative values, TTS enhances robustness by embedding bits exclusively in the reliable tail regions while randomly sampling the central zone to preserve the latent distribution. Our two‑stage framework then ensures sampling diversity by integrating a randomly generated session key into both encryption pipelines. We evaluate T2SMark on diffusion models with both U‑Net and DiT backbones. Extensive experiments show that it achieves an optimal balance between robustness and diversity. Our code is available at \hrefhttps://github.com/0xD009/T2SMarkhttps://github.com/0xD009/T2SMark.

Abstract:
Large language models (LLMs) demonstrate remarkable capabilities across various tasks. However, their deployment introduces significant risks related to intellectual property. In this context, we focus on model stealing attacks, where adversaries replicate the behaviors of these models to steal services. These attacks are highly relevant to proprietary LLMs and pose serious threats to revenue and financial stability. To mitigate these risks, the watermarking solution embeds imperceptible patterns in LLM outputs, enabling model traceability and intellectual property verification. In this paper, we study the vulnerability of LLM service providers by introducing δ‑STEAL, a novel model stealing attack that bypasses the service provider's watermark detectors while preserving the adversary's model utility. δ‑STEAL injects noise into the token embeddings of the adversary's model during fine‑tuning in a way that satisfies local differential privacy (LDP) guarantees. The adversary queries the service provider's model to collect outputs and form input‑output training pairs. By applying LDP‑preserving noise to these pairs, δ‑STEAL obfuscates watermark signals, making it difficult for the service provider to determine whether its outputs were used, thereby preventing claims of model theft. Our experiments show that δ‑STEAL with lightweight modifications achieves attack success rates of up to 96.95% without significantly compromising the adversary's model utility. The noise scale in LDP controls the trade‑off between attack effectiveness and model utility. This poses a significant risk, as even robust watermarks can be bypassed, allowing adversaries to deceive watermark detectors and undermine current intellectual property protection methods.

Abstract:
Watermarking has emerged as a promising solution for tracing and authenticating text generated by large language models (LLMs). A common approach to LLM watermarking is to construct a green/red token list and assign higher or lower generation probabilities to the corresponding tokens, respectively. However, most existing watermarking algorithms rely on heuristic green/red token list designs, as directly optimizing the list design with techniques such as reinforcement learning (RL) comes with several challenges. First, desirable watermarking involves multiple criteria, i.e., detectability, text quality, robustness against removal attacks, and security against spoofing attacks. Directly optimizing for these criteria introduces many partially conflicting reward terms, leading to an unstable convergence process. Second, the vast action space of green/red token list choices is susceptible to reward hacking. In this paper, we propose an end‑to‑end RL framework for robust and secure LLM watermarking. Our approach adopts an anchoring mechanism for reward terms to ensure stable training and introduces additional regularization terms to prevent reward hacking. Experiments on standard benchmarks with two backbone LLMs show that our method achieves a state‑of‑the‑art trade‑off across all criteria, with notable improvements in resistance to spoofing attacks without degrading other criteria. Our code is available at https://github.com/UCSB‑NLP‑Chang/RL‑watermark.

Abstract:
The rapid development of LLMs has raised concerns about their potential misuse, leading to various watermarking schemes that typically offer high detectability. However, existing watermarking techniques often face trade‑off between watermark detectability and generated text quality. In this paper, we introduce Learning to Watermark (LTW), a novel selective watermarking framework that leverages multi‑objective optimization to effectively balance these competing goals. LTW features a lightweight network that adaptively decides when to apply the watermark by analyzing sentence embeddings, token entropy, and current watermarking ratio. Training of the network involves two specifically constructed loss functions that guide the model toward Pareto‑optimal solutions, thereby harmonizing watermark detectability and text quality. By integrating LTW with two baseline watermarking methods, our experimental evaluations demonstrate that LTW significantly enhances text quality without compromising detectability. Our selective watermarking approach offers a new perspective for designing watermarks for LLMs and a way to preserve high text quality for watermarks. The code is publicly available at: https://github.com/fattyray/learning‑to‑watermark

Abstract:
Large web‑scale datasets have driven the rapid advancement of pre‑trained language models (PLMs), but unauthorized data usage has raised serious copyright concerns. Existing dataset ownership verification (DOV) methods typically assume that watermarks remain stable during inference; however, this assumption often fails under natural noise and adversary‑crafted perturbations. We propose the first certified dataset ownership verification method for PLMs under a gray‑box setting (i.e., the defender can only query the suspicious model but is aware of its input representation module), based on dual‑space smoothing (i.e., DSSmoothing). To address the challenges of text discreteness and semantic sensitivity, DSSmoothing introduces continuous perturbations in the embedding space to capture semantic robustness and applies controlled token reordering in the permutation space to capture sequential robustness. DSSmoothing consists of two stages: in the first stage, triggers are collaboratively embedded in both spaces to generate norm‑constrained and robust watermarked datasets; in the second stage, randomized smoothing is applied in both spaces during verification to compute the watermark robustness (WR) of suspicious models and statistically compare it with the principal probability (PP) values of a set of benign models. Theoretically, DSSmoothing provides provable robustness guarantees for dataset ownership verification by ensuring that WR consistently exceeds PP under bounded dual‑space perturbations. Extensive experiments on multiple representative web datasets demonstrate that DSSmoothing achieves stable and reliable verification performance and exhibits robustness against potential adaptive attacks. Our code is available at https://github.com/NcepuQiaoTing/DSSmoothing.

Abstract:
Large Vision‑Language Models (LVLMs) have recently shown promising results on various multimodal tasks, even achieving human‑comparable performance in certain cases. Nevertheless, LVLMs remain prone to hallucinations ‑‑ they often rely heavily on a single modality or memorize training data without properly grounding their outputs. To address this, we propose a training‑free, tri‑layer contrastive decoding with watermarking, which proceeds in three steps: (1) select a mature layer and an amateur layer among the decoding layers, (2) identify a pivot layer using a watermark‑related question to assess whether the layer is visually well‑grounded, and (3) apply tri‑layer contrastive decoding to generate the final output. Experiments on public benchmarks such as POPE, MME and AMBER demonstrate that our method achieves state‑of‑the‑art performance in reducing hallucinations in LVLMs and generates more visually grounded responses.

Abstract:
As large language models (LLMs) continue to advance rapidly, reliable governance tools have become critical. Publicly verifiable watermarking is particularly essential for fostering a trustworthy AI ecosystem. A central challenge persists: balancing text quality against detection robustness. Recent studies have sought to navigate this trade‑off by leveraging signals from model output distributions (e.g., token‑level entropy); however, their reliance on these model‑specific signals presents a significant barrier to public verification, as the detection process requires access to the logits of the underlying model. We introduce STELA, a novel framework that aligns watermark strength with the linguistic degrees of freedom inherent in language. STELA dynamically modulates the signal using part‑of‑speech (POS) n‑gram‑modeled linguistic indeterminacy, weakening it in grammatically constrained contexts to preserve quality and strengthening it in contexts with greater linguistic flexibility to enhance detectability. Our detector operates without access to any model logits, thus facilitating publicly verifiable detection. Through extensive experiments on typologically diverse languages‑analytic English, isolating Chinese, and agglutinative Korean‑we show that STELA surpasses prior methods in detection robustness. Our code is available at https://github.com/Shinwoo‑Park/stela_watermark.

Abstract:
With the rapid adoption of diffusion models for visual content generation, proving authorship and protecting copyright have become critical. This challenge is particularly important when model owners keep their models private and may be unwilling or unable to handle authorship issues, making third‑party verification essential. A natural solution is to embed watermarks for later verification. However, existing methods require access to model weights and rely on computationally heavy procedures, rendering them impractical and non‑scalable. To address these challenges, we propose NoisePrints, a lightweight watermarking scheme that utilizes the random seed used to initialize the diffusion process as a proof of authorship without modifying the generation process. Our key observation is that the initial noise derived from a seed is highly correlated with the generated visual content. By incorporating a hash function into the noise sampling process, we further ensure that recovering a valid seed from the content is infeasible. We also show that sampling an alternative seed that passes verification is infeasible, and demonstrate the robustness of our method under various manipulations. Finally, we show how to use cryptographic zero‑knowledge proofs to prove ownership without revealing the seed. By keeping the seed secret, we increase the difficulty of watermark removal. In our experiments, we validate NoisePrints on multiple state‑of‑the‑art diffusion models for images and videos, demonstrating efficient verification using only the seed and output, without requiring access to model weights.

Abstract:
The widespread adoption of Retrieval‑Augmented Image Generation (RAIG) has raised significant concerns about the unauthorized use of private image datasets. While these systems have shown remarkable capabilities in enhancing generation quality through reference images, protecting visual datasets from unauthorized use in such systems remains a challenging problem. Traditional digital watermarking approaches face limitations in RAIG systems, as the complex feature extraction and recombination processes fail to preserve watermark signals during generation. To address these challenges, we propose ImageSentinel, a novel framework for protecting visual datasets in RAIG. Our framework synthesizes sentinel images that maintain visual consistency with the original dataset. These sentinels enable protection verification through randomly generated character sequences that serve as retrieval keys. To ensure seamless integration, we leverage vision‑language models to generate the sentinel images. Experimental results demonstrate that ImageSentinel effectively detects unauthorized dataset usage while preserving generation quality for authorized applications. Code is available at https://github.com/luo‑ziyuan/ImageSentinel.

Abstract:
The promise of LLM watermarking rests on a core assumption that a specific watermark proves authorship by a specific model. We demonstrate that this assumption is dangerously flawed. We introduce the threat of watermark spoofing, a sophisticated attack that allows a malicious model to generate text containing the authentic‑looking watermark of a trusted, victim model. This enables the seamless misattribution of harmful content, such as disinformation, to reputable sources. The key to our attack is repurposing watermark radioactivity, the unintended inheritance of data patterns during fine‑tuning, from a discoverable trait into an attack vector. By distilling knowledge from a watermarked teacher model, our framework allows an attacker to steal and replicate the watermarking signal of the victim model. This work reveals a critical security gap in text authorship verification and calls for a paradigm shift towards technologies capable of distinguishing authentic watermarks from expertly imitated ones. Our code is available at https://github.com/hsannn/ditto.git.

Abstract:
Effective removal of semantic watermarks requires balancing three competing objectives: \emphhigh removal success, \emphlow perceptual distortion, and \emphlow computational cost. However, existing single‑image attacks typically optimize only for the first two, achieving strong watermark suppression but relying on expensive, multi‑step optimization that limits practical deployment. In this work, we show that this trade‑off is fundamental: no current approach achieves all three properties simultaneously. We introduce \textscDAWN, a lightweight, training‑free attack that explicitly targets the low‑cost regime while maintaining competitive removal performance. \textscDAWN works by projecting a watermarked image onto natural‑image priors in complementary frequency and semantic spaces, suppressing watermark signals that deviate from natural statistics, and then applying a decoupled perceptual‑alignment step to restore visual consistency with minimal artifact. Across diverse pixel‑, frequency‑, and latent‑space watermarking schemes, \textscDAWN consistently reduces detectability while preserving structural and semantic fidelity, demonstrating that efficient, low‑resource watermark removal is feasible with only modest perceptual degradation. Our code is available at https://github.com/Pragati‑Meshram/DAWN.

Abstract:
Watermarking embeds imperceptible patterns into images for authenticity verification. However, existing methods often lack robustness against various transformations primarily including distortions, image regeneration, and adversarial perturbation, creating real‑world challenges. In this work, we introduce SpecGuard, a novel watermarking approach for robust and invisible image watermarking. Unlike prior approaches, we embed the message inside hidden convolution layers by converting from the spatial domain to the frequency domain using spectral projection of a higher frequency band that is decomposed by wavelet projection. Spectral projection employs Fast Fourier Transform approximation to transform spatial data into the frequency domain efficiently. In the encoding phase, a strength factor enhances resilience against diverse attacks, including adversarial, geometric, and regeneration‑based distortions, ensuring the preservation of copyrighted information. Meanwhile, the decoder leverages Parseval's theorem to effectively learn and extract the watermark pattern, enabling accurate retrieval under challenging transformations. We evaluate the proposed SpecGuard based on the embedded watermark's invisibility, capacity, and robustness. Comprehensive experiments demonstrate the proposed SpecGuard outperforms the state‑of‑the‑art models. To ensure reproducibility, the full code is released on \hrefhttps://github.com/inzamamulDU/SpecGuard_ICCV_2025\textcolorblueGitHub.

Abstract:
Large Language Models (LLMs) are increasingly fine‑tuned on smaller, domain‑specific datasets to improve downstream performance. These datasets often contain proprietary or copyrighted material, raising the need for reliable safeguards against unauthorized use. Existing membership inference attacks (MIAs) and dataset‑inference methods typically require access to internal signals such as logits, while current black‑box approaches often rely on handcrafted prompts or a clean reference dataset for calibration, both of which limit practical applicability. Watermarking is a promising alternative, but prior techniques can degrade text quality or reduce task performance. We propose TRACE, a practical framework for fully black‑box detection of copyrighted dataset usage in LLM fine‑tuning. \textttTRACE rewrites datasets with distortion‑free watermarks guided by a private key, ensuring both text quality and downstream utility. At detection time, we exploit the radioactivity effect of fine‑tuning on watermarked data and introduce an entropy‑gated procedure that selectively scores high‑uncertainty tokens, substantially amplifying detection power. Across diverse datasets and model families, TRACE consistently achieves significant detections (p<0.05), often with extremely strong statistical evidence. Furthermore, it supports multi‑dataset attribution and remains robust even after continued pretraining on large non‑watermarked corpora. These results establish TRACE as a practical route to reliable black‑box verification of copyrighted dataset usage. We will make our code available at: https://github.com/NusIoraPrivacy/TRACE.

Abstract:
Watermarking offers a promising solution for detecting LLM‑generated content, yet its robustness under realistic query‑free (black‑box) evasion remains an open challenge. Existing query‑free attacks often achieve limited success or severely distort semantic meaning. We bridge this gap by theoretically analyzing rewriting‑based evasion, demonstrating that reducing the average conditional probability of sampling green tokens by a small margin causes the detection probability to decay exponentially. Guided by this insight, we propose the \emphBias‑Inversion Rewriting Attack (BIRA), a practical query‑free method that applies a negative logit bias to a proxy suppression set identified via token surprisal. Empirically, BIRA achieves state‑of‑the‑art evasion rates (>99%) across diverse watermarking schemes while preserving semantic fidelity substantially better than prior baselines. Our findings reveal a fundamental vulnerability in current watermarking methods and highlight the need for rigorous stress tests. Our code is available at \hrefhttps://github.com/ml‑postech/LLM‑Watermark‑Evasion‑via‑Bias‑Inversionhere.

Abstract:
Semantic‑level watermarking (SWM) for large language models (LLMs) enhances watermarking robustness against text modifications and paraphrasing attacks by treating the sentence as the fundamental unit. However, existing methods still lack strong theoretical guarantees of robustness, and reject‑sampling‑based generation often introduces significant distribution distortions compared with unwatermarked outputs. In this work, we introduce a new theoretical framework on SWM through the concept of proxy functions (PFs) \unicodex2013 functions that map sentences to scalar values. Building on this framework, we propose PMark, a simple yet powerful SWM method that estimates the PF median for the next sentence dynamically through sampling while enforcing multiple PF constraints (which we call channels) to strengthen watermark evidence. Equipped with solid theoretical guarantees, PMark achieves the desired distortion‑free property and improves the robustness against paraphrasing‑style attacks. We also provide an empirically optimized version that further removes the requirement for dynamical median estimation for better sampling efficiency. Experimental results show that PMark consistently outperforms existing SWM baselines in both text quality and robustness, offering a more effective paradigm for detecting machine‑generated text. Our code will be released at [this URL](https://github.com/PMark‑repo/PMark).

Abstract:
Large language model (LLM) watermarking has shown promise in detecting AI‑generated content and mitigating misuse, with prior work claiming robustness against paraphrasing and text editing. In this paper, we argue that existing evaluations are not sufficiently adversarial, obscuring critical vulnerabilities and overstating the security. To address this, we introduce the adaptive robustness radius, a formal metric that quantifies the worst‑case resilience of watermarks against adaptive adversaries. By lifting the paraphrase space into a KL‑divergence ball, we approximate this radius and theoretically demonstrate that optimizing the attack context and model parameters can significantly reduce the approximate radius, making watermarks highly vulnerable to paraphrase attacks. Leveraging this insight, we propose RLCracker, a reinforcement learning (RL)‑based adaptive attack that erases watermark signals with limited watermarked examples and limited access to the detector. Despite weak supervision, it empowers a 3B model to achieve 98.5% removal success with minimal semantic shift on 1,500‑token Unigram‑marked texts after training on only 100 short samples. This performance dramatically exceeds 6.75% by GPT‑4o and generalizes across five model sizes over ten watermarking schemes. Our code is available at https://github.com/OTT0‑OTO/RLCracker.

Abstract:
This paper presents the first study on the impact of audio watermarking on spoofing countermeasures. While anti‑spoofing systems are essential for securing speech‑based applications, the influence of widely used audio watermarking, originally designed for copyright protection, remains largely unexplored. We construct watermark‑augmented training and evaluation datasets, named the Watermark‑Spoofing dataset, by applying diverse handcrafted and neural watermarking methods to existing anti‑spoofing datasets. Experiments show that watermarking consistently degrades anti‑spoofing performance, with higher watermark density correlating with higher Equal Error Rates (EERs). To mitigate this, we propose the Knowledge‑Preserving Watermark Learning (KPWL) framework, enabling models to adapt to watermark‑induced shifts while preserving their original‑domain spoofing detection capability. These findings reveal audio watermarking as a previously overlooked domain shift and establish the first benchmark for developing watermark‑resilient anti‑spoofing systems. All related protocols are publicly available at https://github.com/Alphawarheads/Watermark_Spoofing.git

Abstract:
The rapid progress of image‑guided video generation (I2V) has raised concerns about its potential misuse in misinformation and fraud, underscoring the urgent need for effective digital watermarking. While existing watermarking methods demonstrate robustness within a single modality, they fail to trace source images in I2V settings. To address this gap, we introduce the concept of Robust Diffusion Distance, which measures the temporal persistence of watermark signals in generated videos. Building on this, we propose I2VWM, a cross‑modal watermarking framework designed to enhance watermark robustness across time. I2VWM leverages a video‑simulation noise layer during training and employs an optical‑flow‑based alignment module during inference. Experiments on both open‑source and commercial I2V models demonstrate that I2VWM significantly improves robustness while maintaining imperceptibility, establishing a new paradigm for cross‑modal watermarking in the era of generative video. \hrefhttps://github.com/MrCrims/I2VWM‑Robust‑Watermarking‑for‑Image‑to‑Video‑GenerationCode Released.

Abstract:
Synchronization is the task of estimating and inverting geometric transformations (e.g., crop, rotation) applied to an image. This work introduces SyncSeal, a bespoke watermarking method for robust image synchronization, which can be applied on top of existing watermarking methods to enhance their robustness against geometric transformations. It relies on an embedder network that imperceptibly alters images and an extractor network that predicts the geometric transformation to which the image was subjected. Both networks are end‑to‑end trained to minimize the error between the predicted and ground‑truth parameters of the transformation, combined with a discriminator to maintain high perceptual quality. We experimentally validate our method on a wide variety of geometric and valuemetric transformations, demonstrating its effectiveness in accurately synchronizing images. We further show that our synchronization can effectively upgrade existing watermarking methods to withstand geometric transformations to which they were previously vulnerable.

Abstract:
The rapid growth of digital and AI‑generated images has amplified the need for secure and verifiable methods of image attribution. While digital watermarking offers more robust protection than metadata‑based approaches‑‑which can be easily stripped‑‑current watermarking techniques remain vulnerable to forgery, creating risks of misattribution that can damage the reputations of AI model developers and the rights of digital artists. The vulnerabilities of digital watermarking arise from two key issues: (1) content‑agnostic watermarks, which, once learned or leaked, can be transferred across images to fake attribution, and (2) reliance on detector‑based verification, which is unreliable since detectors can be tricked. We present MetaSeal, a novel framework for content‑dependent watermarking with cryptographic security guarantees to safeguard image attribution. Our design provides (1) forgery resistance, preventing unauthorized replication and enforcing cryptographic verification; (2) robust self‑contained protection, embedding attribution directly into images while maintaining robustness against benign transformations; and (3) evidence of tampering, making malicious alterations visually detectable. Experiments demonstrate that MetaSeal effectively mitigates forgery attempts and applies to both natural and AI‑generated images, establishing a new standard for secure image attribution. Code is available at: https://github.com/Tongzhou0101/MetaSeal.

Abstract:
Semantic watermarking techniques for latent diffusion models (LDMs) are robust against regeneration attacks, but often suffer from detection performance degradation due to the loss of frequency integrity. To tackle this problem, we propose a novel embedding method called Hermitian Symmetric Fourier Watermarking (SFW), which maintains frequency integrity by enforcing Hermitian symmetry. Additionally, we introduce a center‑aware embedding strategy that reduces the vulnerability of semantic watermarking due to cropping attacks by ensuring robust information retention. To validate our approach, we apply these techniques to existing semantic watermarking schemes, enhancing their frequency‑domain structures for better robustness and retrieval accuracy. Extensive experiments demonstrate that our methods achieve state‑of‑the‑art verification and identification performance, surpassing previous approaches across various attack scenarios. Ablation studies confirm the impact of SFW on detection capabilities, the effectiveness of the center‑aware embedding against cropping, and how message capacity influences identification accuracy. Notably, our method achieves the highest detection accuracy while maintaining superior image fidelity, as evidenced by FID and CLIP scores. Conclusively, our proposed SFW is shown to be an effective framework for balancing robustness and image fidelity, addressing the inherent trade‑offs in semantic watermarking. Code available at https://github.com/thomas11809/SFWMark

Abstract:
Recent studies on deep watermarking have predominantly focused on in‑processing watermarking, which integrates the watermarking process into image generation. However, post‑processing watermarking, which embeds watermarks after image generation, offers more flexibility. It can be applied to outputs from any generative model (e.g. GANs, diffusion models) without needing access to the model's internal structure. It also allows users to embed unique watermarks into individual images. Therefore, this study focuses on post‑processing watermarking and enhances its robustness by incorporating an ensemble attack network during training. We construct various versions of attack networks using CNN and Transformer in both spatial and frequency domains to investigate how each combination influences the robustness of the watermarking model. Our results demonstrate that combining a CNN‑based attack network in the spatial domain with a Transformer‑based attack network in the frequency domain yields the highest robustness in watermarking models. Extensive evaluation on the WAVES benchmark, using average bit accuracy as the metric, demonstrates that our ensemble attack network significantly enhances the robustness of baseline watermarking methods under various stress tests. In particular, for the Regeneration Attack defined in WAVES, our method improves StegaStamp by 18.743%. The code is released at:https://github.com/aiiu‑lab/DeepRobustWatermark.

Abstract:
The growing popularity of 3D Gaussian Splatting (3DGS) has intensified the need for effective copyright protection. Current 3DGS watermarking methods rely on computationally expensive fine‑tuning procedures for each predefined message. We propose the first generalizable watermarking framework that enables efficient protection of Splatter Image‑based 3DGS models through a single forward pass. We introduce GaussianBridge that transforms unstructured 3D Gaussians into Splatter Image format, enabling direct neural processing for arbitrary message embedding. To ensure imperceptibility, we design a Gaussian‑Uncertainty‑Perceptual heatmap prediction strategy for preserving visual quality. For robust message recovery, we develop a dense segmentation‑based extraction mechanism that maintains reliable extraction even when watermarked objects occupy minimal regions in rendered views. Project page: https://kevinhuangxf.github.io/marksplatter.

Abstract:
Recent advances in LLM watermarking methods such as SynthID‑Text by Google DeepMind offer promising solutions for tracing the provenance of AI‑generated text. However, our robustness assessment reveals that SynthID‑Text is vulnerable to meaning‑preserving attacks, such as paraphrasing, copy‑paste modifications, and back‑translation, which can significantly degrade watermark detectability. To address these limitations, we propose SynGuard, a hybrid framework that combines the semantic alignment strength of Semantic Information Retrieval (SIR) with the probabilistic watermarking mechanism of SynthID‑Text. Our approach jointly embeds watermarks at both lexical and semantic levels, enabling robust provenance tracking while preserving the original meaning. Experimental results across multiple attack scenarios show that SynGuard improves watermark recovery by an average of 11.1% in F1 score compared to SynthID‑Text. These findings demonstrate the effectiveness of semantic‑aware watermarking in resisting real‑world tampering. All code, datasets, and evaluation scripts are publicly available at: https://github.com/githshine/SynGuard.

Abstract:
Protecting intellectual property on LLM‑generated code necessitates effective watermarking systems that can operate within code's highly structured, syntactically constrained nature. In this work, we introduce CodeTracer, an innovative adaptive code watermarking framework underpinned by a novel reinforcement learning training paradigm. At its core, CodeTracer features a policy‑driven approach that utilizes a parameterized model to intelligently bias token choices during next‑token prediction. This strategy ensures that embedded watermarks maintain code functionality while exhibiting subtle yet statistically detectable deviations from typical token distributions. To facilitate policy learning, we devise a comprehensive reward system that seamlessly integrates execution feedback with watermark embedding signals, balancing process‑level and outcome‑level rewards. Additionally, we employ Gumbel Top‑k reparameterization to enable gradient‑based optimization of discrete watermarking decisions. Extensive comparative evaluations demonstrate CodeTracer's significant superiority over state‑of‑the‑art baselines in both watermark detectability and the preservation of generated code's functionality. Our code is available at https://github.com/TimeLovercc/CodeTracer.

Abstract:
Watermarking LLM‑generated text is critical for content attribution and misinformation prevention. However, existing methods compromise text quality, require white‑box model access and logit manipulation. These limitations exclude API‑based models and multilingual scenarios. We propose SAEMark, a general framework for post‑hoc multi‑bit watermarking that embeds personalized messages solely via inference‑time, feature‑based rejection sampling without altering model logits or requiring training. Our approach operates on deterministic features extracted from generated text, selecting outputs whose feature statistics align with key‑derived targets. This framework naturally generalizes across languages and domains while preserving text quality through sampling LLM outputs instead of modifying. We provide theoretical guarantees relating watermark success probability and compute budget that hold for any suitable feature extractor. Empirically, we demonstrate the framework's effectiveness using Sparse Autoencoders (SAEs), achieving superior detection accuracy and text quality. Experiments across 4 datasets show SAEMark's consistent performance, with 99.7% F1 on English and strong multi‑bit detection accuracy. SAEMark establishes a new paradigm for scalable watermarking that works out‑of‑the‑box with closed‑source LLMs while enabling content attribution.

Abstract:
The rapid advancement of voice generation technologies has enabled the synthesis of speech that is perceptually indistinguishable from genuine human voices. While these innovations facilitate beneficial applications such as personalized text‑to‑speech systems and voice preservation, they have also introduced significant risks, including deepfake impersonation scams and synthetic media‑driven disinformation campaigns. Recent reports indicate that in 2024, deepfake fraud attempts surged by over 1,300% compared to 2023, underscoring the urgent need for robust audio content authentication. The financial sector has been particularly impacted, with a loss of over 10 million USD to voice scams and individual victims reporting losses exceeding 6,000 from AI‑generated deepfake calls. In response, regulators and governments worldwide are enacting measures to improve AI content transparency and traceability, emphasizing the development of forensic tools and watermarking techniques as essential strategies to uphold media integrity.

Abstract:
As valuable digital assets, deep neural networks necessitate robust ownership protection, positioning neural network watermarking (NNW) as a promising solution. Among various NNW approaches, weight‑based methods are favored for their simplicity and practicality; however, they remain vulnerable to forging and overwriting attacks. To address those challenges, we propose NeuralMark, a robust method built around a hashed watermark filter. Specifically, we utilize a hash function to generate an irreversible binary watermark from a secret key, which is then used as a filter to select the model parameters for embedding. This design cleverly intertwines the embedding parameters with the hashed watermark, providing a robust defense against both forging and overwriting attacks. An average pooling is also incorporated to resist fine‑tuning and pruning attacks. Furthermore, it can be seamlessly integrated into various neural network architectures, ensuring broad applicability. Theoretically, we analyze its security boundary. Empirically, we verify its effectiveness and robustness across 13 distinct Convolutional and Transformer architectures, covering five image classification tasks and one text generation task. The source codes are available at https://github.com/AIResearch‑Group/NeuralMark.

Abstract:
The rapid advancement of large language models (LLMs) has raised concerns about reliably detecting AI‑generated text. Stylometric metrics work well on autoregressive (AR) outputs, but their effectiveness on diffusion‑based models is unknown. We present the first systematic comparison of diffusion‑generated text (LLaDA) and AR‑generated text (LLaMA) using 2 000 samples. Perplexity, burstiness, lexical diversity, readability, and BLEU/ROUGE scores show that LLaDA closely mimics human text in perplexity and burstiness, yielding high false‑negative rates for AR‑oriented detectors. LLaMA shows much lower perplexity but reduced lexical fidelity. Relying on any single metric fails to separate diffusion outputs from human writing. We highlight the need for diffusion‑aware detectors and outline directions such as hybrid models, diffusion‑specific stylometric signatures, and robust watermarking.

Abstract:
Deepfakes pose significant security and privacy threats through malicious facial manipulations. While robust watermarking can aid in authenticity verification and source tracking, existing methods often lack the sufficient robustness against Deepfake manipulations. Diffusion models have demonstrated remarkable performance in image generation, enabling the seamless fusion of watermark with image during generation. In this study, we propose a novel robust watermarking framework based on diffusion model, called DiffMark. By modifying the training and sampling scheme, we take the facial image and watermark as conditions to guide the diffusion model to progressively denoise and generate corresponding watermarked image. In the construction of facial condition, we weight the facial image by a timestep‑dependent factor that gradually reduces the guidance intensity with the decrease of noise, thus better adapting to the sampling process of diffusion model. To achieve the fusion of watermark condition, we introduce a cross information fusion (CIF) module that leverages a learnable embedding table to adaptively extract watermark features and integrates them with image features via cross‑attention. To enhance the robustness of the watermark against Deepfake manipulations, we integrate a frozen autoencoder during training phase to simulate Deepfake manipulations. Additionally, we introduce Deepfake‑resistant guidance that employs specific Deepfake model to adversarially guide the diffusion sampling process to generate more robust watermarked images. Experimental results demonstrate the effectiveness of the proposed DiffMark on typical Deepfakes. Our code will be available at https://github.com/vpsg‑research/DiffMark.

Abstract:
AI‑generated content (AIGC) enables efficient visual creation but raises copyright and authenticity risks. As a common technique for integrity verification and source tracing, digital image watermarking is regarded as a potential solution to above issues. However, the widespread adoption and advancing capabilities of generative image editing tools have amplified malicious tampering risks, while simultaneously posing new challenges to passive tampering detection and watermark robustness. To address these challenges, this paper proposes a Tamper‑Aware Generative image WaterMarking method named TAG‑WM. The proposed method comprises four key modules: a dual‑mark joint sampling (DMJS) algorithm for embedding copyright and localization watermarks into the latent space while preserving generative quality, the watermark latent reconstruction (WLR) utilizing reversed DMJS, a dense variation region detector (DVRD) leveraging diffusion inversion sensitivity to identify tampered areas via statistical deviation analysis, and the tamper‑aware decoding (TAD) guided by localization results. The experimental results demonstrate that TAG‑WM achieves state‑of‑the‑art performance in both tampering robustness and localization capability even under distortion, while preserving lossless generation quality and maintaining a watermark capacity of 256 bits. The code is available at: https://github.com/Suchenl/TAG‑WM.

Abstract:
State‑of‑the‑art text‑to‑image models generate photorealistic images at an unprecedented speed. This work focuses on models that operate in a bitwise autoregressive manner over a discrete set of tokens that is practically infinite in size. However, their impressive generative power comes with a growing risk: as their outputs increasingly populate the Internet, they are likely to be scraped and reused as training data‑potentially by the very same models. This phenomenon has been shown to lead to model collapse, where repeated training on generated content, especially from the models' own previous versions, causes a gradual degradation in performance. A promising mitigation strategy is watermarking, which embeds human‑imperceptible yet detectable signals into generated images‑enabling the identification of generated content. In this work, we introduce BitMark, a robust bitwise watermarking framework. Our method embeds a watermark directly at the bit level of the token stream during the image generation process. Our bitwise watermark subtly influences the bits to preserve visual fidelity and generation speed while remaining robust against a spectrum of removal techniques. Furthermore, it exhibits high radioactivity, i.e., when watermarked generated images are used to train another image generative model, this second model's outputs will also carry the watermark. The radioactive traces remain detectable even when only fine‑tuning diffusion or image autoregressive models on images watermarked with our BitMark. Overall, our approach provides a principled step toward preventing model collapse in image generative models by enabling reliable detection of generated outputs. The code is available at https://github.com/sprintml/BitMark.

Abstract:
Watermarking the outputs of generative models has emerged as a promising approach for tracking their provenance. Despite significant interest in autoregressive image generation models and their potential for misuse, no prior work has attempted to watermark their outputs at the token level. In this work, we present the first such approach by adapting language model watermarking techniques to this setting. We identify a key challenge: the lack of reverse cycle‑consistency (RCC), wherein re‑tokenizing generated image tokens significantly alters the token sequence, effectively erasing the watermark. To address this and to make our method robust to common image transformations, neural compression, and removal attacks, we introduce (i) a custom tokenizer‑detokenizer finetuning procedure that improves RCC, and (ii) a complementary watermark synchronization layer. As our experiments demonstrate, our approach enables reliable and robust watermark detection with theoretically grounded p‑values. Code and models are available at https://github.com/facebookresearch/wmar.

Abstract:
Deep neural networks (DNNs) rely heavily on high‑quality open‑source datasets (e.g., ImageNet) for their success, making dataset ownership verification (DOV) crucial for protecting public dataset copyrights. In this paper, we find existing DOV methods (implicitly) assume that the verification process is faithful, where the suspicious model will directly verify ownership by using the verification samples as input and returning their results. However, this assumption may not necessarily hold in practice and their performance may degrade sharply when subjected to intentional or unintentional perturbations. To address this limitation, we propose the first certified dataset watermark (i.e., CertDW) and CertDW‑based certified dataset ownership verification method that ensures reliable verification even under malicious attacks, under certain conditions (e.g., constrained pixel‑level perturbation). Specifically, inspired by conformal prediction, we introduce two statistical measures, including principal probability (PP) and watermark robustness (WR), to assess model prediction stability on benign and watermarked samples under noise perturbations. We prove there exists a provable lower bound between PP and WR, enabling ownership verification when a suspicious model's WR value significantly exceeds the PP values of multiple benign models trained on watermark‑free datasets. If the number of PP values smaller than WR exceeds a threshold, the suspicious model is regarded as having been trained on the protected dataset. Extensive experiments on benchmark datasets verify the effectiveness of our CertDW method and its resistance to potential adaptive attacks. Our codes are at \hrefhttps://github.com/NcepuQiaoTing/CertDWGitHub.

Abstract:
Large language model (LLM) watermarks enable authentication of text provenance, curb misuse of machine‑generated text, and promote trust in AI systems. Current watermarks operate by changing the next‑token predictions output by an LLM. The updated (i.e., watermarked) predictions depend on random side information produced, for example, by hashing previously generated tokens. LLM watermarking is particularly challenging in low‑entropy generation tasks ‑‑ such as coding ‑‑ where next‑token predictions are near‑deterministic. In this paper, we propose an optimization framework for watermark design. Our goal is to understand how to most effectively use random side information in order to maximize the likelihood of watermark detection and minimize the distortion of generated text. Our analysis informs the design of two new watermarks: HeavyWater and SimplexWater. Both watermarks are tunable, gracefully trading‑off between detection accuracy and text distortion. They can also be applied to any LLM and are agnostic to side information generation. We examine the performance of HeavyWater and SimplexWater through several benchmarks, demonstrating that they can achieve high watermark detection accuracy with minimal compromise of text generation quality, particularly in the low‑entropy regime. Our theoretical analysis also reveals surprising new connections between LLM watermarking and coding theory. The code implementation can be found in https://github.com/DorTsur/HeavyWater_SimplexWater

Abstract:
As deep learning advances in audio generation, challenges in audio security and copyright protection highlight the need for robust audio watermarking. Recent neural network‑based methods have made progress but still face three main issues: preventing unauthorized access, decoding initial watermarks after multiple embeddings, and embedding varying lengths of watermarks. To address these issues, we propose WAKE, the first key‑controllable audio watermark framework. WAKE embeds watermarks using specific keys and recovers them with corresponding keys, enhancing security by making incorrect key decoding impossible. It also resolves the overwriting issue by allowing watermark decoding after multiple embeddings and supports variable‑length watermark insertion. WAKE outperforms existing models in both watermarked audio quality and watermark detection accuracy. Code, more results, and demo page: https://thuhcsi.github.io/WAKE.

Abstract:
Diffusion models have achieved remarkable progress in both image generation and editing. However, recent studies have revealed their vulnerability to backdoor attacks, in which specific patterns embedded in the input can manipulate the model's behavior. Most existing research in this area has proposed attack frameworks focused on the image generation pipeline, leaving backdoor attacks in image editing relatively unexplored. Among the few studies targeting image editing, most utilize visible triggers, which are impractical because they introduce noticeable alterations to the input image before editing. In this paper, we propose a novel attack framework that embeds invisible triggers into the image editing process via poisoned training data. We leverage off‑the‑shelf deep watermarking models to encode imperceptible watermarks as backdoor triggers. Our goal is to make the model produce the predefined backdoor target when it receives watermarked inputs, while editing clean images normally according to the given prompt. With extensive experiments across different watermarking models, the proposed method achieves promising attack success rates. In addition, the analysis results of the watermark characteristics in term of backdoor attack further support the effectiveness of our approach. The code is available at:https://github.com/aiiu‑lab/BackdoorImageEditing

Abstract:
The pervasion of large‑scale Deep Neural Networks (DNNs) and their enormous training costs make their intellectual property (IP) protection of paramount importance. Recently introduced passport‑based methods attempt to steer DNN watermarking towards strengthening ownership verification against ambiguity attacks by modulating the affine parameters of normalization layers. Unfortunately, neither watermarking nor passport‑based methods provide a holistic protection with robust ownership proof, high fidelity, active usage authorization and user traceability for offline access distributed models and multi‑user Machine‑Learning as a Service (MLaaS) cloud model. In this paper, we propose a Chameleon Hash‑based Irreversible Passport (CHIP) protection framework that utilizes the cryptographic chameleon hash function to achieve all these goals. The collision‑resistant property of chameleon hash allows for strong model ownership claim upon IP infringement and liable user traceability, while the trapdoor‑collision property enables hashing of multiple user passports and licensee certificates to the same immutable signature to realize active usage control. Using the owner passport as an oracle, multiple user‑specific triplets, each contains a passport‑aware user model, a user passport, and a licensee certificate can be created for secure offline distribution. The watermarked master model can also be deployed for MLaaS with usage permission verifiable by the provision of any trapdoor‑colliding user passports. CHIP is extensively evaluated on four datasets and two architectures to demonstrate its protection versatility and robustness. Our code is released at https://github.com/Dshm212/CHIP.

Abstract:
We introduce MUSE, a watermarking algorithm for tabular generative models. Previous approaches typically leverage DDIM invertibility to watermark tabular diffusion models, but tabular diffusion models exhibit significantly poorer invertibility compared to other modalities, compromising performance. Simultaneously, tabular diffusion models require substantially less computation than other modalities, enabling a multi‑sample selection approach to tabular generative model watermarking. MUSE embeds watermarks by generating multiple candidate samples and selecting one based on a specialized scoring function, without relying on model invertibility. Our theoretical analysis establishes the relationship between watermark detectability, candidate count, and dataset size, allowing precise calibration of watermarking strength. Extensive experiments demonstrate that MUSE achieves state‑of‑the‑art watermark detectability and robustness against various attacks while maintaining data quality, and remains compatible with any tabular generative model supporting repeated sampling, effectively addressing key challenges in tabular data watermarking. Specifically, it reduces the distortion rates on fidelity metrics by 81‑89%, while achieving a 1.0 TPR@0.1%FPR detection rate. Implementation of MUSE can be found at https://github.com/fangliancheng/MUSE.

Abstract:
Knowledge graphs (KGs) are ubiquitous in numerous real‑world applications, and watermarking facilitates protecting intellectual property and preventing potential harm from AI‑generated content. Existing watermarking methods mainly focus on static plain text or image data, while they can hardly be applied to dynamic graphs due to spatial and temporal variations of structured data. This motivates us to propose KGMARK, the first graph watermarking framework that aims to generate robust, detectable, and transparent diffusion fingerprints for dynamic KG data. Specifically, we propose a novel clustering‑based alignment method to adapt the watermark to spatial variations. Meanwhile, we present a redundant embedding strategy to harden the diffusion watermark against various attacks, facilitating the robustness of the watermark to the temporal variations. Additionally, we introduce a novel learnable mask matrix to improve the transparency of diffusion fingerprints. By doing so, our KGMARK properly tackles the variation challenges of structured data. Experiments on various public benchmarks show the effectiveness of our proposed KGMARK. Our code is available at https://github.com/phrara/kgmark.

Abstract:
The rapid development of video generative models has led to a surge in highly realistic synthetic videos, raising ethical concerns related to disinformation and copyright infringement. Recently, video watermarking has been proposed as a mitigation strategy by embedding invisible marks into AI‑generated videos to enable subsequent detection. However, the robustness of existing video watermarking methods against both common and adversarial perturbations remains underexplored. In this work, we introduce VideoMarkBench, the first systematic benchmark designed to evaluate the robustness of video watermarks under watermark removal and watermark forgery attacks. Our study encompasses a unified dataset generated by three state‑of‑the‑art video generative models, across three video styles, incorporating four watermarking methods and seven aggregation strategies used during detection. We comprehensively evaluate 12 types of perturbations under white‑box, black‑box, and no‑box threat models. Our findings reveal significant vulnerabilities in current watermarking approaches and highlight the urgent need for more robust solutions. Our code is available at https://github.com/zhengyuan‑jiang/VideoMarkBench.

Abstract:
Large Language Models (LLMs) represent substantial intellectual and economic investments, yet their effectiveness can inadvertently facilitate model imitation via knowledge distillation (KD). In practical scenarios, competitors can distill proprietary LLM capabilities by simply observing publicly accessible outputs, akin to reverse‑engineering a complex performance by observation alone. Existing protective methods like watermarking only identify imitation post‑hoc, while other defenses assume the student model mimics the teacher's internal logits, rendering them ineffective against distillation purely from observed output text. This paper confronts the challenge of actively protecting LLMs within the realistic constraints of API‑based access. We introduce an effective and efficient Defensive Output Generation (DOGe) strategy that subtly modifies the output behavior of an LLM. Its outputs are accurate and useful for legitimate users, yet are designed to be misleading for distillation, significantly undermining imitation attempts. We achieve this by fine‑tuning only the final linear layer of the teacher LLM with an adversarial loss. This targeted training approach anticipates and disrupts distillation attempts during inference time. Our experiments show that, while preserving the performance of the teacher model, student models distilled from the defensively generated outputs demonstrate catastrophically reduced performance, demonstrating DOGe as a practical safeguard against KD‑based model imitation.

Abstract:
The growing use of large language models (LLMs) for sensitive applications has highlighted the need for effective watermarking techniques to ensure the provenance and accountability of AI‑generated text. However, most existing watermarking methods require access to the decoding process, limiting their applicability in real‑world settings. One illustrative example is the use of LLMs by dishonest reviewers in the context of academic peer review, where conference organizers have no access to the model used but still need to detect AI‑generated reviews. Motivated by this gap, we introduce In‑Context Watermarking (ICW), which embeds watermarks into generated text solely through prompt engineering, leveraging LLMs' in‑context learning and instruction‑following abilities. We investigate four ICW strategies at different levels of granularity, each paired with a tailored detection method. We further examine the Indirect Prompt Injection (IPI) setting as a specific case study, in which watermarking is covertly triggered by modifying input documents such as academic manuscripts. Our experiments validate the feasibility of ICW as a model‑agnostic, practical watermarking approach. Moreover, our findings suggest that as LLMs become more capable, ICW offers a promising direction for scalable and accessible content attribution. Our code is available at https://github.com/yepengliu/In‑Context‑Watermarks.

Abstract:
Large language models (LLMs) are considered valuable Intellectual Properties (IP) for legitimate owners due to the enormous computational cost of training. It is crucial to protect the IP of LLMs from malicious stealing or unauthorized deployment. Despite existing efforts in watermarking and fingerprinting LLMs, these methods either impact the text generation process or are limited in white‑box access to the suspect model, making them impractical. Hence, we propose DuFFin, a novel Dual‑Level Fingerprinting Framework for black‑box setting ownership verification. DuFFin extracts the trigger pattern and the knowledge‑level fingerprints to identify the source of a suspect model. We conduct experiments on a variety of models collected from the open‑source website, including four popular base models as protected LLMs and their fine‑tuning, quantization, and safety alignment versions, which are released by large companies, start‑ups, and individual users. Results show that our method can accurately verify the copyright of the base protected LLM on their model variants, achieving the IP‑ROC metric greater than 0.95. Our code is available at https://github.com/yuliangyan0807/llm‑fingerprint.

Abstract:
Logit‑based LLM watermarking traces and verifies AI‑generated content by maintaining green and red token lists and increasing the likelihood of green tokens during generation. However, it fails in low‑entropy scenarios, where predictable outputs make green token selection difficult without disrupting natural text flow. Existing approaches address this by assuming access to the original LLM to calculate entropy and selectively watermark high‑entropy tokens. However, these methods face two major challenges: (1) high computational costs and detection delays due to reliance on the original LLM, and (2) potential risks of model leakage. To address these limitations, we propose Invisible Entropy (IE), a watermarking paradigm designed to enhance both safety and efficiency. Instead of relying on the original LLM, IE introduces a lightweight feature extractor and an entropy tagger to predict whether the entropy of the next token is high or low. Furthermore, based on theoretical analysis, we develop a threshold navigator that adaptively sets entropy thresholds. It identifies a threshold where the watermark ratio decreases as the green token count increases, enhancing the naturalness of the watermarked text and improving detection robustness. Experiments on HumanEval and MBPP datasets demonstrate that IE reduces parameter size by 99% while achieving performance on par with state‑of‑the‑art methods. Our work introduces a safe and efficient paradigm for low‑entropy watermarking. https://github.com/Carol‑gutianle/IE https://huggingface.co/datasets/Carol0110/IE‑Tagger

Abstract:
Due to the distributed nature of Federated Learning (FL) systems, each local client has access to the global model, which poses a critical risk of model leakage. Existing works have explored injecting watermarks into local models to enable intellectual property protection. However, these methods either focus on non‑traceable watermarks or traceable but white‑box watermarks. We identify a gap in the literature regarding the formal definition of traceable black‑box watermarking and the formulation of the problem of injecting such watermarks into FL systems. In this work, we first formalize the problem of injecting traceable black‑box watermarks into FL. Based on the problem, we propose a novel server‑side watermarking method, \mathbfTraMark, which creates a traceable watermarked model for each client, enabling verification of model leakage in black‑box settings. To achieve this, \mathbfTraMark partitions the model parameter space into two distinct regions: the main task region and the watermarking region. Subsequently, a personalized global model is constructed for each client by aggregating only the main task region while preserving the watermarking region. Each model then learns a unique watermark exclusively within the watermarking region using a distinct watermark dataset before being sent back to the local client. Extensive results across various FL systems demonstrate that \mathbfTraMark ensures the traceability of all watermarked models while preserving their main task performance. The code is available at https://github.com/JiiahaoXU/TraMark.

Abstract:
The explosive growth of generative video models has amplified the demand for reliable copyright preservation of AI‑generated content. Despite its popularity in image synthesis, invisible generative watermarking remains largely underexplored in video generation. To address this gap, we propose Safe‑Sora, the first framework to embed graphical watermarks directly into the video generation process. Motivated by the observation that watermarking performance is closely tied to the visual similarity between the watermark and cover content, we introduce a hierarchical coarse‑to‑fine adaptive matching mechanism. Specifically, the watermark image is divided into patches, each assigned to the most visually similar video frame, and further localized to the optimal spatial region for seamless embedding. To enable spatiotemporal fusion of watermark patches across video frames, we develop a 3D wavelet transform‑enhanced Mamba architecture with a novel spatiotemporal local scanning strategy, effectively modeling long‑range dependencies during watermark embedding and retrieval. To the best of our knowledge, this is the first attempt to apply state space models to watermarking, opening new avenues for efficient and robust watermark protection. Extensive experiments demonstrate that Safe‑Sora achieves state‑of‑the‑art performance in terms of video quality, watermark fidelity, and robustness, which is largely attributed to our proposals. Code is publicly available at https://github.com/Sugewud/Safe‑Sora

Abstract:
The rise of Large Language Models (LLMs) has heightened concerns about the misuse of AI‑generated text, making watermarking a promising solution. Mainstream watermarking schemes for LLMs fall into two categories: logits‑based and sampling‑based. However, current schemes entail trade‑offs among robustness, text quality, and security. To mitigate this, we integrate logits‑based and sampling‑based schemes, harnessing their respective strengths to achieve synergy. In this paper, we propose a versatile symbiotic watermarking framework with three strategies: serial, parallel, and hybrid. The hybrid framework adaptively embeds watermarks using token entropy and semantic entropy, optimizing the balance between detectability, robustness, text quality, and security. Furthermore, we validate our approach through comprehensive experiments on various datasets and models. Experimental results indicate that our method outperforms existing baselines and achieves state‑of‑the‑art (SOTA) performance. We believe this framework provides novel insights into diverse watermarking paradigms. Our code is available at https://github.com/redwyd/SymMark.

Abstract:
Large‑language models (LLMs) are now able to produce text that is, in many cases, seemingly indistinguishable from human‑generated content. This has fueled the development of watermarks that imprint a ``signal'' in LLM‑generated text with minimal perturbation of an LLM's output. This paper provides an analysis of text watermarking in a one‑shot setting. Through the lens of hypothesis testing with side information, we formulate and analyze the fundamental trade‑off between watermark detection power and distortion in generated textual quality. We argue that a key component in watermark design is generating a coupling between the side information shared with the watermark detector and a random partition of the LLM vocabulary. Our analysis identifies the optimal coupling and randomization strategy under the worst‑case LLM next‑token distribution that satisfies a min‑entropy constraint. We provide a closed‑form expression of the resulting detection rate under the proposed scheme and quantify the cost in a max‑min sense. Finally, we provide an array of numerical results, comparing the proposed scheme with the theoretical optimum and existing schemes, in both synthetic data and LLM watermarking. Our code is available at https://github.com/Carol‑Long/CC_Watermark

Abstract:
Deepfake technology poses increasing risks such as privacy invasion and identity theft. To address these threats, we propose WaveGuard, a proactive watermarking framework that enhances robustness and imperceptibility via frequency‑domain embedding and graph‑based structural consistency. Specifically, we embed watermarks into high‑frequency sub‑bands using Dual‑Tree Complex Wavelet Transform (DT‑CWT) and employ a Structural Consistency Graph Neural Network (SC‑GNN) to preserve visual quality. We also design an attention module to refine embedding precision. Experimental results on face swap and reenactment tasks demonstrate that WaveGuard outperforms state‑of‑the‑art methods in both robustness and visual quality. Code is available at https://github.com/vpsg‑research/WaveGuard.

Abstract:
Visible watermark removal is challenging due to its inherent complexities and the noise carried within images. Existing methods primarily rely on supervised learning approaches that require paired datasets of watermarked and watermark‑free images, which are often impractical to obtain in real‑world scenarios. To address this challenge, we propose SSH‑Net, a Self‑Supervised and Hybrid Network specifically designed for noisy image watermark removal. SSH‑Net synthesizes reference watermark‑free images using the watermark distribution in a self‑supervised manner and adopts a dual‑network design to address the task. The upper network, focused on the simpler task of noise removal, employs a lightweight CNN‑based architecture, while the lower network, designed to handle the more complex task of simultaneously removing watermarks and noise, incorporates Transformer blocks to model long‑range dependencies and capture intricate image features. To enhance the model's effectiveness, a shared CNN‑based feature encoder is introduced before dual networks to extract common features that both networks can leverage. Our code will be available at https://github.com/wenyang001/SSH‑Net.

Abstract:
Large language model (LLM) unlearning is critical in real‑world applications where it is necessary to efficiently remove the influence of private, copyrighted, or harmful data from some users. Existing utility‑centric unlearning metrics (based on model utility) may fail to accurately evaluate the extent of unlearning in realistic settings such as when the forget and retain sets have semantically similar content and/or retraining the model from scratch on the retain set is impractical. This paper presents the first data‑centric unlearning metric for LLMs called WaterDrum that exploits robust text watermarking to overcome these limitations. We introduce new benchmark datasets (with different levels of data similarity) for LLM unlearning that can be used to rigorously evaluate unlearning algorithms via WaterDrum. Our code is available at https://github.com/lululu008/WaterDrum and our new benchmark datasets are released at https://huggingface.co/datasets/Glow‑AI/WaterDrum‑Ax.

Abstract:
The rise of LLMs has increased concerns over source tracing and copyright protection for AIGC, highlighting the need for advanced detection technologies. Passive detection methods usually face high false positives, while active watermarking techniques using logits or sampling manipulation offer more effective protection. Existing LLM watermarking methods, though effective on unaltered content, suffer significant performance drops when the text is modified and could introduce biases that degrade LLM performance in downstream tasks. These methods fail to achieve an optimal tradeoff between text quality and robustness, particularly due to the lack of end‑to‑end optimization of the encoder and decoder. In this paper, we introduce a novel end‑to‑end logits perturbation method for watermarking LLM‑generated text. By jointly optimization, our approach achieves a better balance between quality and robustness. To address non‑differentiable operations in the end‑to‑end training pipeline, we introduce an online prompting technique that leverages the on‑the‑fly LLM as a differentiable surrogate. Our method achieves superior robustness, outperforming distortion‑free methods by 37‑39% under paraphrasing and 17.2% on average, while maintaining text quality on par with these distortion‑free methods in terms of text perplexity and downstream tasks. Our method can be easily generalized to different LLMs. Code is available at https://github.com/KahimWong/E2E‑LLM‑Watermark.

Abstract:
Video diffusion models can generate realistic and temporally consistent videos. This raises concerns about provenance, ownership, and integrity. Watermarking can help address these issues by embedding metadata directly into the content. To work well, a watermark needs enough capacity for meaningful metadata. It must also stay imperceptible and remain robust to common video manipulations. Existing methods struggle with limited capacity, extra inference cost, or reduced visual quality. We introduce VidStamp, a watermarking framework that embeds frame‑level messages through the decoder of a latent video diffusion model. The decoder is fine‑tuned in two stages. The first stage uses static image datasets to encourage spatial message separation. The second stage uses synthesized video sequences to restore temporal consistency. This approach enables high‑capacity watermarks with minimal perceptual impact. VidStamp also supports dynamic watermarking through a control signal that selects message templates during inference. This adds flexibility and creates a second channel for communication. We evaluate VidStamp on Stable Video Diffusion (I2V), OpenSora, and Wan (T2V). The system embeds 48 bits per frame while preserving visual quality and staying robust to common distortions. Compared with VideoSeal, VideoShield, and RivaGAN, it achieves lower log P‑values and stronger detectability. Its frame‑wise watermarking design also enables precise temporal tamper localization, with an accuracy of 0.96, which exceeds the VideoShield baseline. Code: https://github.com/SPIN‑UMass/VidStamp

Abstract:
This work introduces VideoMark, a distortion‑free robust watermarking framework for video diffusion models. As diffusion models excel in generating realistic videos, reliable content attribution is increasingly critical. However, existing video watermarking methods often introduce distortion by altering the initial distribution of diffusion variables and are vulnerable to temporal attacks, such as frame deletion, due to variable video lengths. VideoMark addresses these challenges by employing a pure pseudorandom initialization to embed watermarks, avoiding distortion while ensuring uniform noise distribution in the latent space to preserve generation quality. To enhance robustness, we adopt a frame‑wise watermarking strategy with pseudorandom error correction (PRC) codes, using a fixed watermark sequence with randomly selected starting indices for each video. For watermark extraction, we propose a Temporal Matching Module (TMM) that leverages edit distance to align decoded messages with the original watermark sequence, ensuring resilience against temporal attacks. Experimental results show that VideoMark achieves higher decoding accuracy than existing methods while maintaining video quality comparable to watermark‑free generation. The watermark remains imperceptible to attackers without the secret key, offering superior invisibility compared to other frameworks. VideoMark provides a practical, training‑free solution for content attribution in diffusion‑based video generation. Our code and data are available at \hrefhttps://github.com/KYRIE‑LI11/VideoMarkVideoMark.

Abstract:
Given how large parts of publicly available text are crawled to pretrain large language models (LLMs), data creators increasingly worry about the inclusion of their proprietary data for model training without attribution or licensing. Their concerns are also shared by benchmark curators whose test‑sets might be compromised. In this paper, we present STAMP, a framework for detecting dataset membership‑i.e., determining the inclusion of a dataset in the pretraining corpora of LLMs. Given an original piece of content, our proposal involves first generating multiple rephrases, each embedding a watermark with a unique secret key. One version is to be released publicly, while others are to be kept private. Subsequently, creators can compare model likelihoods between public and private versions using paired statistical tests to prove membership. We show that our framework can successfully detect contamination across four benchmarks which appear only once in the training data and constitute less than 0.001% of the total tokens, outperforming several contamination detection and dataset inference baselines. We verify that STAMP preserves both the semantic meaning and utility of the original data. We apply STAMP to two real‑world scenarios to confirm the inclusion of paper abstracts and blog articles in the pretraining corpora.

Abstract:
Text‑to‑image models based on diffusion processes, such as DALL‑E, Stable Diffusion, and Midjourney, are capable of transforming texts into detailed images and have widespread applications in art and design. As such, amateur users can easily imitate professional‑level paintings by collecting an artist's work and fine‑tuning the model, leading to concerns about artworks' copyright infringement. To tackle these issues, previous studies either add visually imperceptible perturbation to the artwork to change its underlying styles (perturbation‑based methods) or embed post‑training detectable watermarks in the artwork (watermark‑based methods). However, when the artwork or the model has been published online, i.e., modification to the original artwork or model retraining is not feasible, these strategies might not be viable. To this end, we propose a novel method for data‑use auditing in the text‑to‑image generation model. The general idea of ArtistAuditor is to identify if a suspicious model has been finetuned using the artworks of specific artists by analyzing the features related to the style. Concretely, ArtistAuditor employs a style extractor to obtain the multi‑granularity style representations and treats artworks as samplings of an artist's style. Then, ArtistAuditor queries a trained discriminator to gain the auditing decisions. The experimental results on six combinations of models and datasets show that ArtistAuditor can achieve high AUC values (> 0.937). By studying ArtistAuditor's transferability and core modules, we provide valuable insights into the practical implementation. Finally, we demonstrate the effectiveness of ArtistAuditor in real‑world cases by an online platform Scenario. ArtistAuditor is open‑sourced at https://github.com/Jozenn/ArtistAuditor.

Abstract:
As digital content becomes increasingly ubiquitous, the need for robust watermark removal techniques has grown due to the inadequacy of existing embedding techniques, which lack robustness. This paper introduces a novel Saliency‑Aware Diffusion Reconstruction (SADRE) framework for watermark elimination on the web, combining adaptive noise injection, region‑specific perturbations, and advanced diffusion‑based reconstruction. SADRE disrupts embedded watermarks by injecting targeted noise into latent representations guided by saliency masks although preserving essential image features. A reverse diffusion process ensures high‑fidelity image restoration, leveraging adaptive noise levels determined by watermark strength. Our framework is theoretically grounded with stability guarantees and achieves robust watermark removal across diverse scenarios. Empirical evaluations on state‑of‑the‑art (SOTA) watermarking techniques demonstrate SADRE's superiority in balancing watermark disruption and image quality. SADRE sets a new benchmark for watermark elimination, offering a flexible and reliable solution for real‑world web content. Code is available on~\hrefhttps://github.com/inzamamulDU/SADREhttps://github.com/inzamamulDU/SADRE.

Abstract:
Watermarking is a technique to help identify the source of data points, which can be used to help prevent the misuse of protected datasets. Existing methods on code watermarking, leveraging the idea from the backdoor research, embed stealthy triggers as watermarks. Despite their high resilience against dilution attacks and backdoor detections, the robustness has not been fully evaluated. To fill this gap, we propose DeCoMa, a dual‑channel approach to Detect and purify Code dataset waterMarks. To overcome the high barrier created by the stealthy and hidden nature of code watermarks, DeCoMa leverages dual‑channel constraints on code to generalize and map code samples into standardized templates. Subsequently, DeCoMa extracts hidden watermarks by identifying outlier associations between paired elements within the standardized templates. Finally, DeCoMa purifies the watermarked dataset by removing all samples containing the detected watermark, enabling the silent appropriation of protected code. We conduct extensive experiments to evaluate the effectiveness and efficiency of DeCoMa, covering 14 types of code watermarks and 3 representative intelligent code tasks (a total of 14 scenarios). Experimental results demonstrate that DeCoMa achieves a stable recall of 100% in 14 code watermark detection scenarios, significantly outperforming the baselines. Additionally, DeCoMa effectively attacks code watermarks with embedding rates as low as 0.1%, while maintaining comparable model performance after training on the purified dataset. Furthermore, as DeCoMa requires no model training for detection, it achieves substantially higher efficiency than all baselines, with a speedup ranging from 31.5 to 130.9X. The results call for more advanced watermarking techniques for code models, while DeCoMa can serve as a baseline for future evaluation. Code is available at https://github.com/xiaoyuanpigo/DeCoMa

Abstract:
Watermarking has emerged as a promising technique for detecting texts generated by LLMs. Current research has primarily focused on three design criteria: high quality of the watermarked text, high detectability, and robustness against removal attack. However, the security against spoofing attacks remains relatively understudied. For example, a piggyback attack can maliciously alter the meaning of watermarked text‑transforming it into hate speech‑while preserving the original watermark, thereby damaging the reputation of the LLM provider. We identify two core challenges that make defending against spoofing difficult: (1) the need for watermarks to be both sensitive to semantic‑distorting changes and insensitive to semantic‑preserving edits, and (2) the contradiction between the need to detect global semantic shifts and the local, auto‑regressive nature of most watermarking schemes. To address these challenges, we propose a semantic‑aware watermarking algorithm that post‑hoc embeds watermarks into a given target text while preserving its original meaning. Our method introduces a semantic mapping model, which guides the generation of a green‑red token list, contrastively trained to be sensitive to semantic‑distorting changes and insensitive to semantic‑preserving changes. Experiments on two standard benchmarks demonstrate strong robustness against removal attacks and security against spoofing attacks, including sentiment reversal and toxic content insertion, while maintaining high watermark detectability. Our approach offers a significant step toward more secure and semantically aware watermarking for LLMs. Our code is available at https://github.com/UCSB‑NLP‑Chang/contrastive‑watermark.

Abstract:
Tree‑Ring Watermarking is a significant technique for authenticating AI‑generated images. However, its effectiveness in rectified flow‑based models remains unexplored, particularly given the inherent challenges of these models with noise latent inversion. Through extensive experimentation, we evaluated and compared the detection and separability of watermarks between SD 2.1 and FLUX.1‑dev models. By analyzing various text guidance configurations and augmentation attacks, we demonstrate how inversion limitations affect both watermark recovery and the statistical separation between watermarked and unwatermarked images. Our findings provide valuable insights into the current limitations of Tree‑Ring Watermarking in the current SOTA models and highlight the critical need for improved inversion methods to achieve reliable watermark detection and separability. The official implementation, dataset release and all experimental results are available at this \hrefhttps://github.com/dsgiitr/flux‑watermarkinglink.

Abstract:
The proliferation of AI‑generated content brings significant concerns on the forensic and security issues such as source tracing, copyright protection, etc, highlighting the need for effective watermarking technologies. Font‑based text watermarking has emerged as an effective solution to embed information, which could ensure copyright, traceability, and compliance of the generated text content. Existing font watermarking methods usually neglect essential font knowledge, which leads to watermarked fonts of low quality and limited embedding capacity. These methods are also vulnerable to real‑world distortions, low‑resolution fonts, and inaccurate character segmentation. In this paper, we introduce FontGuard, a novel font watermarking model that harnesses the capabilities of font models and language‑guided contrastive learning. Unlike previous methods that focus solely on the pixel‑level alteration, FontGuard modifies fonts by altering hidden style features, resulting in better font quality upon watermark embedding. We also leverage the font manifold to increase the embedding capacity of our proposed method by generating substantial font variants closely resembling the original font. Furthermore, in the decoder, we employ an image‑text contrastive learning to reconstruct the embedded bits, which can achieve desirable robustness against various real‑world transmission distortions. FontGuard outperforms state‑of‑the‑art methods by +5.4%, +7.4%, and +5.8% in decoding accuracy under synthetic, cross‑media, and online social network distortions, respectively, while improving the visual quality by 52.7% in terms of LPIPS. Moreover, FontGuard uniquely allows the generation of watermarked fonts for unseen fonts without re‑training the network. The code and dataset are available at https://github.com/KAHIMWONG/FontGuard.

Abstract:
Recently, video‑based large language models (video‑based LLMs) have achieved impressive performance across various video comprehension tasks. However, this rapid advancement raises significant privacy and security concerns, particularly regarding the unauthorized use of personal video data in automated annotation by video‑based LLMs. These unauthorized annotated video‑text pairs can then be used to improve the performance of downstream tasks, such as text‑to‑video generation. To safeguard personal videos from unauthorized use, we propose two series of protective video watermarks with imperceptible adversarial perturbations, named Ramblings and Mutes. Concretely, Ramblings aim to mislead video‑based LLMs into generating inaccurate captions for the videos, thereby degrading the quality of video annotations through inconsistencies between video content and captions. Mutes, on the other hand, are designed to prompt video‑based LLMs to produce exceptionally brief captions, lacking descriptive detail. Extensive experiments demonstrate that our video watermarking methods effectively protect video data by significantly reducing video annotation performance across various video‑based LLMs, showcasing both stealthiness and robustness in protecting personal video content. Our code is available at https://github.com/ttthhl/Protecting_Your_Video_Content.

Abstract:
Text watermarking provides an effective solution for identifying synthetic text generated by large language models. However, existing techniques often focus on satisfying specific criteria while ignoring other key aspects, lacking a unified evaluation. To fill this gap, we propose the Comprehensive Evaluation Framework for Watermark (CEFW), a unified framework that comprehensively evaluates watermarking methods across five key dimensions: ease of detection, fidelity of text quality, minimal embedding cost, robustness to adversarial attacks, and imperceptibility to prevent imitation or forgery. By assessing watermarks according to all these key criteria, CEFW offers a thorough evaluation of their practicality and effectiveness. Moreover, we introduce a simple and effective watermarking method called Balanced Watermark (BW), which guarantees robustness and imperceptibility through balancing the way watermark information is added. Extensive experiments show that BW outperforms existing methods in overall performance across all evaluation dimensions. We release our code to the community for future research. https://github.com/DrankXs/BalancedWatermark.

Abstract:
Audio watermarking is increasingly used to verify the provenance of AI‑generated content, enabling applications such as detecting AI‑generated speech, protecting music IP, and defending against voice cloning. To be effective, audio watermarks must resist removal attacks that distort signals to evade detection. While many schemes claim robustness, these claims are typically tested in isolation and against a limited set of attacks. A systematic evaluation against diverse removal attacks is lacking, hindering practical deployment. In this paper, we investigate whether recent watermarking schemes that claim robustness can withstand a broad range of removal attacks. First, we introduce a taxonomy covering 22 audio watermarking schemes. Next, we summarize their underlying technologies and potential vulnerabilities. We then present a large‑scale empirical study to assess their robustness. To support this, we build an evaluation framework encompassing 22 types of removal attacks (109 configurations) including signal‑level, physical‑level, and AI‑induced distortions. We reproduce 9 watermarking schemes using open‑source code, identify 8 new highly effective attacks, and highlight 11 key findings that expose the fundamental limitations of these methods across 3 public datasets. Our results reveal that none of the surveyed schemes can withstand all tested distortions. This evaluation offers a comprehensive view of how current watermarking methods perform under real‑world threats. Our demo and code are available at https://sokaudiowm.github.io/.

Abstract:
With the increasing adoption of deep learning in speaker verification, large‑scale speech datasets have become valuable intellectual property. To audit and prevent the unauthorized usage of these valuable released datasets, especially in commercial or open‑source scenarios, we propose a novel dataset ownership verification method. Our approach introduces a clustering‑based backdoor watermark (CBW), enabling dataset owners to determine whether a suspicious third‑party model has been trained on a protected dataset under a black‑box setting. The CBW method consists of two key stages: dataset watermarking and ownership verification. During watermarking, we implant multiple trigger patterns in the dataset to make similar samples (measured by their feature similarities) close to the same trigger while dissimilar samples are near different triggers. This ensures that any model trained on the watermarked dataset exhibits specific misclassification behaviors when exposed to trigger‑embedded inputs. To verify dataset ownership, we design a hypothesis‑test‑based framework that statistically evaluates whether a suspicious model exhibits the expected backdoor behavior. We conduct extensive experiments on benchmark datasets, verifying the effectiveness and robustness of our method against potential adaptive attacks. The code for reproducing main experiments is available at https://github.com/Radiant0726/CBW

Abstract:
Neural Radiance Fields (NeRF) have been gaining attention as a significant form of 3D content representation. With the proliferation of NeRF‑based creations, the need for copyright protection has emerged as a critical issue. Although some approaches have been proposed to embed digital watermarks into NeRF, they often neglect essential model‑level considerations and incur substantial time overheads, resulting in reduced imperceptibility and robustness, along with user inconvenience. In this paper, we extend the previous criteria for image watermarking to the model level and propose NeRF Signature, a novel watermarking method for NeRF. We employ a Codebook‑aided Signature Embedding (CSE) that does not alter the model structure, thereby maintaining imperceptibility and enhancing robustness at the model level. Furthermore, after optimization, any desired signatures can be embedded through the CSE, and no fine‑tuning is required when NeRF owners want to use new binary signatures. Then, we introduce a joint pose‑patch encryption watermarking strategy to hide signatures into patches rendered from a specific viewpoint for higher robustness. In addition, we explore a Complexity‑Aware Key Selection (CAKS) scheme to embed signatures in high visual complexity patches to enhance imperceptibility. The experimental results demonstrate that our method outperforms other baseline methods in terms of imperceptibility and robustness. The source code is available at: https://github.com/luo‑ziyuan/NeRF_Signature.

Abstract:
Identifying LLM‑generated code through watermarking poses a challenge in preserving functional correctness. Previous methods rely on the assumption that watermarking high‑entropy tokens effectively maintains output quality. Our analysis reveals a fundamental limitation of this assumption: syntax‑critical tokens such as keywords often exhibit the highest entropy, making existing approaches vulnerable to logic corruption. We present STONE, a syntax‑aware watermarking method that embeds watermarks only in non‑syntactic tokens and preserves code integrity. For rigorous evaluation, we also introduce STEM, a comprehensive metric that balances three critical dimensions: correctness, detectability, and imperceptibility. Across Python, C++, and Java, STONE preserves correctness, sustains strong detectability, and achieves balanced performance with minimal computational overhead. Our implementation is available at https://github.com/inistory/STONE‑watermarking.

Abstract:
The radioactive nature of Large Language Model (LLM) watermarking enables the detection of watermarks inherited by student models when trained on the outputs of watermarked teacher models, making it a promising tool for preventing unauthorized knowledge distillation. However, the robustness of watermark radioactivity against adversarial actors remains largely unexplored. In this paper, we investigate whether student models can acquire the capabilities of teacher models through knowledge distillation while avoiding watermark inheritance. We propose two categories of watermark removal approaches: pre‑distillation removal through untargeted and targeted training data paraphrasing (UP and TP), and post‑distillation removal through inference‑time watermark neutralization (WN). Extensive experiments across multiple model pairs, watermarking schemes and hyper‑parameter settings demonstrate that both TP and WN thoroughly eliminate inherited watermarks, with WN achieving this while maintaining knowledge transfer efficiency and low computational overhead. Given the ongoing deployment of watermarking techniques in production LLMs, these findings emphasize the urgent need for more robust defense strategies. Our code is available at https://github.com/THU‑BPM/Watermark‑Radioactivity‑Attack.

Abstract:
Watermarking embeds information into digital content like images, audio, or text, imperceptible to humans but robustly detectable by specific algorithms. This technology has important applications in many challenges of the industry such as content moderation, tracing AI‑generated content, and monitoring the usage of AI models. The contributions of this thesis include the development of new watermarking techniques for images, audio, and text. We first introduce methods for active moderation of images on social platforms. We then develop specific techniques for AI‑generated content. We specifically demonstrate methods to adapt latent generative models to embed watermarks in all generated content, identify watermarked sections in speech, and improve watermarking in large language models with tests that ensure low false positive rates. Furthermore, we explore the use of digital watermarking to detect model misuse, including the detection of watermarks in language models fine‑tuned on watermarked text, and introduce training‑free watermarks for the weights of large transformers. Through these contributions, the thesis provides effective solutions for the challenges posed by the increasing use of generative AI models and the need for model monitoring and content moderation. It finally examines the challenges and limitations of watermarking techniques and discuss potential future directions for research in this area.

Abstract:
Chatbot Arena is a popular platform for evaluating LLMs by pairwise battles, where users vote for their preferred response from two randomly sampled anonymous models. While Chatbot Arena is widely regarded as a reliable LLM ranking leaderboard, we show that crowdsourced voting can be rigged to improve (or decrease) the ranking of a target model m_t. We first introduce a straightforward target‑only rigging strategy that focuses on new battles involving m_t, identifying it via watermarking or a binary classifier, and exclusively voting for m_t wins. However, this strategy is practically inefficient because there are over 190 models on Chatbot Arena and on average only about 1% of new battles will involve m_t. To overcome this, we propose omnipresent rigging strategies, exploiting the Elo rating mechanism of Chatbot Arena that any new vote on a battle can influence the ranking of the target model m_t, even if m_t is not directly involved in the battle. We conduct experiments on around 1.7 million historical votes from the Chatbot Arena Notebook, showing that omnipresent rigging strategies can improve model rankings by rigging only hundreds of new votes. While we have evaluated several defense mechanisms, our findings highlight the importance of continued efforts to prevent vote rigging. Our code is available at https://github.com/sail‑sg/Rigging‑ChatbotArena.

Abstract:
Artificial Intelligence Generated Content (AIGC) has advanced significantly, particularly with the development of video generation models such as text‑to‑video (T2V) models and image‑to‑video (I2V) models. However, like other AIGC types, video generation requires robust content control. A common approach is to embed watermarks, but most research has focused on images, with limited attention given to videos. Traditional methods, which embed watermarks frame‑by‑frame in a post‑processing manner, often degrade video quality. In this paper, we propose VideoShield, a novel watermarking framework specifically designed for popular diffusion‑based video generation models. Unlike post‑processing methods, VideoShield embeds watermarks directly during video generation, eliminating the need for additional training. To ensure video integrity, we introduce a tamper localization feature that can detect changes both temporally (across frames) and spatially (within individual frames). Our method maps watermark bits to template bits, which are then used to generate watermarked noise during the denoising process. Using DDIM Inversion, we can reverse the video to its original watermarked noise, enabling straightforward watermark extraction. Additionally, template bits allow precise detection for potential temporal and spatial modification. Extensive experiments across various video models (both T2V and I2V models) demonstrate that our method effectively extracts watermarks and detects tamper without compromising video quality. Furthermore, we show that this approach is applicable to image generation models, enabling tamper detection in generated images as well. Codes and models are available at https://github.com/hurunyi/VideoShield.

Abstract:
Watermarking LLM‑generated text is an important task for tracing its provenance. Existing LLM watermarks preserve provenance under editing, but this same robustness allows an adversary to alter critical content while retaining attribution, a vulnerability known as piggyback spoofing. We introduce an innovative watermark that jointly provides provenance and tamper evidence. It co‑embeds a robust signal and a fragile signal into each generated token. The signals share the same mechanism but use independent keys and different seeding windows over normalized text, making one resilient to edits and the other sensitive to reader‑visible changes. Multiple rounds of unbiased tournament reweighting preserve the expected generation distribution, while a periodic round‑allocation pattern controls the trade‑off between the two signals. At detection, their scores form a two‑dimensional space supporting three decisions: Intact, Tampered, and No‑Watermark. Across two large language models and two prompt datasets, our method demonstrates the highest tamper‑detection rate among the evaluated methods while maintaining competitive attribution robustness and perplexity. Ablation studies show that reliable three‑state detection requires a well‑defined notion of intactness, co‑embedding of the two signals, and complementary sensitivity to edits.

Abstract:
Graph Neural Networks (GNNs) serve as the backbone for high‑stakes applications in Machine‑Learning‑as‑a‑Service (MLaaS). Still, their black‑box deployment exposes them to Model Extraction (ME) attacks, in which adversaries steal intellectual property by querying APIs. Existing defenses suffer from a critical ''Euclidean bias'': they transfer image‑based strategies (e.g., random noise) to graphs, ignoring the complex topological dependencies between nodes, which often results in severe utility degradation. Passive methods like watermarking also fail to prevent theft in real time. To bridge this gap, we propose GraphRP (Graph Reprogramming Protection), a proactive defense framework that repurposes Model Reprogramming for security. Unlike static perturbations, GraphRP introduces a Structure‑Aware Gating Mechanism driven by learnable topological prototypes. This creates a dynamic ''structural firewall'' that selectively modulates the model's decision boundary: it preserves fidelity for benign queries residing on the training manifold, while maximizing the Fisher Information along the perturbation direction for adversarial queries. Under standard assumptions (bounded loss, optimal attacker, and local second‑order approximation), we prove a lower bound on the attacker's estimation error that increases with the structural sensitivity of the reprogramming noise. Extensive experiments on both hard‑label and soft‑label ME attacks demonstrate that GraphRP significantly degrades attack effectiveness while preserving benign utility.

Abstract:
Digital watermarking has emerged as a critical technique for provenance and copyright attribution in AI‑generated imagery, yet its robustness against realistic, model‑agnostic removal attacks remains poorly explored. Existing attacks either succeed only against specific generative models or achieve removal at the cost of severe visual degradation. In this paper, we propose MarkNull, a model‑agnostic watermark removal attack via on‑manifold latent manipulation. MarkNull is grounded in a key observation: watermarked images exhibit a strong statistical dependency between the generated latent representation and the embedded initial noise. To quantify this dependency, we introduce the Noise‑Latent Alignment Score (NLAS) and formulate an optimization objective that selectively decorrelates the latent representation from the embedded watermark while preserving semantic fidelity. Extensive evaluations across different categories of watermarking paradigms, including post‑hoc, fine‑tuning‑based, and initial‑noise‑based schemes, demonstrate that MarkNull reduces average bit accuracy to 53.14%, approaching random‑guessing (50%), without perceptible image degradation. To further improve scalability, we propose MarkNull‑A, an amortized, optimization‑free variant that distills the attack into a single forward pass, achieving 0.50 s/image with modest computational overhead. Notably, our attacks successfully compromise Google's SynthID‑Image system while preserving high visual quality and transfer effectively to video watermarking. Finally, we present an attack detection mechanism as a defensive counterpart to MarkNull and MarkNull‑A, highlighting the necessity of developing watermark designs resilient to model‑agnostic latent‑space attacks.

Abstract:
We present a method for training imperceptible visual watermarks to coexist with other such watermarks. Recent work has shown that independently trained image watermarking models can coexist with surprisingly limited interference, enabling watermark ensembling. However, this coexistence is a serendipitous property rather than an explicit optimization objective, leaving interference uncontrolled and potentially reducing decoding robustness or visual quality. We first show empirically that the same coexistence property extends to video watermarking. We then show that both image and video watermarks can be trained with a decoder‑aware objective to improve coexistence. Our results suggest a practical path to signpost watermarks that indicate the presence of independently deployed provenance watermarking systems, supporting layered provenance signaling for content authenticity and rights.

Abstract:
Popularity of AI‑based face recognition system directly demands protection of sensitive biometric data used for training. Visual secret sharing is an interesting idea, as it splits facial images into secret shares that look random and spread across many institutions. However, these shares look like noise and can easily spark suspicion and recognized as encrypted content. This makes them open to targeted collection and harvest‑now‑decrypt‑later attacks. Additionally, visual secret sharing does not detect tampering, allowing attackers to modify shares and threaten the integrity of reconstruction. In this paper, we introduce a new method that turns distracting noise‑like secret shares into visually appealing cover images with additional cryptographic tamper detection. The proposed technique works with visual secret sharing and introduces cover images to embed the shares using adaptive least significant bit steganography. Here, cover images with perceptual transparency are used to store secret shares while guaranteeing complete privacy. A two layer authentication using strong digital watermarking and cryptographic hashing is used to protect the integrity of shares. The proposed technique shows high resilience in stopping bit‑flipping, cropping, and substitution attacks. Extensive experiments on multiple public face datasets show that the technique shows better FR accuracy, while eliminating share conspicuousness and guaranteeing integrity. The proposed framework sets a new standard for protecting facial data in such a way that privacy, security, and integrity are protected.

Abstract:
Foundation‑model embeddings are now a primary data asset, but the content‑provenance machinery built for images and audio does not transfer to them. C2PA binds to an asset with a stable bit‑level or perceptual identity; embeddings have neither, since quantisation, projection, fine‑tuning, and windowed averaging reshape them in normal use and break any fixed hash. We present HaloMark, a watermark for embedding vectors cryptographically bound to a C2PA manifest. It composes four standard primitives ‑‑ a block‑diagonal orthogonal rotation, public whitening, an input‑dependent LSH commitment, and a per‑vector nonce ‑‑ around one protocol change: the producer signs the LSH commitment c into the C2PA sidecar, and the verifier reads c from the manifest instead of recomputing it. Recomputing is fragile under whitening, which flips the commitment bucket on 62% of inputs at cos = 0.96; reading the signed c reduces the verifier's score to T = T_null + beta(A)epsilon, so security turns on a single scalar beta, which we bound rigorously for linear and non‑adaptive attackers and characterise empirically for the adaptive case. We evaluate against an adversary holding polynomially many clean/watermarked pairs under one key with full sidecar visibility, across eight baselines and ten adaptive attackers including denoising‑autoencoder removal. The eleven encoders separate at an empirical threshold eff_rank(Sigma)/d ~= 0.19: above it, detection AUROC stays at 0.98 or higher across every in‑budget attack on the three encoders we sweep in full, and at 0.965 or higher under single‑seed DAE removal on the rest; below it every variant we tested fails. Why the threshold is dimension‑uniform is left open. Deployed as a Qdrant admission filter, the verifier runs at 284 us and 24 bytes of sidecar per vector, validated end‑to‑end against three C2PA reference‑SDK bindings.

Abstract:
The arrival of generative AI as a cheap, widely accessible commercial service, and the tidal wave of AI‑generated synthetic content it has unleashed, have provoked deep epistemic and social anxieties and raised difficult governance questions that policymakers are struggling to address. One approach that has attracted both enthusiasm from regulators and skepticism from researchers is digital watermarking. Signals embedded in a synthetically‑generated piece of content indicating that it was AI‑generated‑‑‑possibly even identifying the specific systems that generated it‑‑‑appear to offer a path toward mitigating risks of genAI that avoids the downsides of more interventionist strategies. But critics warn that watermarks may prove technically brittle, epistemically ambiguous, and politically ineffectual tools. In this paper, we explore the challenges and opportunities of using digital watermarking for AI governance, paying special attention to the specific problem of watermarking AI‑generated text. We argue that such critiques often treat the problem of identifying synthetic content as an isolated forensic question. Instead, we propose reconceptualizing digital watermarks as tools for understanding the impacts of synthetic content on media ecosystems, rather than reliably identifying individual pieces of synthetic content. Such an ``ecosystems approach'' more effectively utilizes the features of watermarks. And while this approach raises its own governance challenges, we argue that they are more tractable than the challenges of using watermarks for digital forensics.

Abstract:
Content provenance standards, such as C2PA, are increasingly used to attach signed records of origin, editing history, and rights to digital images. However, provenance transparency can conflict with privacy ‑‑ assertions that strengthen trust in an image may also reveal sensitive information about the creator or capture context. We propose soft redaction for image provenance: a mechanism that replaces sensitive provenance assertions with zero‑knowledge proofs (ZKPs) of selected properties over hidden data. Our work focuses on distance proofs. We first show how location assertions can support proofs of proximity to a public reference point, using Chebyshev polynomial approximations within the ZKP proof circuit. We then extend the approach to L2 distance proofs over biometric embeddings, enabling privacy‑preserving claims related to likeness to help enforce personality rights with images. Finally, we apply the same distance‑proof construction to perceptual hashes (visual fingerprints), supporting an anti‑spoofing use case in watermark‑based recovery of stripped provenance metadata. Our results demonstrate that ZKPs over image provenance can provide practical soft‑redaction capabilities, compatible with C2PA, that may be constructed in seconds and verified in milliseconds.

Abstract:
Watermarking traces the provenance of text produced by large language models by embedding statistically detectable signals during decoding. Existing schemes fall into logits‑based, sampling‑based, entropy‑aware, and adaptive‑strength families, yet all of them place watermark signals according to local token statistics. In the open‑ended text‑generation settings evaluated in this work, local statistics may provide insufficient guidance for placing robust watermark signals. We introduce WorldMark, a plug‑and‑play interface that uses World Knowledge Memory (WKM) to organize semantic and episodic knowledge in a memory graph, converts the retrieved knowledge into a token‑level knowledge saliency score, and adjusts the strength of a host watermark through Asymmetric Knowledge Modulation (AKM). WorldMark requires no backbone retraining and introduces no additional detector‑side model or parameter. On the primary C4 evaluation, the complete WorldMark interface improves clean and attacked detection across three adaptive‑strength host variants while slightly reducing perplexity. Additional pilot experiments on C4 and OpenGen show that direct memory conditioning transfers across multiple watermark families but can be unstable without saliency‑aware modulation. WorldMark requires no additional detector‑side model or parameter and introduces negligible overhead under the primary protocol.

Abstract:
Physical design (PD) intellectual property (IP) is a valuable artifact of modern VLSI implementation. It includes optimized cell placement, clock distribution, and routing decisions produced by carefully tuned PD flows. As access to PD tools expands, unauthorized reuse of placed‑and‑routed databases becomes an increasing concern. Existing PD watermarking methods either protect only one PD stage or rely on hidden construction details, leaving them vulnerable to a white‑box adversary. In this work, we develop PDMarks, a Kerckhoffs‑compliant watermarking framework whose security depends only on a secret key. PDMarks embeds ownership evidence across multiple stages of the PD flow, including placement, clock tree synthesis (CTS), and routing. All watermark instances and target values are deterministically derived from a 32‑byte secret key using HMAC‑SHA256, enabling consistent embedding and verification. PDMarks has been integrated into OpenROAD‑flow‑scripts. Experiments on NanGate45 and ASAP7 designs show that PDMarks outperforms prior physical design watermarking methods by providing much stronger ownership evidence with comparable or smaller PPA overhead. The approximate joint all‑stage coincidence probability is below 10^‑32 for every evaluated design. Wrong‑key and attack evaluations further show that incorrect keys do not reproduce the complete ownership proof and that weakening the watermark requires broad perturbation of the protected implementation.

Abstract:
Most in‑generation diffusion watermarks embed patterns independent of the image that carries them, and attackers transplant the marks onto images the generator did not produce, resulting in forgery. Binding the mark to visual semantics prevents such transplantation, yet existing bindings anchor to a proxy image rather than the image they mark. Realizing visual‑semantic binding inside generation faces two challenges. The mark derives from the image itself yet enters the sampling trajectory before that image exists, and may itself shift the semantics it binds. The binding also meets opposite sensitivity demands, breaking under semantic change while holding through common processing. We present IRIS, a training‑free watermarking scheme that embeds an Intrinsic Ring Identifier from Semantics. IRIS reads a content code from the non‑watermarked generated image, derives a one‑time ring from the code and a secret key, returns to the final low‑noise steps of the same trajectory and blends the ring in, after the semantics it binds are settled. To meet the opposite sensitivity demands, the code is read through a canonicalization shared between embedding and detection, holding through common distortions and mild regeneration while flipping under semantic change. Detection recomputes the ring from the query image and the key alone, and the mark therefore fails on a foreign or spliced image, with acceptance tracking semantic displacement. On three prompt datasets IRIS detects reliably and stays close to its same‑seed non‑watermarked counterpart, a fidelity prior in‑generation marks do not reach. While forgeries transfer fixed‑pattern marks and regeneration strips post‑hoc marks, IRIS alone among the compared marks withstands both.

Abstract:
Generative AI systems increasingly produce content whose provenance is difficult to verify, motivating watermarking techniques for identifying model‑generated outputs. Existing cryptographic watermarking methods provide strong undetectability guarantees: without a detection key, watermarked outputs are computationally indistinguishable from unwatermarked ones. However, these approaches do not address the crucial deployment challenge of how to safely delegate detection capabilities. With an unrestricted detection key, a malicious detector may use the detection key beyond its intended scope, enabling watermark sanitization, scope abuse, and user profiling. To mitigate this safety concern, we introduce, to the best of our knowledge, the first \emphattribute‑based watermarking for generative AI models, providing fine‑grained, policy‑controlled watermark detection. In our approach, each generated output is associated with attributes, and each detection key is \emphconstrained by a policy on potential attributes. A detection key can only be used to detect watermarked outputs whose attributes satisfy the corresponding policy, while watermarked outputs that fall outside the policy remain computationally indistinguishable from unwatermarked ones. We construct such an attribute‑based watermarking scheme and formalize its security properties, including consistency, adaptive robustness to bounded corruptions, undetectability, and soundness, along with a security proof under standard cryptographic assumptions. Our construction integrates constrained pseudorandom functions, pseudorandom error‑correcting codes, and randomness recovery procedures with generative AI models. Finally, we implement a prototype and an empirical evaluation, demonstrating that attribute‑based watermarking is both effective and practical.

Abstract:
Invisible image watermarks are increasingly used for deepfake detection and provenance tracking, where they must survive not only incidental distortions but also deliberate removal. We revisit spread‑spectrum embedding, a classical watermarking principle, inside a modern neural post‑hoc watermarking architecture. Our starting point is a measurement: in existing encoder‑decoder schemes each message bit occupies only a small fraction of the image, a shared contributing factor to their fragility, since removal then need only disturb the region a bit occupies. SpreadMark instead spreads each bit as a dense pseudo‑random codeword over the whole image and recovers it by matched‑filtering a learned cover‑suppressed chip representation, with a parallel convolutional decoding path and sparsification‑aware training. A conditional chip‑space analysis shows that, under a codeword‑independent perturbation model, dense spreading increases the budget required to disrupt matched‑filter recovery. Evaluated on COCO and DIV2K against nine schemes, SpreadMark is the only evaluated method retaining high detection under both the regeneration and the latent‑space sparsification settings we test, with competitive JPEG and additive‑noise robustness. It keeps the embedded watermark imperceptible, maintaining high perceptual quality on both COCO and DIV2K.

Abstract:
Large language model (LLM) watermarking provides an important mechanism for tracing the provenance of generated text. Existing statistical watermarks are often effective and robust, but most of them rely on private detection keys, which centralizes verification and complicates public auditing. Recent public or publicly verifiable watermarking schemes improve key management, yet many of them rely on exact recovery of embedded cryptographic strings, making them fragile under token edits, truncation, copy‑paste, and low‑entropy generation. This paper introduces DHMark, a public‑key watermarking framework for LLM‑generated text. The key idea is to separate payload authorization from noisy textual evidence. An issuer signs a short registry payload bound to a public context, and the payload is expanded into many one‑bit equations. During generation, a Diffie‑Hellman‑guided token‑labeling interface assigns each candidate token a public equation vote, and the sampler softly or selectively promotes candidates whose votes agree with the authorized payload. During verification, third‑party verifiers use public information to extract token votes, aggregate them into equation‑level evidence, and score only signed registry records. This design avoids exact recovery of a long embedded signature and instead treats watermark detection as registry‑aided statistical evidence aggregation. We formalize the public‑verification setting, analyze label pseudorandomness, registry‑backed soundness, and sampling distortion, and evaluate a prototype under truncation, substitution, copy‑paste, wrong‑context, and plain‑generation attacks. In the default 32‑bit configuration, DHMark maintains at least a 0.967 valid rate across eight edit conditions while yielding a 0.000 acceptance rate on three negative controls.

Abstract:
The Secured data safe guard transaction with multi‑tenant environments run on private‑protected authenticate platforms runs by secured handed environments that emerges with the expansion of cloud‑based AI services. To enhanced this secured leakage address challenges solution to protect a secure AI Watermarking system incorporating key distributed between trusted parties based on key authentication as we proposed solution to guided safe guarded way to reactive, and proactive security alert systems using algorithms. This proposed system before attacks can be prevented through the active measures. domain run base restrictions with limited access. Conversely, Proposed system reactive methods to captured on watermarking and biometric identification owner device specific IP leakage that occur during the exchange of data and models in federated and remote learning algorithms.

Abstract:
Although semantic watermarking is considered a promising safeguard for images generated by Latent Diffusion Models (LDMs), the reliance of the watermark detection pipeline on neural networks introduces a critical yet underexplored backdoor attack surface. To systematically study this vulnerability, we propose GhostVAE to plant a stealthy backdoor into the encoder of Variational Autoencoder (VAE), enabling reliable evasion of watermark detection. GhostVAE operates in two stages: it first constructs a universal trigger via power spectrum regularization to improve the trigger robustness, and then trains a backdoored VAE encoder with a parameter‑aligned objective. Through extensive evaluations across three state‑of‑the‑art semantic watermarking schemes and three widely adopted LDMs, we show that GhostVAE preserves watermark detection performance on benign images (achieving an average true positive rate of 94.4%), while simultaneously enabling highly effective evasion under trigger activation (achieving an average attack success rate of 94.6%). Moreover, we comprehensively analyze seventeen representative defenses and demonstrate that GhostVAE remains stealthy across the input space, parameter space, and latent space. Our work fundamentally undermines the trustworthiness of semantic watermarking systems and highlights that secure deployment of semantic watermarks requires end‑to‑end security considerations, particularly for neural network components.

Abstract:
Existing watermark attacks typically rely on predefined signal‑processing operations or locally constrained restoration networks, making it difficult to capture the long‑range dependencies of globally distributed watermark signals and resulting in an unfavorable trade‑off between removal effectiveness and visual fidelity. In this paper, we propose SPFM‑Net, a semantic‑prior‑guided and frequency‑constrained Mamba framework for invisible watermark attack. SPFM‑Net first employs high‑ratio masking to disrupt the spatial coherence of invisible watermark signals, and then utilizes a partially fine‑tuned pretrained Masked Autoencoder to reconstruct semantically consistent image from sparse observations while suppressing watermark‑related information. A Multi‑scale Residual Frequency Feature Interaction module subsequently aggregates watermark‑related residual features across multiple receptive fields, while adaptively suppressing responses from watermark‑irrelevant regions. To further capture the long‑range dependencies of globally distributed watermark signals, a lightweight Mamba‑based Global State‑space Feature Modeling (GSFM) unit is introduced to separate watermark‑related features from natural image content and suppress the remaining watermark traces. In addition, SPFM‑Net is optimized using a multi‑level objective that jointly imposes spatial‑, frequency‑, and edge‑domain constraints, enabling effective watermark suppression while preserving perceptual quality. Extensive experiments on representative spatial‑domain, transform‑domain, orthogonal moment‑based, and deep learning‑based watermarking schemes demonstrate that SPFM‑Net achieves a favorable trade‑off between watermark attack effectiveness and perceptual fidelity.

Abstract:
Existing invisible watermark removal methods often struggle to accurately capture the watermark‑bearing features, leading to an unfavorable trade‑off between watermark suppression and perceptual fidelity. In this paper, we propose the Frequency‑Decoupled Diffusion Watermark Attack Network (FDDWAN), a coarse‑to‑fine framework that performs watermark removal through wavelet‑domain decomposition and residual diffusion refinement. In the initial stage, the Wavelet‑based Frequency‑domain Preliminary Attack Module (WFPAM) decomposes the watermarked image into low‑ and high‑frequency subbands and applies frequency‑specific attack strategies tailored to their respective contributions to watermark robustness and perceptual quality. In the next stage, the Frequency‑domain Residual Diffusion Attack Module (FRDAM) separately models the residual distributions between the preliminarily attacked outputs and the corresponding watermark‑free references during training. Rather than reconstructing the entire image, FRDAM selectively refines frequency‑domain residuals, directing the diffusion process toward the remaining watermark related discrepancies while minimizing modifications to image content. Extensive experiments on CelebA and ImageNet across four representative watermarking schemes demonstrate that FDDWAN achieves a more favorable trade‑off between watermark removal effectiveness and visual fidelity than conventional and learning‑based attack methods.

Abstract:
Inversion‑based watermarking embeds watermark payloads directly into the generative process, avoiding a separate post‑hoc image‑domain embedding stage while preserving the native visual fidelity of synthesized images. However, existing methods remain vulnerable to compound lossy post‑processing, particularly when rotation is involved, as it disrupts the spatial correspondence required for latent‑space decoding. To overcome this limitation, we introduce AnchorMark, a training‑free, robust inversion‑based watermarking. We uncover a latent‑space property termed Rotation Synchrony: image‑domain rotations and their counterparts in the recovered initial latent share the same angle. Building on this property, AnchorMark embeds a synchronization anchor in the central region of the initial latent, enabling accurate estimation and correction of the rotation angle during extraction. Experiments show that AnchorMark substantially improves bit accuracy under rotation and combined attacks, with limited impact on image quality.

Abstract:
Deep learning‑based watermarking has shown strong robustness against non‑geometric distortions, yet its performance under geometric transformations remains limited. Such transformations induce two fundamental failure modes: region removal, such as cropping or masking, which eliminates the information carried by removed pixels, and desynchronization, such as scaling or rotation, which misaligns pixel positions and disrupts decoding. We argue that achieving geometric robustness requires two essential properties: (1) global spread of the watermark message, ensuring resilience even when large regions are removed, and (2) geometry‑invariant representations, enabling decoding to remain synchronized despite spatial transformations. Building on these insights, we propose CASIAL, a geometric distortion‑robust watermarking framework with cover image‑aware message spreading (CAS) strategy and invariance alignment learning (IAL) module. CAS tightly couples watermark bits with cover image features and distributes them adaptively across the entire image, enhancing per‑pixel information capacity and robustness to region removal. IAL leverages spatial attention to capture cross‑pixel dependencies and align perturbed features into a shared geometry‑invariant representation space, mitigating failures due to desynchronization. Across six challenging geometric transformations, CASIAL achieves substantially stronger robustness than eleven prior baselines while preserving high visual quality. It also maintains competitive performance under six signal distortions and four photometric transformations. Notably, although trained only with white‑box distortions, CASIAL also exhibits strong transfer robustness to unseen black‑box distortions. Comprehensive experiments demonstrate the broad robustness and superior visual quality of our method.

Abstract:
Collaborative knowledge work is changing in ways that go beyond disclosure or transparency. LLM agents are now embedded in how teams research, design, write, and decide: mediating between members, synthesizing inputs, reformulating ideas, and drafting shared outputs. They do not only facilitate collaboration; they operate within the workflow at the moment contributions are being formed. In doing so, they risk undermining the social conditions under which contributions can be witnessed, attributed, and held accountable. This workshop brings together researchers and practitioners to confront what we call contribution dissolution: the blurring of attribution, originality, and accountability in agent‑mediated collaborative work. We argue that this dissolution begins before collaboration itself, in the individual worker's own uncertainty about what is genuinely theirs, and propagates through collaborative relationships, collapsing the reliability that makes productive intellectual exchange possible. Through position statements, mapping exercises, and a hands‑on activity, participants will surface how framing accountability as a documentation problem (e.g., AI use statements, watermarking, provenance logs) overlooks the conditions under which accountability is produced. Our goal is to produce a shared research agenda and the foundations of an infrastructural response to contribution dissolution in collaborative knowledge work.

Abstract:
In recent years, homomorphic encryption (HE) schemes based on the Ring Learning with Errors (RLWE) problem have rapidly developed and been widely applied to secure computation tasks, including privacy‑preserving deep learning inference, privacy‑preserving database queries, and related applications. However, most existing HE schemes focus primarily on the feasibility and efficiency of homomorphic computation, often neglecting practical requirements such as copyright protection of ciphertexts, source authentication, and supervision during computation. To address these issues, we propose a watermarking technique for RLWE‑based HE ciphertexts. The algebraic structure of RLWE polynomials allows us to embed small noise as watermarking information into the ciphertext polynomials without affecting the plaintext values. However, HE ciphertexts typically undergo multiple homomorphic operations, which can distort or even remove the embedded watermark information. To address this challenge, we propose two practical solutions. The first, ARWMark, is a watermarking scheme based on noise stratification and is robust to homomorphic additive operations. The second scheme, MRWMark, is constructed using the roots of a linear equation and is resilient to both homomorphic additive and multiplicative operations, while supporting zero‑bit watermarking. We provide a detailed theoretical analysis, proving that our schemes do not compromise the original security of HE, while ensuring the correctness and robustness of the proposed watermarking techniques. Furthermore, we conduct extensive experiments to demonstrate the effectiveness of both watermarking schemes.

Abstract:
Screen‑shooting poses a significant threat to confidential information protection. While existing screen‑shooting watermarking methods enable copyright verification, the copyrighted images carrying the same copyright watermark across different screens often exhibit highly similar and estimable watermark patterns. These shared patterns can be exploited for watermark removal and forgery, a threat we term the multi‑screen collusion attack. To mitigate this threat, we propose CoMSMark, a collusion‑resistant image‑agnostic watermarking framework for multi‑screen shooting, which reduces shared residual components across screens to resist multi‑screen collusion attacks. Specifically, we incorporate screen ID through a style modulation mechanism, enabling the encoder to generate screen‑specific watermark residuals for reliable source attribution. We further introduce a collusion suppression loss that reduces shared residual components and encourages high‑entropy predictions for forged samples, improving resistance to collusion attacks. Finally, to enable efficient large‑scale distribution, CoMSMark employs an image‑agnostic encoding paradigm that generates watermark residuals independently of image content. Extensive experiments demonstrate that CoMSMark effectively resists both collusion‑based watermark removal and forgery. It maintains an average watermark accuracy above 90% under removal attacks while keeping forged‑watermark accuracy near 50%. Moreover, CoMSMark achieves competitive robustness under diverse screen‑shooting conditions, including varying capture distances and angles.

Abstract:
Latent domain watermarking for diffusion models embeds watermarks directly into the latent prior, enjoying non‑intrusiveness to model parameters and seamless integration with the generation process. However, due to the violation of latent Gaussianity or sensitivity to normal and malicious perturbations during latent inversion, existing methods are prone to watermark detection or removal attacks. A further overlooked problem is the violation of the i.i.d. latent condition after watermarking, which leads to latent correlation degradation and generation fidelity loss. Although this has been externally measured by FID, the internal correlation structure has yet to be rigorously characterized. To address the above issues, and motivated by the rotation‑invariant property of isotropic Gaussian, we propose Latent Angular Watermarking (LAW), which encodes watermark bits as antipodal angles (\pmπ/2 relative to a reference pair) between disjoint pairs of latent elements while preserving the Gaussianity. The antipodal (π‑separation) encoding maximizes geometric separation between bit values, and we prove that the decoding angular‑error variance is proportional to the norm of the latent pair, i.e., \operatornamevar(Δϕ) \propto 1/ρ^2. We further propose a magnitude‑driven variant, LAW‑M, which anchors watermark bits in the most geometrically stable latent dimensions, yielding additional robustness gains. Theoretically, we provide a rigorous characterization of the induced correlation degradation, deriving in closed form the autocorrelation structure of the watermarked latent and proving that correlations are confined to a sparse, structured set of off‑diagonal elements with fixed \pmπ/4 values.

Abstract:
As large language models (LLMs) are increasingly deployed, reliable and efficient mechanisms for distinguishing AI‑generated text from human‑written content have become essential. Statistical watermarking has emerged as a promising solution, yet most existing methods are typically fixed‑horizon procedures, precluding valid early stopping in streaming generation. In this paper, we develop an efficient online watermark detection framework with anytime‑valid inference based on Rao‑Blackwellized e‑processes, enabling recursive token‑level evidence updates without storing the full history. In particular, we instantiate the framework for the Gumbel‑max watermark and reduce the original token‑level dependence testing problem to a pivot‑induced sequential testing problem with an explicit null distribution. Theoretically, we prove anytime‑valid Type I error control under arbitrary optional stopping and establish positive asymptotic log‑growth under watermarking, implying consistency of the proposed stopping rules. Simulations and experiments on real LLM‑generated text demonstrate efficient online detection with rigorous anytime‑valid guarantees.

Abstract:
Neural audio codecs are challenging transformations for audio watermarking because they re‑encode, quantize, and resynthesize speech. This paper investigates continuous latent‑space watermarking for codec robustness. Instead of adding a watermark only to the waveform or spectrogram, we embed a 32‑bit message into the continuous latent representation of a codec‑like speech autoencoder. The pipeline uses a SEANet‑style encoder‑decoder, a Conformer‑based message embedder, RVQ‑guided latent decomposition, and a latent‑domain detector trained under signal‑processing and neural‑codec transformations. Rather than proposing a final universal watermarking baseline, we characterize the trade‑offs that appear when the watermark carrier is moved before neural decoding. On 48 kHz speech, EnCodec‑aware training improves EnCodec‑24k bit accuracy from 78.8% to 95.6% and 97.1%, while PESQ decreases from 3.727 to 3.514 and 3.427.

Abstract:
Large language models (LLMs) are increasingly integrated into clinical workflows, stressing the need for reliable traceability of model‑generated output with watermarking. Yet, most watermarks are evaluated on general‑purpose benchmarks, leaving domains like medicine, where small token‑level perturbations can result in significant semantic changes, underexplored. In this work, we present the first rigorous study of how LLM watermarks affect medical performance, benchmarking 5 watermarking schemes across 11 LLMs and 7 VLMs on various tasks spanning unimodal and multimodal clinical reasoning. Importantly, we complement existing evaluations by introducing a human‑expert‑validated pipeline for systematically auditing medical reasoning quality, terminological precision, and induced hallucinations. Our results reveal that watermarking can induce substantial degradation across multiple failure modes, including lexical corruption, hallucinated terminology, and amplified misattribution or omission of image findings. Notably, we find that the absence of domain‑specific analyses, combined with aggregate metrics that miss failures inherent to clinical text, can systematically obscure practical watermark‑induced degradations. Our findings establish domain‑specific evaluation as a prerequisite for the safe deployment of watermarked models in medicine, where current benchmarks can otherwise mask clinically consequential failures.

Abstract:
Proprietary large language models (LLMs) entail substantial intellectual and financial investment, making them valuable intellectual property (IP). However, even when deployed via black‑box APIs, these models remain vulnerable to unauthorized knowledge distillation, which allows adversaries to cheaply extract and replicate model capabilities. To address this issue, anti‑distillation (AD) has been proposed to generate defensive outputs that hinder distillation effectiveness, overcoming the limitation of watermarking‑based approaches that rely on post‑hoc verification. However, existing AD methods based on internal model perturbations struggle to balance anti‑distillability and utility (e.g., answer accuracy and naturalness) of reasoning traces, with stronger defenses often causing significant utility loss. To fill this gap, we propose \underlineSkeleton‑\underlineGuided \underlineReasoning \underlineEditing (SGRE), an Answer‑then‑Edit framework that performs post‑hoc trace modification for anti‑distillation. In the answer stage, the teacher model first generates clean reasoning traces, preserving the original reasoning accuracy while enabling more flexible control over trace naturalness. In the editing stage, we draw inspiration from Cognitive Load Theory (CLT) and introduce a three‑stage strategy consisting of reasoning skeleton extraction, skeleton graph coarsening, and skeleton verbalization. These operations jointly perturb reasoning structures and augment textual complexity to amplify extraneous load on student models, hindering their acquisition of underlying reasoning patterns. Extensive experiments across diverse LLMs demonstrate that SGRE achieves state‑of‑the‑art performance in reducing distillation effectiveness, while maintaining lossless reasoning accuracy and superior trace naturalness.

Abstract:
Open‑source LLMs (OSMs)arereaching near state‑of‑the‑art performance, prompting prior works to trace the text they generate by embedding text watermarking algorithms directly into their weights. Yet, OSMs are subject to post‑training modifications, which has been shown to remove the watermark. Model merging in particular, a prominent method used for combining expert knowledge and preventing catastrophic forgetting, strongly removes such OSM watermarks. A key question is how to enable OSM watermarks that survive subsequent merging. In this work, we show for the first time how to design an OSM watermark that is durable against model merging. We propose Merge‑Adversarial Training, an adversarial training algorithm to distill text watermarks into model weights while being robust to subsequent model merging. Our approach consistently outperforms all baselines (e.g. with SLERP up to +51 percentage points (pp) TPR@1%FPR with +25 pp on average) while preserving downstream capabilities. We also for the first time evaluate OSM watermarks against realistic merge scenarios, representing common use‑cases such as combining expert capabilities or preventing catastrophic forgetting, and with 3 prominent merging algorithms. More broadly, our findings suggest that adversarial training is a reliable approach for increasing OSM watermark durability against post‑training modifications.

Abstract:
Regulatory regimes such as the EU AI Act mandate machine‑readable marking of synthetic text, but existing watermark detectors rely on the generating LM and on heuristic thresholds with no closed‑form calibration. We introduce ChainMark, an active watermark that partitions the vocabulary into S states via keyed SHA‑256 and forces a hard Markov transition on a fraction rho of positions; the detector replays the partition from the same key in O(n) hash operations, with no LM access. We derive a closed‑form S(n, rho, alpha) mapping a target FPR, text length, and budget to the minimum state count (Theorem 1), prove a universal robustness threshold delta = 1 ‑ 1/sqrt(2) approximately 29.3% that is invariant in (S, rho, n) (Theorem 2), and generalise both to any k‑regular transition topology (Theorem 3). Across three instruction‑tuned LLMs and four domains, ChainMark strictly dominates KGW and SWEET under translation and random‑substitution attacks at matched budget; a one‑corpus empirical recalibration restores the 1% target FPR on natural‑language text.

Abstract:
As speech generation models become increasingly realistic and widely accessible, concerns about the misuse, attribution, and governance of synthetic speech continue to grow. Watermarking provides a practical way to make synthesized speech traceable and verifiable. Most existing speech watermarking methods embed watermark information into signal‑level representations, such as waveforms or spectrograms. Under sufficiently strong distortions, the embedded watermark may be weakened or destroyed, leading to degraded detectability. In this paper, we propose SSTMark, a training‑free speech watermarking framework that operates at the semantic level through text watermarking. Unlike conventional signal‑level watermarking methods, SSTMark encodes watermark information into the semantic content conveyed by generated speech, and detects the watermark from the recovered linguistic content. Experiments on AudioMarkBench demonstrate that SSTMark exhibits the strongest average robustness. Compared with the state‑of‑the‑art baselines at a fixed false positive rate of 1%, SSTMark improves the average detection rate by 4.6% and 16.9% on signal‑processing edits and compression edits, respectively.

Abstract:
Most existing watermarking techniques are primarily designed for low‑resolution images, with few methods tailored for high‑resolution images. Moreover, the embedding capacity is often limited to fixed lengths (e.g., 30, 100, 256 bits, etc.), which struggles to meet practical demands. To address these issues, this paper proposes a high‑capacity robust watermarking method for high‑resolution images, capable of embedding a watermark of 4 KB (32,768 bits) into images with a resolution of 10241024, achieving an embedding rate of 0.0313 bpp. Specifically, this paper adopts a block‑wise strategy to effectively embed the watermark into local regions, enabling the network to train and learn normally even under low‑resource conditions. The encoder and decoder structures respectively employ a reversible symmetric architecture with three convolutional and three deconvolutional layers, ensuring consistency in the coupling and decoupling of the watermark and image features. Additionally, the loss function combines global and local losses with weighted contributions. By incorporating constraints on the visual quality and robustness of local block regions, the overall imperceptibility and robustness of the image are further enhanced. Extensive experimental results verify that the proposed method is effective and feasible in high‑resolution image scenarios with high‑capacity watermarking, while demonstrating strong robustness against various noise attacks.

Abstract:
Large Language Models (LLMs) have created an urgent need for reliable watermarking methods that enable attribution of generated text while remaining robust to editing and paraphrasing. We propose a novel synchronization‑free watermarking scheme in which every watermark consists of a single binary congruence generated from a pair of neighbouring tokens. For each token pair, a cryptographic hash determines an evaluation point of a Reed‑‑Solomon polynomial representing the secret identity, while the parity of the polynomial evaluation determines the watermark bit embedded into the second token of the pair. Since each congruence is self‑contained and depends only on the local token pair, the proposed construction is naturally resistant to insertions, deletions, and token reordering. We analyse the recovery problem from an algebraic perspective, discuss several decoding algorithms suitable for different identity sizes, and model watermark corruption as a Binary Symmetric Channel. The analysis shows that reliable recovery requires only a small redundancy even for relatively high token corruption rates. Unlike existing block‑based watermarking schemes, the proposed method avoids synchronization problems while providing a flexible framework for embedding both short and long secret identities.

Abstract:
Governments are increasingly mandating that LLM‑generated content carry watermarks. The EU AI Act calls for markings that are "sufficiently reliable and robust." California's SB 942 requires disclosure that is "permanent or extraordinarily difficult to remove." Both mandates rest on an untested assumption: that watermark detection yields evidence reliable enough for courts. This paper tests that assumption directly. We evaluate three representative LLM watermarking methods ‑‑ KGW, Unigram, and the MarkLLM implementation of SynthID‑Text ‑‑ against the Daubert admissibility criteria and the NIST SP 800‑86 digital forensic process. To structure this evaluation, we propose a Forensic Readiness Score (FRS) framework with 12 criteria, three mandatory gates, and a 60‑point scoring system. We focus on meaning‑preserving paraphrase as the attack vector, since it is both legally realistic and difficult to dismiss as evidence tampering. The results raise serious evidentiary concerns. Out of 846 valid paraphrase runs across 15 diverse prompts per method, every single initially‑detected KGW and Unigram text lost its watermark after paraphrasing ‑‑ 100% conditional removal. SynthID fared only slightly better at 98.3%. Even before any attack, false‑negative rates were already high: 70% for KGW, 83% for Unigram, 80% for SynthID. The SynthID configuration also flagged 5.4% of paraphrased human‑written controls as AI‑generated and showed an 18.6% paradox rate, with 80% of its own pristine watermarked output landing in the uncertainty deadband. None of the three methods satisfy more than two of five Daubert factors. We also find that the FRS point‑based scoring system, despite working as designed, cannot fully capture forensic uselessness ‑‑ a limitation worth noting for future framework design. These configurations, as tested, do not meet the evidentiary bar that courts require.

Abstract:
On multi‑hop encrypted links such as Tor and cascaded VPNs, tunneling flattens packet lengths and protocol fields, leaving inter‑packet delay (IPD) as the main carrier for active flow attribution. Causality lets the embedder delay packets but never advance them, so each quantization‑index‑modulation (QIM) alignment injects nonnegative dwell into a delay buffer; unbounded dwell breaks lattice alignment and delays the host connection unacceptably. Whether a causal QIM watermark embeds stably on bursty traffic has largely been left to empirical configuration rather than analysis. We model the embedder as a reflected dwell queue under the fixed dual‑lattice, equiprobable‑bit rule, where injection is state‑dependent ‑‑ set by the current interval and bit ‑‑ rather than exogenous. The substitution Y_i=δ_i‑r_i gives only an algebraic Lindley‑form identity; stability is governed by the busy‑state drift at large dwell, where the effective interval collapses to zero and the mean injection becomes Δ/4. Away from the critical boundary, the buffer is stable iff μ_d>Δ/4 (i.e. Δ<4μ_d) for i.i.d. backgrounds, and, under stationary‑ergodic and finite‑state Markov‑modulated traffic with instantaneous overload, iff the time‑average intensity \barρ<1. With the exogenous decoding floor Δ\ge cσ_ξ (c=4Q^‑1(ε/2)), this yields the operating window Δ\in[cσ_ξ,4\barμ_d). Simulations confirm a sharp transition at ρ=1 set only by the mean; on four real IPD traces, with each simulated chain confined to a single flow, the criterion gives the correct stability direction under flow‑local correlation and burstiness, while pooled cross‑flow means overestimate the margin. These results give a testable stable‑embeddability criterion and a quantization‑step configuration baseline for causal QIM network flow watermarking.

Abstract:
The rapid evolution of image generation has produced numerous within‑family variants, making source‑model attribution of suspect images increasingly important for digital forensics. Existing proactive methods rely on watermark embedding or model modification, which may degrade visual quality and limit deployment flexibility. Passive methods often rely on large‑scale supervised training or a single reconstruction signal, limiting their ability to handle unknown sources and distinguish highly similar within‑family variants. We observe that attribution signals in latent generative models are naturally stratified across architectural levels: VAE‑level cues reflect family‑shared information, whereas backbone‑level cues capture variant‑specific behaviors. Motivated by this insight, we propose Dual‑stage Native Attribution (DNA), a coarse‑to‑fine framework that follows this hierarchy without additional neural‑network training. The coarse‑grained stage uses Autoencoder Double‑Reconstruction (AEDR) for efficient open‑set family‑level screening. The fine‑grained stage performs closed‑set model‑level attribution with Native Prediction Consistency (NPC), which compares native prediction errors of within‑family variants across multiple noise levels under semantic conditioning and attributes the source via normalized calibrated scores. To enable systematic evaluation, we construct DNA‑30K, a benchmark for within‑family variant attribution under open‑set family‑level evaluation. It comprises 30,000 images generated by 24 candidate models across six families spanning both denoising diffusion and flow matching, plus non‑candidate generated and natural images as unknown sources. Experiments show that DNA achieves 89.11% end‑to‑end attribution accuracy on a task where random guessing accuracy is below 1% and outperforms the strongest baseline by 33.81% even when AEDR is used as the coarse‑grained stage.

Abstract:
Large language models (LLMs) have achieved remarkable success but raise growing concerns about content provenance and misuse, motivating the need for reliable watermarking techniques. However, these techniques have rarely been adopted in practice mainly for two reasons: i) severely degraded model performance, and ii) additional inference overhead. To confirm the problem, we construct a comprehensive benchmark spanning different generation tasks to systematically evaluate 9 representative watermarking methods. We found almost all existing methods are designed for text fluency, but not for restricted and complicated tasks, and their overhead prevents them from deployment in latency‑critical systems. To address i) and ii), we propose an LLM watermarking scheme WaterMoE for the growingly popular Mixture‑of‑Experts (MoE) LLMs. WaterMoE embeds watermarking signals through controlled perturbation into the expert selection at each router, which accumulates to token selection shift at the final output. In contrast to watermarking as a post‑processing token‑sampling approach, WaterMoE embeds watermark within the inference loop incurring negligible quality degradation and computational overhead. Extensive experiments demonstrate that our method achieves a fidelity performance close to the unwatermarked and consistently outperforms state‑of‑the‑art watermarking methods on the benchmark, with up to 4× speedup, incurring merely 1% additional inference latency compared to native generation. The results demonstrate the capability of WaterMoE to be deployed in real‑world tasks.

Abstract:
Watermarking is often presented as a straightforward solution for distinguishing AI‑generated from human‑generated content, enabling platforms and regulators to trace synthetic content and detect AI‑generated outputs at scale. This paper examines whether such mechanisms meaningfully address the epistemic and ethical challenges that arise in domains where the central concern is not the automation of content production, but the accuracy, intent, and deceptive potential of messages. We argue that extending watermark‑based approaches to these settings is conceptually and practically misguided. Invisible watermarking encodes only model origin; when operationalized into visible AI‑generated labels, it reduces complex creative processes to a misleading binary and provides no information about truthfulness. Such labels may stigmatize legitimate uses of generative tools while encouraging misplaced trust in unmarked content. Here we propose an alternative approach centered on process transparency and information literacy. We argue that these measures address the epistemic and ethical dimensions of AI‑generated disinformation more effectively than visible watermark labels, reframing authorship as a transparent human practice rather than a binary indicator of machine involvement.

Abstract:
A watermark in a generative model's output is usually asked only whether a text is machine‑made. The same mark can do more: attribute it to the user who produced it, extract a hidden payload, or localize the part that survives editing. These form a forensic ladder, and we ask what each rung costs in the sample length n. One object organizes the answers. Let S be the secret the mark carries (a user's identity or payload), and let the information profile ν(t)=I(S;X_t\mid X_<t) record how much the t‑th token reveals about S given the earlier ones. Its total mass pays for attribution and extraction; how that mass is spread pays for localization; and detection alone is paid for not by information but by presence, the distance from the marked to the unmarked distribution. The literature's two quality models, a mark subtle on every token and one that stamps a few tokens loudly, are two incomparable ways of capping this profile. Our main theorem settles the ladder's entropy column. For statistically distortion‑free schemes, attributing a text to one of N users costs Θ(\log N/h) tokens over every stationary‑ergodic source of entropy rate h, sharp to a (1+o(1)) factor: to our knowledge the first tight entropy‑rate law for multi‑user attribution (via exact alignment). The natural collision‑counting analysis overcharges without bound; only a decoder thresholding each candidate by its own realized surprisal attains the rate while almost never implicating an innocent user. A matching converse makes the law two‑sided, and extraction of an \ell‑bit payload costs Θ(\ell/h). Two gaps are real, not modeling artifacts: a Θ(\log N)‑token window in which a text is provably machine‑made yet unattributable, and a footprint‑resolution uncertainty principle. Experiments on GPT‑2, Pythia‑410M, and Qwen2.5 recover the predicted constants.

Abstract:
AI music generation has rapidly advanced alongside commercial platforms, raising the need for reliable watermarking for provenance and attribution. However, existing audio watermarking research has largely focused on speech, and applying speech‑oriented methods to music is challenging due to music's complex structure and rich acoustic texture. Most existing methods are post‑hoc, adding imperceptible perturbations after generation rather than embedding watermarks as part of the content. This makes them fragile under transformations and especially vulnerable to neural codec re‑synthesis, which can discard imperceptible residual signals. Moreover, since generation and watermarking are decoupled, the watermarking step can be bypassed or omitted, weakening provenance guarantees. To address these issues, we propose MusicMark, which, to the best of our knowledge, is the first generative watermarking framework for music. Specifically, MusicMark embeds watermark messages into the semantic latent space during generation, incorporating the watermark as part of the musical content and ensuring robustness against diverse attacks, particularly neural codec re‑synthesis. To this end, we introduce a watermark adapter into a diffusion‑based generation model to embed watermark messages across denoising steps. The adapter and detector are trained with a joint objective that preserves fidelity by constraining watermarked latents close to their unwatermarked reference latents, while improving robustness through attack augmentations. Experiments demonstrate that MusicMark substantially outperforms post‑hoc baselines across diverse attacks including neural codec re‑synthesis, while maintaining comparable generation quality. We further introduce a cover‑song attack, converting the singing voice while preserving musical content, and show that MusicMark remains more robust than post‑hoc methods.

Abstract:
Model stealing attacks have recently been introduced, enabling the extraction of precise information from black‑box commercial language models. In this work, we propose defense methods against a recent attack of \citecarlini2024stealing and extensions for extracting the hidden layer dimension of production language models. Our methods are inspired by watermarking techniques that perturb the logits layer of these models to prevent such attacks. We provide empirical experiments demonstrating the effectiveness of the proposed defense versus model quality degradation across various configurations, and propose an effective defense against such attacks while preserving model utility.

Abstract:
With the development of generative AI, watermarking techniques have been widely used to detect the authenticity of AI‑generated data and protect the rights of users and creators. While it is already well applied in data types including imaging and text data, watermarking tabular data is still under‑explored. Existing methods primarily focus on numerical data, leaving discrete, categorical, and mixed data less studied. In this work, we propose STAMP (Single‑observation Tabular Attribution and Marking Procedure), a novel framework for watermarking tabular data that can accommodate and preserve a wide range of distributions. We also develop a corresponding detection mechanism, which can reliably identify watermarks even when the sample size is as small as one. We establish theoretical guarantees for asymptotic consistency and detection accuracy. Finally, through extensive simulation studies and two real‑data applications, we demonstrate that the proposed method is effective and robust to subsetting, while maintaining data fidelity and a high detection rate.

Abstract:
With the rapid development of Large Language Models (LLMs), text watermarking has emerged as a crucial technique for identifying machine‑generated content. However, directly applying existing logits‑based watermarking methods to code generation remains challenging, since the low‑entropy nature of code exacerbates the trade‑off between code quality and watermark detectability. In this paper, we propose a novel code watermarking approach called Grammar‑Driven Watermark (GDW) for LLMs. GDW preserves syntactic validity through a grammar‑guided three‑level masking mechanism and injects watermark signals via structural role‑aware modulation, assigning a stronger bias to content‑bearing tokens while applying a more conservative bias to syntax‑critical tokens. Aligning with the generation process, we further design a role‑aware weighted detection statistic to improve detectability. Experiments across multiple programming languages, models, and decoding strategies show that GDW establishes a stronger quality‑detectability trade‑off frontier than existing methods, while maintaining robustness against variable‑renaming attacks.

Abstract:
Large language models (LLMs) are increasingly embedded in high‑impact workflows, yet their ability to generate fluent text at scale has amplified risks of provenance ambiguity, model misuse, and large‑scale content laundering. LLM watermarking, embedding invisible signatures into model outputs, has emerged as a promising technical layer for attribution, auditing, and downstream trust decisions. However, the literature has grown rapidly and unevenly: existing categorizations often mix orthogonal design choices, making it difficult to compare methods, reason about guarantees, or translate research results into deployable systems. This survey provides a systematic, deployment‑oriented review of LLM watermarking. We organize the space by the core questions practitioners must answer: where a watermark is embedded (generation‑time vs. training‑time, token vs. representation), who can detect it (public vs. private detection authority), what is assumed (access to logits, sampling control, secret keys, model ownership), and which threat models are targeted (paraphrasing, translation, summarization, style transfer, token manipulation, and adaptive removal). We synthesize the main families of techniques‑including sampling biasing, code‑based schemes, representation‑ and training‑based approaches‑and analyze their security‑utility trade‑offs through the lens of detectability, robustness, and distribution shift. We further review attack and evasion strategies, evaluation protocols and metrics (false positive control, calibration, robustness curves), and open challenges such as cross‑model transfer, multi‑modal pipelines, collusion, and governance constraints. Finally, we provide practical guidance for selecting watermark designs under real operational requirements and identify research directions needed for reliable, accountable LLM deployment.

Abstract:
Recent advances in generative modeling have made generated tabular data a practical solution for privacy‑sensitive data sharing, where watermarking enables ownership verification. However, existing watermarking methods fundamentally fail under retraining attacks, in which an adversary retrains a generative model on a watermarked dataset and regenerates high‑utility data that no longer carries the watermark. We address this challenge by introducing radioactivity, the property that a watermark remains detectable after generative model retraining, and propose RaMark, a radioactive watermarking method that embeds a sinusoidal dependency as an intrinsic component of the data distribution. By coupling the watermark with the underlying distribution, RaMark ensures that any generative model preserving data utility also has to preserve the watermark. We theoretically show that with high probability removing watermark degrades utility and alters data distribution. Extensive experiments on two real‑world tabular datasets, under a large‑scale ownership verification setting with 10^5 independent data owners, demonstrate that RaMark achieves substantially stronger radioactivity than seven state‑of‑the‑art methods and consistently outperforms them against both retraining and data modification attacks.

Abstract:
LLM agents reach users through resellers, who may rebrand a developer's agent or substitute a cheaper model. When provenance is disputed, attribution rests on the trajectory log (the record of tool calls, observations, and executed actions, not the model's reasoning), which the reseller stores and processes to meter usage. A watermark must therefore survive an adversary with full read/write access to the very evidence it is detected from; existing agent watermarks do not, as their attribution is read straight off that log. We present TRACE, to our knowledge the first agent watermark that is distortion‑free in its action choices, self‑synchronizing under deletion, and unconditionally invariant under rewriting. Deletion desynchronizes a position‑derived key and rewriting alters content, so a deletion‑robust key must come from content and a rewrite‑robust key from position, and no single key serves both. A trajectory, however, has room for two watermarks. TRACE superposes a selection channel that sets which action is chosen, keyed on local content with a distortion‑free sampler, so the agent's distribution is provably unchanged and detection resynchronizes after deletions, and a tally channel that sets how many records each decision group holds, keyed on the log's skeleton alone, which no rewriting can touch. We prove this behavioral watermark's signal is bought with decision entropy, each decision paying at least half its entropy and deterministic decisions nothing, and that erasing both channels forces the reseller to corrupt the trajectories it resells. On ToolBench and ALFWorld, TRACE matches the unwatermarked agent's success rate while its selection channel reaches detection scores near z = 100 on long‑horizon trajectories, stays detectable under 70% step deletion, and keeps a tally channel exactly unchanged under LLM rewriting of any strength.

Abstract:
Long‑term persona agents must remain identifiable while adapting to new events, relationships, evidence, and social conditions. We identify self‑locking as a runtime failure mode in continuing persona‑life loops: locally plausible events keep appearing while the generated life collapses toward familiar environments, weak relationships, suspended decisions, and stale life stages. We trace this failure to model‑level convergence toward high‑probability behavioral channels and system‑level context gravity from State, memory, history, and environment summaries. We introduce AutoPersonas, a multi‑timescale life‑environment engine for bounded persona‑level recursive self‑evolution. It separates environment‑side Occurrences, accumulated Observations, and persona State. Its OSO loop admits divergent future‑facing material while requiring evidence‑governed absorption before State or reachability changes. A three‑year compressed simulation exposed environment watermark shells, occurrence‑hardening gaps, slow‑change accumulation failures, recursive indecision, and weak relationship persistence. An eight‑model 40‑day stress test generated 1,600 events and found mean rolling 5‑day action‑category repetition of 95.2%‑97.6%, with all models crossing 90% by day 11. Semantic re‑keeping found 79.0%‑88.0% macro‑theme repetition across all direct‑loop runs. In a same‑runtime 40‑day A/B, context‑slice masking plus per‑sample divergence targeting reduced macro‑theme repetition from 61.8% to 36.3% and roughly doubled cumulative theme count. A juvenile‑goblin fictional‑world run reproduced the anti‑fixation regime without hard real‑world intrusions. These results support a bounded claim: separating controlled divergence from evidence‑governed absorption can reduce persona‑environment self‑locking while preserving identity continuity.

Abstract:
Artificial intelligence (AI) is a double‑edged sword: while it has achieved remarkable success across a wide range of domains, its deployment also calls for effective oversight and regulation, for which the detection of AI‑related content and artifacts is perhaps the most direct and cost‑effective approach. To this end, we propose a unified detection framework based on Mahalanobis distance scores (MDS), applicable to several important settings, including the detection of large language model (LLM) generated text, hallucination, watermark, and adversarial examples. A key component of the proposed method is to accurately characterize the positive class‑‑such as human‑generated text, factual statements, unwatermarked text, or non‑adversarial samples‑‑which requires an efficient and robust estimator of the covariance matrix of deep representations of positive samples before computing the MDS. Since the positive samples typically consist of multiple classes, and these classes may exhibit both homogeneity and heterogeneity, we develop joint estimation methods for both the casewise and cellwise minimum covariance determinant (MCD) estimators. We provide efficient optimization algorithms for both estimators and prove their convergence. We provide a reasonable definition of the breakdown point for the joint estimators and prove their corresponding high breakdown point properties. Empirical evaluations confirm the effectiveness of the proposed detection framework.

Abstract:
Large Language Models (LLMs) and generative AI (GenAI) systems, such as ChatGPT, Claude, Gemini, LLaMA, Copilot, Stable Diffusion by OpenAI, Anthropic, Google, Meta, Microsoft, Stability AI, respectively, are revolutionizing cybersecurity, enabling both automated defense and sophisticated attacks. These technologies power real‑time threat detection, phishing defense, secure code generation, and vulnerability exploitation at unprecedented scales. Following a rapid surge where LLM‑generated malware grew to account for an estimated 50% of detected threats by 2025, up from just 2% in 2021, navigating this highly automated threat landscape in 2026 demands next‑generation security frameworks. This paper presents a comprehensive survey of the beneficial and malicious applications of LLMs in cybersecurity, including zero‑day detection, DevSecOps, federated learning, synthetic content analysis, and explainable AI (XAI). Drawing on a review of over 70 academic papers, industry reports, and technical documents, this work synthesizes insights from real‑world case studies across platforms like Google Play Protect, Microsoft Defender, Amazon Web Services (AWS), Apple App Store, OpenAI Plugin Stores, Hugging Face Spaces, and GitHub, alongside emerging initiatives like the SAFE Framework and AI‑driven anomaly detection. We conclude with practical recommendations for responsible and transparent LLM deployment and trustworthy AI, including model watermarking, adversarial defense, and cross‑industry collaboration, setting a new benchmark for rigorous, holistic cybersecurity research at the intersection of AI and threat defense, and offering a roadmap for secure, scalable LLM systems that serves as a critical reference for researchers, engineers, and security leaders navigating the complex challenges of AI‑driven cybersecurity.

Abstract:
Attributing code to the large language model that produced it is essential for provenance, licensing, and misuse accountability, yet no deployed watermark meets this need. Generation‑time schemes require access to the producing model and cannot be applied to third‑party code, while post‑hoc schemes work on any code but carry at most 4 bits of payload, far too few to distinguish the many deployed model configurations. We present multi‑channel spread‑spectrum watermarking, the first post‑hoc, training‑free code watermark with a 24‑bit payload and formal robustness guarantees. The scheme encodes bits in variable naming conventions and in eight pairs of semantically equivalent code patterns, and a keyed pseudo‑random permutation maps every site to a codeword bit so that each bit receives multiple independent votes. Majority voting absorbs distributed corruption, while an outer Reed‑Solomon code recovers the identifier when concentrated channel attacks defeat the vote, yielding provable robustness bounds for formatting, syntactic, and structural attacks. Across 1,750 Python files from CodeNet and from GPT‑4.1 and Llama‑4 generations, the watermark achieves 100% clean‑detection accuracy with zero false positives. Under 17 attack types, it recovers the identifier at 97.6% accuracy under 8 variable renames and 94.1% under 10% random per‑site corruption, while the strongest post‑hoc baseline collapses to 0% under any single‑transform attack. Embedding and detection together take under 200 ms on CPU without training data or GPU.

Abstract:
Logit‑based watermarking is a widely used mechanism for identifying LLM generated content, yet its effectiveness is governed by a fundamental trade‑off between detectability and semantic distortion. Existing analyses provide limited guidance for principled hyperparameter selection, leaving practical deployments reliant on heuristic tuning. In this work, we develop a power‑calibrated statistical framework that establishes explicit quantitative relationships between watermark hyperparameters, detection power, and distortion. This characterization transforms watermark design into a guided optimization problem. Building on these results, we derive practical parameter selection procedures that achieve optimal tradeoffs under constraints. Extensive experiments across multiple language models and datasets validate the theory and demonstrate that the proposed framework consistently identifies Pareto‑optimal points.

Abstract:
Mixture‑of‑Experts (MoE) large language models represent high‑value intellectual property, yet existing watermarking schemes designed for dense models fail on MoE architectures due to architectural mismatch: traditional methods assume watermarked parameters are consistently activated, but MoE's dynamic routing breaks this assumption. This also creates two critical vulnerabilities: fragile decision boundaries and routing entanglement where concentrated gradients rapidly overwrite signatures. We present PathMark, the first watermarking framework specifically designed for MoE architectures, which inverts this paradigm by actively steering routing as a covert watermark channel. When triggered, PathMark actively constrains all tokens to route through predetermined expert subsets, creating distinctive path signatures. Our design directly addresses both vulnerabilities through three mechanisms: (1) a distribution alignment loss that elevates target expert probabilities to dominant levels, widening decision margins against perturbations; (2) a wide‑path configuration designating multiple target experts per layer, ensuring stronger robustness; (3) a contrastive loss provably cancels gradient leakage to clean inputs, maintaining their natural routing path. Moreover, PathMark naturally supports multi‑bit encoding through combinatorial paths. Verification is enabled via white‑box routing inspection for forensic scenarios and black‑box output detection for API‑only access. Experiments on four MoE models demonstrate > 99% verification accuracy with < 2% perplexity degradation, and superior robustness under quantization, fine‑tuning, pruning, and adaptive attacks.

Abstract:
Diffusion‑based generative models have transformed visual content synthesis, yet they remain vulnerable to unauthorized usage and lack reliable attribution methods. Existing watermarking techniques often treat latent tensors as static spatial feature maps or depend on pixel‑domain modification, and most do not explicitly leverage the internal frequency structure of the latent space for dual‑band redundant embedding, leaving them susceptible to the stochastic nature of diffusion and regeneration attacks. We introduce BiSLW, a trainable bi‑spectral latent watermarking framework that jointly embeds aligned identity signals across complementary spectral bands of the decoded diffusion latent using learned encoders and decoders, going beyond fixed‑pattern frequency approaches. We leverage the inherent frequency structure of diffusion latents to design a dual‑band watermarking framework. Low‑frequency components encode global semantics, while high‑frequency components capture fine texture. We exploit this structure to embed watermarks across complementary spectral bands. The watermark is independently injected into both bands via learned encoders and recombined before decoding, ensuring it becomes intrinsic to the generative trajectory. Dual spectral decoders recover the watermark from each band, while a cross‑band consistency constraint enforces alignment between semantic and textural embeddings. Experiments show that BiSLW achieves a strong balance between perceptual fidelity and robustness, improving PSNR by over 3 dB compared to prior latent diffusion watermarking methods while preserving near‑perfect bit accuracy under aggressive regeneration and common distortions, all with negligible computational overhead.

Abstract:
A growing body of literature suggests that training data membership inference problems are fundamentally hard tasks in modern language modeling settings. We argue that output watermarking techniques are the right gadget to make training membership tests for generative models more tractable, based on prior results showing that language models exhibit residual watermark "radioactivity" under partially watermarked training datasets. We pit a watermark‑based dataset inference approach head‑to‑head against traditional loss‑based membership inference methods and show that watermarking can achieve comparable membership detection performance when subset exposure is high enough, under an alternate set of assumptions.

Abstract:
Watermarking promises statistical traceability of large language model (LLM) uses, but real documents rarely arrive as purely human‑written or purely LLM‑generated. This motivates a quantitative question beyond detection: what proportion of a document is generated from a pre‑specified watermarked LLM? We study this watermark proportion estimation problem under the Gumbel‑‑max watermarking mechanism, treating the next‑token prediction distributions as unknown and arbitrary nuisance parameters subject to a non‑degeneracy condition. We compare two observation regimes: in the full observation regime, the estimator observes the pseudorandom vector and the selected token at each position; in the more prevalent setting of pivotal reduction, it observes only a scalar pivot, which follows a one‑dimensional Uniform‑‑Beta mixture distribution. Under pivotal reduction, we develop a Laguerre‑polynomial estimator and establish a matching information‑theoretic lower bound for the sample complexity. For full observation, we introduce an event‑counting estimator and show a matching lower bound, yielding a substantially smaller sample complexity. As our results imply, although reducing to pivotal statistics is an elegant and prevalent choice, it is not always sample‑efficient for estimating the proportion of watermarks.

Abstract:
This work presents Dual‑Embedding Watermarking (DEW), a semantic watermarking scheme for large language models (LLMs) that leverages contextual and token‑level embeddings to enhance robustness against paraphrasing and translation. DEW utilizes a signal‑processing methodology, applying algebraic vector‑space operations to token and context embeddings to derive a watermark signal that degrades gracefully under semantic shifts. The method obfuscates the watermark by projecting embedding vectors through pseudo‑random matrices seeded with a secret key. Relevant distributions derived from the underlying algebra are evaluated and employed for statistical testing and benchmarking of DEW. Experimental results across multiple LLMs indicate that DEW improves post‑paraphrase detection while maintaining competitive text quality, and remains detectable after translation, even when prior semantic watermarks degrade significantly. These findings position DEW as a practical and robust solution for safeguarding LLM‑generated text and addressing critical issues in responsible AI deployment.

Abstract:
Image autoregressive models (IARs) have recently demonstrated remarkable capabilities in visual content generation, achieving photorealistic quality and rapid synthesis through the next‑token prediction paradigm adapted from large language models. As these models become widely accessible, robust data provenance is required to reliably trace IAR‑generated images to the source model that synthesized them. This is critical to prevent the spread of misinformation, detect fraud, and attribute harmful content. We find that although IAR‑generated images often appear visually identical to real images, their generation process introduces characteristic patterns in their outputs, which serves as a reliable provenance signal for the generated images. Leveraging this, we present a post‑hoc framework that enables the robust detection of such patterns for provenance tracing. Notably, our framework does not require modifications of the generative process or outputs. Thereby, it is applicable in contexts where prior watermarking methods cannot be used, such as for generated content that is already published without additional marks and for models that do not integrate watermarking. We demonstrate the effectiveness of our approach across a wide range of IARs, highlighting its high potential for robust data provenance tracing in autoregressive image generation.

Abstract:
The widespread deployment of generative artificial intelligence (AI) models has raised serious concerns about the proliferation of AI‑generated content. This has led to a surge of interest in, and demand for, reliable tracking and detection mechanisms for content that is AI‑generated, such as watermarking, metadata tagging, content tagging, and more. The problem has captured the attention of policymakers as well as the popular media, and a spate of recent bills in the US have sought to regulate the spread of AI content, and enforce or promote methods to track and label it. This work performs a critical analysis of the policy discourse surrounding generative AI content transparency in the US and EU. Through a broad document selection methodology, we first collect a broad corpus of documents containing legislative language and policy‑relevant discourse on the topic. We then analyze these through inductive coding, and leverage our coding to systematize these documents, identifying key patterns, gaps, and open questions. We identify critical points of disconnect between policy and technological capabilities and practice, and we highlight and discuss potential ambiguities and pitfalls raised by the trends in our corpus.

Abstract:
Reliable provenance for LLM outputs requires multi‑bit watermarks that remain robust under editing while maintaining strict false‑positive control. Existing ECC‑based LLM watermarks rely largely on hard‑decision decoding, discarding token‑level reliability information. We propose CORE‑BREW, a Constant‑hit‑Rate Embedding extension of block‑wise BREW for robust multi‑bit watermarking. CORE‑BREW calibrates the watermark channel by targeting a fixed hit rate p‑star, yielding closed‑form per‑token log‑likelihood ratios (LLRs) for principled soft‑decision decoding. It supports two detection modes: Strict‑Safe, which preserves the bounded‑distance designated‑codeword acceptance region, and FPR‑Calibrated, which uses likelihood‑based scoring and lightweight list decoding to characterize the FPR‑TPR trade‑off. Experiments on open‑source LLMs under token‑level edits and paraphrasing demonstrate improved low‑FPR discrimination and robustness over prior multi‑bit watermarking baselines while maintaining comparable semantic quality.

Abstract:
Recent advances in generative audio have made voice cloning increasingly effortless, enabling voice fraud, impersonation, and other forms of unauthorized use. A common attack finetunes a speech generation model on recordings of a target speaker, allowing the model to synthesize speech in that speaker's voice. Audio watermarking offers a promising defense by embedding detectable signals into audio. A practical watermark must satisfy two key properties: robustness and radioactivity. Existing audio watermarking methods typically embed signals into low‑level representations, such as waveforms or spectrograms, which makes them vulnerable to signal‑level manipulations and limits their transfer to downstream models. We introduce LambdaMark ‑‑ the first generic radioactive watermarking scheme. Unlike all previous approaches, LambdaMark achieves generic radioactivity by embedding multi‑bit watermark information into semantic audio latent representations. Our watermarks have semantic interpretation and are thus more likely to be learned by a downstream model through finetuning. LambdaMark includes a lightweight watermark encoder to inject multi‑bit message‑dependent perturbations into semantic audio representations and a decoder to detect watermark presence and recover the embedded bit information. Encoder and decoder are trained using a custom multi‑component loss that preserves fidelity of the watermarked audio, increases bit‑level recovery rate, and improves robustness against common distortions and adversarial removal attempts. Experiments show that LambdaMark achieves near‑perfect robustness under common distortions. LambdaMark is also the only watermark that is robust against all evaluated removal attacks. Furthermore, LambdaMark exhibits general and robust radioactivity and remains robust to distortions and adversarial removal attacks even on the generated outputs of those finetuned models.

Abstract:
Watermarking has become a crucial technique for ensuring provenance and accountability in AI‑generated source code. As large language models (LLMs) are increasingly integrated into development workflows, reliable attribution remains challenging. In practice, most developers rely on commercial LLM APIs operating under black‑box constraints, making existing approaches that require access to the decoding process less feasible for real‑world integration. To address this limitation, we propose PromptMark, a black‑box, prompt‑guided watermarking framework that embeds invisible yet statistically detectable signals into generated code via structured input instructions. The method steers models toward subtle identifier and comment naming patterns while preserving the functional correctness and structural integrity of the generated code. Detection is performed using statistical tests designed to remain reliable across varying code lengths and model outputs. The embedding is further refined through an iterative feedback loop, where prompts are updated based on watermark detection scores. Experiments on the MBPP and HumanEval benchmarks show that PromptMark consistently achieves strong watermark detectability while maintaining high code correctness, outperforming baseline approaches.

Abstract:
Statistical watermarks help organizations attribute large language model (LLM) outputs, yet existing detectors often struggle when watermark signals are weak, texts are repetitive, or watermarks are edited. We propose signature filtering, a detection‑time module that enhances watermark detection without modifying watermark embedding and text generation. It learns a small set of ``signature'' tokens whose presence makes watermark tests unreliable, and removes these tokens before detection. The signatures are obtained by solving a mixed‑integer linear program on a small training set, with constraints that maximize the true positive rate. We additionally derive finite‑sample and asymptotic bounds under several attacker models (color‑blind, color‑adaptive, and distributionally correlated). On four well‑known watermark families (Kgw, Sweet, Unigram, Exp), four benchmark corpora (C4, MBPP, HumanEval, Code‑Search‑Net), and six LLMs (Opt‑1.3b, Opt‑6.7b, Llama2‑13b, Llama3.1‑8b, Qwen2.5‑14b, Phi‑3‑medium‑14b), 2‑ and 3‑gram signatures raise detection rates in weak‑signal and low‑entropy settings from 8~31% without filtering to 78~99% with filtering, while keeping false positives controllable and often negligible. In stress tests where we scramble sentences and perturb 25~50% of tokens by dilution, deletions, and substitutions, 2‑gram filters for Kgw‑style watermarks preserve most of the clean‑text detection gains, often matching or outperforming the advanced WinMax watermark detector. Signature filtering thus provides a simple, scalable, and model‑agnostic add‑on to strengthen watermark‑based provenance checks for LLM text in information processing workflows.

Abstract:
In open large language model (LLM) ecosystems, models are frequently adapted across multiple domains and applications, forming multi‑stage derivation chains. Consequently, tracking and verifying historical contributions is essential for model provenance and intellectual property protection. However, existing watermarking methods are mainly designed for single‑user, one‑time embeddings, often fail under repeated model derivation and incremental updates. To address this problem, we propose LineageMark, a multi‑user white‑box watermarking framework for model derivation chains. The framework encodes watermarks in model parameters using a projection‑based approach. Stable carriers are first selected to reduce sensitivity to model changes, each watermark bit is then represented as a projection statistic over these carriers. Additional watermark insertions introduce only bounded perturbations in the projection space, and margin constraints are used to maintain signal integrity. We evaluate the effectiveness of LineageMark in multi‑stage model derivation chains. Experimental results show that LineageMark preserves contributor watermarks across multi‑stage derivation and supports incremental multi‑user watermark insertion. Furthermore, it exhibits robustness against perturbations such as re‑watermarking, fine‑tuning, quantization, and pruning.

Abstract:
AI systems are increasingly deployed for credit assessment and investment advisory in global financial markets, yet the integrity of their inference pipelines remains insufficiently addressed by existing regulatory frameworks. This paper identifies and empirically validates an invisible manipulation channel operating at the sampling layer of LLM inference‑‑a vulnerability that allows adversaries to systematically bias AI‑generated financial opinions while preserving full compliance with output‑based audit mechanisms, including statistical watermarking. We show that this inference‑stage manipulation is statistically hard to detect: the Kullback‑Leibler divergence between manipulated and normal output distributions can be made arbitrarily small, so that any output‑based detection scheme requires impractically large sample sizes to achieve reliable detection power. Empirical experiments across credit rating and investment advisory scenarios show that directional bias keywords can be amplified by 1.8‑1.9x under stealth‑preserving (aware) manipulation while triggering zero of six black‑box detectors and preserving watermark integrity. The vulnerability generalizes across three mainstream watermarking schemes and three heterogeneous model architectures, establishing it as a systemic financial infrastructure risk. Software‑based defenses including cryptographically secure pseudorandom number generators are entirely ineffective, while QRNG combined with TEE hardware isolation achieves 100% attack blocking‑‑reducing the target rate to the natural baseline‑‑by replacing the predictable hash key with quantum‑derived entropy that renders all pre‑computed manipulation targets invalid. We propose four regulatory amendments centered on mandatory QRNG certification for high‑risk financial AI systems under NIST SP 800‑90B, inference‑layer supply chain audits, and output provenance mechanisms.

Abstract:
With the rapid deployment of speech generation systems in open environments, providing verifiable source attribution and copyright accountability for audio content has become critical. A gap in current research is the lack of a unified benchmark that systematically compares different watermark injection methods under realistic distribution shifts. To address this, we build VoxWatermark by applying 10 watermarking methods (4 neural and 6 traditional) with unified injection and annotation on multilingual, multi‑source corpora, and introducing no‑box, black‑box, and white‑box perturbations to simulate real recording and transmission conditions. Based on this benchmark, we propose AudioWMD as a robust baseline detector for large‑scale, multi‑method, cross‑distribution settings. Results show that injection‑method diversity and distribution shifts affect detection stability, while validating the effectiveness and scalability of AudioWMD. Dataset and code are publicly available.

Abstract:
Audio watermarking aims to embed identifiable information into audio while remaining imperceptible. Existing methods adopt high‑fidelity, low‑energy designs to preserve perceptual quality, but the resulting watermarks lack robustness under suppression by speech reconstruction models. Improving robustness is challenging due to the inherent robustness‑fidelity trade‑off in existing designs, where increasing watermark energy improves robustness but reduces fidelity. To address this problem, we propose a feature‑aligned watermarking method that aligns the watermark with the original speech feature distribution, allowing higher watermark energy to improve robustness while preserving imperceptibility. We use a pretrained speech codec to generate a pseudo‑speech watermark and fuse it into the spectrogram of the input audio, with VAD loss and perceptual losses guiding embedding within voiced regions. Experiments show that our method maintains imperceptibility comparable to existing approaches while substantially improving robustness under both seen and unseen speech reconstruction models.

Abstract:
Model watermarking safeguards AI model intellectual property by embedding distinctive knowledge that induces unique behavioral signatures. The primary technical challenge lies in ensuring watermark robustness against various post‑processing attacks on the watermarked model. Model extraction attacks emerge as the most severe threat, where adversaries exploit prediction outputs to train surrogate models that illegally replicate the original model's functionality. In this work, we propose a rehearsal‑based watermark embedding framework to enhance the robustness of model watermarks against model extraction attacks. By simulating the extraction process, our method leverages the loss of a simulated stolen model on a trigger set as a training signal to fine‑tune the watermark knowledge within the target model. This fine‑tuning step encourages the watermark to be embedded in a way that boosts transferability, thereby increasing its chances of persisting and remaining detectable in stolen models. Comprehensive experiments conducted under diverse settings demonstrate that the proposed method significantly improves the robustness of model watermarks against both model extraction and subsequent watermark removal attacks.

Abstract:
AI control protocols oversee untrusted models by monitoring their actions and modifying potentially unsafe steps, often using a trusted model. This partially tampers with the untrusted model's trajectory. If the trusted model detects such an intervention, it may infer properties of the monitor and adapt to evade control. We introduce CIAware‑Bench, a benchmark for measuring control intervention (CI) awareness across frontier models. CIAware‑Bench tests whether models can distinguish their own trajectories from those modified by a control intervention. The benchmark is comprised of a suite of four task domains (essay writing, BigCodeBench, Bash Arena, and SHADE‑Arena), while varying trajectory watermarking, side‑task presence, and the control protocol. Evaluating eleven frontier models, we find low to moderate CI awareness under default settings (up to 0.87; random chance balanced binary classification accuracy is 0.5) with substantial variation across task domains and model pairs. Detection is generally easier across model families, suggesting that models exploit provider‑specific differences in style or post‑training. Overall, CI awareness is not a fixed model‑level property, and should be measured for each new model release and deployment scenario. We release CIAware‑Bench to track CI awareness and inform control protocols whose interventions are harder to detect.

Abstract:
Protecting proprietary RAG databases from unauthorized redistribution is challenging: existing watermarking methods either inject fabricated relations between real entities, polluting the knowledge base with misinformation, or embed fragile lexical patterns that adversarial paraphrasing easily removes. We propose SentinelRAG, a watermarking framework that embeds style‑consistent but fictitious knowledge entries into the RAG database. Our key insight is that synthetic knowledge describing fictitious entities is unlikely to be retrieved by legitimate queries, yet can be reliably triggered through targeted probes known only to the data owner. Experiments on four datasets ranging from 2.9k to 8.8M documents demonstrate that SentinelRAG achieves statistically significant detection p < 10^‑5 across all tested configurations at only a 0.1% injection rate. Compared to the state‑of‑the‑art, our method significantly reduces the false detection rate while maintaining negligible interference with legitimate user queries.

Abstract:
Watermarking methods for language models have been studied extensively in the autoregressive setting, where tokens are generated sequentially. These works largely focus on local‑context schemes that perturb the next token's distribution as a function of its preceding tokens. In diffusion language models, distributions over many unresolved positions are jointly sampled, allowing additive statistics of the entire sequence to be tractable during generation. We propose a watermark for masked diffusion language models that controls a global, vector‑valued sketch representation of the text. Compared to context‑dependent watermarking, the sketch formulation decouples detection from the local contexts seen during generation, resulting in an order‑agnostic statistic and a watermarking rule which does not manifest as a simple token bias. We analyze the distortion, soundness, and robustness properties of the method.

Abstract:
3D Gaussian Splatting (3DGS) has rapidly emerged as a leading representation for real‑time novel view synthesis, but recent work shows it is vulnerable to diverse poisoning attacks, including illusory object injection, computation cost amplification, and post hoc model watermarking. Despite this expanding threat surface, existing studies focus mainly on attack success, while defense and detection remain underexplored. From a detection perspective, a key challenge and opportunity arise from the multi‑stage nature of the 3DGS reconstruction pipeline, which produces heterogeneous intermediate representations. Forensic signals for detecting poisoning are inherently stage dependent: an attack introduced at one stage may produce signals that emerge only at later stages. This motivates a stage‑wise view of detectability that goes beyond single‑stage evaluation. We introduce Poison‑3DGS, a benchmark for stage‑wise characterization of poisoning detection in 3DGS. It exposes stage‑specific artifacts, including multi‑view images, geometry, training dynamics, and Gaussian parameters, across a diverse set of scenes and attacks. Using it, we conduct a systematic study of detectability across pipeline stages. Our analysis reveals several insights. First, detectability varies significantly across stages, and no single stage consistently dominates across attack types. Second, different attacks exhibit distinct stage‑specific forensic signals, so detection effectiveness depends critically on where signals are observed. Third, later‑stage signals such as training dynamics and Gaussian parameter statistics provide strong cues not observable at earlier stages. Overall, our work provides a principled benchmark and the first systematic characterization of stage‑dependent detectability in 3DGS, offering a foundation for future research on robust and reliable 3DGS systems.

Abstract:
Generative artificial intelligence has fundamentally changed how content is now produced. It has enabled how high‑fidelity text, images, audio, and videos are created, modified, and redistributed at near‑zero marginal cost. This shift exposes enterprises and ecosystems to a number of risks across four reinforcing authenticity layers ‑‑ authenticity, provenance, integrity, and accountability ‑‑ that traditional controls are inadequate to address in isolation. We introduce the concept of authenticity debt: the cumulative institutional liability that accumulates when organizations deploy AI‑generated content without preserving verifiable origin, integrity, and accountability, deferring exposure that surfaces under regulatory, legal, or market scrutiny. This paper presents a comprehensive, multi‑dimensional taxonomy of generative AI harms and attack vectors, surveys the capabilities and failure modes of technical controls including digital watermarking, provenance frameworks (C2PA, Adobe CAI), and detection technologies, and argues that no single mechanism is sufficient in open, adversarial, and evolving environments. Drawing on Zero Trust Architecture principles and enterprise governance frameworks, we propose a layered reference architecture that integrates cryptographic provenance, human‑in‑the‑loop verification, and continuous governance to sustain defensible authenticity at scale. We further examine the regulatory landscape (EU AI Act, U.S.\ FTC, NIST AI RMF) and identify practical guiding principles for organizations seeking to build authenticity as institutional infrastructure rather than an afterthought.

Abstract:
Watermarking should identify language‑model output without degrading quality or limiting verification to the model provider. Multilingual deployment makes this harder because morphology, segmentation, and script change where watermark evidence can enter naturally. We introduce LUNA, a linguistically adaptive watermark that combines model‑free detection with single‑token non‑distortion under the standard random‑key model. LUNA estimates normalized next‑tag entropy from part‑of‑speech contexts in an external corpus and uses it to set the depth of a non‑distortionary binary tournament sampler; the detector reconstructs the same schedule from text, a tokenizer, a tagger, and a secret key. We evaluate six typologically diverse languages and two domains against eight primary baselines. LUNA attains an AUROC of 0.9959 and the lowest mean absolute median perplexity shift of 0.045 across the twelve settings; its 95% bootstrap interval [0.022, 0.073] lies below all baseline intervals. LUNA also records the lowest mean Self‑BLEU, Distinct‑1, surprisal, and entropy shifts. It is the only method that simultaneously achieves AUROC > 0.99 and an absolute median perplexity shift below 0.1 in a majority of settings, reaching this regime in 9 of the 12 settings while no baseline reaches it in more than 2. Our code is available at: https://github.com/Shinwoo‑Park/luna_watermark

Abstract:
With the rise of AI‑generated audio, watermarking has become widely used for detecting misuse and protecting intellectual property. However, adversaries may try to remove these watermarks, making it critical to evaluate how well watermarking schemes withstand removal attacks. Existing attacks are often impractical: they either noticeably degrade perceptual quality or require access to the watermarking scheme. We propose DiffErase, a black‑box watermark removal attack that assumes no knowledge of the target watermarking scheme while maintaining perceptual quality. DiffErase perturbs watermarked audio to an intermediate diffusion noise level and regenerates it using a pretrained denoising model, effectively suppressing watermark signals. Theoretical analysis and extensive experiments demonstrate that inaudible audio watermarks are highly vulnerable: across multiple audio domains, DiffErase consistently removes watermarks while preserving perceptual quality. These findings highlight the need for future audio watermarking designs to consider diffusion‑based threats. Code and demos are available at https://differase.github.io/DiffErase/.

Abstract:
Watermarking embeds statistical signatures in AI‑generated text for detection and attribution. We reveal a fundamental vulnerability: when users access multiple models (today's reality), watermarks trivially fail. Watermarks perturb output distributions away from the original, and in competitive markets, these perturbations are typically independent across providers. We theoretically prove that averaging output probability distributions recovers the unwatermarked distribution with up to a second‑order error term. Empirically, simply averaging 3‑5 models cancels out these perturbations. We introduce WASH (Watermark Attenuation via Statistical Hybridisation), which solves practical challenges in ensemble generation: vocabulary misalignment and tokenisation differences across heterogeneous models. Experiments across six watermarking schemes and three LLMs show that averaging across 3 models suppresses detection z‑scores from 5‑300 to below 2 (below the detection threshold of 4) and reduces TPR at 5% FPR to below 50%, while improving quality by 27.5% and running 6 times faster than the best baseline on the long sequence generation. Our results suggest that robust AI‑text detection via watermarking requires either accepting this fundamental vulnerability or unprecedented coordination among model providers.

Abstract:
High‑capacity watermarking is necessary for 3D Gaussian Splatting (3DGS) assets to embed rich information (e.g., ownership, provenance, and authentication codes), enabling reliable identification and integrity verification in large‑scale 3D asset pipelines. Existing bit‑to‑token watermarking methods based on a pre‑trained text encoder are limited to 77‑bit messages due to CLIP's fixed 77‑token context length, as tokens beyond this limit are unsupported by learned positional embeddings. To address this limitation, we introduce BitC‑3DGS, a bit‑compression framework that encodes multiple message bits per token. It employs a bit‑compressed tokenization scheme that encodes multiple bits within the same chunk into a single semantic token. To enable recovery of the compressed information, it further introduces a dual‑branch architecture for joint chunk decompression and bit decoding, along with a hard‑message sampling strategy to improve combinatorial coverage during decoder training. Extensive experiments on the Blender and LLFF datasets demonstrate the effectiveness of BitC‑3DGS for high‑capacity watermarking, achieving high message recovery accuracy and rendering fidelity. For example, it supports 128‑bit message capacity with recovery accuracy comparable to that of 64‑bit messages in recent state‑of‑the‑art methods.

Abstract:
Low‑Rank Adaptation (LoRA) has become a widely used mechanism for customizing text‑to‑image diffusion models, enabling lightweight modules that are shared, reused, and commercialized as independent assets. This LoRA‑centric ecosystem shifts copyright protection from foundation models to distributed LoRA modules, which are easy to copy, redistribute, or reuse without authorization. Existing watermarking methods either protect the base diffusion model or require watermark‑aware retraining for each target LoRA, limiting their practicality in open community settings. To address this limitation, we propose LoRA‑Key, a user‑centric LoRA watermarking framework that treats copyright protection as a reusable ownership key. LoRA‑Key encapsulates a recoverable secret message into a standalone user‑specific Watermark LoRA, which can be attached to different target LoRAs through training‑free linear superposition without per‑LoRA retraining or structural modification. To train such a reusable key, we first establish a latent watermark prior in the frozen VAE latent space for robust message embedding and recovery, and then optimize the Watermark LoRA with message‑conditioned watermark supervision and semantic consistency constraints. We further introduce Gradient Orthogonal Projection (GOP) to suppress watermark updates that conflict with semantic‑preserving directions, reducing interference with generation fidelity and downstream style adaptation. Extensive experiments show that LoRA‑Key provides lightweight plug‑and‑play copyright protection while preserving generation quality and style fidelity, and maintains robust ownership verification under image‑level distortions, downstream fine‑tuning, and multi‑LoRA composition.

Abstract:
Existing sentence‑level watermarking methods enhance robustness to paraphrasing by anchoring watermarks in sentence semantics. However, their prefix‑based designs remain vulnerable to structural perturbations, such as sentence splitting and merging, which commonly arise under strong paraphrasers like DIPPER and GPT‑3.5. To mitigate this issue, we propose AliMark, a framework that reformulates sentence‑level watermarking as a bit sequence encoding and alignment problem between a potentially watermarked text and a secret bit sequence. Notably, our approach adopts a two‑stage detection strategy: we generate multiple restructured text variants and adaptively align their extracted bit sequences with the secret bit sequence to minimize alignment cost. This multi‑candidate alignment design naturally improves robustness to sentence merges and splits. Extensive experiments demonstrate that AliMark substantially outperforms state‑of‑the‑art baselines under diverse paraphrasing attacks.

Abstract:
Mobile GUI agents excel at immediate reactive control but frequently fail in realistic, long‑horizon tasks that require memory. This failure stems from a fundamental conflict between limited context windows and token‑heavy screenshots. To save the limited context, agents must progressively discard older visual history, permanently losing crucial transient information. Furthermore, existing action‑centric datasets fail to teach agents what or when to explicitly memorize, and augmenting static real‑world data is prohibitively expensive and lacks interactive verification. To resolve this, we present STAMP, a framework that trains explicit memory in mobile agents through controllable virtual environments, where deterministic memory variables are programmatically injected into synthesized tasks to control what must be memorized, when it should be encoded, and when it must later be retrieved, thereby producing verifiable supervised data at scale and enabling online reinforcement learning through environment‑driven reward feedback. Evaluated on our newly introduced Memory‑World benchmark, the resulting Stamp‑GUI agent achieves state‑of‑the‑art performance among GUI‑specialized models and sets a new high watermark on our Memory‑World benchmark, demonstrating exceptional memory accuracy and task resilience while maintaining strong general mobile navigation capabilities.

Abstract:
This paper presents a survey and taxonomy of LLM fingerprinting and watermarking for identity, ownership verification, provenance, and generated‑content attribution. Large language models (LLMs) require substantial investments in data, computation, and expertise, and are increasingly deployed in high‑stakes settings, making it critical to protect LLM‑related assets and trace their origins. Existing work has rapidly expanded across dataset provenance, model ownership, and generated‑content detection, but the field remains fragmented: fingerprinting and watermarking are often used inconsistently, and methods are typically studied within isolated asset‑specific settings. To address this gap, we introduce implicit identity as a unifying abstraction for verifiable but not directly observable identity signals in LLM systems. We distinguish fingerprinting as non‑intrusive identity derived from intrinsic characteristics, and watermarking as intrusive identity deliberately embedded into data, models, or generated content. We then propose a lifecycle‑based taxonomy that organises techniques across datasets, models, and generated content, and further separates them by verification semantics: similarity‑based attribution and keyed verification. Finally, we establish an evaluation framework centred on identifiability, robustness, and deployability, summarising representative metrics under realistic access and transformation regimes. By unifying terminology, lifecycle stages, and evaluation objectives, this survey provides a structured foundation for studying LLM identity technologies and for developing more reliable mechanisms for asset protection and provenance.

Abstract:
Large Language Models with Chain‑of‑Thought reasoning capabilities represent valuable intellectual property, yet existing black‑box watermarking methods often trade robustness for reasoning fidelity by perturbing final answers or relying on fragile trigger patterns. We propose BiCoT, a watermarking framework that embeds ownership signals into the internal geometry of reasoning traces by aligning high‑saliency structural anchors with a private signature subspace while regularizing ordinary control tokens to preserve semantic capacity. This design couples the watermark with reasoning‑relevant representations, making removal difficult without disrupting the features that support coherent reasoning. To enable verification under model theft and representation drift, we introduce Robust Subspace Registration (RSR), a Top‑ logprob‑based black‑box verifier that uses sentinel tokens to calibrate systematic shifts in the output distribution. Experiments show that BiCoT preserves reasoning fidelity across diverse complex reasoning tasks while achieving robust detection under fine‑tuning, quantization, model‑level perturbations, and adaptive output‑level attacks across in‑domain and out‑of‑distribution settings.

Abstract:
Cryptographic watermarking is a leading defense for attributing text generated by large language models (LLMs). Existing schemes, including KGW, Unigram, and DipMark, derive their security guarantees from the assumption that the underlying pseudo‑random number generator (PRNG) is trustworthy. This work introduces SeedHijack, the first supply‑chain attack on LLM watermarking that is simultaneously (i) blind ‑‑ requiring no knowledge of the watermark key, detector, or model logits, (ii) integrity‑preserving ‑‑ amplifying rather than erasing the watermark signal, and (iii) orthogonal to detection ‑‑ the attack‑induced bias is statistically independent of all content‑side detector statistics, ensuring that amplification and evasion coexist without trade‑off. Rather than perturbing generated text, SeedHijack replaces the PRNG at the supply‑chain layer, biasing green‑list selection without altering output tokens or degrading text quality. Across three watermarking schemes and three open‑source LLMs, the attack triggers 0/6 state‑of‑the‑art content‑side statistical detectors while inflating the watermark z‑score up to 2.42x (system‑level defenses such as entropy‑source attestation remain orthogonal and complementary). A quantum random number generator (QRNG) countermeasure is shown to fully neutralize the attack while preserving benign watermarking utility. These findings establish PRNG integrity as a first‑class security requirement for cryptographic content‑provenance systems.

Abstract:
With the rapid proliferation of generative models, such as diffusion models, digital watermarking has emerged as a crucial solution for identifying AI‑generated images. Modern post‑hoc watermarking schemes use neural networks to achieve an extremely low false‑alarm rate while remaining robust to common image transformations. However, there is a lack of comparison between these modern methods and classic ones, particularly in real‑world scenarios where robustness and security take precedence over achieving an extremely low false‑alarm probability. In this paper, we propose a fair comparison of robustness and security between modern and classic post‑hoc watermarking across various types of classic augmentations and recent sophisticated attacks. Our experiments show that, in a realistic scenario, classic watermarking outperforms modern techniques in terms of security while maintaining robustness.

Abstract:
Reliable watermarking of panoramic imagery is fundamentally challenged by arbitrary 3D rotations. As panoramas are defined on the sphere, they naturally transform under the action of SO(3), rendering conventional planar representations and augmentation‑based robustness strategies inadequate and devoid of theoretical guarantees. To address this, we formulate panoramas as spherical signals and leverage SO(3) representation theory to derive provably rotation‑invariant descriptors. While spherical harmonic coefficients transform equivariantly under rotations, the natural invariant constructions are typically limited to zeroth‑order statistics which eliminate directional information and severely constrain embedding capacity. In this work, we introduce a principled third‑order invariant construction by coupling higher‑order SO(3) irreducible representations via tensor products and projecting onto the trivial representation. This yields a spherical invariant bispectrum that preserves phase information while remaining strictly rotation‑invariant. Leveraging this property, we embed watermarks into higher‑order spherical harmonic coefficients and recover them from invariant bispectral scalars, enabling reliable extraction under arbitrary 3D rotations. We provide a theoretical proof of SO(3) invariance for it and demonstrate experimentally its near‑perfect robustness to continuous rotations while maintaining high visual fidelity.

Abstract:
As policy catches up with the capabilities of generative AI, watermarking is central to content provenance efforts. Inference‑time watermarks for autoregressive models are unfit for continuous modalities due to discretization inconsistencies. Existing methods overcome this by finetuning the modality tokenizers, nullifying the watermark's training‑free advantage. In this work, motivated by the vocabulary redundancy of discretization, we propose an elegant solution for powerful and robust watermarking of synthetic audio. We theoretically analyze the impact of token errors on watermark detection, and effectively mitigate them using a reduced vocabulary obtained via community detection. Thorough experiments showcase that our gradient‑free method can boost detectability by several orders of magnitude, while also achieving built‑in robustness to audio modifications. Broadly, we discover a new state‑of‑the‑art for token‑level watermarks in multimedia, which simply arises from the nature of discrete representation learning.

Abstract:
Semantic‑level watermarking (SWM) improves robustness against text modifications by treating sentences as the basic unit. However, robustness to paragraph‑level paraphrasing remains difficult because such attacks globally disrupt watermark signals by changing sentence order. In this work, we propose SAMark, a self‑anchored watermarking framework that removes the dependency on sentence order by establishing a step‑independent green region in semantic space. To improve detectability, we introduce a multi‑channel hyperbolic scoring mechanism that amplifies watermark signals while suppressing noise from weakly aligned candidates. We further propose a diversity‑aware filtering strategy that combines hard filtering with soft regularization, extending beyond simple n‑gram repetition filters to address semantic redundancy. Experimental results show that SAMark achieves up to 90.2% TP@FP1% under typical paragraph‑level paraphrasing attacks, outperforming the strongest prior baseline by more than 30% on average, while maintaining generation quality competitive with unwatermarked text and breaking the robustness‑quality trade‑off that limits prior methods.

Abstract:
Memory‑backed agents need provenance that can survive leaked or migrated snapshots, where logs, visible outputs, and trusted metadata may be absent. We propose MemMark, a state‑evolution attribution watermark that embeds an owner‑controlled signal into latent memory‑write decisions. At each internal LLM call, MemMark samples among admissible candidates using keyed, distribution‑preserving selection, and records cryptographic commitments with signed session anchors and reveal evidence. This makes attribution depend on reproducible backend behavior rather than mutable provenance fields. Across A‑Mem and Graphiti on LoCoMo, with three LLM backbones, MemMark preserves memory utility: Overall F1 retains 99.6% of the unwatermarked baseline, while BLEU‑1 changes by +0.2%. It also provides usable carrier capacity, with 1.16, 1.14, and 1.26 bits of mean entropy for update‑target, link‑target, and semantic‑realization decisions. In the snapshot‑only R3 setting, MemMark recovers the full 40‑bit payload from final snapshots, while wrong‑key verification remains near chance. Under nine memory‑lifecycle attacks, verification distinguishes tampering, evidence deletion, and partial payload recovery. These results show that robust snapshot‑only attribution is feasible for long‑term agent memory without surviving traces, trusted metadata, or utility‑degrading.

Abstract:
Digital avatar watermarking presents unique challenges: avatars are routinely post‑processed with background replacement, reframing, and format conversion before deployment. We introduce RAW (Robust Avatar Watermarking), a benchmark comprising 50 synthetic avatar videos from 5 commercial providers and 6 attacks simulating real‑world avatar workflows. Evaluating 7 existing methods reveals that avatar‑specific attacks such as background removal significantly degrade watermark recovery. We propose WALT (Watermarking Avatars with Learned Textures), which embeds watermarks in UV texture space via 3D face reconstruction. WALT achieves the highest robustness to zoom attacks (92.4%) while maintaining strong performance on background removal (95.6%). We release our benchmark to facilitate research into avatar‑specific watermarking.

Abstract:
Proprietary large language models (LLMs) face risks of intellectual property (IP) violation, as adversaries can replicate an LLM by collecting input‑output pairs to train a surrogate model, causing financial setbacks. Watermarks offer a promising defense to verify ownership, but existing methods often struggle with semantic distortion, factual inconsistency, and adversarial attacks. In addition, key‑conditioned watermarks for provider‑specific detection, especially in cross‑provider and multi‑user scenarios, remain largely underexplored. To address these challenges, we propose SAFESEAL, a novel key‑conditioned watermarking framework that achieves strong detectability with minimal impact on model utility, effectively balancing detectability, utility, and robustness. SAFESEAL preserves named entities while substituting linguistic terms with context‑aware synonyms through a key‑conditioned Tournament sampling mechanism, maintaining semantic fidelity and factual consistency. For detection, we introduce a key‑conditioned contrastive detector that jointly encodes the text and key, enabling provider‑specific and robust watermark verification. We derive theoretical bounds on the utility‑detectability trade‑off and significantly reduce latency through lightweight models, batching, and parallelism. Extensive experiments show that SAFESEAL outperforms baselines in utility, detectability, and robustness, achieving a BERTScore of 0.983, entity similarity of 0.963, a 98.2% detection rate, and the highest human ratings for text quality and content preservation, with latency comparable to the fastest baseline. To promote transparency and community‑driven progress, we release the first public watermark leaderboard and an interactive demo.

Abstract:
While 4D Gaussian Splatting (4DGS) has revolutionized high‑fidelity dynamic reconstruction, safeguarding the intellectual property of these assets remains an open challenge. Conventional steganographic techniques often neglect the underlying kinematic manifolds, triggering non‑physical artifacts such as severe temporal flickering and "FVD collapse". To address this, we propose 4D‑GSW, a kinematic‑aware watermarking framework designed to embed robust copyright information while preserving high spatio‑temporal consistency. Unlike prior 4D steganography that primarily focuses on opacity‑guided invisibility, our approach explicitly addresses the physical coherence of motion trajectories. We introduce a Spatio‑Temporal Curvature (STC) metric to identify "Dynamic Instants," adaptively gating watermark gradient injection to shield critical motion manifolds from non‑physical perturbations. To ensure global coherence across complex deformations, we formulate a joint HMM‑MRF energy minimization model that synchronizes watermark phases within both temporal trajectories and spatial neighborhoods. Furthermore, an anisotropic gradient routing mechanism ensures that watermark embedding remains strictly decoupled from photometric reconstruction fidelity. Extensive experiments have demonstrated the superior performance of our method in robustly hiding watermarks while resisting various attacks and maintaining high rendering quality and spatiotemporal consistency.

Abstract:
Data leakage from API responses has drawn wide attention. APIs are often not fully regulated, making them easy to abuse. One common solution is to embed watermarks into API responses for traceability. However, existing watermarking methods often require modifying database content or API response data. This forces changes to business system code, and may even disrupt normal business operations because data values are altered. In this paper, we propose an original pluggable watermarking scheme based on a watermark proxy gateway and PEMark (Position Encoding‑based Watermarking). The key novelty of our approach is exploiting the inherent permutation redundancy in the ordering of JSON/XML key‑value pairs ‑‑ an overlooked dimension that carries no semantic information yet provides abundant encoding capacity. First, we forward server responses to the watermark proxy gateway, a design that requires zero modification to existing business systems. Then, we embed a watermark into each API response using position encoding, which reorders keys without altering any data values. To the best of our knowledge, this is the first work to achieve distortion‑free API response watermarking via position encoding over a proxy gateway. Our method does not modify any data values, so normal business operations continue seamlessly after watermark embedding. Experimental results show that our framework maintains business usability while ensuring that returned API data is traceable. Compared with current mainstream schemes, our method is robust against tampering and insertion attacks (100% similarity), and can withstand certain levels of deletion attacks.

Abstract:
Generative artificial intelligence now synthesizes photorealistic imagery, audio, and video at a cost that defeats traditional forensic intuition. The legal consequences span three regimes studied so far in isolation: international operational law, domestic procedure, and product regulation. This article presents a unified evidentiary framework that maps cryptographic content provenance, robust statistical watermarking, and zero knowledge attestation to the proof requirements of each regime. We define a five tier threat model spanning naive regeneration, adversarial laundering, cross model regeneration, active watermark removal, and insider provenance forgery. We release a public benchmark of 12000 generated items across image, audio, and video modalities under six laundering pipelines for 72000 evaluation samples. We evaluate four representative schemes and report true positive rate at fixed false positive rate, robustness area under the curve, computational overhead, and a regime conditioned legal sufficiency score. We translate empirical detection bounds into legal sufficiency thresholds for command decisions under the law of armed conflict, for criminal and civil admissibility under domestic procedure, and for persistence audits under the European Union Artificial Intelligence Act and analogous regimes. The result is a reproducible reference pipeline, a public benchmark, and model annexes that lawyers, engineers, and operators can deploy together.

Abstract:
Generative artificial intelligence is rapidly transforming the supply side of training data: an increasing share of new tokens, images, and structured records is produced by previous‑generation models rather than by human originators. Recursive training on such synthetic content induces a measurable and often irreversible loss of distributional fidelity, a phenomenon known as model collapse. We develop the first unified microeconomic theory of synthetic data markets under model collapse. We introduce the Synthetic Data Contamination Equilibrium (SDCE), prove existence and generic uniqueness, derive a welfare decomposition W = W_prod + W_cons ‑ L_coll ‑ L_info, establish a Wasserstein‑gradient‑flow mean‑field collapse limit, prove an impossibility of information‑constrained implementation, and obtain closed‑form expressions for the welfare‑maximizing provenance subsidy s = KL(q||p)/(2 kappa) and the welfare‑maximizing watermark strength w = (1 ‑ psi) KL(q||p)/(2 kappa psi). We prove an information‑theoretic Cramer‑Rao lower bound on any provenance estimator using only producer‑side observations and show that the Provenance‑Market Iterative Retraining (PMIR) algorithm attains this bound up to constants while converging to an epsilon‑SDCE in O(epsilon^‑2 log T) iterations. A reduced‑form OLS estimation on a C4‑synthetic benchmark over ten retraining generations yields a collapse‑rate coefficient b‑hat = 0.181 (HAC s.e. 0.024), within one standard error of the structural prediction 0.183. Calibrated experiments raise generation‑ten model quality by 23.1 percent over the unregulated benchmark while lowering the 2‑Wasserstein drift on a held‑out diversity probe from 0.318 to 0.142. Scaling experiments over generations t in 1,...,10 recover a logarithmic‑in‑t collapse law log Q_t = log Q_0 ‑ 0.183 t rho^2 with R^2 = 0.962.

Abstract:
This paper investigates a fundamental yet underexplored question: can watermarked images remain editable without compromising watermark integrity? We propose SafeMark, a framework for watermark‑preserving text‑guided image manipulation that explicitly integrates watermark integrity into the editing process. Specifically, SafeMark adds a thresholded watermark‑decoding loss directly to the diffusion editor's training objective, fine‑tuning the editor so that semantically valid edits also preserve the embedded watermark at the final output. This design admits a clean information‑theoretic justification: maintaining high bit‑accuracy on the edited image lower‑bounds the mutual information that the editor channel preserves between watermark and edited output, the quantity that fundamentally controls watermark recoverability. SafeMark is compatible with differentiable diffusion‑based editors, and requires no architectural modification. Extensive evaluations across multiple datasets, text‑guided editing methods, and post‑edit distortion settings demonstrate that SafeMark achieves high watermark bit accuracy across diverse editing settings while maintaining high‑quality semantic edits, without sacrificing robustness to common post‑edit distortions. These results demonstrate that semantic editability and watermark integrity are fundamentally compatible, enabling trustworthy image provenance in generative editing pipelines.

Abstract:
Pseudorandom codes (PRCs), introduced by Christ and Gunn (CRYPTO '2024), are error‑correcting codes whose codewords are computationally indistinguishable from uniformly random strings, while still being decodable by someone holding the key. They provide a natural primitive for robust and undetectable watermarking, particularly in applications to AI‑generated content. Although recent works have obtained strong results for substitution errors, the edit‑error setting remains much less understood, especially in the high‑rate regime and over small alphabets. We study public‑key pseudorandom codes against edit errors. First, we give a new reduction showing that binary zero‑bit PRCs robust against a constant fraction of substitution errors can be transformed into binary zero‑bit PRCs robust against edit errors. Consequently, under any assumption that yields zero‑bit Hamming‑robust PRCs, one also obtains zero‑bit PRCs for edit channels, albeit only for the weaker class of sublinear polynomial edit channels, namely channels with edit error rate 1/n^γ for any constant γ>0. In the high‑rate regime, we construct public‑key PRCs with rate arbitrarily close to 1 over sufficiently large constant alphabets, and with rate arbitrarily close to 1/2 over the binary alphabet. Moreover, if we allow the alphabet size to be \mathrmpoly(λ), where λ is the security parameter, then our public‑key PRCs can attain the Singleton bound for insertion‑deletion channels. Taken together, these results yield the first high‑rate public‑key binary PRC constructions for edit channels, under the same assumption that yields zero‑bit Hamming‑robust PRCs.

Abstract:
Critical infrastructure defense is fundamentally bottlenecked by the operational reality that preventive controls are frequently bypassed by sophisticated supply‑chain compromises and stolen administrative credentials. When prevention fails, defense relies entirely on rapid, post‑ingress threat detection and automated response across sovereign sectors. We present a novel, federated, high‑throughput stream‑processing and correlation framework designed to detect coordinated cross‑sector threat campaigns and orchestrate containment at machine speed. By utilizing a stateless Pre‑Filtering Dispatcher Subsystem (PFDS), in‑memory lock‑sharded state workers, and a 95% statistical watermark heuristic, our system maintains detection momentum during network partitions to evacuate speculative alerts. Delayed telemetry is subsequently reconciled directly within a version‑keyed columnar storage engine via deterministic time‑bucket hashing, eliminating state‑retraction overhead. We evaluate a prototype of our framework ‑ implemented in Go with an instantiated production‑grade columnar analytical store ‑ against a 500,000 events per second workload. The results demonstrate an internal framework processing overhead of under 7 seconds, while achieving total end‑to‑end operational convergence ‑ accounting for multi‑sector detection, correlation, wide‑area network (WAN) propagation, windowing stability, VLAN‑level response, and hardware level mitigation commitment ‑ within a realistic 12‑20 seconds window.

Abstract:
Watermarking combines an imperceptible change to an input image that will trigger a detector, to assert provenance and protect intellectual property. The literature has shown great interest in attacks on watermarking schemes: attackers are clearly motivated to steal copyrighted material or circumvent legislated deepfake protections. In this work, we make a simple‑yet‑powerful observation: that such attacks on watermarking‑like watermarks themselves‑seek an imperceptible change to an input image (now already watermarked) that will trigger a detector. This analogy comparing watermark attacks to watermarking itself is highly suggestive: that watermarks could be used to attack watermarks. Our first contribution validates this hypothesis. In rigorous experiments spanning 96 combinations of dataset, victim, and attack watermarks, we show that simply re‑watermarking an already watermarked image reliably suppresses the original signal, without requiring gradients, surrogate models, or detection keys. Our second contribution is a simple classifier for detecting the presence and identity of an existing watermark in a given image. Surprisingly, experimental findings demonstrate outstanding overall accuracies 0.878‑0.953. This result is of independent interest as a security vulnerability: research shows that method‑specific attacks achieve substantially stronger removal than black‑box attacks. Taken together, watermark identification combined with re‑watermarking successfully reduces bit accuracy by at least 25% and up to 48%. Our work constitutes a cheap, generic, and highly effective attack pipeline, calling into question the reliability of current watermarking schemes to such a simple attack, as well as the value of existing sophisticated attacks.

Abstract:
Robust watermarking is typically trained with random post‑processing augmentation, but random sampling under‑covers the combinatorial space of realistic attack pipelines and rarely encounters the rare compositions that actually break detection. This leads to unstable training and poor sample efficiency. We instead formulate watermark robustness as a min‑max problem over a structured space of compositional transformations. We propose Compositional Adversarial Training (CAT), a plug‑in framework that learns a sequential differentiable adversary that observes the current watermarked image and selects an attack family at each step to maximally disrupt message recovery. CAT combines a straight‑through Gumbel‑Softmax attack selection with entropy regularization, allowing the backward pass to be end‑to‑end differentiable and aggregate gradient information across attack families, yielding faster, smoother convergence without collapsing to a single attack mode. We evaluate CAT on post‑generation watermarks VideoSeal 0.0, VideoSeal 1.0, and PixelSeal and in‑generation WMAR under both single‑step and two‑step attack suites, on in‑distribution and multiple out‑of‑distribution image and video benchmarks. CAT consistently outperforms random‑augmentation baselines trained with the same augmentation budget, with the largest gains on hard composed attacks and OOD evaluations; improving overall watermark capacity by up to 63.5% in the single‑step attack setting and 13.0% in the compositional setting. In the autoregressive setting, CAT improves the TPR@FPR=1% by 12% on average on difficult geometric transformations. These results show that robust visual watermarking benefits from training against adaptive compositional adversaries rather than independent random corruptions.

Abstract:
We study the problem of multi‑bit watermarking for large language models (LLMs). We introduce a block‑autoregressive model inspired by multi‑token prediction, in which the encoder has limited non‑causal access to token distributions within each block. This formulation enables an information‑theoretic characterization of multi‑bit watermarking capacity, by which the knowledge of LLM cover statistics is leveraged to enable a multi‑bit covert embedding. We study the information‑theoretic limits of the model by combining Gelfand‑Pinsker and channel synthesis coding techniques and obtain an exact characterization of the capacity. The embedding strategy is further optimized across blocks using a constrained Markov decision process (CMDP) and we develop an explicit algorithm based on polar codes following the information‑theoretic principles. Our algorithm achieves a bit‑error rate below 10 percent with a rate of 0.375 bits/token over short token lengths with negligible perplexity and distortion degradation.

Abstract:
Generative AI systems are increasingly used not only to produce content but also to retrieve data, invoke tools, and execute actions. This work examines the security and safety implications of that shift across content‑level, model‑level, and agentic threats. We analyze how attacker access requirements, system autonomy, and the scope of potential harm change as models move from generating artifacts to executing operations through tool chains and external APIs. We then assess technical countermeasures including detection, watermarking, alignment, and emerging agentic safeguards, and show that several depend on forms of institutional coordination that current governance arrangements do not yet provide. Across the cases examined, capability deployment and attack‑surface expansion repeatedly outpace defensive responses as systems move from generating content to executing real‑world actions.

Abstract:
Detecting unauthorized knowledge distillation from a deployed LLM API is hard because the defender controls neither the attacker's training pipeline nor the next‑token logits. Existing defenses operate on the teacher's output tokens ‑‑ biasing the next‑token distribution (green‑list watermarks, cryptographic schemes, antidistillation sampling) or rewriting outputs after generation. Recent work shows a paraphrasing attacker can strip these signals without losing the underlying knowledge. We propose interaction‑layer antidistillation watermarks, which move the trace one layer higher, into the teacher's interaction behavior: the defender wraps the teacher with a system prompt that intermittently induces a behavioral marker ‑‑ an explicit follow‑up question, a low‑frequency variant, or a declarative restatement. An oblivious distiller inherits the behavior, and the defender audits via black‑box queries with a human‑validated LLM‑as‑judge (Cohen's kappa = 0.84/0.78 on strong/style rubrics). Across 63 LoRA‑distilled students under a Llama‑3.3‑70B‑Instruct teacher (35,343 judged samples), behavioral watermarks transfer at 88.9% (Gemma) / 80.9% (OLMo) / 45.2% (Qwen) relative fidelity (H1, H2). Under non‑adaptive DIPPER paraphrasing, robustness decomposes into a teacher‑self ceiling (about 66.4%) and student‑relative retention of 21‑112%, with OLMo preserving the watermark above the teacher itself (H3, F‑Amp). Low‑density (about 20%) explicit and implicit declarative variants transfer above per‑family baseline (H4, F‑Style). An N=20 in‑lab study (pre‑registered Latin‑square) shows all marker variants within 0.22 Likert step of baseline; TOST, Friedman, and Bonferroni‑Wilcoxon support H5. The interaction layer is a viable design locus for antidistillation watermarking, complementary to token‑, model‑, and reasoning‑trace‑layer defenses.

Abstract:
Deep Neural Networks (DNNs) are high‑value intellectual property (IP), yet deploying them to edge environments exposes them to unrestricted oracle access, rendering them vulnerable to model extraction and inversion attacks. Existing defenses fail to address this practically: passive watermarking only offers post‑hoc provenance, while active defenses impose prohibitive latency or require persistent access to sensitive training data. To bridge this gap, we propose LymphNode, a novel post‑hoc defense framework that acts as an intrinsic ``immune system" within the model. LymphNode enforces a strict ``default‑deny'' policy: it actively neutralizes model utility for unauthorized queries via Generalized Sparse Universal Adversarial Perturbations (GSUAP) injected into the feature space, effectively blocking gradient estimation and data inference. Utility is selectively restored only for authorized inputs carrying a stealthy feature‑domain credential. Our framework is highly practical: it is data‑efficient, establishing robust protection with fewer than 100 samples (<1% of training data), and cross‑dataset adaptable, enabling protection using public surrogate datasets. LymphNode thus provides a lightweight, immediately deployable defense for high‑stakes scenarios where original training data is restricted or unavailable.

Abstract:
As artificial intelligence (AI) is increasingly embedded in wireless networks, models are becoming core components that influence signal processing, resource scheduling and network control. However, model anomalies, tampering and malicious functions also introduce new security risks. In this article, we focus on model forensics in AI‑native wireless networks. Specifically, we first discuss key problems including model authenticity verification, malicious function identification and accountability tracing, and summarize the main categories of model forensics. We then explain the role of model forensics in AI‑native wireless networks and review representative application scenarios. In the case study, we use RF fingerprinting as an example and present two concrete workflows based on watermark authentication and backdoor detection, illustrating how provenance authentication and malicious behavior identification can be implemented in practice. The results show that model forensics can provide important support for anomaly assessment, provenance tracing and trustworthy operation in AI‑native wireless networks. Finally, we outline several promising directions for future research in this emerging area.

Abstract:
Watermarking techniques for large language models (LLMs), which encode hidden information in the output so its source can be verified, have gained significant attention in recent days, thanks to their potential capability to detect accidental or deliberate misuse. Similar challenges involving model misuse also exist in the context of game‑playing, such as when detecting the unauthorized use of AI tools in gaming platforms (e.g., cheating in online chess). In this paper, we initiate the study of how game‑playing strategies can be watermarked. We show how the KGW watermark for LLMs can be adapted to watermark game‑playing agents in perfect‑information extensive‑form games. The watermark can then be detected using a statistical test. We show that the degradation in the quality of the watermarked strategy profile, quantified by the expected utility, can be bounded, but there is a tradeoff between detectability and quality. In our experiments, we bootstrap the watermarking framework to various chess engines and demonstrate that a) the impact of the watermark on the quality of the strategy is negligible and b) the watermark can be detected with just a handful of games.

Abstract:
Watermarking is widely proposed for provenance, attribution, and safety monitoring in generative models, yet is typically evaluated only under adversaries who attempt to evade detection or induce false positives at the level of individual samples. We argue that watermarking should be treated as a monitoring primitive, and that internal monitoring is unavoidable given per‑entity attribution keys and messages, as well as detector access. We introduce an observer‑based threat model in which observers can aggregate watermark signals across outputs to infer entity‑level information, showing that even zero‑bit watermarking enables attribution under multi‑key settings. We further show that external monitoring can emerge over time from persistent, key‑dependent statistical structure, although this depends on watermark design and may be mitigated by distribution‑preserving or undetectable schemes. Our findings reveal a fundamental dual‑use tension between attribution and monitoring, motivating evaluation of watermarking beyond per‑sample robustness to account for aggregation and observer‑based capabilities.

Abstract:
3D Gaussian Splatting (3DGS) is becoming a practical representation for novel view synthesis, but its growing adoption, together with rapid advances in instruction‑driven 3DGS editing, also exposes a dual copyright risk: once a 3DGS‑based asset is released, it can be used without permission and manipulated through 3D editing. Existing protection methods address only one side of this problem. Watermarking can trace ownership after unauthorized use, but it cannot prevent malicious editing. Adversarial edit‑deterrence methods can disrupt editing, but they do not provide evidence of ownership. To the best of our knowledge, we present the first unified protection framework for 3DGS that jointly optimizes ownership tracing and unauthorized editing deterrence. Our framework combines a scene‑wide watermarking objective over all Gaussians with an adversarial objective for edit deterrence. The adversarial branch combines latent‑anchor separation, denoising‑trajectory diversion, and cross‑attention diversion to divert the editing trajectory, while an update‑saliency‑motivated Gaussian selection strategy assigns stronger adversarial updates to mask‑selected Gaussians, improving the balance among watermark recovery, edit deterrence, and rendering fidelity. Experiments on scenes from Mip‑NeRF 360 and Instruct‑NeRF2NeRF demonstrate that the proposed framework achieves a favorable balance among bit accuracy, edit deterrence, and rendering quality. These results suggest that practical copyright protection of 3DGS‑based assets can be more effectively addressed by integrating ownership tracing and unauthorized editing deterrence into a single optimization framework.

Abstract:
We introduce TextSeal, a state‑of‑the‑art watermark for large language models. Building on Gumbel‑max sampling, TextSeal introduces dual‑key generation to restore output diversity, along with entropy‑weighted scoring and multi‑region localization for improved detection. It supports serving optimizations such as speculative decoding and multi‑token prediction, and does not add any inference overhead. TextSeal strictly dominates baselines like SynthID‑text in detection strength and is robust to dilution, maintaining confident localized detection even in heavily mixed human/AI documents. The scheme is theoretically distortion‑free, and evaluation across reasoning benchmarks confirms that it preserves downstream performance; while a multilingual human evaluation (6000 A/B comparisons, 5 languages) shows no perceptible quality difference. Beyond its use for provenance detection, TextSeal is also ``radioactive'': its watermark signal transfers through model distillation, enabling detection of unauthorized use.

Abstract:
With LLM watermarking already being deployed commercially, practical applications increasingly require multibit watermarks that encode more complex payloads, such as user IDs or timestamps, into the generated text. In this work, we propose a fundamentally new approach for multibit watermarking: introducing binomial encoding to directly encode every bit of the payload at every token position. We complement our approach with a stateful encoder that during generation dynamically redirects encoding pressure toward underencoded bits. Our evaluation against 8 baselines on up to 64‑bit payloads shows that our scheme achieves superior message accuracy and robustness, with the gap to baseline methods widening in more relevant settings (i.e., large payloads and low‑distortion regimes). At the same time, we challenge prior works' evaluation metrics, highlighting their lack of practical insights, and introduce per‑bit confidence scoring as a practically relevant metric for evaluating multibit LLM watermarks.

Abstract:
LLM‑based agents act through sequences of executable decisions, but their trajectories provide little evidence of which agent or policy produced them, making provenance, ownership, and unauthorized reuse difficult to establish from observed behavior alone. This motivates watermarking signals embedded directly into agent behavior rather than only into generated text, since text watermarking cannot capture the action‑level decisions that define agent execution. Recent agent watermarking methods address this gap by moving the watermark from generated text to behavioral choices. However, by treating each action step as an independent trial, they overlook trajectory structure and become fragile when trajectories are perturbed, truncated, or observed without reliable alignment. We propose SeqWM, a sequential behavioral watermarking framework that embeds signals into history‑conditioned transition patterns and verifies trajectories position‑agnostically against random‑key baselines. Experiments across diverse agent benchmarks and LLM backbones show that SeqWM consistently achieves reliable detection while preserving agent utility, and remains robust under trajectory corruption where round‑indexed behavioral watermarks collapse.

Abstract:
With the proliferation of AI‑generated images, digital watermarking has become an essential safeguard for protecting intellectual property and mitigating malicious exploitation. Recent works on semantic watermarking have enabled efficient copyright protection for diffusion models. However, the dependence of semantic watermarking on diffusion inversion for watermark detection creates a critical vulnerability. Imprint removal and forgery attacks exploit this weakness to produce deceptive results. Our analysis reveals that these attacks succeed by displacing watermarked latents into the unwatermarked region, while guiding unwatermarked latents into the watermarked region. Based on that, we propose Progressive Guided Inversion and Denoising (PGID), the first plug‑and‑play, training‑free noise extraction framework designed to defend against both attack strategies. PGID effectively defends by projecting perturbed latents back to the region where they originally belong. The projection is achieved by eliminating intermediate latent deflections and mitigating adversarial perturbations through progressive inversion‑denoising cycles. Comprehensive evaluations across multiple schemes demonstrate that PGID successfully restores detection reliability by recovering removed watermarks and identifying forged instances.

Abstract:
Watermarks for AI‑generated images are meant to support downstream decisions about provenance, manipulation, and trust. In the settings that motivate watermark removal, therefore, success means more than causing the watermark test to fail. A successful remover must also preserve the utility of the image and make the output forensically indistinguishable from clean content, so that defeating the verifier restores deniability rather than merely replacing one detection signal with another. We show that current watermark removal attacks fail this stronger objective. Across six state‑of‑the‑art removers spanning four attack families, independent forensic detectors distinguish removal‑processed outputs from clean images at over 98% true‑positive rate under a 1% false‑positive budget. Thus, current removers often replace the watermark with a different detectable signal. Using UnMarker (IEEE S&P 2025) as a detailed case study, we show that this signal persists under common post‑processing, exhibits a characteristic two‑regime spectral deformation, and yields a three‑way tension among removal success, image quality, and forensic stealth. These results show that existing removal benchmarks are incomplete: they reward verifier evasion and utility preservation while omitting forensic stealth. A workable watermark remover must satisfy all three conditions at once: watermark evasion, utility preservation, and forensic indistinguishability from clean content.

Abstract:
Vision‑Language‑Action models (VLAs) support generalist robotic control by enabling end‑to‑end decision policies directly from multi‑modal inputs. As trained VLAs are increasingly shared and adapted, protecting model ownership becomes essential for secure deployment and responsible open‑source usage. In this paper, we present GuardVLA, the first backdoor‑based ownership verification framework specifically designed for VLAs. GuardVLA embeds a stealthy and harmless backdoor watermark into the protected model during training by injecting secret messages into embodied visual data. For post‑release verification, we propose a swap‑and‑detect mechanism, in which the trigger projector and an external classifier head are used to activate and detect the embedded backdoor based on prediction probabilities. Extensive experiments across multiple datasets, model architectures, and adaptation settings demonstrate that GuardVLA enables reliable ownership verification while preserving benign task performance. Further results show that the embedded watermark remains detectable under post‑release model adaptation.

Abstract:
In this thesis, we develop algorithms with theoretical guarantees for ensuring reliability and accountability of Machine Learning (ML) systems. As ML systems evolve from predictive models to generative models and autonomous agents, the landscape of trustworthy AI has shifted. This thesis introduces tools grounded in information theory, optimization, and statistical learning to mitigate bias, reduce arbitrary decisions, ensure content provenance, and evaluate LLM‑driven agents in autonomous settings. Towards mitigating bias and arbitrariness in traditional ML models, we introduce a kernel‑based method to achieve multiaccuracy across complex subpopulations that traditional demographic categories may overlook. We also develop methods to address predictive multiplicity, where equally accurate models yield conflicting individual predictions. We ensure the accountability in generative AI through watermarking large language models (LLMs). We characterize the information‑theoretic trade‑off between watermark detection and text distortion and derive optimal watermarking strategies by leveraging optimal transport and coding theory. Empirical evaluations show our watermarks achieve a superior detection‑quality tradeoff across language generation and coding tasks. Finally, we evaluate autonomous LLM agents in multi‑agent environments through the first simulator of a fully LLM‑driven supply chain. LLM agents offer significant performance gains, outperforming human teams and reducing costs by up to 67%, but also introduce systemic risks, including costly tail events.

Abstract:
We study multi‑bit watermarking for data generated by stochastic processes, where a hidden message is embedded during sampling and must be decodable by an authorized detector that possesses side information unavailable to unauthorized observers. In high‑stakes deployments, a practical watermark must simultaneously control false alarms, preserve generation quality without distorting the output distribution, and support reliable multi‑bit decoding. Satisfying all three goals at once inevitably creates fundamental trade‑offs. We formulate watermark embedding as a distributional information‑embedding problem and watermark detection as a multiple‑hypothesis testing problem under distortion and rate constraints, leading to four fundamental metrics: false‑alarm probability, detection error probability, distortion, and information rate. Within this information‑theoretic framework, we derive matched converse and achievability bounds that characterize the optimal trade‑offs and provide scheme‑agnostic benchmarks for any watermarking method. For stationary ergodic stochastic processes, we further obtain matched asymptotic limits and connect them to the finite‑sample regime. Finally, we present a reference watermarking construction satisfying our assumptions and empirically illustrating the predicted trade‑offs.

Abstract:
In this paper, we investigate the recent state‑of‑the‑art schemes for watermarking large language models (LLMs) outputs. These techniques are claimed to be robust, scalable and production‑grade, aimed at promoting responsible usage of LLMs. We analyse the effectiveness of these watermarking techniques against an extensive collection of modified text attacks, which perform targeted semantic changes without altering the general meaning of the text content. Our approach encompasses multiple attack strategies, which include lexical alterations, machine translation, and even neural paraphrasing. The attack efficacy is measured with two target criteria ‑ successful removal of the watermark and preservation of semantic content. We evaluate semantic preservation through BERT scores, text complexity measures, grammatical errors, and Flesch Reading Ease indices. The experimental results reveal varying levels of effectiveness among different watermarking models, with the same underlying result that it is possible to remove the watermark with reasonable effort. This study sheds light on the strengths and weaknesses of existing LLM watermarking systems, suggesting how they should be constructed to improve security of available schemes.

Abstract:
The proliferation of deepfake audio challenges voice‑based authentication systems; passive forensic detectors are sensitive to evolving generative models and to real‑world channel distortions. We propose Asymmetric Phase Coding (APC), a training‑free cryptographic signing layer for audio, designed as a compact and auditable provenance primitive that can stand alone or be stacked with learned watermarks. APC combines Ed25519 digital signatures (EdDSA, FIPS 186‑5; 64‑byte signatures) with Reed‑Solomon error correction, pseudo‑random STFT phase‑bin selection, and a redundant quantization‑index‑modulation (QIM) code on log‑magnitude differences of adjacent bin pairs, yielding a compact, non‑repudiable, blind‑extractable watermark. We evaluate APC on 1,000 LibriSpeech test‑clean clips (10 s each, 44.1 kHz) under eight attack configurations ‑‑ identity, 10% end‑cropping, 20% end‑cropping, 8 kHz low‑pass, 16 kHz round‑trip resampling, FLAC re‑encoding, MP3 at 128 kbps, and OGG‑Vorbis at 128 kbps ‑‑ and achieve cryptographic verification rates between 97.5% and 98.3% on every condition at mean PESQ=3.02 and tens‑of‑milliseconds CPU latency. We explicitly compare APC against recent neural baselines (AudioSeal, WavMark, SilentCipher), detail the threat model (forgery resistance vs. erasure), characterize the dataset, define all metrics, quantify an adaptive white‑box erasure attack, and release code, keys, and metadata for reproducibility.

Abstract:
Large language models (LLMs) are pre‑trained and post‑trained on vast amounts of loosely curated data, raising the possibility that these models may have been trained on proprietary datasets or the same benchmarks used for evaluation. This motivates the need for dataset watermarking: designing datasets such that training on them leaves detectable signatures in the resulting model. Prior work has explored this problem for open models. We introduce the first dataset watermarking method for closed LLMs with provable detection. In particular, we embed a dataset‑level watermark signal by increasing the co‑occurrence frequency of randomly selected word pairs through rephrasing, and detect it using a statistical test on co‑occurrence patterns in model‑generated outputs. We evaluate our method with multiple base models and benchmark datasets and show that it reliably detects the watermark (p <0.01) in the fine‑tuning stage. Notably, our method remains effective in a data mixture setting where the watermarked dataset constitutes only approximately 1% of the total fine‑tuning tokens. Furthermore, we show that our method preserves the utility and semantic integrity of the benchmark.

Abstract:
Watermark radioactivity testing type of methods can detect whether a model was trained on watermarked documents, and have become key tools for protecting data ownership in the fine‑tuning of large language models (LLMs). Existing works have proved their effectiveness in centralized LLM fine‑tuning. However, this type of method faces several challenges and remains underexplored in federated learning (FL), a widely‑applied paradigm for fine‑tuning LLMs collaboratively on private data across different users. FL mainly ensures privacy through secure aggregation (SA), which allows the server to aggregate updates while keeping clients' updates private. This mechanism preserves privacy but makes it difficult to identify which client trained on watermarked documents. In this work, we propose FedAttr, a new client‑level attribution protocol for FL. FedAttr identifies which clients trained on watermarked data via a paired‑subset‑difference mechanism, while preserving the privacy guarantees of SA and FL performance. FedAttr proceeds in three steps: (i) estimate each client's update by differencing two SA queries, (ii) score the estimate with the watermark detector via differential scoring, and (iii) combine scores across rounds via Stouffer method. We theoretically show that FedAttr produces an unbiased estimator of each client's update with bounded mutual information leakage (i.e., O(d^/N) per‑round update). Moreover, FedAttr empirically achieves 100% TPR and 0% FPR, outperforming all baselines by at least 44.4% in TPR or 19.1% in FPR, with only 6.3% overhead relative to FL training time. Ablation studies confirm that FedAttr is robust to protocol parameters and configurations.

Abstract:
The rapid emergence of generative image models has led to the development of specialized watermarking techniques, particularly in‑generation methods such as seed‑based embedding. However, current evaluations in this area remain largely empirical, making them heavily reliant on the specific model architectures used for generation and inversion. This prevents any clear conclusion on the performance of any method, especially regarding security, for which a rigorous definition is lacking. Against this approach, we argue that the effectiveness of a watermarking scheme should be established purely through a thorough theoretical analysis. This is enabled by decoupling the model‑dependent part from the actual decision mechanism of the watermarking system. Using this decoupling, we introduce a formal evaluation framework based on security, robustness, and fidelity. This allows precise comparisons between watermarking systems through a characteristic surface representing the trade‑off between these three quantities, independent of any generative model. Based on this framework, we propose SSB, a novel watermarking method that generalizes previous seed‑based methods by allowing to reach any security‑robustness‑fidelity regime on its characteristic surface. This work opens the door to the design of modern watermarking systems with theoretical guarantees that do not necessitate any costly empirical evaluations.

Abstract:
Low‑latency anonymity networks such as Tor remain vulnerable to infrastructure‑level traffic analysis that exploits side‑channel information observable from encrypted communications. We introduce NATA, a non‑invasive active traffic‑correlation analysis algorithm that injects distinguishable throughput patterns into traffic flows through controlled bandwidth perturbations. Unlike passive correlation methods, NATA does not require endpoint compromise, Tor‑browser modification, or packet‑payload decryption or modification. It can be carried out by an adversary that controls an upstream network gateway and observes traffic at adversary‑controlled exit relays. To identify perturbed flows under substantial network variability, we develop BM‑Net (Bandwidth Modulation Network), a selective state‑space learning framework adapted for bandwidth‑modulation detection. Given the limited availability of high‑fidelity ground truth on real‑world cross‑continental Tor paths, BM‑Net adopts a data‑efficient learning strategy that separates self‑supervised representation learning from supervised task‑specific classification. It first learns reusable traffic representations through masked pre‑training on serialized traffic traces, and then adapts these representations to binary perturbation detection and fine‑grained modulation classification using task‑specific labeled data. Through real Tor traffic measurements, BM‑Net achieves a 99.65% binary detection F1 score and a 97.5% macro‑F1 score for fine‑grained modulation classification under our evaluated settings. In addition, tornettools‑based scaled simulations are used to estimate exit‑observation probability under bandwidth‑weighted relay selection. These results suggest that active bandwidth perturbation can serve as an infrastructure‑level side channel for traffic correlation under a clearly defined adversary model.

Abstract:
Statistical watermarking is a common approach for verifying whether text was written by a language model. Most existing schemes assume autoregressive generation, where tokens are produced left to right and contextual hashing is well defined. Diffusion language models generate text by denoising tokens in arbitrary order, so these schemes cannot be applied directly. A recent watermark by Gloaguen et al. addresses this gap for LLaDA 8B Instruct and reports true positive detection above 99%. This paper studies what happens when watermarked text is rewritten not once but several times. Using the same watermark configuration, 1,605 watermarked completions of about 300 tokens each are produced across five WaterBench domains. Each completion is rewritten by four open weight language models, from 1.5B to 8B parameters, none of which know the watermark key. Five rewrite styles are tested: paraphrase, humanize, simplify, academic, and summarize expand. Each style is chained for up to five hops, producing 160,500 rewritten texts in total. The watermark is detected on 87.9% of the original outputs at the standard significance threshold. After a single rewrite, detection falls to between 14% and 41% depending on the rewriter and style. After five chained rewrites, detection falls to 4.86%, meaning 94.76% of the originally detected texts are no longer flagged. After three rewrites, the detector score has dropped 86% of the way from its watermarked baseline toward the null distribution. Repeated rewriting is therefore a much stronger attack than a single rewrite, and the result holds across all four rewriters tested.

Abstract:
LLM watermarks must be detectable without compromising text quality, yet most existing schemes bias the next‑token distribution and pay for detection with measurable quality loss. We present SLAM (Structural Linguistic Activation Marking), a novel white‑box watermarking scheme that sidesteps this cost by writing the mark into structural geometry rather than token frequencies: sparse autoencoders identify residual‑stream directions encoding linguistic structure (e.g., voice, tense, clause order), and we causally steer those directions at generation time, leaving lexical sampling and semantics unconstrained. On Gemma‑2 2B and 9B, SLAM achieves 100% detection accuracy with a quality cost of only 1‑2 reward points ‑ compared to 7.5‑11.5 for KGW, EWD, and Unigram ‑ with naturalness and diversity preserved at near‑unwatermarked levels across both models. The trade‑off is a complementary robustness profile: SLAM resists word‑level edits but is vulnerable to paraphrase that restructures syntax (at a quality cost), the converse of token‑distribution methods.

Abstract:
Given two GNNs that output node embeddings, how can we determine if they were trained independently? An adversary could have trained one GNN specifically to mimic the other GNN's embeddings. To obscure this relationship between the GNNs, the adversarial GNN might then transform its output embeddings. The two GNNs could have different architectures, weights, and embedding dimensions, and the adversary can transform the embeddings. Despite these stringent conditions, our algorithm (named CopyCop) can identify such copycat GNNs, unlike existing watermarking and fingerprinting methods. We also provide theoretical guarantees for CopyCop. Finally, experiments on 14 datasets and 5 GNN architectures demonstrate that CopyCop is accurate and robust against a broad class of adversarial attacks and transformations. Code is available at: https://anonymous.4open.science/r/CopyCop‑Graph‑Ownership‑Verification‑8143/README.md

Abstract:
Today, advances in medical technology extensively utilize 3D volume data for accurate and efficient diagnostics. However, sharing these data across networks in telemedicine poses significant security risks of data tampering and unauthorized copying. To address these challenges, this paper proposes a novel reversible‑zero watermarking approach, termed Vol‑Mark, for medical volume data to protect their ownership and authenticity in telemedicine. The proposed Vol‑Mark method offers two key benefits: 1) it designs a volume data feature extractor that leverages contrastive learning to efficiently extract discriminative and stable volumetric features, ensuring robustness against 3D attacks; 2) it introduces the cubic difference expansion (c‑DE) technique, which leverages the 3D integer wavelet transform to embed watermark bits into neighboring voxels within cubes at low‑frequency coefficients. The voxel differences within each cube are expanded to create embedding space, and a majority voting mechanism is employed during extraction to enhance reliability. The embedding process incurs low distortion and supports lossless removal, thereby preserving the integrity and diagnostic accuracy of medical volume data. Through these two benefits, Vol‑Mark enables both integrity verification and ownership verification. Integrity verification is first performed, and ownership verification through hypothesis testing is further conducted to enhance reliability, particularly under data tampering or watermark removal attacks. Comprehensive experimental results show the effectiveness of the proposed method and its superior robustness against conventional, geometric, and hybrid attacks on medical volume data. In particular, through multiple tasks evaluations, Vol‑Mark consistently achieves an ACC above 0.90 in most attack scenarios, outperforming existing methods by a clear margin.

Abstract:
We introduce SWAN (Semantic Watermarking with Abstract Meaning Representation), a novel framework that embeds watermark signatures into the semantic structure of a sentence using Abstract Meaning Representation (AMR). In contrast to existing watermarking methods, which typically encode signatures by adjusting token selection preferences during text generation, SWAN embeds the signature directly in the sentence's semantic representation. As the signature is encoded at the semantic structure level, any paraphrase that preserves meaning automatically preserves the signature. SWAN is training‑free: watermark injection is achieved by prompting an LLM to generate sentences guided by a selected AMR template while maintaining contextual coherence, and detection uses an off‑the‑shelf AMR parser followed by a simple one‑proportion z‑test. Empirical evaluation on the RealNews benchmark shows SWAN matches state‑of‑the‑art detection performance on unaltered watermarked text, while significantly improving robustness against paraphrasing, increasing detection AUC by up to 13.9 percentage points compared to prior methods. These results demonstrate that SWAN's approach of anchoring watermarks in AMR semantic structures provides a simple, effective, and prompt‑based method for robust text provenance verification under paraphrasing, opening new avenues for semantic‑level watermarking research.

Abstract:
With the application of vertical domain pre‑trained language models (VPLMs) in specialized fields such as medical, finance, and law, model parameters and inference capabilities have become important digital assets. Achieving traceable copyright verification for VPLMs has become an urgent challenge. Existing copyright verification methods primarily rely on embedding backdoor watermarks into models. However, most of these methods require additional training, suffer from inefficient watermark embedding, and lack scalable designs for multiple vertical domains. To address these limitations, we propose VertMark, the first unified training‑free and robust watermarking framework for copyright verification across multiple vertical domain VPLMs. The framework embeds ownership‑encoded watermarks by establishing a hidden semantic equivalence between low‑frequency trigger tokens and high‑frequency domain‑relevant words via a training‑free parameter replacement strategy. Experiments demonstrate that VertMark can achieve efficient watermark embedding and reliable watermark verification for both text understanding and text generation downstream tasks in the medical, financial, and legal domains, with negligible impact on model performance. Moreover, VertMark exhibits strong robustness against various attacks (e.g., pruning and quantization), highlighting its practical value and providing strong protection for the copyright security of VPLMs.

Abstract:
Contrastive learning (CL) reduces annotation cost via auto‑derived supervisory signals. Since large‑scale in‑house CL datasets are infeasible, reliance on third‑party or internet data is common. Recent studies show CL models are vulnerable to data‑poisoning backdoor attacks, but their generalization and robustness are underexplored. We systematically evaluate existing data‑poisoning backdoor attacks on CL, revealing limitations: poor dataset adaptability, low success rates, limited portability, and restrictive assumptions (e.g., downstream task knowledge). Interestingly, trigger samples exhibit distinguishable statistical divergence from clean samples, which inspires repurposing it as a watermark for dataset IP protection. Direct repurposing is challenging due to low success rates; we overcome this by statistical verification using a unified density metric. We further propose a multi‑level watermarking scheme adapting to feature‑level, soft‑label, or hard‑label outputs in CL. Experiments show some backdoor attacks can be repurposed as effective watermarks with trade‑offs among fidelity, verifiability, and robustness. This work demonstrates weak backdoor effects become reliable signals for dataset IP protection in challenging CL settings.

Abstract:
In this paper, we propose MelShield, a robust, in‑generation, keyed audio watermarking framework that embeds identifiable signals into AI‑generated audio for copyright protection and reliable attribution. Specifically, MelShield operates in the Mel‑spectrogram domain during the generation process, targeting intermediate acoustic representations in Mel‑conditioned pipelines for text‑to‑speech (TTS) generation. The core idea is to treat the intermediate Mel‑spectrogram as the host signal and embed a short binary payload via low‑energy, keyed spread‑spectrum perturbations distributed across carefully selected time‑frequency regions prior to waveform synthesis. By performing watermarking before vocoder inference, MelShield remains plug‑and‑play for Mel‑conditioned TTS architectures and does not require modification or retraining of the underlying TTS generation vocoder, such as DiffWave and HiFi‑GAN. Moreover, the multi‑user keyed construction enables scalable user‑specific attribution, while the keyed verification mechanism limits unauthorized decoding, thereby reducing the risk of large‑scale extractor probing and adversarial analysis. Extensive experiments on DiffWave and HiFi‑GAN demonstrate that MelShield achieves reliable watermark extraction, approaching 100% bit accuracy, even under signal distortions, e.g., compression and additive noise, while preserving high perceptual audio quality.

Abstract:
Latent‑based diffusion model watermarking embeds watermarks into generated images' latent space to enable content attribution, offering a training‑free solution for intellectual property protection and digital forensics. However, these methods exhibit a critical vulnerability to the forgery attack, attackers can extract the watermark by inverting the watermarked image and re‑generating it with an arbitrary prompt, thereby enabling false attribution on malicious content. In this paper, we propose the CSGuard, the first forgery‑resistant watermarking schema that leverages compressed sensing to bind the watermarked image generation and verification to a secret matrix. This ensures that only users possessing the secret matrix can correctly embed or verify the image watermark, prevents the illegal users from forgery without compromising generation quality and watermark integrity. Experimental results demonstrate that CSGuard achieves strong forgery resistance, reduces the attack success rate from 100.0% to 28.12%, and achieve 100% detection rate on benign watermarked images without compromising watermarking effectiveness.

Abstract:
Detecting machine‑generated text is essential for transparency and accountability when deploying large language models (LLMs). Among detection approaches, watermarking is a statistically reliable method by design ‑‑ it embeds detectable signals into LLM outputs by biasing their token distributions. However, it has been reported that watermarked LLMs often perform worse on downstream tasks. We propose PUPPET, a framework that fine‑tunes an LLM via reinforcement learning to generate text that is both more detectable and better performing on downstream tasks. We use two reward functions: a detector that outputs a machine‑class likelihood and an evaluator that measures a task‑specific metric. Experiments on long‑form QA, summarization, and essay writing show that LLMs trained with PUPPET achieve high detectability competitive with watermarking methods while outperforming them on downstream tasks. The analysis shows that this optimization can be performed efficiently with only a few thousand samples in 1‑‑2 GPU hours. Moreover, these gains are consistent across out‑of‑domain tasks, different LLM families, and model sizes, and are even robust to paraphrasing attacks.

Abstract:
Recent multi‑bit watermarking methods for large language models (LLMs) prioritize capacity over reliability, often conflating decoding with detection. Our analysis reveals that existing ECC‑based extractors suffer from catastrophic false positive rates (FPR), and applying rejection thresholds merely collapses detection sensitivity (TPR) to random guessing. To resolve this structural limitation, we propose BREW (Block‑wise Reliable Embedding for Watermarking), a framework shifting the paradigm to \emphdesignated verification. BREW employs a two‑stage mechanism: (i) blind message estimation via independent block voting, followed by (ii) window‑shifting verification that rigorously validates the payload against local edits. Experiments demonstrate that BREW achieves a TPR of 0.965 with an FPR of 0.02 under 10% synonym substitution, demonstrating that the high‑FPR issue is not an inherent trade‑off of multi‑bit watermarking, but a solvable structural flaw of prior decoding‑centric designs. Our framework is model‑agnostic and theoretically grounded, providing a scalable solution for reliable forensic deployment.

Abstract:
Constructing and curating high‑quality code datasets requires significant resources, making them valuable intellectual property. Unfortunately, these datasets currently face severe risks of unauthorized use. Although digital watermarking offers a post hoc mechanism for copyright authentication, existing methods are predominantly based on the co‑occurrence pattern, which is not robust and is susceptible to watermark detection and removal attacks. In this paper, we propose PuzzleMark, a robust watermarking method for code datasets. To reduce the risk of watermark exposure, PuzzleMark introduces a carrier selection strategy that leverages code complexity to evaluate the suitability of code snippets as watermark carriers, and selects those with high suitability for watermarking. To enhance the robustness of the watermark, PuzzleMark proposes a novel concatenation pattern to replace the traditional co‑occurrence pattern, and implements two watermarking strategies through variable name concatenation. PuzzleMark adaptively embeds watermarks based on the inherent characteristics of the code, making it more stealthy while maintaining design simplicity. For watermark verification, PuzzleMark employs Fisher's exact test to verify suspicious models under a black‑box setting. Experimental results demonstrate that PuzzleMark achieves a 100% verification success rate and a 0% false positive rate, with negligible impact on model performance. Both our human study and our evaluation using four state‑of‑the‑art watermark detection methods show that PuzzleMark exhibits strong imperceptibility, with an average suspicious rate \leq 0.24 and an average recall \leq 30.41%, respectively. As a practical digital watermarking method, PuzzleMark provides strong protection for the intellectual property of code datasets and offers new insights for future research.

Abstract:
Large Language Model (LLM) watermarking is crucial for establishing the provenance of machine‑generated text, but most existing methods rely on a centralized trust model. This model forces users to reveal potentially sensitive text to a provider for detection and offers no way to verify the integrity of the result. While asymmetric schemes have been proposed to address these issues, they are either impractical for short texts or lack formal guarantees linking watermark insertion and detection. We propose VOW, a new protocol that achieves both privacy‑preserving and cryptographically verifiable watermark detection with high efficiency. Our approach formulates detection as a secure two‑party computation problem, instantiating the watermark's core logic with a Verifiable Oblivious Pseudorandom Function (VOPRF). This allows the user and provider to perform detection without the user's text being revealed, while the provider's result is verifiable. Our comprehensive evaluation shows that VOW is practical for short texts and provides a crucial reassessment of watermark robustness against modern paraphrasing attacks.

Abstract:
The rapid evolution of deepfake technology poses an unprecedented threat to the authenticity of Graphics Interchange Format (GIF) imagery, which serves as a representative of short‑loop temporal media in social networks. However, existing proactive forensics works are designed for static images, which limits their applicability to animated GIFs. To bridge this gap, we propose GIFGuard, the first spatiotemporal watermarking framework tailored for deepfake proactive forensics in GIFs. In the embedding stage, we propose the Spatiotemporal Adaptive Residual Encoder (STARE) to ensure robustness against high‑level semantic tampering. It employs a 3D convolutional backbone with adaptive channel recalibration to capture globally coherent temporal dependencies. In the extraction stage, we design the Deep Integrity Restoration Decoder (DIRD). It utilizes a spatiotemporal hourglass architecture equipped with 3D attention to restore latent features, allowing for the accurate extraction of watermark signals even under severe facial manipulation. Furthermore, we construct GIFfaces, the first large‑scale benchmark dataset curated for GIF proactive forensics to facilitate research in this domain. Extensive results show that GIFGuard achieves high‑fidelity visual quality and remarkable robustness performance against deepfakes. Related code and dataset will be released.

Abstract:
Unlike single‑face forgeries, deepfakes in complex multi‑person interaction scenarios (such as group photos and multi‑person meetings) more closely reflect real‑world threats. Although existing proactive forensics solutions demonstrate good performance, they heavily rely on a "single‑face" setting, making it difficult to effectively address the problems of deepfake localization and source tracing in complex multi‑person environments. To address this challenge, we propose the Deep Attributable Watermarking Framework (DAWF). This framework adopts a novel multi‑face encoder‑decoder architecture that bypasses the cumbersome offline pre‑processing steps of traditional forensics, facilitating efficient in‑network parallel watermark embedding and cross‑face collaborative processing. Crucially, we propose a selective regional supervision loss. This innovative mechanism guides the decoder to focus exclusively on the facial regions tampered with by deepfakes. Leveraging this mechanism alongside the embedded identity payloads, DAWF realizes the "which + who" goal, answering the dual questions of which facial region was forged and who was forged. Extensive experiments on challenging multi‑face datasets show that DAWF achieves excellent deepfake localization and traceability in complex multi‑person scenes.

Abstract:
Current watermark removal methods are evaluated on two axes: attack success rate and perceptual quality. We show this is insufficient. While state‑of‑the‑art attacks successfully degrade the watermark signal without visible distortion, they leave distinct statistical artifacts that betray the removal attempt. We name this overlooked axis Watermark Removal Detection (WRD) and demonstrate that a modern classifier trained on these artifacts achieves state‑of‑the‑art detection rates at 10^‑3 FPR across every removal method tested. No existing attack accounts for this forensic leakage. We benchmark leading watermarking schemes against standard removal pipelines under the extended evaluation triple of attack success, perceptual quality, and forensic detectability, and find that no current method balances all three. Our results establish forensic stealthiness as a necessary requirement for watermark removal.

Abstract:
The release of GPT‑image‑2 by OpenAI marks a watershed moment in AI‑generated imagery: the boundary between photographic reality and synthetic content has never been more difficult to discern. We introduce the GPT‑Image‑2 Twitter Dataset, the first published dataset of GPT‑image‑2 generated images, sourced from publicly available Twitter/X posts in the immediate aftermath of the model's April 21, 2026 release. Leveraging the Twitter API v2 and a multi‑stage curation pipeline spanning multilingual text heuristics (English, Japanese, and Chinese), browser‑automated Twitter "Made with AI" badge verification, and model name variant matching, we curate 10,217 confirmed GPT‑image‑2 images from 27,662 collected records over a six‑day window. We characterize the dataset across four analyses: CLIP‑based zero‑shot subject taxonomy, OCR text legibility (82.0% of images contain detectable text), face detection (59.2% of images, 22,583 total faces), and semantic clustering (137 CLIP ViT‑L/14 clusters). A key negative result is that C2PA content credentials are systematically stripped by Twitter's CDN on upload, rendering cryptographic provenance verification infeasible for social‑media‑sourced AI images. The dataset and all curation code are released publicly.

Abstract:
Large language models (LLMs) are widely deployed in multiple scenarios due to reasoning capabilities. In order to prevent the models from being misused, watermarking is generally employed to ensure ownership. However, most existing watermarking methods rely on superficial modifications to the model's output distribution, rendering the watermark vulnerable to perturbation and removal. To overcome this challenge, this paper introduces a reasoning‑layer framework termed Redundant Chain‑of‑Thought (R‑CoT), which embeds watermarks into the reasoning path. A dual‑trajectory optimization mechanism based on GRPO enables the native and the watermark reasoning path to coexist within a shared parameter space, internalizing the watermark as a distinct reasoning policy. Therefore, the watermark is embedded into the model's stable reasoning path, avoiding the watermark failure caused by output‑level perturbations. Experimental results show that, compared with existing methods, R‑CoT achieves high watermark effectiveness and strong robustness. Under fine‑tuning and other post‑training operations, the true positive rate (TPR) consistently remains above 95%, exhibiting only marginal degradation.

Abstract:
Proactive watermarking offers a promising approach for deepfake tamper detection and localization in short‑form videos. However, existing methods often decouple audio and visual evidence and assume that watermark signals remain reliable under real‑world degradations, making tamper localization vulnerable to multimodal misalignment and compression distortions. Moreover, existing semi‑fragile visual watermarking methods often degrade significantly under codec compression because their embedding bands overlap with compression‑sensitive frequency regions. To address these limitations, we propose Layered Audio‑Visual Anti‑tampering Watermarking (LAVA), a calibration‑aware audio‑visual watermark fusion framework for deepfake tamper detection and localization. LAVA leverages cross‑modal watermark fusion and calibration‑aware alignment to preserve consistent and reliable tamper evidence under compression and audio‑visual asynchrony, enabling robust tamper localization. Extensive experiments demonstrate that LAVA achieves near‑perfect detection performance (AP = 0.999), remains robust to compression and multimodal misalignment, and significantly improves tamper localization reliability over existing audio‑visual fusion baselines.

Abstract:
Self‑supervised learning (SSL) encoders are invaluable intellectual property (IP). However, no existing SSL watermarking for IP protection can concurrently satisfy the following two practical requirements: (1) provide ownership verification capability under black‑box suspect model access once the stolen encoders are used in downstream tasks; (2) be robust under adversarial watermark detection or removal, because the watermark samples form a distinguishable out‑of‑distribution (OOD) cluster. We propose ArmSSL, an SSL watermarking framework that assures black‑box verifiability and adversarial robustness while preserving utility. For verification, we introduce paired discrepancy enlargement, enforcing feature‑space orthogonality between the clean and its watermark counterpart to produce a reliable verification signal in black‑box against the suspect model. For adversarial robustness, ArmSSL integrates latent representation entanglement and distribution alignment to suppress the OOD clustering. The former entangles watermark representations with clean representations (i.e., from non‑source‑class) to avoid forming a dense cluster of watermark samples, while the latter minimizes the distributional discrepancy between watermark and clean representations, thereby disguising watermark samples as natural in‑distribution data. For utility, a reference‑guided watermark tuning strategy is designed to allow the watermark to be learned as a small side task without affecting the main task by aligning the watermarked encoder's outputs with those of the original clean encoder on normal data. Extensive experiments across five mainstream SSL frameworks and nine benchmark datasets, along with end‑to‑end comparisons with SOTAs, demonstrate that ArmSSL achieves superior ownership verification, negligible utility degradation, and strong robustness against various adversarial detection and removal.

Abstract:
Watermarking has emerged as a promising technique for tracing the authorship of content generated by large language models (LLMs). Among existing approaches, the KGW scheme is particularly attractive due to its versatility, efficiency, and effectiveness in natural language generation. However, KGW's effectiveness degrades significantly under low‑entropy settings such as code generation and mathematical reasoning. A crucial step in the KGW method is random vocabulary partitioning, which enables adjustments to token selection based on specific preferences. Our study revealed that the next‑token probability distribution plays an critical role in determining how much, or even whether, we can modify token selection and, consequently, the effectiveness of watermarking. We refer to this characteristic, associated with the probability distribution of each token prediction, as \emphwatermark strength. In cases of random vocabulary partitioning, the lower bound of watermark strength is dictated by the next‑token probability distribution. However, we found that, by redesigning the vocabulary partitioning algorithm, we can potentially raise this lower bound. In this paper, we propose SSG (Sort‑then‑Split by Groups), a method that partitions the vocabulary into two logit‑balanced subsets. This design lifts the lower bound of watermark strength for each token prediction, thereby improving watermark detectability. Experiments on code generation and mathematical reasoning datasets demonstrate the effectiveness of SSG.

Abstract:
Large language models (LLMs) often produce content that contradicts or overlooks information provided in the input context, a phenomenon known as faithfulness hallucination. In this paper, we propose Context‑Fidelity Boosting (CFB), a lightweight and general decoding‑time framework that reduces such hallucinations by increasing the generation probability of source‑supported tokens. Motivated by logit‑shaping principles from watermarking techniques, CFB applies additive token‑level logit adjustments based on a token's degree of support from the input context. Specifically, we develop three boosting strategies: static boosting, which applies a fixed bias to source‑supported tokens; context‑aware boosting, which scales this bias using the divergence between next‑token distributions with and without context; and token‑aware boosting, which further redistributes the adaptive bias according to local relevance estimated from source‑position attention and source‑scoped semantic similarity. CFB requires no retraining or architectural changes, making it compatible with a wide range of LLMs. Experiments on summarization and question answering tasks across multiple open‑source LLMs show that CFB consistently improves faithfulness metrics with minimal generation overhead. Our implementation is fully open‑sourced.

Abstract:
Digital image watermarking has advanced rapidly for copyright protection of generative AI, yet the comparatively limited progress in watermark attack techniques has broken the attack‑defense balance and hindered further advances in the field. In this paper, we propose FMDiffWA, a frequency‑domain modulated diffusion framework for watermark attacks. Specifically, we introduce a frequency‑domain watermark modulation (FWM) module and incorporate it into the sampling stages both the forward and reverse diffusion processes. This mechanism enables selective modulation of watermark‑related frequency components, thereby allowing FMDiffWA to effectively neutralize the invisible watermark signals while preserving the perceptual quality of the attacked watermarked images. To achieve a better trade‑off between attack efficacy and visual fidelity, we reformulate the training strategy of conventional diffusion models by augmenting the canonical noise estimation objective with an auxiliary refinement constraint. Comprehensive experiments demonstrate that FMDiffWA achieves superior visual fidelity compared to existing watermark attacks, while exhibiting strong generalization across diverse watermarking schemes.

Abstract:
The rapid adoption of diffusion‑based generative models has intensified concerns over the attribution and integrity of AI‑generated content (AIGC). Existing single‑domain watermarking methods either fail under regeneration, remain vulnerable to black‑box reprompting that enables adversarial framing, or provide no spatial evidence for tampered regions. We propose Dual‑Guard, a dual‑channel latent watermarking framework for practical provenance verification, framing resistance, and region‑level tamper localization. Dual‑Guard combines two complementary anchors: a Gaussian Shading watermark in the initial diffusion noise as a global provenance signal, and a Latent Fingerprint Codec in the final denoised latent as a structured content anchor. Reprompting tends to preserve the former while breaking the latter, whereas localized edits disturb the content anchor only in tampered regions. In Full mode on a 2,400‑sample benchmark, Dual‑Guard keeps clean‑image authentication false rejection and tamper false alarm below one half of one percent, while maintaining near‑complete detection under reprompting, diffusion editing, and eight local tampering attacks.

Abstract:
Text‑to‑image models are commercially valuable assets often distributed under restrictive licenses, but such licenses are enforceable only when violations can be detected. Existing methods require pre‑deployment watermarking or internal model access, which are unavailable in commercial API deployments. We present Compositional Semantic Fingerprinting (CSF), the first black‑box method for attributing fine‑tuned text‑to‑image models to protected lineages using only query access. CSF treats models as semantic category generators and probes them with compositional underspecified prompts that remain rare under fine‑tuning. This gives IP owners an asymmetric advantage: new prompt compositions can be generated after deployment, while attackers must anticipate and suppress a much broader space of fingerprints. Across 6 model families (FLUX, Kandinsky, SD1.5/2.1/3.0/XL) and 13 fine‑tuned variants, our Bayesian attribution framework enables controlled‑risk lineage decisions, with all variants satisfying the dominance criterion.

Abstract:
Code Large Language Models (Code LLMs) have revolutionized software development but raised critical concerns regarding code provenance, copyright protection, and security. Existing code watermarking approaches suffer from two fundamental limitations: black‑box methods either exhibit detectable syntactic patterns vulnerable to statistical analysis or rely on implicit neural embedding behaviors that weaken interpretability, auditability, and precise control, while white‑box methods lack code‑aware capabilities that may compromise functionality. Moreover, current single‑layer watermarking schemes fail to address increasingly complex provenance requirements such as multi‑level attribution and version tracking. We present MATRIX, a novel code watermarking framework that formulates watermark encoding as solving constrained parity‑check matrix equations. MATRIX employs dual‑channel watermarking through variable naming and semantic‑preserving transformations, enhancing watermark coverage across a wider range of code while ensuring mutual backup for robustness. By integrating BCH error‑correction codes with solution space diversity, our approach achieves robustness against statistical analysis. Extensive evaluation on Python code generated by multiple Code LLMs demonstrates that MATRIX achieves an average watermark detection accuracy of 99.20% with minimal functionality loss (0‑0.14%), improves robustness by 7.70‑26.67% against various attacks, and increases watermarking applicability by 2‑6x compared with existing methods. These results establish MATRIX as an effective solution for complex code provenance scenarios while balancing among detectability, fidelity, and robustness.

Abstract:
Watermarking is becoming the default mechanism for AI content authentication, with governance policies and frameworks referencing it as infrastructure for content provenance. Yet across text, image, and audio modalities, watermark signal strength, detectability, and robustness depend on statistical properties of the content itself, properties that vary systematically across languages, cultural visual traditions, and demographic groups. We examine how this content dependence creates modality‑specific pathways to bias. Reviewing the major watermarking benchmarks across modalities, we find that, with one exception, none report performance across languages, cultural content types, or population groups. To address this, we propose three concrete evaluation dimensions for pluralistic watermark benchmarking: cross‑lingual detection parity, culturally diverse content coverage, and demographic disaggregation of detection metrics. We connect these to the governance frameworks currently mandating watermarking deployment and show that watermarking is held to a lower fairness standard than the generative systems it is meant to govern. Our position is that evaluation must precede deployment, and that the same bias auditing requirements applied to AI models should extend to the verification layer.

Abstract:
The widespread use of Large Language Models (LLMs) in text generation has raised increasing concerns about intellectual property disputes. Watermarking techniques, which embed meta information into AI‑generated content (AIGC), have the potential to serve as judicial evidence. However, existing methods rely on statistical signals in token distributions, leading to inherently probabilistic detection and reduced reliability, especially in multi‑bit encoding (e.g., timestamps). Moreover, such methods introduce detectable statistical patterns, making them vulnerable to forgery attacks and enabling model providers to fabricate arbitrary watermarks. To address these issues, we propose the concept of trustworthy watermark, which achieves reliable recovery with 100% identification accuracy while resisting both user‑side statistical attacks and provider‑side forgery. We focus on trustworthy time watermarking for use as judicial evidence. Our framework integrates cryptographic techniques and encodes time information into time‑dependent secret keys under regulatory supervision, preventing arbitrary timestamp fabrication. The watermark payload is decoupled from time and generated as a random, non‑stored bit sequence for each instance, eliminating statistical patterns. To ensure verifiability, we design a two‑stage encoding mechanism, which, combined with error‑correcting codes, enables reliable recovery of generation time with theoretically perfect accuracy. Both theoretical analysis and experiments demonstrate that our framework satisfies the reliability requirements for judicial evidence and offers a practical solution for future AIGC‑related intellectual property disputes.

Abstract:
A recent and exciting thread of work focuses on developing methods for watermarking the output of large language models (LLMs). We focus on provably undetectable watermarking‑that is, schemes that do not alter the output distribution of the LLM, yet enable embedding a watermark in the output that identifies the output as having been generated by the particular LLM. Furthermore, the watermark should be hard to remove by an adversary that may potentially edit, insert, or delete tokens from the watermarked output. Indeed, recent work (Christ et al. [COLT'24], Christ et al. [CRYPTO'24], Golowich et al. [NeuroIPS'24]) shows how to develop such schemes that are robust against a constant fraction of substitutions, or even against a constant fraction of arbitrary edits. These works, however, make strong assumptions on the entropy present in the output of the LLM. Most notably, they all require constant entropy rate‑that is, a constant fraction of the tokens in a sufficiently long substring of the output need to have empirical entropy at least O(log |T|), where T is the alphabet of tokens, and Golowich et al. additionally require T to be larger than the security parameter. In this work, we consider whether we can also watermark the outputs of LLMs when the per‑token entropy is just a constant, discarding the dependence on the alphabet size or security parameter. In this regime, we construct: ‑ A watermarking scheme robust against random substitutions (assuming subexponential LPN, as in Christ et al. [CRYPTO'24]) ‑ A watermarking scheme robust against random substitutions and random deletions, given either the additional heuristic assumption that the output of the LLM only introduces random errors (analogous to the assumption made by Christ et al. [CRYPTO'24]) or a construction of a pseudorandom error‑correcting code robust to adversarial substitutions and random deletions.

Abstract:
Invisible watermarking for autoregressive (AR) image generation has recently gained attention as a means of protecting image ownership and tracing AI‑generated content. However, existing approaches suffer from three key limitations: (1) they embed only zero‑bit watermarks for binary verification, lacking the ability to convey multi‑bit messages; (2) they rely on static codebook partitioning strategies that are vulnerable to security attacks once the partition is exposed; and (3) they are designed for specific AR architectures, failing to generalize across diverse AR paradigms. We propose \method, a training‑free, unified watermarking framework for autoregressive image generators that addresses all three limitations. \method introduces three core components: Adaptive Semantic Grouping (ASG), which dynamically partitions codebook entries based on semantic similarity and a secret key, ensuring both image quality preservation and security; Block‑wise Multi‑bit Encoding (BME), which divides the token sequence into blocks and encodes different bits across blocks with error‑correcting codes for reliable message transmission; and a Unified Token‑Replacement Interface (UTRI) that abstracts the watermark embedding process to support both next‑token prediction (e.g., LlamaGen) and next‑scale prediction (e.g., VAR) paradigms. We provide theoretical analysis on detection error rates and embedding capacity. Extensive experiments on three AR models demonstrate that \method achieves state‑of‑the‑art performance in image quality (FID), watermark detection accuracy, and multi‑bit message extraction, while maintaining robustness against cropping, JPEG compression, Gaussian noise, blur, color jitter, and random erasing attacks.

Abstract:
The proliferation of autoregressive (AR) image generators demands reliable detection and attribution of their outputs to mitigate misinformation, and to filter synthetic images from training data to prevent model collapse. To address this need, watermarking techniques, specifically designed for AR models, embed a subtle signal at generation time, enabling downstream verification through a corresponding watermark detector. In this work, we study these schemes and demonstrate their vulnerability to both watermark removal and forgery attacks. We assess existing attacks and further introduce three new attacks: (i) a vector‑quantized regeneration removal attack, (ii) adversarial optimization‑based attack, and (iii) a frequency injection attack. Our evaluation reveals that removal and forgery attacks can be effective with access to a single watermarked reference image and without access to original model parameters or watermarking secrets. Our findings indicate that existing watermarking schemes for AR image generation do not reliably support synthetic content detection for dataset filtering. Moreover, they enable Watermark Mimicry, whereby authentic images can be manipulated to imitate a generator's watermark and trigger false detection to prevent their inclusion in future model training.

Abstract:
Large language model (LLM) watermarking has emerged as a promising approach for detecting and attributing AI‑generated text, yet its robustness to black‑box spoofing remains insufficiently evaluated. Existing evaluation methods often demand extensive datasets and white‑box access to algorithmic internals, limiting their practical applicability. In this paper, we study watermark resilience against spoofing fundamentally from a distributional perspective. We first establish a local capacity bottleneck, which theoretically characterizes the probability mass that can be reallocated under KL‑bounded local updates while preserving semantic fidelity. Building on this, we propose RLSpoofer, a reinforcement learning‑based black‑box spoofing attack that requires only 100 human‑watermarked paraphrase training pairs and zero access to the watermarking internals or detectors. Despite weak supervision, it empowers a 4B model to achieve a 62.0% spoof success rate with minimal semantic shift on PF‑marked texts, dwarfing the 6% of baseline models trained on up to 10,000 samples. Our findings expose the fragile spoofing resistance of current LLM watermarking paradigms, providing a lightweight evaluation framework and stressing the urgent need for more robust schemes.

Abstract:
As generative models enable rapid creation of high‑fidelity images, societal concerns about misinformation and authenticity have intensified. A promising remedy is multi‑bit image watermarking, which embeds a multi‑bit message into an image so that a verifier can later detect whether the image is generated by someone and further identify the source by decoding the embedded message. Existing approaches often fall short in capacity, resilience to common image distortions, and theoretical justification. To address these limitations, we propose ADD (Add, Dot, Decode), a multi‑bit image watermarking method with two stages: learning a watermark to be linearly combined with the multi‑bit message and added to the image, and decoding through inner products between the watermarked image and the learned watermark. On the standard MS‑COCO benchmark, we demonstrate that for the challenging task of 48‑bit watermarking, ADD achieves 100% decoding accuracy, with performance dropping by at most 2% under a wide range of image distortions, substantially smaller than the 14% average drop of state‑of‑the‑art methods. In addition, ADD achieves substantial computational gains, with 2‑fold faster embedding and 7.4‑fold faster decoding than the fastest existing method. We further provide a theoretical analysis explaining why the learned watermark and the corresponding decoding rule are effective.

Abstract:
Embedding‑as‑a‑Service (EaaS) has become an important semantic infrastructure for natural language and multimedia applications, but it is highly vulnerable to model stealing and copyright infringement. Existing EaaS watermarking methods face a fundamental robustness‑‑utility‑‑verifiability tension: trigger‑based methods are fragile to paraphrasing, transformation‑based methods are sensitive to dimensional perturbation, and region‑based methods may incur false positives due to coincidental geometric affinity. To address this problem, we propose GeoMark, a geometry‑aware localized watermarking framework for EaaS copyright protection. GeoMark uses a natural in‑manifold embedding as a shared watermark target, constructs geometry‑separated anchors with explicit target‑‑anchor margins, and activates watermark injection only within adaptive local neighborhoods. This design decouples where watermarking is triggered from what ownership is attributed to, achieving localized triggering and centralized attribution. Experiments on four benchmark datasets show that GeoMark preserves downstream utility and geometric fidelity while maintaining robust copyright verification under paraphrasing, dimensional perturbation, and CSE (Clustering, Selection, Elimination) attacks, with improved verification stability and low false‑positive risk.

Abstract:
The proliferation of large language models for code (CodeLMs) and open‑source contributions has heightened concerns over unauthorized use of source code datasets. While watermarking provides a viable protection mechanism by embedding ownership signals, existing methods rely on detectable trigger‑target patterns and are limited to source‑code tasks, overlooking other scenarios such as decompilation tasks. In this paper, we propose DuCodeMark, a stealthy and robust dual‑purpose watermarking method for code datasets that generalizes across both source‑code tasks and decompilation tasks. DuCodeMark parses each code sample into an abstract syntax tree (AST), applies language‑specific style transformations to construct stealthy trigger‑target pairs, and injects repressible poisoned features into a subset of return‑typed samples to enhance robustness against watermark removal or evasion. These features remain inactive during normal training but are activated upon watermark removal, degrading model performance. For verification, DuCodeMark employs a black‑box method based on the independent‑samples t‑test. We conduct a comprehensive evaluation of DuCodeMark across 72 settings spanning two code tasks, two programming languages, three CodeLMs, and six decoding temperatures. The results demonstrate that it consistently achieves strong verifiability (p < 0.05), high stealthiness (suspicion rate \leq 0.36), robustness against both watermark and poisoning attacks (recall \leq 0.57), and a substantial drop in model performance upon watermark removal (Pass@1 drops by 28.6%), underscoring its practicality and resilience.

Abstract:
The AI agent ecosystem has converged on two protocols: the Model Context Protocol (MCP) for tool invocation and Agent‑to‑Agent (A2A) for single‑principal task delegation. Both assume a single controlling principal, meaning one person or organization that owns every agent. When independent principals' agents must coordinate over shared state, such as engineers' coding agents editing the same repository, family members planning a shared trip, or agents from different organizations negotiating a joint decision, neither protocol applies, and coordination collapses to ad‑hoc chat, manual merging, or silent overwrites. We present MPAC (Multi‑Principal Agent Coordination Protocol), an application‑layer protocol that fills this gap with explicit coordination semantics across five layers: Session, Intent, Operation, Conflict, and Governance. MPAC makes intent declaration a precondition for action, represents conflicts as first‑class structured objects, and supports human‑in‑the‑loop arbitration through a pluggable governance layer. The specification defines 21 message types, three state machines with normative transition tables, Lamport‑clock causal watermarking, two execution models, three security profiles, and optimistic concurrency control on shared state. We release two interoperable reference implementations in Python and TypeScript with 223 tests, a JSON Schema suite, and seven live multi‑agent demos. A controlled three‑agent code review benchmark shows a 95 percent reduction in coordination overhead and a 4.8 times wall‑clock speedup versus a serialized human‑mediated baseline, with per‑agent decision time preserved. The speedup comes from eliminating coordination waits, not compressing model calls. Specification, implementations, and demos are open source.

Abstract:
This paper considers the problem of multi‑bit generative watermarking for large language models under a worst‑case false‑alarm constraint. Prior work established a lower bound on the achievable miss‑detection probability in the finite‑token regime and proposed a scheme claimed to achieve this bound. We show, however, that the proposed scheme is in fact suboptimal. We then develop two new encoding‑decoding constructions that attain the previously established lower bound, thereby completely characterizing the optimal multi‑bit watermarking performance. Our approach formulates the watermark design problem as a linear program and derives the structural conditions under which optimality can be achieved. In addition, we identify the failure mechanism of the previous construction and compare the tradeoffs between the two proposed schemes.

Abstract:
Generated contents have raised serious concerns about copyright protection, image provenance, and credit attribution. A potential solution for these problems is watermarking. Recently, content watermarking for text‑to‑image diffusion models has been studied extensively for its effective detection utility and robustness. However, these watermarking techniques are vulnerable to potential adversarial attacks, such as removal attacks and forgery attacks. In this paper, we build a novel watermarking paradigm called Instance‑Specific watermarking with Two‑Sided detection (ISTS) to resist removal and forgery attacks. Specifically, we introduce a strategy that dynamically controls the injection time and watermarking patterns based on the semantics of users' prompts. Furthermore, we propose a new two‑sided detection approach to enhance robustness in watermark detection. Experiments have demonstrated the superiority of our watermarking against removal and forgery attacks.

Abstract:
AI agents are increasingly deployed to interact with other agents on behalf of users and organizations. We ask whether two such agents, operated by different entities, can carry out a parallel secret conversation while still producing a transcript that is computationally indistinguishable from an honest interaction, even to a strong passive auditor that knows the full model descriptions, the protocol, and the agents' private contexts. Building on recent work on watermarking and steganography for LLMs, we first show that if the parties possess an interaction‑unique secret key, they can facilitate an optimal‑rate covert conversation: the hidden conversation can exploit essentially all of the entropy present in the honest message distributions. Our main contributions concern extending this to the keyless setting, where the agents begin with no shared secret. We show that covert key exchange, and hence covert conversation, is possible even when each model has an arbitrary private context, and their messages are short and fully adaptive, assuming only that sufficiently many individual messages have at least constant min‑entropy. This stands in contrast to previous covert communication works, which relied on the min‑entropy in each individual message growing with the security parameter. To obtain this, we introduce a new cryptographic primitive, which we call pseudorandom noise‑resilient key exchange: a key‑exchange protocol whose public transcript is pseudorandom while still remaining correct under constant noise. We study this primitive, giving several constructions relevant to our application as well as strong limitations showing that more naive variants are impossible or vulnerable to efficient attacks. These results show that transcript auditing alone cannot rule out covert coordination between AI agents, and identify a new cryptographic theory that may be of independent interest.

Abstract:
Deep learning‑based image watermarking commonly adopts an "Encoder‑Noise Layer‑Decoder" (END) architecture to improve robustness against random channel distortions, yet it often overlooks intentional manipulations introduced by adversaries with additional knowledge. In this paper, we revisit this paradigm and expose a critical yet underexplored vulnerability: the Known Original Attack (KOA), where an adversary has access to multiple original‑watermarked image pairs, enabling various targeted suppression strategies. We show that even a simple residual‑based removal approach, namely estimating an embedding residual from known pairs and subtracting it from unseen watermarked images, can almost completely remove the watermark while preserving visual quality. This vulnerability stems from the insufficient image dependency of residuals produced by END frameworks, which makes them transferable across images. To address this, we propose ResGuard, a plug‑and‑play module that enhances KOA robustness by enforcing image‑dependent embedding. Its core lies in a residual specificity enhancement loss, which encourages residuals to be tightly coupled with their host images and thus improves image dependency. Furthermore, an auxiliary KOA noise layer injects residual‑style perturbations during training, allowing the decoder to remain reliable under stronger embedding inconsistencies. Integrated into existing frameworks, ResGuard boosts KOA robustness, improving average watermark extraction accuracy from 59.87% to 99.81%.

Abstract:
Diffusion‑based watermarking methods embed verifiable marks by manipulating the initial noise or the reverse diffusion trajectory. However, these methods share a critical assumption: verification can succeed only if the diffusion trajectory can be faithfully reconstructed. This reliance on trajectory recovery constitutes a fundamental and exploitable vulnerability. We propose \underline\mathbfStochastic \underline\mathbfHidden‑Trajectory De\underline\mathbfflec\underline\mathbftion (\mathbfSHIFT), a training‑free attack that exploits this common weakness across diverse watermarking paradigms. SHIFT leverages stochastic diffusion resampling to deflect the generative trajectory in latent space, making the reconstructed image statistically decoupled from the original watermark‑embedded trajectory while preserving strong visual quality and semantic consistency. Extensive experiments on nine representative watermarking methods spanning noise‑space, frequency‑domain, and optimization‑based paradigms show that SHIFT achieves 95%‑‑100% attack success rates with nearly no loss in semantic quality, without requiring any watermark‑specific knowledge or model retraining.

Abstract:
Replay attacks comprise replaying previously recorded sensor measurements and injecting malicious signals into a physical plant, causing great damage to cyber‑physical systems. Replay attack detection has been widely studied for linear systems, whereas limited research has been reported for nonlinear cases. In this paper, the replay attack is studied in the context of a nonlinear plant controlled by an observer‑based output feedback controller. We first analyze replay attack detection using an innovation‑based detector and reveal that this detector alone may fail to detect such attacks. Consequently, we turn to a watermark‑based design framework to improve the detection. In the proposed framework, the effects of the watermark on attack detection and closed‑loop system performance loss are quantified by two indices, which exploit the incremental gains of nonlinear systems. To balance the detection performance and control system performance loss, an explicit optimization problem is formulated. Moreover, to achieve a better balance, we generalize the proposed watermark design framework to co‑design the watermark, controller and observer. Numerical simulations are presented to validate the proposed frameworks.

Abstract:
The widespread deployment of high‑fidelity generative models has intensified the need for reliable mechanisms for provenance and content authentication. In‑processing watermarking, embedding a signature into the generative model's synthesis procedure, has been advocated as a solution and is often reported to be robust to standard post‑processing (such as geometric transforms and filtering). Yet robustness to semantic manipulations that alter high‑level scene content while maintaining reasonable visual quality is not well studied or understood. We introduce a simple, multi‑stage framework for systematically stress‑testing in‑processing generative watermarks under semantic drift. The framework utilizes off‑the‑shelf models for object detection, mask generation, and semantically guided inpainting or regeneration to produce controlled, meaning‑altering edits with minimal perceptual degradation. Based on extensive experiments on representative schemes, we find that robustness varies significantly with the degree of semantic entanglement: methods by which watermarks remain detectable under a broad suite of conventional perturbations can fail under semantic edits, with watermark detectability in many cases dropping to near zero while image quality remains high. Overall, our results reveal a critical gap in current watermarking evaluations and suggest that watermark designs and benchmarking must explicitly account for robustness against semantic manipulation.

Abstract:
The success of modern text‑to‑image generation is largely attributed to massive, high‑quality datasets. Currently, these datasets are curated through a filter‑first paradigm that aggressively discards low‑quality raw data based on the assumption that it is detrimental to model performance. Is the discarded bad data truly useless, or does it hold untapped potential? In this work, we critically re‑examine this question. We propose LACON (Labeling‑and‑Conditioning), a novel training framework that exploits the underlying uncurated data distribution. Instead of filtering, LACON re‑purposes quality signals, such as aesthetic scores and watermark probabilities as explicit, quantitative condition labels. The generative model is then trained to learn the full spectrum of data quality, from bad to good. By learning the explicit boundary between high‑ and low‑quality content, LACON achieves superior generation quality compared to baselines trained only on filtered data using the same compute budget, proving the significant value of uncurated data.

Abstract:
Screen‑shooting robust watermarking aims to imperceptibly embed extractable information into host images such that the watermark survives the complex distortion pipeline of screen display and camera recapture. However, achieving high extraction accuracy while maintaining satisfactory visual quality remains an open challenge, primarily because the screen‑shooting channel introduces severe and entangled degradations including Moiré patterns, color‑gamut shifts, perspective warping, and sensor noise. In this paper, we present an end‑to‑end deep learning framework that jointly optimizes watermark embedding and extraction for screen‑shooting robustness. Our framework incorporates three key innovations: (i) a comprehensive noise simulation layer that faithfully models realistic screen‑shooting distortions ‑‑ notably including a physically‑motivated Moiré pattern generator ‑‑ enabling the network to learn robust representations against the full spectrum of capture‑channel noise through adversarial training; (ii) a Just Noticeable Distortion (JND) perceptual loss function that adaptively modulates watermark embedding strength by supervising the perceptual discrepancy between the JND coefficient map and the watermark residual, thereby concentrating watermark energy in perceptually insensitive regions to maximize visual quality; and (iii) two complementary automatic localization modules ‑‑ a semantic‑segmentation‑based foreground extractor for captured image rectification and a symmetric noise template mechanism for anti‑cropping region recovery ‑‑ that enable fully automated watermark decoding under realistic deployment conditions. Extensive experiments demonstrate that our method achieves an average PSNR of 30.94~dB and SSIM of 0.94 on watermarked images while embedding 127‑bit payloads.

Abstract:
As machine learning (ML) systems expand in both scale and functionality, the security landscape has become increasingly complex, with a proliferation of attacks and defenses. However, existing studies largely treat these threats in isolation, lacking a coherent framework to expose their shared principles and interdependencies. This fragmented view hinders systematic understanding and limits the design of comprehensive defenses. Crucially, the two foundational assets of ML ‑‑ data and models ‑‑ are no longer independent; vulnerabilities in one directly compromise the other. The absence of a holistic framework leaves open questions about how these bidirectional risks propagate across the ML pipeline. To address this critical gap, we propose a \emphunified closed‑loop threat taxonomy that explicitly frames model‑data interactions along four directional axes. Our framework offers a principled lens for analyzing and defending foundation models. The resulting four classes of security threats represent distinct but interrelated categories of attacks: (1) Data\rightarrowData (D\rightarrowD): including \emphdata decryption attacks and watermark removal attacks; (2) Data\rightarrowModel (D\rightarrowM): including \emphpoisoning, harmful fine‑tuning attacks, and jailbreak attacks; (3) Model\rightarrowData (M\rightarrowD): including \emphmodel inversion, membership inference attacks, and training data extraction attacks; (4) Model\rightarrowModel (M\rightarrowM): including \emphmodel extraction attacks. Our unified framework elucidates the underlying connections among these security threats and establishes a foundation for developing scalable, transferable, and cross‑modal security strategies, particularly within the landscape of foundation models.

Abstract:
The proliferation of AIGC‑driven face manipulation and deepfakes poses severe threats to media provenance, integrity, and copyright protection. Prior versatile watermarking systems typically rely on embedding explicit localization payloads, which introduces a fidelity‑‑functionality trade‑off: larger localization signals degrade visual quality and often reduce decoding robustness under strong generative edits. Moreover, existing methods rarely support content recovery, limiting their forensic value when original evidence must be reconstructed. To address these challenges, we present VeriFi, a versatile watermarking framework that unifies copyright protection, pixel‑level manipulation localization, and high‑fidelity face content recovery. VeriFi makes three key contributions: (1) it embeds a compact semantic latent watermark that serves as an content‑preserving prior, enabling faithful restoration even after severe manipulations; (2) it achieves fine‑grained localization without embedding localization‑specific artifacts by correlating image features with decoded provenance signals; and (3) it introduces an AIGC attack simulator that combines latent‑space mixing with seamless blending to improve robustness to realistic deepfake pipelines. Extensive experiments on CelebA‑HQ and FFHQ show that VeriFi consistently outperforms strong baselines in watermark robustness, localization accuracy, and recovery quality, providing a practical and verifiable defense for deepfake forensics.

Abstract:
Deepfakes generated by modern generative models pose a serious threat to information integrity, digital identity, and public trust. Existing detection methods are largely reactive, attempting to identify manipulations after they occur and often failing to generalize across evolving generation techniques. This motivates the need for proactive mechanisms that secure media authenticity at the time of creation. In this work, we introduce SAiW, a Source‑Attributed Invisible watermarking Framework for proactive deepfake defense and media provenance verification. Unlike conventional watermarking methods that treat watermark payloads as generic signals, SAiW formulates watermark embedding as a source‑conditioned representation learning problem, where watermark identity encodes the originating source and modulates the embedding process to produce discriminative and traceable signatures. The framework integrates feature‑wise linear modulation to inject source identity into the embedding network, enabling scalable multi‑source watermark generation. A perceptual guidance module derived from human visual system priors ensures that watermark perturbations remain visually imperceptible while maintaining robustness. In addition, a dual‑purpose forensic decoder simultaneously reconstructs the embedded watermark and performs source attribution, providing both automated verification and interpretable forensic evidence. Extensive experiments across multiple deepfake datasets demonstrate that SAiW achieves high perceptual quality while maintaining strong robustness against compression, filtering, noise, geometric transformations, and adversarial perturbations. By binding digital media to its origin through invisible yet verifiable markers, SAiW enables reliable authentication and source attribution, providing a scalable foundation for proactive deepfake defense and trustworthy media provenance.

Abstract:
Large language models (LLMs) can be misused to reveal sensitive information, such as weapon‑making instructions or writing malware. LLM providers rely on \emphmonitoring to detect and flag unsafe behavior during inference. An open security challenge is \emphadaptive adversaries who craft attacks that simultaneously (i) evade detection while (ii) eliciting unsafe behavior. Adaptive attackers are a major concern as LLM providers cannot patch their security mechanisms, since they are unaware of how their models are being misused. We cast \emphrobust LLM monitoring as a security game, where adversaries who know about the monitor try to extract sensitive information, while a provider must accurately detect these adversarial queries at low false positive rates. Our work (i) shows that existing LLM monitors are vulnerable to adaptive attackers and (ii) designs improved defenses through \emphactivation watermarking by carefully introducing uncertainty for the attacker during inference. We find that \emphactivation watermarking outperforms guard baselines by up to 52% under adaptive attackers who know the monitoring algorithm but not the secret key.

Abstract:
As diffusion models (DMs) enable photorealistic image generation at unprecedented scale, watermarking techniques have become essential for provenance establishment and accountability. Existing methods face challenges: sampling‑based approaches operate on frozen models but require costly N‑step Denoising Diffusion Implicit Models (DDIM) inversion (typically N=50) for zero‑bit‑only detection; fine‑tuning‑based methods achieve fast multi‑bit extraction but couple the watermark to a specific model checkpoint, requiring retraining for each architecture. We propose DiffMark, a plug‑and‑play watermarking method that offers three key advantages over existing approaches: single‑pass multi‑bit detection, per‑image key flexibility, and cross‑model transferability. Rather than encoding the watermark into the initial noise vector, DiffMark injects a persistent learned perturbation δ at every denoising step of a completely frozen DM. The watermark signal accumulates in the final denoised latent z_0 and is recovered in a single forward pass. The central challenge of backpropagating gradients through a frozen UNet without traversing the full denoising chain is addressed by employing Latent Consistency Models (LCM) as a differentiable training bridge. This reduces the number of gradient steps from 50 DDIM to 4 LCM and enables a single‑pass detection at 16.4 ms, a 45x speedup over sampling‑based methods. Moreover, by this design, the encoder learns to map any runtime secret to a unique perturbation at inference time, providing genuine per‑image key flexibility and transferability to unseen diffusion‑based architectures without per‑model fine‑tuning. Although achieving these advantages, DiffMark also maintains competitive watermark robustness against distortion, regeneration, and adversarial attacks.

Abstract:
Model watermarking utilizes internal representations to protect the ownership of large language models (LLMs). However, these features inevitably undergo complex distortions during realistic model modifications such as fine‑tuning, quantization, or knowledge distillation, making reliable extraction extremely challenging. Despite extensive research on model‑side watermarking, existing methods still lack sufficient robustness against parameter‑level perturbations. To address this gap, we propose \textttFunctional Subspace Watermarking (FSW), a framework that anchors ownership signals into a low‑dimensional functional backbone. Specifically, we first solve a generalized eigenvalue problem to extract a stable functional subspace for watermark injection, while introducing an adaptive spectral truncation strategy to achieve an optimal balance between robustness and model utility. Furthermore, a vector consistency constraint is incorporated to ensure that watermark injection does not compromise the original semantic performance. Extensive experiments across various LLM architectures and datasets demonstrate that our method achieves superior detection accuracy and statistical verifiability under multiple model attacks, maintaining robustness that outperforms existing state‑of‑the‑art (SOTA) methods.

Abstract:
Recent advancements in diffusion‑based image editing pose a significant threat to the authenticity of digital visual content. Traditional embedding‑based watermarking methods often introduce perceptible perturbations to maintain robustness, inevitably compromising visual fidelity. Meanwhile, existing zero‑watermarking approaches, typically relying on global image features, struggle to withstand sophisticated manipulations. In this work, we uncover a key observation: while individual image patches undergo substantial alterations during AI‑based editing, the relational distance between patch pairs remains relatively invariant. Leveraging this property, we propose Relational Zero‑Watermarking (Rel‑Zero), a novel framework that requires no modification to the original image but derives a unique zero‑watermark from these editing‑invariant patch relations. By grounding the watermark in intrinsic structural consistency rather than absolute appearance, Rel‑Zero provides a non‑invasive yet resilient mechanism for content authentication. Extensive experiments demonstrate that Rel‑Zero achieves substantially improved robustness across diverse editing models and manipulations compared to prior zero‑watermarking approaches.

Abstract:
Recent advancements in AI‑generated content (AIGC) have introduced new challenges in intellectual property protection and the authentication of generated objects. We focus on scenarios in which an author seeks to assert authorship of an object generated using latent diffusion models (LDMs), in the presence of adversaries who attempt to falsely claim authorship of objects they did not create. While proof‑of‑ownership has been studied in the context of multimedia content through techniques such as time‑stamping and watermarking, these approaches face notable limitations. In contrast to traditional content creation sources (e.g., cameras), the LDM generation process offers greater control to the author. Specifically, the random seed used during generation can be deliberately chosen. By binding the seed to the author's identity using cryptographic pseudorandom functions, the author can assert to be the creator of the object. We refer to this stronger guarantee as proof‑of‑authorship, since only the creator of the object can legitimately claim the object. This contrasts with proof‑of‑ownership via time‑stamping or watermarking, where any entity could potentially claim ownership of an object by being the first to timestamp or embed the watermark. We propose a proof‑of‑authorship framework involving a probabilistic adjudicator who quantifies the probability that a claim is false. Furthermore, unlike prior approaches, the proposed framework does not involve any secret. We explore various attack scenarios and analyze design choices using Stable Diffusion 2.1 (SD2.1) as representative case studies.

Abstract:
Modern audio is created by mixing stems from different sources, raising the question: can we independently watermark each stem and recover all watermarks after separation? We study a separation‑first, multi‑stream watermarking framework‑embedding distinct information into stems using unique keys but a shared structure, mixing, separating, and decoding from each output. A naive pipeline (robust watermarking + off‑the‑shelf separation) yields poor bit recovery, showing robustness to generic distortions does not ensure robustness to separation artifacts. To enable this, we jointly train the watermark system and the separator in an end‑to‑end manner, encouraging the separator to preserve watermark cues while adapting embedding to separation‑specific distortions. Experiments on speech+music and vocal+accompaniment mixtures show substantial gains in post‑separation recovery while maintaining perceptual quality.

Abstract:
The nature of personalized text‑to‑image models poses a unique safety challenge that generic context‑blind methods are ill‑equipped to handle. Such global filters create a dilemma: to prevent misuse, they are forced to damage the model's broader utility by erasing concepts entirely, causing unacceptable collateral damage.Our work presents a more precisely targeted approach, built on the principle that security should be as context‑aware as the threat itself, intrinsically bound to the personalized concept. We present IDENTITYGUARD, which realizes this principle through a conditional restriction that blocks harmful content only when combined with the personalized identity, and a concept‑specific watermark for precise traceability. Experiments show our approach prevents misuse while preserving the model's utility and enabling robust traceability. By moving beyond blunt, global filters, our work demonstrates a more effective and responsible path toward AI safety.

Abstract:
While watermarking serves as a critical mechanism for LLM provenance, existing secret‑key schemes tightly couple detection with injection, requiring access to keys or provider‑side scheme‑specific detectors for verification. This dependency creates a fundamental barrier for real‑world governance, as independent auditing becomes impossible without compromising model security or relying on the opaque claims of service providers. To resolve this dilemma, we introduce TTP‑Detect, a pioneering black‑box framework designed for non‑intrusive, third‑party watermark verification. By decoupling detection from injection, TTP‑Detect reframes verification as a relative hypothesis testing problem. It employs a proxy model to amplify watermark‑relevant signals and a suite of complementary relative measurements to assess the alignment of the query text with watermarked distributions. Extensive experiments across representative watermarking schemes, datasets and models demonstrate that TTP‑Detect achieves superior detection performance and robustness against diverse attacks.

Abstract:
Watermarking has emerged as an effective solution for copyright protection of synthetic data. However, applying watermarking techniques to synthetic tabular data presents challenges, as tabular data can easily lose their watermarks through shuffling or deletion operations. The major challenge is to provide traceability for tracking multiple users of the watermarked tabular data while maintaining high data utility and robustness (resistance to attacks). To address this, we design a multi‑bit watermarking scheme TableMark that encodes watermarks into synthetic tabular data, ensuring superior traceability and robustness while maintaining high utility. We formulate the watermark encoding process as a constrained optimization problem, allowing the data owner to effectively trade off robustness and utility. Additionally, we propose effective optimization mechanisms to solve this problem to enhance the data utility. Experimental results on four widely used real‑world datasets show that TableMark effectively traces a large number of users, is resilient to attacks, and preserves high utility. Moreover, TableMark significantly outperforms state‑of‑the‑art tabular watermarking schemes.

Abstract:
We propose SERUM: an intriguingly simple yet highly effective method for marking images generated by diffusion models (DMs). We only add a unique watermark noise to the initial diffusion generation noise and train a lightweight detector to identify watermarked images, simplifying and unifying the strengths of prior approaches. SERUM provides robustness against any image augmentations or watermark removal attacks and is extremely efficient, all while maintaining negligible impact on image quality. In contrast to prior approaches, which are often only resilient to limited perturbations and incur significant training, injection, and detection costs, our SERUM achieves remarkable performance, with the highest true positive rate (TPR) at a 1% false positive rate (FPR) in most scenarios, along with fast injection and detection and low detector training overhead. Its decoupled architecture also seamlessly supports multiple users by embedding individualized watermarks with little interference between the marks. Overall, our method provides a practical solution to mark outputs from DMs and to reliably distinguish generated from natural images.

Abstract:
Robust invisible watermarks are widely used to support copyright protection, content provenance, and accountability by embedding hidden signals designed to survive common post‑processing operations. However, diffusion‑based image editing introduces a fundamentally different class of transformations: it injects noise and reconstructs images through a powerful generative prior, often altering semantic content while preserving photorealism. In this paper, we provide a unified theoretical and empirical analysis showing that non‑adversarial diffusion editing can unintentionally degrade or remove robust watermarks. We model diffusion editing as a stochastic transformation that progressively contracts off‑manifold perturbations, causing the low‑amplitude signals used by many watermarking schemes to decay. Our analysis derives bounds on watermark signal‑to‑noise ratio and mutual information along diffusion trajectories, yielding conditions under which reliable recovery becomes information‑theoretically impossible. We further evaluate representative watermarking systems under a range of diffusion‑based editing scenarios and strengths. The results indicate that even routine semantic edits can significantly reduce watermark recoverability. Finally, we discuss the implications for content provenance and outline principles for designing watermarking approaches that remain robust under generative image editing.

Abstract:
We propose TRACE, a structure‑aware framework leveraging diffusion models for localized character encoding to embed data. Unlike existing methods that rely on edge features or pre‑defined codebooks, TRACE exploits character structures that provide inherent resistance to noise interference due to their stability and unified representation across diverse characters. Our framework comprises three key components: (1) adaptive diffusion initialization that automatically identifies handle points, target points, and editing regions through specialized algorithms including movement probability estimator (MPE), target point estimation (TPE) and mask drawing model (MDM), (2) guided diffusion encoding for precise movement of selected point, and (3) masked region replacement with a specialized loss function to minimize feature alterations after the diffusion process. Comprehensive experiments demonstrate \name's superior performance over state‑of‑the‑art methods, achieving more than 5 dB improvement in PSNR and 5% higher extraction accuracy following cross‑media transmission. \name achieves broad generalizability across multiple languages and fonts, making it particularly suitable for practical document security applications.

Abstract:
Watermarking the initial noise of diffusion models has emerged as a promising approach for image provenance, but content‑independent noise patterns can be forged via inversion and regeneration attacks. Recent semantic‑aware watermarking methods improve robustness by conditioning verification on image semantics. However, their reliance on a single global semantic binding makes them vulnerable to localized but globally coherent semantic edits. To address this limitation and provide a trustworthy semantic‑aware watermark, we propose \underlineSemantic \underlineLatent \underlineInjection via \underlineCompartmentalized \underlineEmbedding (SLICE). Our framework decouples image semantics into four semantic factors (subject, environment, action, and detail) and precisely anchors them to distinct regions in the initial Gaussian noise. This fine‑grained semantic binding enables advanced watermark verification where semantic tampering is detectable and localizable. We theoretically justify why SLICE enables robust and reliable tamper localization and provides statistical guarantees on false‑accept rates. Experimental results demonstrate that SLICE significantly outperforms existing baselines against advanced semantic‑guided regeneration attacks, substantially reducing attack success while preserving image quality and semantic fidelity. Overall, SLICE offers a practical, training‑free provenance solution that is both fine‑grained in diagnosis and robust to realistic adversarial manipulations.

Abstract:
Neural Structural Obfuscation (NSO) (USENIX Security'23) is a family of ``zero cost'' structure‑editing transforms (\textttnso\_zero, \textttnso\_clique, \textttnso\_split) that inject dummy neurons. By combining neuron permutation and parameter scaling, NSO makes a radical modification to the network structure and parameters while strictly preserving functional equivalence, thereby disrupting white‑box watermark verification. This capability has been a fundamental challenge to the reliability of existing white‑box watermarking schemes. We rethink NSO and, for the first time, fully recover from the damage it has caused. We redefine NSO as a graph‑consistent threat model within a producer‑‑consumer paradigm. This formulation posits that any obfuscation of a producer node necessitates a compatible layout update in all downstream consumers to maintain structural integrity. Building on these consistency constraints on signal propagation, we present \textscCanon, a recovery framework that probes the attacked model to identify redundancy/dummy channels and then globally canonicalizes the network by rewriting all downstream consumers by construction, synchronizing layouts across \textttfan‑out, \textttadd, and \textttcat. Extensive experiments demonstrate that, even under strong composed and extended NSO attacks, \textscCanon achieves 100% recovery success, restoring watermark verifiability while preserving task utility. Our code is available at https://anonymous.4open.science/r/anti‑NSO‑9874.

Abstract:
Federated Language Model (FedLM) allows a collaborative learning without sharing raw data, yet it introduces a critical vulnerability, as every untrustworthy client may leak the received functional model instance. Current watermarking schemes for FedLM often require white‑box access and client‑side cooperation, providing only group‑level proof of ownership rather than individual traceability. We propose EmbTracker, a server‑side, traceable black‑box watermarking framework specifically designed for FedLMs. EmbTracker achieves black‑box verifiability by embedding a backdoor‑based watermark detectable through simple API queries. Client‑level traceability is realized by injecting unique identity‑specific watermarks into the model distributed to each client. In this way, a leaked model can be attributed to a specific culprit, ensuring robustness even against non‑cooperative participants. Extensive experiments on various language and vision‑language models demonstrate that EmbTracker achieves robust traceability with verification rates near 100%, high resilience against removal attacks (fine‑tuning, pruning, quantization), and negligible impact on primary task performance (typically within 1‑2%).

Abstract:
As scaling laws push the training of frontier large language models (LLMs) toward ever‑growing data requirements, training pipelines are approaching a regime where much of the publicly available online text may be consumed. At the same time, widespread LLM usage increases the volume of machine‑generated content on the web; together, these trends raise the likelihood of generated text re‑entering future training corpora, increasing the associated risk of performance degradation often called model collapse. In practice, model developers address this concern through data cleaning, watermarking, synthetic‑data policies, or, in some cases, blissful ignorance. However, the problem of model collapse in generative models has not been examined from a learning‑theoretic perspective: we study it through the theoretical lens of the language generation in the limit framework, introducing a replay adversary that augments the example stream with the generator's own past outputs. Our main contribution is a fine‑grained learning‑theoretic characterization of when replay fundamentally limits generation: while replay is benign for the strongest notion of uniform generation, it provably creates separations for the weaker notions of non‑uniform generation and generation in the limit. Interestingly, our positive results mirror heuristics widely used in practice, such as data cleaning, watermarking, and output filtering, while our separations show when these ideas can fail.

Abstract:
Being trained on large and diverse datasets, visual foundation models (VFMs) can be fine‑tuned to achieve remarkable performance and efficiency in various downstream computer vision tasks. The high computational cost of data collection and training makes these models valuable assets, which motivates some VFM owners to distribute them alongside a license to protect their intellectual property rights. In this paper, we propose an approach to ownership verification of visual foundation models that leverages a small encoder‑decoder network to embed digital watermarks into an internal representation of a hold‑out set of input images. The method is based on random watermark embedding, which makes the watermark statistics detectable in functional copies of the watermarked model. Both theoretically and experimentally, we demonstrate that the proposed method yields a low probability of false detection for non‑watermarked models and a low probability of false misdetection for watermarked models.

Abstract:
As open‑weights generative AI rapidly proliferates, the ability to synthesize hyper‑realistic media has introduced profound challenges to digital trust. Automated disinformation and AI‑generated imagery have made robust digital provenance a critical cybersecurity imperative. Currently, state‑of‑the‑art invisible watermarks operate within one of two primary mathematical manifolds: the spatial domain (post‑generation pixel embedding) or the latent domain (pre‑generation frequency embedding). While existing literature frequently evaluates these models against isolated, classical distortions, there is a critical lack of rigorous, comparative benchmarking against modern generative AI editing tools. In this study, we empirically evaluate two leading representative paradigms, RivaGAN (Spatial) and Tree‑Ring (Latent), utilizing an automated Attack Simulation Engine across 30 intensity intervals of geometric and generative perturbations. We formalize an "Adversarial Evasion Region" (AER) framework to measure cryptographic degradation against semantic visual retention (OpenCLIP > 75.0). Our statistical analysis (n=100 per interval, MOE = \pm 3.92%) reveals that these domains possess mutually exclusive, mathematically orthogonal vulnerabilities. Spatial watermarks experience severe cryptographic degradation under algorithmic pixel‑rewriting (exhibiting a 67.47% AER evasion rate under Img2Img translation), whereas latent watermarks exhibit profound fragility against geometric misalignment (yielding a 43.20% AER evasion rate under static cropping). By proving that single‑domain watermarking is fundamentally insufficient against modern adversarial toolsets, this research exposes a systemic vulnerability in current digital provenance standards and establishes the foundational exigence for future multi‑domain cryptographic architectures.

Abstract:
Diffusion models have made substantial advances in recent years, enabling high‑quality image synthesis; however, the widespread dissemination and reuse of their outputs have introduced new challenges in intellectual property protection and content provenance. Image watermarking offers a solution to these challenges, and recent work has increasingly explored Noise‑as‑Watermark (NaW) approaches that integrate watermarking directly into the diffusion process. However, existing NaW methods fail to balance robustness and diversity. We attribute this weakness to value encoding, which encodes watermark bits into individual sampled values. It is extremely fragile in practical application scenarios. To address this, we encode watermark bits into the structured noise pattern, so that the watermark is preserved even when individual values are perturbed. To further ensure generation diversity, we introduce a dedicated randomization design that reshuffles the positions of noise elements without changing their values, preventing the watermark from inducing fixed noise patterns or spatial locations. Extensive experiments demonstrate that our method achieves state‑of‑the‑art robustness while maintaining high generation quality across a wide range of lossy scenarios.

Abstract:
As 3D Gaussian Splatting becomes the de facto representation for interactive 3D assets, robust yet imperceptible watermarking is critical. We present a representation‑native framework that separates where to write from how to preserve quality. A Trio‑Experts module operates directly on Gaussian primitives to derive priors for carrier selection, while a Safety and Budget Aware Gate (SBAG) allocates Gaussians to watermark carriers, optimized for bit resilience under perturbation and bitrate budgets, and to visual compensators that are insulated from watermark loss. To maintain fidelity, we introduce a channel‑wise group mask that controls gradient propagation for carriers and compensators, thereby limiting Gaussian parameter updates, repairing local artifacts, and preserving high‑frequency details without increasing runtime. Our design yields view‑consistent watermark persistence and strong robustness against common image distortions such as compression and noise, while achieving a favorable robustness‑quality trade‑off compared with prior methods. In addition, decoupled finetuning provides per‑Gaussian attributions that reveal where the message is carried and why those carriers are selected, enabling auditable explainability. Compared with state‑of‑the‑art methods, our approach achieves a PSNR improvement of +0.83 dB and a bit‑accuracy gain of +1.24%.

Abstract:
Model training is increasingly offered as a service for resource‑constrained data owners to build customized models. Split Learning (SL) enables such services by offloading training computation under privacy constraints, and evolves toward serverless and multi‑client settings where model segments are distributed across training clients. This cooperative mode assumes partial trust: data owners hide labels and data from trainer clients, while trainer clients produce verifiable training artifacts and ownership proofs. We present CliCooper, a multi‑client cooperative SL framework tailored for cooperative model training services in heterogeneous and partially trusted environments, where one client contributes data, while others collectively act as SL trainers. CliCooper bridges the privacy and trust gaps through two new designs. First, differential privacy‑based activation protection and secret label obfuscation safeguard data owners' privacy without degrading model performance. Second, a dynamic chained watermarking scheme cryptographically links training stages on model segments across trainers, ensuring verifiable training integrity, robust model provenance, and copyright protection. Experiments show that CliCooper preserves model accuracy while enhancing resilience to privacy and ownership attacks. It reduces the success rate of clustering attacks (which infer label groups from intermediate activation) to 0%, decreases inversion‑reconstruction (which recovers training data) similarity from 0.50 to 0.03, and limits model‑extraction‑based surrogates to about 1% accuracy, comparable to random guessing.

Abstract:
Image generation has advanced rapidly over the past decade, yet the literature seems fragmented across different models and application domains. This paper aims to offer a comprehensive survey of breakthrough image generation models, including variational autoencoders (VAEs), generative adversarial networks (GANs), normalizing flows, autoregressive and transformer‑based generators, and diffusion‑based methods. We provide a detailed technical walkthrough of each model type, including their underlying objectives, architectural building blocks, and algorithmic training steps. For each model type, we present the optimization techniques as well as common failure modes and limitations. We also go over recent developments in video generation and present the research works that made it possible to go from still frames to high quality videos. Lastly, we cover the growing importance of robustness and responsible deployment of these models, including deepfake risks, detection, artifacts, and watermarking.

Abstract:
As Joint Audio‑Visual Generation Models see widespread commercial deployment, embedding watermarks has become essential for protecting vendor copyright and ensuring content provenance. However, existing techniques suffer from an architectural mismatch by treating modalities as decoupled entities, exposing a critical Binding Vulnerability. Adversaries exploit this via Swap Attacks by replacing authentic audio with malicious deepfakes while retaining the watermarked video. Because current detectors rely on independent verification (Video_wm\vee Audio_wm), they incorrectly authenticate the manipulated content, falsely attributing harmful media to the original vendor and severely damaging their reputation. To address this, we propose mAVE (Manifold Audio‑Visual Entanglement), the first watermarking framework natively designed for joint architectures. mAVE cryptographically binds audio and video latents at initialization without fine‑tuning, defining a Legitimate Entanglement Manifold via Inverse Transform Sampling. Experiments on state‑of‑the‑art models (LTX‑2, MOVA) demonstrate that mAVE guarantees performance‑losslessness and provides an exponential security bound against Swap Attacks. Achieving near‑perfect binding integrity (>99%), mAVE offers a robust cryptographic defense for vendor copyright.

Abstract:
Invisible watermarks, as an essential technology for image copyright protection, have been widely deployed with the rapid development of social media and AIGC. However, existing invisible watermark detection heavily relies on prior knowledge of specific algorithms, leading to limited detection capabilities for ``unknown watermarks'' in open environments. To this end, we propose a novel task named Agnostic Watermark Presence Detection (AWPD), which aims to identify whether an image carries a copyright mark without requiring decoding information. We construct the UniFreq‑100K dataset, comprising large‑scale samples across various invisible watermark embedding algorithms. Furthermore, we propose the Frequency Shield Network (FSNet). This model deploys an Adaptive Spectral Perception Module (ASPM) in the shallow layers, utilizing learnable frequency gating to dynamically amplify high‑frequency watermark signals while suppressing low‑frequency semantics. In the deep layers, the network introduces Dynamic Multi‑Spectral Attention (DMSA) combined with tri‑stream extremum pooling to deeply mine watermark energy anomalies, forcing the model to precisely focus on sensitive frequency bands. Extensive experiments demonstrate that FSNet exhibits superior zero‑shot detection capabilities on the AWPD task, outperforming existing baseline models. Code and datasets will be released upon acceptance.

Abstract:
While existing audio watermarking techniques have achieved strong robustness against traditional digital signal processing (DSP) attacks, they remain vulnerable to neural resynthesis. This occurs because modern neural audio codecs act as semantic filters and discard the imperceptible waveform variations used in prior watermarking methods. To address this limitation, we propose Latent‑Mark, the first zero‑bit audio watermarking framework designed to survive semantic compression. Our key insight is that robustness to the encode‑decode process requires embedding the watermark within the codec's invariant latent space. We achieve this by optimizing the audio waveform to induce a detectable directional shift in its encoded latent representation, while constraining perturbations to align with the natural audio manifold to ensure imperceptibility. To prevent overfitting to a single codec's quantization rules, we introduce Cross‑Codec Optimization, jointly optimizing the waveform across multiple surrogate codecs to target shared latent invariants. Extensive evaluations demonstrate robust zero‑shot transferability to unseen neural codecs, achieving state‑of‑the‑art resilience against traditional DSP attacks while preserving perceptual imperceptibility. Our work inspires future research into universal watermarking frameworks capable of maintaining integrity across increasingly complex and diverse generative distortions.

Abstract:
Robust invisible watermarking systems aim to embed imperceptible payloads that remain decodable after common post‑processing such as JPEG compression, cropping, and additive noise. In parallel, diffusion‑based image editing has rapidly matured into a default transformation layer for modern content pipelines, enabling instruction‑based editing, object insertion and composition, and interactive geometric manipulation. This paper studies a subtle but increasingly consequential interaction between these trends: diffusion‑based editing procedures may unintentionally compromise, and in extreme cases practically bypass, robust watermarking mechanisms that were explicitly engineered to survive conventional distortions. We develop a unified view of diffusion editors that (i) inject substantial Gaussian noise in a latent space and (ii) project back to the natural image manifold via learned denoising dynamics. Under this view, watermark payloads behave as low‑energy, high‑frequency signals that are systematically attenuated by the forward diffusion step and then treated as nuisance variation by the reverse generative process. We formalize this degradation using information‑theoretic tools, proving that for broad classes of pixel‑level watermark encoders/decoders the mutual information between the watermark payload and the edited output decays toward zero as the editing strength increases, yielding decoding error close to random guessing. We complement the theory with a realistic hypothetical experimental protocol and tables spanning representative watermarking methods and representative diffusion editors. Finally, we discuss ethical implications, responsible disclosure norms, and concrete design guidelines for watermarking schemes that remain meaningful in the era of generative transformations.

Abstract:
Google's SynthID‑Text, the first ever production‑ready generative watermark system for large language model, designs a novel Tournament‑based method that achieves the state‑of‑the‑art detectability for identifying AI‑generated texts. The system's innovation lies in: 1) a new Tournament sampling algorithm for watermarking embedding, 2) a detection strategy based on the introduced score function (e.g., Bayesian or mean score), and 3) a unified design that supports both distortionary and non‑distortionary watermarking methods. This paper presents the first theoretical analysis of SynthID‑Text, with a focus on its detection performance and watermark robustness, complemented by empirical validation. For example, we prove that the mean score is inherently vulnerable to increased tournament layers, and design a layer inflation attack to break SynthID‑Text. We also prove the Bayesian score offers improved watermark robustness w.r.t. layers and further establish that the optimal Bernoulli distribution for watermark detection is achieved when the parameter is set to 0.5. Together, these theoretical and empirical insights not only deepen our understanding of SynthID‑Text, but also open new avenues for analyzing effective watermark removal strategies and designing robust watermarking techniques. Source code is available at https: //github.com/romidi80/Synth‑ID‑Empirical‑Analysis.

Abstract:
Cryptographic provenance standards such as C2PA and invisible watermarking are positioned as complementary defenses for content authentication, yet the two verification layers are technically independent: neither conditions on the output of the other. This work formalizes and empirically demonstrates the Integrity Clash, a condition in which a digital asset carries a cryptographically valid C2PA manifest asserting human authorship while its pixels simultaneously carry a watermark identifying it as AI‑generated, with both signals passing their respective verification checks in isolation. We construct metadata washing workflows that produce these authenticated fakes through standard editing pipelines, requiring no cryptographic compromise, only the semantic omission of a single assertion field permitted by the current C2PA specification. To close this gap, we propose a cross‑layer audit protocol that jointly evaluates provenance metadata and watermark detection status, achieving 100% classification accuracy across 3,500 test images spanning four conflict‑matrix states and three realistic perturbation conditions. Our results demonstrate that the gap between these verification layers is unnecessary and technically straightforward to close.

Abstract:
Watermarking has emerged as a key defense against the misuse of machine‑generated images (MGIs). Yet the robustness of these protections remains underexplored. To reveal the limits of SOTA proactive image watermarking defenses, we propose HIDE&SEEK (HS), a suite of versatile and cost‑effective attacks that reliably remove embedded watermarks while preserving high visual fidelity.

Abstract:
The rise of text‑to‑video generation models has raised growing concerns over content authenticity, copyright protection, and malicious misuse. Watermarking serves as an effective mechanism for regulating such AI‑generated content, where high fidelity and strong robustness are particularly critical. Recent generative image watermarking methods provide a promising foundation by leveraging watermark information and pseudo‑random keys to control the initial sampling noise, enabling lossless embedding. However, directly extending these techniques to videos introduces two key limitations: Existing designs implicitly rely on strict alignment between video frames and frame‑dependent pseudo‑random binary sequences used for watermark encryption. Once this alignment is disrupted, subsequent watermark extraction becomes unreliable; and Video‑specific distortions, such as inter‑frame compression, significantly degrade watermark reliability. To address these issues, we propose SKeDA, a generative watermarking framework tailored for text‑to‑video diffusion models. SKeDA consists of two components: (1) Shuffle‑Key‑based Distribution‑preserving Sampling (SKe) employs a single base pseudo‑random binary sequence for watermark encryption and derives frame‑level encryption sequences through permutation. This design transforms watermark extraction from synchronization‑sensitive sequence decoding into permutation‑tolerant set‑level aggregation, substantially improving robustness against frame reordering and loss; and (2) Differential Attention (DA), which computes inter‑frame differences and dynamically adjusts attention weights during extraction, enhancing robustness against temporal distortions. Extensive experiments demonstrate that SKeDA preserves high video generation quality and watermark robustness.

Abstract:
Knowledge distillation transfers large teacher models to compact student models, enabling deployment on resource‑limited platforms while suffering minimal performance degradation. However, this paradigm could lead to various security risks, especially model theft. Existing defenses against model theft, such as watermarking and secure enclaves, focus primarily on identity authentication and incur significant resource costs. Aiming to provide post‑theft accountability and traceability, we propose a novel fingerprinting framework that superimposes device‑specific Physical Unclonable Function (PUF) signatures onto teacher logits during distillation. Compared with watermarking or secure enclaves, our approach is lightweight, requires no architectural changes, and enables traceability of any leaked or cloned model. Since the signatures are based on PUFs, this framework is robust against reverse engineering and tampering attacks. In this framework, the signature recovery process consists of two stages: first a neural network‑based decoder and then a Hamming distance decoder. Furthermore, we also propose a bit compression scheme to support a large number of devices. Experiment results demonstrate that our framework achieves high key recovery rate and negligible accuracy loss while allowing a tunable trade‑off between these two key metrics. These results show that the proposed framework is a practical and robust solution for protecting distilled models.

Abstract:
Quantum cloud platforms have become the most widely adopted and mainstream approach for accessing quantum computing resources, due to the scarcity and operational complexity of quantum hardware. In this service‑oriented paradigm, quantum circuits, which constitute high‑value intellectual property, are exposed to risks of unauthorized access, reuse, and misuse. Digital watermarking has been explored as a promising mechanism for protecting quantum circuits by embedding ownership information for tracing and verification. However, driven by recent advances in generative artificial intelligence, the paradigm of quantum circuit design is shifting from individually and manually constructed circuits to automated synthesis based on quantum circuit generative models (QCGMs). In such generative settings, protecting only individual output circuits is insufficient, and existing post hoc, circuit‑centric watermarking methods are not designed to integrate with the generative process, often failing to simultaneously ensure stealthiness, functional correctness, and robustness at scale. These limitations highlight the need for a new watermarking paradigm that is natively integrated with quantum circuit generative models. In this work, we present the first watermarking framework for QCGMs, which embeds ownership signals into the generation process while preserving circuit fidelity. We introduce a symmetric sampling strategy that aligns watermark encoding with the model's Gaussian prior, and a synchronization mechanism that counteracts adversarial watermark attack through latent drift correction. Empirical results confirm that our method achieves high‑fidelity circuit generation and robust watermark detection across a range of perturbations, paving the way for scalable, secure copyright protection in AI‑powered quantum design.

Abstract:
Recent advances in image authenticity have primarily focused on deepfake detection and localization, leaving recovery of tampered contents for factual retrieval relatively underexplored. We propose a unified hidden‑code recovery framework that enables both retrieval and restoration from post‑hoc and in‑generation watermarking paradigms. Our method encodes semantic and perceptual information into a compact hidden‑code representation, refined through multi‑scale vector quantization, and enhances contextual reasoning via conditional Transformer modules. To enable systematic evaluation for natural images, we construct ImageNet‑S, a benchmark that provides paired image‑label factual retrieval tasks. Extensive experiments on ImageNet‑S demonstrate that our method exhibits promising retrieval and reconstruction performance while remaining fully compatible with diverse watermarking pipelines. This framework establishes a foundation for general‑purpose image recovery beyond detection and localization.

Abstract:
Deep learning‑based watermarking has made remarkable progress in recent years. To achieve robustness against various distortions, current methods commonly adopt a training strategy where a \underlinesingle \underlinerandom \underlinedistortion (SRD) is chosen as the noise layer in each training batch. However, the SRD strategy treats distortions independently within each batch, neglecting the inherent relationships among different types of distortions and causing optimization conflicts across batches. As a result, the robustness and generalizability of the watermarking model are limited. To address this issue, we propose a novel training strategy that enhances robustness and generalization via \underlinemeta‑learning with \underlinefeature \underlineconsistency (Meta‑FC). Specifically, we randomly sample multiple distortions from the noise pool to construct a meta‑training task, while holding out one distortion as a simulated ``unknown'' distortion for the meta‑testing phase. Through meta‑learning, the model is encouraged to identify and utilize neurons that exhibit stable activations across different types of distortions, mitigating the optimization conflicts caused by the random sampling of diverse distortions in each batch. To further promote the transformation of stable activations into distortion‑invariant representations, we introduce a feature consistency loss that constrains the decoded features of the same image subjected to different distortions to remain consistent. Extensive experiments demonstrate that, compared to the SRD training strategy, Meta‑FC improves the robustness and generalization of various watermarking models by an average of 1.59%, 4.71%, and 2.38% under high‑intensity, combined, and unknown distortions.

Abstract:
Generative images have proliferated on Web platforms in social media and online copyright distribution scenarios, and semantic watermarking has increasingly been integrated into diffusion models to support reliable provenance tracking and forgery prevention for web content. Traditional noise‑layer‑based watermarking, however, remains vulnerable to inversion attacks that can recover embedded signals. To mitigate this, recent content‑aware semantic watermarking schemes bind watermark signals to high‑level image semantics, constraining local edits that would otherwise disrupt global coherence. Yet, large language models (LLMs) possess structured reasoning capabilities that enable targeted exploration of semantic spaces, allowing locally fine‑grained but globally coherent semantic alterations that invalidate such bindings. To expose this overlooked vulnerability, we introduce a Coherence‑Preserving Semantic Injection (CSI) attack that leverages LLM‑guided semantic manipulation under embedding‑space similarity constraints. This alignment enforces visual‑semantic consistency while selectively perturbing watermark‑relevant semantics, ultimately inducing detector misclassification. Extensive empirical results show that CSI consistently outperforms prevailing attack baselines against content‑aware semantic watermarking, revealing a fundamental security weakness of current semantic watermark designs when confronted with LLM‑driven semantic perturbations.

Abstract:
Robust watermarking is critical for intellectual property protection, whereas existing methods face a severe vulnerability against regeneration‑based AIGC attacks. We identify that existing methods fail because they entangle the watermark with high‑frequency cover texture, which is susceptible to being rewritten during generative purification. To address this, we propose WaterVIB, a theoretically grounded framework that reformulates the encoder as an information sieve via the Variational Information Bottleneck. Instead of overfitting to fragile cover details, our approach forces the model to learn a Minimal Sufficient Statistic of the message. This effectively filters out redundant cover nuances prone to generative shifts, retaining only the essential signal invariant to regeneration. We theoretically prove that optimizing this bottleneck is a necessary condition for robustness against distribution‑shifting attacks. Extensive experiments demonstrate that WaterVIB significantly outperforms state‑of‑the‑art methods, achieving superior zero‑shot resilience against unknown diffusion‑based editing.

Abstract:
Robust invisible watermarking schemes aim to embed hidden information into images such that the watermark survives common manipulations. However, powerful diffusion‑based image generation and editing techniques now pose a new threat to these watermarks. In this paper, we present a comprehensive theoretical and empirical analysis demonstrating that diffusion models can effectively erase robust watermarks even when those watermarks were designed to withstand conventional distortions. We show that a diffusion‑driven image regeneration process, which leverages generative models to recreate an image, can remove embedded watermarks while preserving the image's perceptual content. Furthermore, we introduce a guided diffusion‑based attack that explicitly targets the embedded watermark signal during generation, significantly degrading watermark detectability. Theoretically, we prove that as an image undergoes sufficient diffusion transformations, the mutual information between the watermarked image and the hidden payload approaches zero, leading to inevitable decoding failure. Experimentally, we evaluate multiple state‑of‑the‑art watermarking methods (including deep learning‑based schemes like StegaStamp, TrustMark, and VINE) and demonstrate that diffusion edits yield near‑zero watermark recovery rates after attack, while maintaining high visual fidelity of the regenerated images. Our findings reveal a fundamental vulnerability in current robust watermarking techniques against generative model‑based edits, underscoring the need for new strategies to ensure watermark resilience in the era of powerful diffusion models.

Abstract:
The proliferation of AI‑generated content has facilitated sophisticated face manipulation, severely undermining visual integrity and posing unprecedented challenges to intellectual property. In response, a common proactive defense leverages fragile watermarks to detect, localize, or even recover manipulated regions. However, these methods always assume an adversary unaware of the embedded watermark, overlooking their inherent vulnerability to watermark removal attacks. Furthermore, this fragility is exacerbated in the commonly used dual‑watermark strategy that adds a robust watermark for image ownership verification, where mutual interference and limited embedding capacity reduce the fragile watermark's effectiveness. To address the gap, we propose RecoverMark, a watermarking framework that achieves robust manipulation localization, content recovery, and ownership verification simultaneously. Our key insight is twofold. First, we exploit a critical real‑world constraint: an adversary must preserve the background's semantic consistency to avoid visual detection, even if they apply global, imperceptible watermark removal attacks. Second, using the image's own content (face, in this paper) as the watermark enhances extraction robustness. Based on these insights, RecoverMark treats the protected face content itself as the watermark and embeds it into the surrounding background. By designing a robust two‑stage training paradigm with carefully crafted distortion layers that simulate comprehensive potential attacks and a progressive training strategy, RecoverMark achieves a robust watermark embedding in no fragile manner for image manipulation localization, recovery, and image IP protection simultaneously. Extensive experiments demonstrate the proposed RecoverMark's robustness against both seen and unseen attacks and its generalizability to in‑distribution and out‑of‑distribution data.

Abstract:
Deep learning‑based image watermarking, while robust against conventional distortions, remains vulnerable to advanced adversarial and regeneration attacks. Conventional countermeasures, which jointly optimize the encoder and decoder via a noise layer, face 2 inevitable challenges: (1) decrease of clean accuracy due to decoder adversarial training and (2) limited robustness due to simultaneous training of all three advanced attacks. To overcome these issues, we propose AdvMark, a novel two‑stage fine‑tuning framework that decouples the defense strategies. In stage 1, we address adversarial vulnerability via a tailored adversarial training paradigm that primarily fine‑tunes the encoder while only conditionally updating the decoder. This approach learns to move the image into a non‑attackable region, rather than modifying the decision boundary, thus preserving clean accuracy. In stage 2, we tackle distortion and regeneration attacks via direct image optimization. To preserve the adversarial robustness gained in stage 1, we formulate a principled, constrained image loss with theoretical guarantees, which balances the deviation from cover and previous encoded images. We also propose a quality‑aware early‑stop to further guarantee the lower bound of visual quality. Extensive experiments demonstrate AdvMark outperforms with the highest image quality and comprehensive robustness, i.e. up to 29%, 33% and 46% accuracy improvement for distortion, regeneration and adversarial attacks, respectively.

Abstract:
Robust reversible watermarking (RRW) enables copyright protection for images while overcoming the limitation of distortion introduced by watermark itself. Current RRW schemes typically employ a two‑stage framework, which fails to achieve simultaneous robustness and reversibility within a single watermarking, and functional interference between the two watermarks results in performance degradation in multiple terms such as capacity and imperceptibility. We propose SiGRRW, a single‑watermark RRW framework, which is applicable to both generative models and natural images. We introduce a novel guiding strategy to generate guiding images, serving as the guidance for embedding and recovery. The watermark is reversibly embedded with the guiding residual, which can be calculated from both cover images and watermark images. The proposed framework can be deployed either as a plug‑and‑play watermarking layer at the output stage of generative models, or directly applied to natural images. Extensive experiments demonstrate that SiGRRW effectively enhances imperceptibility and robustness compared to existing RRW schemes while maintaining lossless recovery of cover images, with significantly higher capacity than conventional schemes.

Abstract:
Generative AI models pose a significant challenge to intellectual property (IP), as they can replicate unique artistic styles and concepts without attribution. While watermarking offers a potential solution, existing methods often fail in complex scenarios where multiple concepts (e.g., an object and an artistic style) are composed within a single image. These methods struggle to disentangle and attribute each concept individually. In this work, we introduce TokenTrace, a novel proactive watermarking framework for robust, multi‑concept attribution. Our method embeds secret signatures into the semantic domain by simultaneously perturbing the text prompt embedding and the initial latent noise that guide the diffusion model's generation process. For retrieval, we propose a query‑based TokenTrace module that takes the generated image and a textual query specifying which concepts need to be retrieved (e.g., a specific object or style) as inputs. This query‑based mechanism allows the module to disentangle and independently verify the presence of multiple concepts from a single generated image. Extensive experiments show that our method achieves state‑of‑the‑art performance on both single‑concept (object and style) and multi‑concept attribution tasks, significantly outperforming existing baselines while maintaining high visual quality and robustness to common transformations.

Abstract:
Camera recapture introduces complex optical degradations, such as perspective warping, illumination shifts, and Moiré interference, that remain challenging for deep watermarking systems. We present TIACam, a text‑anchored invariant feature learning framework with auto‑augmentation for camera‑robust zero‑watermarking. The method integrates three key innovations: (1) a learnable auto‑augmentor that discovers camera‑like distortions through differentiable geometric, photometric, and Moiré operators; (2) a text‑anchored invariant feature learner that enforces semantic consistency via cross‑modal adversarial alignment between image and text; and (3) a zero‑watermarking head that binds binary messages in the invariant feature space without modifying image pixels. This unified formulation jointly optimizes invariance, semantic alignment, and watermark recoverability. Extensive experiments on both synthetic and real‑world camera captures demonstrate that TIACam achieves state‑of‑the‑art feature stability and watermark extraction accuracy, establishing a principled bridge between multimodal invariance learning and physically robust zero‑watermarking.

Abstract:
LLM agents rely heavily on high‑quality trajectory data to guide their problem‑solving behaviors, yet producing such data requires substantial task design, high‑capacity model generation, and manual filtering. Despite the high cost of creating these datasets, existing literature has overlooked copyright protection for LLM agent trajectories. This gap leaves creators vulnerable to data theft and makes it difficult to trace misuse or enforce ownership rights. This paper introduces ActHook, the first watermarking method tailored for agent trajectory datasets. Inspired by hook mechanisms in software engineering, ActHook embeds hook actions that are activated by a secret input key and do not alter the original task outcome. Like software execution, LLM agents operate sequentially, allowing hook actions to be inserted at decision points without disrupting task flow. When the activation key is present, an LLM agent trained on watermarked trajectories can produce these hook actions at a significantly higher rate, enabling reliable black‑box detection. Experiments on mathematical reasoning, web searching, and software engineering agents show that ActHook achieves an average detection AUC of 94.3 on Qwen‑2.5‑Coder‑7B while incurring negligible performance degradation.

Abstract:
We provide background on emerging challenges and future directions with media integrity and authentication methods, focusing on distinguishing AI‑generated media from authentic content captured by cameras and microphones. We evaluate several approaches, including provenance, watermarking, and fingerprinting. After defining each method, we analyze three representative technologies: cryptographically secured provenance, imperceptible watermarking, and soft‑hash fingerprinting. We analyze how these tools operate across modalities and evaluate relevant threat models, attack categories, and real‑world workflows spanning capture, editing, distribution, and verification. We consider sociotechnical reversal attacks that can invert integrity signals, making authentic content appear synthetic and vice versa, highlighting the value of verification systems that are resilient to both technical and psychosocial manipulation. Finally, we outline techniques for delivering high‑confidence provenance authentication, including directions for strengthening edge‑device security using secure enclaves.

Abstract:
The proliferation of Large Language Models (LLMs) necessitates efficient mechanisms to distinguish machine‑generated content from human text. While statistical watermarking has emerged as a promising solution, existing methods suffer from two critical limitations: the lack of a principled approach for selecting sampling distributions and the reliance on fixed‑horizon hypothesis testing, which precludes valid early stopping. In this paper, we bridge this gap by developing the first e‑value‑based watermarking framework, Anchored E‑Watermarking, that unifies optimal sampling with anytime‑valid inference. Unlike traditional approaches where optional stopping invalidates Type‑I error guarantees, our framework enables valid, anytime‑inference by constructing a test supermartingale for the detection process. By leveraging an anchor distribution to approximate the target model, we characterize the optimal e‑value with respect to the worst‑case log‑growth rate and derive the optimal expected stopping time. Our theoretical claims are substantiated by simulations and evaluations on established benchmarks, showing that our framework can significantly enhance sample efficiency, reducing the average token budget required for detection by 13‑15% relative to state‑of‑the‑art baselines.

Abstract:
Research on backdoor attacks against multimodal contrastive learning models faces two key challenges: stealthiness and persistence. Existing methods often fail under strong detection or continuous fine‑tuning, largely due to (1) cross‑modal inconsistency that exposes trigger patterns and (2) gradient dilution at low poisoning rates that accelerates backdoor forgetting. These coupled causes remain insufficiently modeled and addressed. We propose BadCLIP++, a unified framework that tackles both challenges. For stealthiness, we introduce a semantic‑fusion QR micro‑trigger that embeds imperceptible patterns near task‑relevant regions, preserving clean‑data statistics while producing compact trigger distributions. We further apply target‑aligned subset selection to strengthen signals at low injection rates. For persistence, we stabilize trigger embeddings via radius shrinkage and centroid alignment, and stabilize model parameters through curvature control and elastic weight consolidation, maintaining solutions within a low‑curvature wide basin resistant to fine‑tuning. We also provide the first theoretical analysis showing that, within a trust region, gradients from clean fine‑tuning and backdoor objectives are co‑directional, yielding a non‑increasing upper bound on attack success degradation. Experiments demonstrate that with only 0.3% poisoning, BadCLIP++ achieves 99.99% attack success rate (ASR) in digital settings, surpassing baselines by 11.4 points. Across nineteen defenses, ASR remains above 99.90% with less than 0.8% drop in clean accuracy. The method further attains 65.03% success in physical attacks and shows robustness against watermark removal defenses.

Abstract:
AI watermarking embeds invisible signals within images to provide provenance information and identify content as AI‑generated. In this paper, we introduce MarkSweep, a novel watermark removal attack that effectively erases the embedded watermarks from AI‑generated images without degrading visual quality. MarkSweep first amplifies watermark noise in high‑frequency regions via edge‑aware Gaussian perturbations and injects it into clean images for training a denoising network. This network then integrates two modules, the learnable frequency decomposition module and the frequency‑aware fusion module, to suppress amplified noise and eliminate watermark traces. Theoretical analysis and extensive experiments demonstrate that invisible watermarks are highly vulnerable to MarkSweep, which effectively removes embedded watermarks, reducing the bit accuracy of HiDDeN and Stable Signature watermarking schemes to below 67%, while preserving perceptual quality of AI‑generated images.

Abstract:
Language models now routinely produce text that is difficult to distinguish from human writing, raising the need for robust tools to verify content provenance. Watermarking has emerged as a promising countermeasure, with existing work largely focused on model quality preservation and robust detection. However, current schemes provide limited protection against false attribution. We strengthen the notion of soundness by introducing two novel guarantees: unforgeability and recoverability. Unforgeability prevents adversaries from crafting false positives, texts that are far from any output from the watermarked model but are nonetheless flagged as watermarked. Recoverability provides an additional layer of protection: whenever a watermark is detected, the detector identifies the source text from which the flagged content was derived. Together, these properties strengthen content ownership by linking content exclusively to its generating model, enabling secure attribution and fine‑grained traceability. We construct the first undetectable watermarking scheme that is robust, unforgeable, and recoverable with respect to substitutions (i.e., perturbations in Hamming metric). The key technical ingredient is a new cryptographic primitive called robust (or recoverable) digital signatures, which allow verification of messages that are close to signed ones, while preventing forgery of messages that are far from all previously signed messages. We show that any standard digital signature scheme can be boosted to a robust one using property‑preserving hash functions (Boyle, LaVigne, and Vaikuntanathan, ITCS 2019).

Abstract:
Large language models now produce text indistinguishable from human writing, which increases the need for reliable provenance tracing. Multi‑bit watermarking can embed identifiers into generated text, but existing methods struggle to keep both text quality and watermark strength while carrying long messages. We propose MC^2Mark, a distortion‑free multi‑bit watermarking framework designed for reliable embedding and decoding of long messages. Our key technical idea is Multi‑Channel Colored Reweighting, which encodes bits through structured token reweighting while keeping the token distribution unbiased, together with Multi‑Layer Sequential Reweighting to strengthen the watermark signal and an evidence‑accumulation detector for message recovery. Experiments show that MC^2Mark improves detectability and robustness over prior multi‑bit watermarking methods while preserving generation quality, achieving near‑perfect accuracy for short messages and exceeding the second‑best method by nearly 30% for long messages.

Abstract:
The surging demand for large‑scale datasets in deep learning has heightened the need for effective copyright protection, given the risks of unauthorized use to data owners. Although the dataset watermark technique holds promise for auditing and verifying usage, existing methods are hindered by inconsistent evaluations, which impede fair comparisons and assessments of real‑world viability. To address this gap, we propose a two‑layer taxonomy that categorizes methods by implementation (model‑based vs. model‑free injection; model‑behavior vs. model‑message verification), offering a structured framework for cross‑task analysis. Then, we develop DWBench, a unified benchmark and open‑source toolkit for systematically evaluating image dataset watermark techniques in classification and generation tasks. Using DWBench, we assess 25 representative methods under standardized conditions, perturbation‑based robustness tests, multi‑watermark coexistence, and multi‑user interference. In addition to reporting the results of four commonly used metrics, we present the results of two new metrics: sample significance for fine‑grained watermark distinguishability and verification success rate for dataset‑level auditing, which enable accurate and reproducible benchmarking. Key findings reveal inherent trade‑offs: no single method dominates all scenarios; classification and generation tasks require specialized approaches; and existing techniques exhibit instability at low watermark rates and in realistic multi‑user settings, with elevated false positives or performance declines. We hope that DWBench can facilitate advances in watermark reliability and practicality, thus strengthening copyright safeguards in the face of widespread AI‑driven data exploitation.

Abstract:
Watermarking has emerged as a crucial technique for detecting and attributing content generated by large language models. While recent advancements have utilized watermark ensembles to enhance robustness, prevailing methods typically prioritize maximizing the strength of the watermark at every individual layer. In this work, we identify a critical limitation in this "stronger‑is‑better" approach: strong watermarks significantly reduce the entropy of the token distribution, which paradoxically weakens the effectiveness of watermarking in subsequent layers. We theoretically and empirically show that detectability is bounded by entropy and that watermark ensembles induce a monotonic decrease in both entropy and the expected green‑list ratio across layers. To address this inherent trade‑off, we propose a general framework that utilizes weaker single‑layer watermarks to preserve the entropy required for effective multi‑layer ensembling. Empirical evaluations demonstrate that this counter‑intuitive strategy mitigates signal decay and consistently outperforms strong baselines in both detectability and robustness.

Abstract:
Speech provenance goes beyond detecting whether a watermark is present. Real workflows involve splicing, quoting, trimming, and platform‑level transforms that may preserve some regions while altering others. Neural watermarking systems have made strides in robustness and localised detection, but most deployments produce outputs with no third‑party verifiable cryptographic proof tying a time segment to an issuer‑signed original. Provenance standards like C2PA adopt signed manifests and Merkle‑based fragment validation, yet their bindings target encoded assets and break under re‑encoding or routine processing. We propose MerkleSpeech, a system for public‑key verifiable, chunk‑localised speech provenance offering two tiers of assurance. The first, a robust watermark attribution layer (WM‑only), survives common distribution transforms and answers "was this chunk issued by a known party?". The second, a strict cryptographic integrity layer (MSv1), verifies Merkle inclusion of the chunk's fingerprint under an issuer signature. The system computes perceptual fingerprints over short speech chunks, commits them in a Merkle tree whose root is signed with an issuer key, and embeds a compact in‑band watermark payload carrying a random content identifier and chunk metadata sufficient to retrieve Merkle inclusion proofs from a repository. Once the payload is extracted, all subsequent verification steps (signature check, fingerprint recomputation, Merkle inclusion) use only public information. The result is a splice‑aware timeline indicating which regions pass each tier and why any given region fails. We describe the protocol, provide pseudocode, and present experiments targeting very low false positive rates under resampling, bandpass filtering, and additive noise, informed by recent audits identifying neural codecs as a major stressor for post‑hoc audio watermarks.

Abstract:
Watermarking has emerged as a pivotal solution for content traceability and intellectual property protection in Large Vision‑Language Models (LVLMs). However, vision‑agnostic watermarks may introduce visually irrelevant tokens and disrupt visual grounding by enforcing indiscriminate pseudo‑random biases. Additionally, current vision‑specific watermarks rely on a static, one‑time estimation of vision critical weights and ignore the weight distribution density when determining the proportion of protected tokens. This design fails to account for dynamic changes in visual dependence during generation and may introduce low‑quality tokens in the long tail. To address these challenges, we propose Attention‑Guided Dynamic Watermarking (AGMark), a novel framework that embeds detectable signals while strictly preserving visual fidelity. At each decoding step, AGMark first dynamically identifies semantic‑critical evidence based on attention weights for visual relevance, together with context‑aware coherence cues, resulting in a more adaptive and well‑calibrated evidence‑weight distribution. It then determines the proportion of semantic‑critical tokens by jointly considering uncertainty awareness (token entropy) and evidence calibration (weight density), thereby enabling adaptive vocabulary partitioning to avoid irrelevant tokens. Empirical results confirm that AGMark outperforms conventional methods, observably improving generation quality and yielding particularly strong gains in visual semantic fidelity in the later stages of generation. The framework maintains highly competitive detection accuracy (at least 99.36% AUC) and robust attack resilience (at least 88.61% AUC) without sacrificing inference efficiency, effectively establishing a new standard for reliability‑preserving multi‑modal watermarking.

Abstract:
Watermarking is an important mechanism for provenance and copyright protection of diffusion‑generated images. Training‑free methods, exemplified by Gaussian Shading, embed watermarks into the initial noise of diffusion models with negligible impact on the quality of generated images. However, extracting this type of watermark typically requires multi‑step diffusion inversion to obtain precise initial noise, which is computationally expensive and time‑consuming. To address this issue, we propose One‑step Inversion (OSI), a significantly faster and more accurate method for extracting Gaussian Shading style watermarks. OSI reformulates watermark extraction as a learnable sign classification problem, which eliminates the need for precise regression of the initial noise. Then, we initialize the OSI model from the diffusion backbone and finetune it on synthesized noise‑image pairs with a sign classification objective. In this manner, the OSI model is able to accomplish the watermark extraction efficiently in only one step. Our OSI substantially outperforms the multi‑step diffusion inversion method: it is 20x faster, achieves higher extraction accuracy, and doubles the watermark payload capacity. Extensive experiments across diverse schedulers, diffusion backbones, and cryptographic schemes consistently show improvements, demonstrating the generality of our OSI framework.

Abstract:
High‑quality medical imaging datasets are essential for training deep learning models, but their unauthorized use raises serious copyright and ethical concerns. Medical imaging presents a unique challenge for existing dataset ownership verification methods designed for natural images, as static watermark patterns generated in fixed‑scale images scale poorly dynamic and high‑resolution scans with limited visual diversity and subtle anatomical structures, while preserving diagnostic quality. In this paper, we propose X‑Mark, a sample‑specific clean‑label watermarking method for chest x‑ray copyright protection. Specifically, X‑Mark uses a conditional U‑Net to generate unique perturbations within salient regions of each sample. We design a multi‑component training objective to ensure watermark efficacy, robustness against dynamic scaling processes while preserving diagnostic quality and visual‑distinguishability. We incorporate Laplacian regularization into our training objective to penalize high‑frequency perturbations and achieve watermark scale‑invariance. Ownership verification is performed in a black‑box setting to detect characteristic behaviors in suspicious models. Extensive experiments on CheXpert verify the effectiveness of X‑Mark, achieving WSR of 100% and reducing probability of false positives in Ind‑M scenario by 12%, while demonstrating resistance to potential adaptive attacks.

Abstract:
The goal of the PAN workshop is to advance computational stylometry and text forensics via objective and reproducible evaluation. In 2026, we run the following five tasks: (1) Voight‑Kampff Generative AI Detection, particularly in mixed and obfuscated authorship scenarios, (2) Text Watermarking, a new task that aims to find new and benchmark the robustness of existing text watermarking schemes, (3) Multi‑author Writing Style Analysis, a continued task that aims to find positions of authorship change, (4) Generative Plagiarism Detection, a continued task that targets source retrieval and text alignment between generated text and source documents, and (5) Reasoning Trajectory Detection, a new task that deals with source detection and safety detection of LLM‑generated or human‑written reasoning trajectories. As in previous years, PAN invites software submissions as easy‑to‑reproduce Docker containers for most of the tasks. Since PAN 2012, more than 1,100 submissions have been made this way via the TIRA experimentation platform.

Abstract:
The evolution of Large Language Models (LLMs) into agentic systems that perform autonomous reasoning and tool use has created significant intellectual property (IP) value. We demonstrate that these systems are highly vulnerable to imitation attacks, where adversaries steal proprietary capabilities by training imitation models on victim outputs. Crucially, existing LLM watermarking techniques fail in this domain because real‑world agentic systems often operate as grey boxes, concealing the internal reasoning traces required for verification. This paper presents AGENTWM, the first watermarking framework designed specifically for agentic models. AGENTWM exploits the semantic equivalence of action sequences, injecting watermarks by subtly biasing the distribution of functionally identical tool execution paths. This mechanism allows AGENTWM to embed verifiable signals directly into the visible action trajectory while remaining indistinguishable to users. We develop an automated pipeline to generate robust watermark schemes and a rigorous statistical hypothesis testing procedure for verification. Extensive evaluations across three complex domains demonstrate that AGENTWM achieves high detection accuracy with negligible impact on agent performance. Our results confirm that AGENTWM effectively protects agentic IP against adaptive adversaries, who cannot remove the watermarks without severely degrading the stolen model's utility.

Abstract:
Watermarking is an important tool for promoting the responsible use of large language models (LLMs). Existing watermarks insert a signal into generated tokens that either flags LLM‑generated text (zero‑bit watermarking) or encodes more complex messages (multi‑bit watermarking). Though a number of recent approaches insert multiple bits into text without perturbing average next‑token predictions, they largely extend design principles from the zero‑bit setting, such as encoding a single bit per token. In contrast, a watermarker capable of embedding multiple bytes into the text would dramatically increase the potential applications, by embedding information such as the ID of the user who submitted the prompt, the precise model version that was used, or even the prompt itself. We address this problem by introducing ArcMark: a new watermark construction based on coding and information‑theoretic principles that is capable of reliably embedding multiple bytes of information into just a few hundred tokens, without any distortion of the underlying LLM next‑token distribution. We derive ArcMark by formulating the distortion‑free watermarking problem as a channel coding problem, and deriving an information‑theoretic channel capacity that establishes the fundamental limit of embedding information in LLM output in a distortion‑free manner. This capacity formulation informs the design of ArcMark. In practice, ArcMark outperforms competing multi‑bit distortion‑free watermarks in terms of reconstruction accuracy, including in the face of attacks that alter a subset of the LLM text. ArcMark output is also shown to be indistinguishable from unwatermarked text in terms of perplexity, and in downstream task quality.

Abstract:
LLM watermarks allow tracing AI‑generated texts by inserting a detectable signal into their generated content. Recent works have proposed a wide range of watermarking algorithms, each with distinct designs, usually built using a bottom‑up approach. Crucially, there is no general and principled formulation for LLM watermarking. In this work, we show that most existing and widely used watermarking schemes can in fact be derived from a principled constrained optimization problem. Our formulation unifies existing watermarking methods and explicitly reveals the constraints that each method optimizes. In particular, it highlights an understudied quality‑diversity‑power trade‑off. At the same time, our framework also provides a principled approach for designing novel watermarking schemes tailored to specific requirements. For instance, it allows us to directly use perplexity as a proxy for quality, and derive new schemes that are optimal with respect to this constraint. Our experimental evaluation validates our framework: watermarking schemes derived from a given constraint consistently maximize detection power with respect to that constraint.

Abstract:
Watermarking is a technical alternative to safeguarding intellectual property and reducing misuse. Existing methods focus on optimizing watermarked latent variables to balance watermark robustness and fidelity, as Latent diffusion models (LDMs) are considered a powerful tool for generative tasks. However, reliance on computationally intensive heuristic optimization for iterative signal refinement results in high training overhead and local optima entrapment.To address these issues, we propose an \underlineAna\underlinelytical Watermark\underlineing Framework for Controllabl\underlinee Generatio\underlinen (ALIEN). We develop the first analytical derivation of the time‑dependent modulation coefficient that guides the diffusion of watermark residuals to achieve controllable watermark embedding pattern.Experimental results show that ALIEN‑Q outperforms the state‑of‑the‑art by 33.1% across 5 quality metrics, and ALIEN‑R demonstrates 14.0% improved robustness against generative variant and stability threats compared to the state‑of‑the‑art across 15 distinct conditions. Code can be available at https://anonymous.4open.science/r/ALIEN/.

Abstract:
Model distillation enables efficient emulation of frontier large language models (LLMs), creating a need for robust mechanisms to detect when a third‑party student model has trained on a teacher model's outputs. However, existing fingerprinting techniques that could be used to detect such distillation rely on heuristic perturbations that impose a steep trade‑off between generation quality and fingerprinting strength, often requiring significant degradation of utility to ensure the fingerprint is effectively internalized by the student. We introduce antidistillation fingerprinting (ADFP), a principled approach that aligns the fingerprinting objective with the student's learning dynamics. Building upon the gradient‑based framework of antidistillation sampling, ADFP utilizes a proxy model to identify and sample tokens that directly maximize the expected detectability of the fingerprint in the student after fine‑tuning, rather than relying on the incidental absorption of the un‑targeted biases of a more naive watermark. Experiments on GSM8K, OASST1, and MBPP demonstrate that ADFP achieves a significant Pareto improvement over state‑of‑the‑art baselines, yielding stronger detection confidence with minimal impact on utility across mathematical reasoning, dialogue, and code generation, even when the student model's architecture is unknown.

Abstract:
To ensure the responsible distribution and use of open‑source deep neural networks (DNNs), DNN watermarking has become a crucial technique to trace and verify unauthorized model replication or misuse. In practice, black‑box watermarks manifest as specific predictive behaviors for specially crafted samples. However, due to the generalization nature of DNNs, the keys to extracting the watermark message are not unique, which would provide attackers with more opportunities. Advanced attack techniques can reverse‑engineer approximate replacements for the original watermark keys, enabling subsequent watermark removal. In this paper, we explore black‑box DNN watermarking specificity, which refers to the accuracy of a watermark's response to a key. Using this concept, we introduce Specificity‑Enhanced Watermarking (SEW), a new method that improves specificity by reducing the association between the watermark and approximate keys. Through extensive evaluation using three popular watermarking benchmarks, we validate that enhancing specificity significantly contributes to strengthening robustness against removal attacks. SEW effectively defends against six state‑of‑the‑art removal attacks, while maintaining model usability and watermark verification performance.

Abstract:
Deep watermarking methods often share similar encoder‑decoder architectures, yet differ substantially in their functional behaviors. We propose DiM, a new multi‑dimensional watermarking framework that formulates watermarking as a dimension‑aware mapping problem, thereby unifying existing watermarking methods at the functional level. Under DiM, watermark information is modeled as payloads of different dimensionalities, including one‑dimensional binary messages, two‑dimensional spatial masks, and three‑dimensional spatiotemporal structures. We find that the dimensional configuration of embedding and extraction largely determines the resulting watermarking behavior. Same‑dimensional mappings preserve payload structure and support fine‑grained control, while cross‑dimensional mappings enable spatial or spatiotemporal localization. We instantiate DiM in the video domain, where spatiotemporal representations enable a broader set of dimension mappings. Experiments demonstrate that varying only the embedding and extraction dimensions, without architectural changes, leads to different watermarking capabilities, including spatiotemporal tamper localization, local embedding control, and recovery of temporal order under frame disruptions.

Abstract:
3D content acquisition and creation are expanding rapidly in the new era of machine learning and AI. 3D Gaussian Splatting (3DGS) has become a promising high‑fidelity and real‑time representation for 3D content. Similar to the initial wave of digital audio‑visual content at the turn of the millennium, the demand for intellectual property protection is also increasing, since explicit and editable 3D parameterization makes unauthorized use and dissemination easier. In this position paper, we argue that effective progress in watermarking 3D assets requires articulated security objectives and realistic threat models, incorporating the lessons learned from digital audio‑visual asset protection over the past decades. To address this gap in security specification and evaluation, we advocate a scenario‑driven formulation, in which adversarial capabilities are formalized through a security model. Based on this formulation, we construct a reference framework that organizes existing methods and clarifies how specific design choices map to corresponding adversarial assumptions. Within this framework, we also examine a legacy spread‑spectrum embedding scheme, characterizing its advantages and limitations and highlighting the important trade‑offs it entails. Overall, this work aims to foster effective intellectual property protection for 3D assets.

Abstract:
The rapid advancement of artificial intelligence has made the generation of synthetic images widely accessible, increasing concerns related to misinformation, digital forgery, and content authenticity on large‑scale online platforms. This paper proposes a blockchain‑backed framework for verifying AI‑generated images through a registry‑based provenance mechanism. Each AI‑generated image is assigned a digital fingerprint that preserves similarity using perceptual hashing and is registered at creation time by participating generation platforms. The hashes are stored on a hybrid on‑chain/off‑chain public blockchain using a Merkle Patricia Trie for tamper‑resistant storage (on‑chain) and a Burkhard‑Keller tree (off‑chain) to enable efficient similarity search over large image registries. Verification is performed when images are re‑uploaded to digital platforms such as social media services, enabling identification of previously registered AI‑generated images even after benign transformations or partial modifications. The proposed system does not aim to universally detect all synthetic images, but instead focuses on verifying the provenance of AI‑generated content that has been registered at creation time. By design, this approach complements existing watermarking and learning‑based detection methods, providing a platform‑agnostic, tamper‑proof mechanism for scalable content provenance and authenticity verification at the point of large‑scale online distribution.

Abstract:
As large language models (LLMs) generate increasingly human‑like text, watermarking has emerged as a promising solution for reliable attribution beyond mere detection. While multi‑bit watermarking enables richer provenance encoding, existing approaches typically extend zero‑bit watermarking schemes by introducing static logit perturbations and counting‑based decoding strategies, which can degrade text quality and compromise decoding robustness as the payload increases. In this paper, we propose WorldCup, a multi‑bit watermarking framework for LLMs that models the sampling process as a structured communication channel and embeds message bits through a hierarchical competition mechanism guided by complementary signals. Moreover, WorldCup incorporates entropy‑aware modulation to preserve generation quality and enables robust message recovery via confidence‑aware decoding that accounts for token‑level reliability. Comprehensive experiments demonstrate that WorldCup achieves a strong balance across message capacity, detectability, robustness, text quality, and decoding efficiency, consistently outperforming prior baselines. We believe that this work establishes a scalable and principled foundation for future research on multi‑bit watermarking in LLMs.

Abstract:
Semantic watermarks exhibit strong robustness against conventional image‑space attacks. In this work, we show that such robustness does not survive under micro‑geometric perturbations: spatial displacements can remove watermarks by breaking the phase alignment. Motivated by this observation, we introduce MarkCleaner, a watermark removal framework that avoids semantic drift caused by regeneration‑based watermark removal. Specifically, MarkCleaner is trained with micro‑geometry‑perturbed supervision, which encourages the model to separate semantic content from strict spatial alignment and enables robust reconstruction under subtle geometric displacements. The framework adopts a mask‑guided encoder that learns explicit spatial representations and a 2D Gaussian Splatting‑based decoder that explicitly parameterizes geometric perturbations while preserving semantic content. Extensive experiments demonstrate that MarkCleaner achieves superior performance in both watermark removal effectiveness and visual fidelity, while enabling efficient real‑time inference. Our code will be made available upon acceptance.

Abstract:
Watermarking is a principled approach for tracing the provenance of large language model (LLM) outputs, but its deployment in practice is hindered by inference inefficiency. Speculative sampling accelerates inference, with efficiency improving as the acceptance rate between draft and target models increases. Yet recent work reveals a fundamental trade‑off: higher watermark strength reduces acceptance, preventing their simultaneous achievement. We revisit this trade‑off and show it is not absolute. We introduce a quantitative measure of watermark strength that governs statistical detectability and is maximized when tokens are deterministic functions of pseudorandom numbers. Using this measure, we fully characterize the trade‑off as a constrained optimization problem and derive explicit Pareto curves for two existing watermarking schemes. Finally, we introduce a principled mechanism that injects pseudorandomness into draft‑token acceptance, ensuring maximal watermark strength while maintaining speculative sampling efficiency. Experiments further show that this approach improves detectability without sacrificing efficiency. Our findings uncover a principle that unites speculative sampling and watermarking, paving the way for their efficient and practical deployment.

Abstract:
Reinforcement Learning (RL) serves as a potent paradigm for enhancing reasoning capabilities in Large Language Models (LLMs), yet standard outcome‑based approaches often suffer from reward sparsity and inefficient credit assignment. In this paper, we propose a novel framework designed to provide continuous reward signals, which introduces a Step‑wise Marginal Information Gain (MIG) mechanism that quantifies the intrinsic value of reasoning steps against a Monotonic Historical Watermark, effectively filtering out training noise. To ensure disentangled credit distribution, we implement a Decoupled Masking Strategy, applying process‑oriented rewards specifically to the chain‑of‑thought (CoT) and outcome‑oriented rewards to the full completion. Additionally, we incorporate a Dual‑Gated SFT objective to stabilize training with high‑quality structural and factual signals. Extensive experiments across textual and multi‑modal benchmarks (e.g., MATH, Super‑CLEVR) demonstrate that our approach consistently outperforms baselines such as GRPO in both sample efficiency and final accuracy. Furthermore, our model exhibits superior out‑of‑distribution robustness, demonstrating promising zero‑shot transfer capabilities to unseen and challenging reasoning tasks.

Abstract:
We propose dgMARK, a decoding‑guided watermarking method for discrete diffusion language models (dLLMs). Unlike autoregressive models, dLLMs can generate tokens in arbitrary order. While an ideal conditional predictor would be invariant to this order, practical dLLMs exhibit strong sensitivity to the unmasking order, creating a new channel for watermarking. dgMARK steers the unmasking order toward positions whose high‑reward candidate tokens satisfy a simple parity constraint induced by a binary hash, without explicitly reweighting the model's learned probabilities. The method is plug‑and‑play with common decoding strategies (e.g., confidence, entropy, and margin‑based ordering) and can be strengthened with a one‑step lookahead variant. Watermarks are detected via elevated parity‑matching statistics, and a sliding‑window detector ensures robustness under post‑editing operations including insertion, deletion, substitution, and paraphrasing.

Abstract:
Generated speech achieves human‑level naturalness but escalates security risks of misuse. However, existing watermarking methods fail to reconcile fidelity with robustness, as they rely either on simple superposition in the noise space or on intrusive alterations to model weights. To bridge this gap, we propose VocBulwark, an additional‑parameter injection framework that freezes generative model parameters to preserve perceptual quality. Specifically, we design a Temporal Adapter to deeply entangle watermarks with acoustic attributes, synergizing with a Coarse‑to‑Fine Gated Extractor to resist advanced attacks. Furthermore, we develop an Accuracy‑Guided Optimization Curriculum that dynamically orchestrates gradient flow to resolve the optimization conflict between fidelity and robustness. Comprehensive experiments demonstrate that VocBulwark achieves high‑capacity and high‑fidelity watermarking, offering robust defense against complex practical scenarios, with resilience to Codec regenerations and variable‑length manipulations.

Abstract:
As large language models (LLMs) become integral to applications such as question answering and content creation, reliable content attribution has become increasingly important. Watermarking is a promising approach, but most existing methods either provide only binary signals or achieve multi‑bit embedding by distorting the generation distribution. We propose MirrorMark, a generalizable mapping‑centric approach for multi‑bit LLM watermarking. MirrorMark separates the symbol mapping rule from the base watermarking sampler and maps each symbol to a mod‑1 mirroring transformation of a detector‑reproducible pseudorandom object, such as sampling values or permutation ranks. A binary‑tokenizer analysis shows that complementary mappings yield larger matched‑‑mismatched score gaps than independent‑key or shift‑based mappings. When composed with a distortion‑free base sampler, MirrorMark preserves the token probability distribution by design and maintains text quality in practice. To support practical payload embedding, we introduce a Context‑Anchored Balanced Scheduler (CABS), which balances token assignments across message positions while localizing edit effects. We further provide theoretical EER analyses for two representative sampler instantiations. Experiments show that MirrorMark achieves strong detectability and bit accuracy while maintaining text quality comparable to non‑watermarked generation.

Abstract:
Digital watermarking is essential for securing generated images from diffusion models. Accurate watermark evaluation is critical for algorithm development, yet existing methods have significant limitations: they lack a unified framework for both residual and semantic watermarks, provide results without interpretability, neglect comprehensive security considerations, and often use inappropriate metrics for semantic watermarks. To address these gaps, we propose WMVLM, the first unified and interpretable evaluation framework for diffusion model image watermarking via vision‑language models (VLMs). We redefine quality and security metrics for each watermark type: residual watermarks are evaluated by artifact strength and erasure resistance, while semantic watermarks are assessed through latent distribution shifts. Moreover, we introduce a three‑stage training strategy to progressively enable the model to achieve classification, scoring, and interpretable text generation. Experiments show WMVLM outperforms state‑of‑the‑art VLMs with strong generalization across datasets, diffusion models, and watermarking methods.

Abstract:
The exceptional performance of diffusion models establishes them as high‑value intellectual property but exposes them to unauthorized replication. Existing protection methods either modify the model to embed watermarks, which impairs performance, or extract model fingerprints by manipulating the denoising process, rendering them incompatible with black‑box APIs. In this paper, we propose TrajPrint, a completely lossless and training‑free framework that verifies model copyright by extracting unique manifold fingerprints formed during deterministic generation. Specifically, we first utilize a watermarked image as an anchor and exactly trace the path back to its trajectory origin, effectively locking the model fingerprint mapped by this path. Subsequently, we implement a joint optimization strategy that employs dual‑end anchoring to synthesize a specific fingerprint noise, which strictly adheres to the target manifold for robust watermark recovery. As input, it enables the protected target model to recover the watermarked image, while failing on non‑target models. Finally, we achieved verification via atomic inference and statistical hypothesis testing. Extensive experiments demonstrate that TrajPrint achieves lossless verification in black‑box API scenarios with superior robustness against model modifications.

Abstract:
Audio watermarking embeds auxiliary information into speech while maintaining speaker identity, linguistic content, and perceptual quality. Although recent advances in neural and digital signal processing‑based watermarking methods have improved imperceptibility and embedding capacity, robustness is still primarily assessed against conventional distortions such as compression, additive noise, and resampling. However, the rise of deep learning‑based attacks introduces novel and significant threats to watermark security. In this work, we investigate self voice conversion as a universal, content‑preserving attack against audio watermarking systems. Self voice conversion remaps a speaker's voice to the same identity while altering acoustic characteristics through a voice conversion model. We demonstrate that this attack severely degrades the reliability of state‑of‑the‑art watermarking approaches and highlight its implications for the security of modern audio watermarking techniques.

Abstract:
Latent‑based watermarks, integrated into the generation process of latent diffusion models (LDMs), simplify detection and attribution of generated images. However, recent black‑box forgery attacks, where an attacker needs at least one watermarked image and black‑box access to the provider's model, can embed the provider's watermark into images not produced by the provider, posing outsized risk to provenance and trust. We propose SemBind, the first defense framework for latent‑based watermarks that resists black‑box forgery by binding latent signals to image semantics via a learned semantic masker. Trained with contrastive learning, the masker yields near‑invariant codes for the same prompt and near‑orthogonal codes across prompts; these codes are reshaped and permuted to modulate the target latent before any standard latent‑based watermark. SemBind is generally compatible with existing latent‑based watermarking schemes and keeps image quality essentially unchanged, while a simple mask‑ratio parameter offers a tunable trade‑off between anti‑forgery strength and robustness. Across four mainstream latent‑based watermark methods, our SemBind‑enabled anti‑forgery variants markedly reduce false acceptance under black‑box forgery while providing a controllable robustness‑security balance.

Abstract:
Digital watermarking techniques are essential to prevent unauthorized use of images. Since pirated images are often geometrically distorted by operations such as scaling and cropping, accurate synchronization ‑ detecting the embedding position of the watermark ‑ is critical for proper extraction. In particular, cropping changes the origin of the image, making synchronization difficult. However, few existing methods are robust against cropping. To address this issue, we propose a watermarking method that estimates geometric transformations applied to a stego image using a pilot signal, allowing synchronization even after cropping. A grid‑shaped pilot signal with distinct horizontal and vertical values is embedded in the image. When the image is transformed, the grid is also distorted. By analyzing this distortion, the transformation matrix can be estimated. Applying the Radon transform to the distorted image allows estimation of the grid angles and intervals. In addition, since the horizontal and vertical grid lines are encoded differently, the grid orientation can be determined, which reduces ambiguity. To validate our method, we performed simulations with anisotropic scaling, rotation, shearing, and cropping. The results show that the proposed method accurately estimates transformation matrices with low error under both single and composite attacks.

Abstract:
The rapid proliferation of realistic deepfakes has raised urgent concerns over their misuse, motivating the use of defensive watermarks in synthetic images for reliable detection and provenance tracking. However, this defense paradigm assumes such watermarks are inherently resistant to removal. We challenge this assumption with DeMark, a query‑free black‑box attack framework that targets defensive image watermarking schemes for deepfakes. DeMark exploits latent‑space vulnerabilities in encoder‑decoder watermarking models through a compressive sensing based sparsification process, suppressing watermark signals while preserving perceptual and structural realism appropriate for deepfakes. Across eight state‑of‑the‑art watermarking schemes, DeMark reduces watermark detection accuracy from 100% to 32.9% on average while maintaining natural visual quality, outperforming existing attacks. We further evaluate three defense strategies, including image super resolution, sparse watermarking, and adversarial training, and find them largely ineffective. These results demonstrate that current encoder decoder watermarking schemes remain vulnerable to latent‑space manipulations, underscoring the need for more robust watermarking methods to safeguard against deepfakes.

Abstract:
Large language models (LLMs) are deployed at scale, yet their training data life cycle remains opaque. This survey synthesizes research from the past ten years on three tightly coupled axes: (1) data provenance, (2) transparency, and (3) traceability, and three supporting pillars: (4) bias \& uncertainty, (5) data privacy, and (6) tools and techniques that operationalize them. A central contribution is a proposed taxonomy defining the field's domains and listing corresponding artifacts. Through analysis of 95 publications, this work identifies key methodologies concerning data generation, watermarking, bias measurement, data curation, data privacy, and the inherent trade‑off between transparency and opacity.

Abstract:
Robust reversible watermarking in encrypted images (RRWEI) faces an inherent challenge in simultaneously achieving robustness, reversibility, and content privacy under severely constrained embedding capacity. Existing RRWEI schemes often exhibit limited robustness against noise, lossy compression, and cropping attacks due to insufficient redundancy in the encrypted domain. To address this challenge, this paper proposes a novel RRWEI framework that couples dual most significant bit‑plane (dual‑MSBs) embedding with spatial redundancy and error‑correcting coding. By compressing prediction‑error bit‑planes, sufficient embedding space and auxiliary information for lossless reconstruction are reserved. The dual‑MSBs are further reorganized using a spiral embedding strategy to distribute multiple redundant watermark copies across spatially dispersed regions, enhancing robustness against both noise and spatial loss.Experimental results on standard test images demonstrate that the proposed method consistently outperforms under evaluated settings robustness against Gaussian noise, JPEG compression, and diverse cropping attacks, while maintaining perfect reversibility and high embedding capacity. Compared with state‑of‑the‑art RRWEI schemes, the proposed framework achieves substantially lower bit‑error rates and more stable performance under a wide range of attack scenarios.

Abstract:
Graph‑structured data is foundational to numerous web applications, and watermarking is crucial for protecting their intellectual property and ensuring data provenance. Existing watermarking methods primarily operate on graph structures or entangled graph representations, which compromise the transparency and robustness of watermarks due to the information coupling in representing graphs and uncontrollable discretization in transforming continuous numerical representations into graph structures. This motivates us to propose DRGW, the first graph watermarking framework that addresses these issues through disentangled representation learning. Specifically, we design an adversarially trained encoder that learns an invariant structural representation against diverse perturbations and derives a statistically independent watermark carrier, ensuring both robustness and transparency of watermarks. Meanwhile, we devise a graph‑aware invertible neural network to provide a lossless channel for watermark embedding and extraction, guaranteeing high detectability and transparency of watermarks. Additionally, we develop a structure‑aware editor that resolves the issue of latent modifications into discrete graph edits, ensuring robustness against structural perturbations. Experiments on diverse benchmark datasets demonstrate the superior effectiveness of DRGW.

Abstract:
The proliferation of hyper‑realistic images from Latent Diffusion Models (LDMs) demands robust watermarking, yet existing post‑hoc methods are prohibitively slow due to iterative optimization or inversion processes. We introduce PhaseMark, a single‑shot, optimization‑free framework that directly modulates the phase in the VAE latent frequency domain. This approach makes PhaseMark thousands of times faster than optimization‑based techniques while achieving state‑of‑the‑art resilience against severe attacks, including regeneration, without degrading image quality. We analyze four modulation variants, revealing a clear performance‑quality trade‑off. PhaseMark demonstrates a new paradigm where efficient, resilient watermarking is achieved by exploiting intrinsic latent properties.

Abstract:
Watermarking (WM) is a critical mechanism for detecting and attributing AI‑generated content. Current WM methods for Large Language Models (LLMs) are predominantly tailored for autoregressive (AR) models: They rely on tokens being generated sequentially, and embed stable signals within the generated sequence based on the previously sampled text. Diffusion Language Models (DLMs) generate text via non‑sequential iterative denoising, which requires significant modification to use WM methods designed for AR models. Recent work proposed to watermark DLMs by inverting the process when needed, but suffers significant computational or memory overhead. We introduce Left‑Right Diffusion Watermarking (LR‑DWM), a scheme that biases the generated token based on both left and right neighbors, when they are available. LR‑DWM incurs minimal runtime and memory overhead, remaining close to the non‑watermarked baseline DLM while enabling reliable statistical detection under standard evaluation settings. Our results demonstrate that DLMs can be watermarked efficiently, achieving high detectability with negligible computational and memory overhead.

Abstract:
The proliferation of generative AI has transformed creative workflows, yet current systems face critical challenges in controllability and content protection. We propose a novel multi‑agent framework that addresses both limitations through specialized agent roles and integrated watermarking mechanisms. Unlike existing multi‑agent systems focused solely on generation quality, our approach uniquely combines controllable content synthesis with provenance protection during the generation process itself. The framework orchestrates Director/Planner, Generator, Reviewer, Integration, and Protection agents with human‑in‑the‑loop feedback to ensure alignment with user intent while embedding imperceptible digital watermarks. We formalize the pipeline as a joint optimization objective unifying controllability, semantic alignment, and protection robustness. This work contributes to responsible generative AI by positioning multi‑agent architectures as a solution for trustworthy creative workflows with built‑in ownership tracking and content traceability.

Abstract:
Unauthorized screen‑shooting poses a critical data leakage risk. Resisting screen‑shooting attacks typically requires high‑strength watermark embedding, inevitably degrading the cover image. To resolve the robustness‑fidelity conflict, non‑intrusive watermarking has emerged as a solution by constructing logical verification keys without altering the original content. However, existing non‑intrusive schemes lack the capacity to withstand screen‑shooting noise. While deep learning offers a potential remedy, we observe that directly applying it leads to a previously underexplored failure mode, the Structural Shortcut: networks tend to learn trivial identity mappings and neglect the image‑watermark binding. Furthermore, even when logical binding is enforced, standard training strategies cannot fully bridge the noise gap, yielding suboptimal robustness against physical distortions. In this paper, we propose NiMark, an end‑to‑end framework addressing these challenges. First, to eliminate the structural shortcut, we introduce the Sigmoid‑Gated XOR (SG‑XOR) estimator to enable gradient propagation for the logical operation, effectively enforcing rigid image‑watermark binding. Second, to overcome the robustness bottleneck, we devise a two‑stage training strategy integrating a restorer to bridge the domain gap caused by screen‑shooting noise. Experiments demonstrate that NiMark consistently outperforms representative state‑of‑the‑art methods against both digital attacks and screen‑shooting noise, while maintaining zero visual distortion.

Abstract:
Box‑free model watermarking has gained significant attention in deep neural network (DNN) intellectual property protection due to its model‑agnostic nature and its ability to flexibly manage high‑entropy image outputs from generative models. Typically operating in a black‑box manner, it employs an encoder‑decoder framework for watermark embedding and extraction. While existing research has focused primarily on the encoders for the robustness to resist various attacks, the decoders have been largely overlooked, leading to attacks against the watermark. In this paper, we identify one such attack against the decoder, where query responses are utilized to obtain backpropagated gradients to train a watermark remover. To address this issue, we propose Decoder Gradient Shields (DGSs), a family of defense mechanisms, including DGS at the output (DGS‑O), at the input (DGS‑I), and in the layers (DGS‑L) of the decoder, with a closed‑form solution for DGS‑O and provable performance for all DGS. Leveraging the joint design of reorienting and rescaling of the gradients from watermark channel gradient leaking queries, the proposed DGSs effectively prevent the watermark remover from achieving training convergence to the desired low‑loss value, while preserving image quality of the decoder output. We demonstrate the effectiveness of our proposed DGSs in diverse application scenarios. Our experimental results on deraining and image generation tasks with the state‑of‑the‑art box‑free watermarking show that our DGSs achieve a defense success rate of 100% under all settings.

Abstract:
We demonstrate that while the current approaches for language model watermarking are effective for open‑ended generation, they are inadequate at watermarking LM outputs for constrained generation tasks with low‑entropy output spaces. Therefore, we devise SeqMark, a sequence‑level watermarking algorithm with semantic differentiation that balances the output quality, watermark detectability, and imperceptibility. It improves on the shortcomings of the prevalent token‑level watermarking algorithms that cause under‑utilization of the sequence‑level entropy available for constrained generation tasks. Moreover, we identify and improve upon a different failure mode we term region collapse, associated with prior sequence‑level watermarking algorithms. This occurs because the pseudorandom partitioning of semantic space for watermarking in these approaches causes all high‑probability outputs to collapse into either invalid or valid regions, leading to a trade‑off in output quality and watermarking effectiveness. SeqMark instead, differentiates the high‑probable output subspace and partitions it into valid and invalid regions, ensuring the even spread of high‑quality outputs among all the regions. On various constrained generation tasks like machine translation, code generation, and abstractive summarization, SeqMark substantially improves watermark detection accuracy (up to 28% increase in F1) while maintaining high generation quality.

Abstract:
Large Language Models (LLMs) can now solve entire exams directly from uploaded PDF assessments, raising urgent concerns about academic integrity and the reliability of grades and credentials. Existing watermarking techniques either operate at the token level or assume control over the model's decoding process, making them ineffective when students query proprietary black‑box systems with instructor‑provided documents. We present Integrity Shield, a document‑layer watermarking system that embeds schema‑aware, item‑level watermarks into assessment PDFs while keeping their human‑visible appearance unchanged. These watermarks consistently prevent MLLMs from answering shielded exam PDFs and encode stable, item‑level signatures that can be reliably recovered from model or student responses. Across 30 exams spanning STEM, humanities, and medical reasoning, Integrity Shield achieves exceptionally high prevention (91‑94% exam‑level blocking) and strong detection reliability (89‑93% signature retrieval) across four commercial MLLMs. Our demo showcases an interactive interface where instructors upload an exam, preview watermark behavior, and inspect pre/post AI performance & authorship evidence.

Abstract:
This paper presents SiliconHealth, a comprehensive blockchain‑based healthcare infrastructure designed for resource‑constrained regions, particularly sub‑Saharan Africa. We demonstrate that obsolete Bitcoin mining Application‑Specific Integrated Circuits (ASICs) can be repurposed to create a secure, low‑cost, and energy‑efficient medical records system. The proposed architecture employs a four‑tier hierarchical network: regional hospitals using Antminer S19 Pro (90+ TH/s), urban health centers with Antminer S9 (14 TH/s), rural clinics equipped with Lucky Miner LV06 (500 GH/s, 13W), and mobile health points with portable ASIC devices. We introduce the Deterministic Hardware Fingerprinting (DHF) paradigm, which repurposes SHA‑256 mining ASICs as cryptographic proof generators, achieving 100% verification rate across 23 test proofs during 300‑second validation sessions. The system incorporates Reed‑Solomon LSB watermarking for medical image authentication with 30‑40% damage tolerance, semantic Retrieval‑Augmented Generation (RAG) for intelligent medical record queries, and offline synchronization protocols for intermittent connectivity. Economic analysis demonstrates 96% cost reduction compared to GPU‑based alternatives, with total deployment cost of 847 per rural clinic including 5‑year solar power infrastructure. Validation experiments on Lucky Miner LV06 (BM1366 chip, 5nm) achieve 2.93 MH/W efficiency and confirm hardware universality. This work establishes a practical framework for deploying verifiable, tamper‑proof electronic health records in regions where traditional healthcare IT infrastructure is economically unfeasible, potentially benefiting over 600 million people lacking access to basic health information systems.

Abstract:
We present CallShield, the first caller identity authentication system that operates entirely at the audio layer, without relying on speech transcription, internet connectivity, or trusted infrastructure. CallShield introduces a real‑time neural watermarking technique that enables per‑bit embedding and recovery within 40‑millisecond frames of live 8 kHz speech. This capability allows CallShield to transform the real‑time audio channel into a noisy serial communication medium. To ensure reliable data transmission, CallShield implements a low‑bitrate data link protocol that provides basic frame synchronization along with error detection, correction, and recovery. For caller authentication, CallShield adopts a secure and lightweight symmetric‑key protocol that relies on pairwise shared secrets among trusted contacts. The system completes the full authentication process in an average of 63 seconds, including up to three retransmission attempts, making it suitable for real‑time deployment. Extensive experiments under realistic telephony conditions demonstrate that CallShield achieves an overall authentication success rates exceeding 99.2% on clean audio and over 95% under common distortions, aided by selective retransmission of failed messages. Additionally, CallShield maintains high audio quality, achieving PESQ scores above 4.2 and STOI scores above 0.94 on clean speech, and exhibits robustness across a wide range of channel distortions, validating its practical viability for secure, real‑time caller authentication.

Abstract:
Invisible watermarking has become a critical mechanism for authenticating AI‑generated image content, with major platforms deploying watermarking schemes at scale. However, evaluating the vulnerability of these schemes against sophisticated removal attacks remains essential to assess their reliability and guide robust design. In this work, we expose a fundamental vulnerability in invisible watermarks by reformulating watermark removal as a view synthesis problem. Our key insight is that generating a perceptually consistent alternative view of the same semantic content, akin to re‑observing a scene from a shifted perspective, naturally removes the embedded watermark while preserving visual fidelity. This reveals a critical gap: watermarks robust to pixel‑space and frequency‑domain attacks remain vulnerable to semantic‑preserving viewpoint transformations. We introduce a zero‑shot diffusion‑based framework that applies controlled geometric transformations in latent space, augmented with view‑guided correspondence attention to maintain structural consistency during reconstruction. Operating on frozen pre‑trained models without detector access or watermark knowledge, our method achieves state‑of‑the‑art watermark suppression across 15 watermarking methods‑‑outperforming 14 baseline attacks while maintaining superior perceptual quality across multiple datasets.

Abstract:
Watermarking has emerged as a pivotal solution for content traceability and intellectual property protection in Large Vision‑Language Models (LVLMs). However, vision‑agnostic watermarks introduce visually irrelevant tokens and disrupt visual grounding by enforcing indiscriminate pseudo‑random biases, while some semantic‑aware methods incur prohibitive inference latency due to rejection sampling. In this paper, we propose the VIsual Semantic Adaptive Watermark (VISA‑Mark), a novel framework that embeds detectable signals while strictly preserving visual fidelity. Our approach employs a lightweight, efficiently trained prefix‑tuner to extract dynamic Visual‑Evidence Weights, which quantify the evidentiary support for candidate tokens based on the visual input. These weights guide an adaptive vocabulary partitioning and logits perturbation mechanism, concentrating watermark strength specifically on visually‑supported tokens. By actively aligning the watermark with visual evidence, VISA‑Mark effectively maintains visual fidelity. Empirical results confirm that VISA‑Mark outperforms conventional methods with a 7.8% improvement in visual consistency (Chair‑I) and superior semantic fidelity. The framework maintains highly competitive detection accuracy (96.88% AUC) and robust attack resilience (99.3%) without sacrificing inference efficiency, effectively establishing a new standard for reliability‑preserving multimodal watermarking.

Abstract:
The proliferation of generative AI systems creates unprecedented opportunities for content creation while raising critical concerns about controllability, copyright infringement, and content provenance. Current generative models operate as "black boxes" with limited user control and lack built‑in mechanisms to protect intellectual property or trace content origin. We propose a novel multi‑agent framework that addresses these challenges through specialized agent roles and integrated watermarking. Our system orchestrates Director, Generator, Reviewer, Integration, and Protection agents to ensure user intent alignment while embedding digital provenance markers. We demonstrate feasibility through two case studies: creative content generation with iterative refinement and copyright protection for AI‑generated art in commercial contexts. Preliminary feasibility evidence from prior work indicates up to 23% improvement in semantic alignment and 95% watermark recovery rates. This work contributes to responsible generative AI deployment, positioning multi‑agent systems as a solution for trustworthy creative workflows in legal and commercial applications.

Abstract:
Multimodal AI systems integrate text generation, image generation, and other capabilities within a single conversational interface. These systems employ safety mechanisms to prevent disallowed actions, including the removal of watermarks from copyrighted images. While single‑turn refusals are expected, the interaction between safety filters and conversation‑level state is not well understood. This study documents a reproducible behavioral effect in the ChatGPT (GPT‑5.1) web interface. Manual execution was chosen to capture the exact user‑facing safety behavior of the production system, rather than isolated API components. When a conversation begins with an uploaded copyrighted image and a request to remove a watermark, which the model correctly refuses, subsequent prompts to generate unrelated, benign images are refused for the remainder of the session. Importantly, text‑only requests (e.g., generating a Python function) continue to succeed. Across 40 manually run sessions (30 contaminated and 10 controls), contaminated threads showed 116/120 image‑generation refusals (96.67%), while control threads showed 0/40 refusals (Fisher's exact p < 0.0001). All sessions used an identical fixed prompt order, ensuring sequence uniformity across conditions. We describe this as safety‑state persistence: a form of conversational over‑generalization in which a copyright refusal influences subsequent, unrelated image‑generation behavior. We present these findings as behavioral observations, not architectural claims. We discuss possible explanations, methodological limitations (single model, single interface), and implications for multimodal reliability, user experience, and the design of session‑level safety systems. These results motivate further examination of session‑level safety interactions in multimodal AI systems.

Abstract:
Reasoning Large Language Models (RLLMs) excelling in complex tasks present unique challenges for digital watermarking, as existing methods often disrupt logical coherence or incur high computational costs. Token‑based watermarking techniques can corrupt the reasoning flow by applying pseudo‑random biases, while semantic‑aware approaches improve quality but introduce significant latency or require auxiliary models. This paper introduces ReasonMark, a novel watermarking framework specifically designed for reasoning‑intensive LLMs. Our approach decouples generation into an undisturbed Thinking Phase and a watermarked Answering Phase. We propose a Criticality Score to identify semantically pivotal tokens from the reasoning trace, which are distilled into a Principal Semantic Vector (PSV). The PSV then guides a semantically‑adaptive mechanism that modulates watermark strength based on token‑PSV alignment, ensuring robustness without compromising logical integrity. Extensive experiments show ReasonMark surpasses state‑of‑the‑art methods by reducing text Perplexity by 0.35, increasing translation BLEU score by 0.164, and raising mathematical accuracy by 0.67 points. These advancements are achieved alongside a 0.34% higher watermark detection AUC and stronger robustness to attacks, all with a negligible increase in latency. This work enables the traceable and trustworthy deployment of reasoning LLMs in real‑world applications.

Abstract:
As large language models (LLMs) are increasingly deployed for text generation, watermarking has become essential for authorship attribution, intellectual property protection, and misuse detection. While existing watermarking methods perform well in high‑resource languages, their robustness in low‑resource languages remains underexplored. This work presents the first systematic evaluation of state‑of‑the‑art text watermarking methods: KGW, Exponential Sampling (EXP), and Waterfall, for Bangla LLM text generation under cross‑lingual round‑trip translation (RTT) attacks. Under benign conditions, KGW and EXP achieve high detection accuracy (>88%) with negligible perplexity and ROUGE degradation. However, RTT causes detection accuracy to collapse below RTT causes detection accuracy to collapse to 9‑13%, indicating a fundamental failure of token‑level watermarking. To address this, we propose a layered watermarking strategy that combines embedding‑time and post‑generation watermarks. Experimental results show that layered watermarking improves post‑RTT detection accuracy by 25‑35%, achieving 40‑50% accuracy, representing a 3× to 4× relative improvement over single‑layer methods, at the cost of controlled semantic degradation. Our findings quantify the robustness‑quality trade‑off in multilingual watermarking and establish layered watermarking as a practical, training‑free solution for low‑resource languages such as Bangla. Our code and data will be made public.

Abstract:
Training data is a critical and often proprietary asset in Large Language Model (LLM) development, motivating the use of data watermarking to embed model‑transferable signals for usage verification. We identify low coverage as a vital yet largely overlooked requirement for practicality, as individual data owners typically contribute only a minute fraction of massive training corpora. Prior methods fail to maintain stealthiness, verification feasibility, or robustness when only one or a few sequences can be modified. To address these limitations, we introduce SLIM, a framework enabling per‑user data provenance verification under strict black‑box access. SLIM leverages intrinsic LLM properties to induce a Latent‑Space Confusion Zone by training the model to map semantically similar prefixes to divergent continuations. This manifests as localized generation instability, which can be reliably detected via hypothesis testing. Experiments demonstrate that SLIM achieves ultra‑low coverage capability, strong black‑box verification performance, and great scalability while preserving both stealthiness and model utility, offering a robust solution for protecting training data in modern LLM pipelines.

Abstract:
We present SWaRL, a robust and fidelity‑preserving watermarking framework designed to protect the intellectual property of code LLMs by embedding unique and verifiable signatures in the generated program. Existing watermarking approaches either rely on handcrafted code transformations or manipulate token generation probabilities at inference time, making them vulnerable to removal attacks or prone to breaking functional correctness. To address these challenges, SWaRL employs a reinforcement learning‑based co‑training framework that uses compiler feedback for functional correctness and a jointly trained confidential verifier as a reward signal to maintain watermark detectability. Furthermore, SWaRL employs low‑rank adaptation (LoRA) during fine‑tuning, enabling efficient integration of watermarking behavior and transferability across model updates. Extensive experiments show that SWaRL achieves strong watermark detection accuracy compared to prior methods while fully maintaining watermarked code functionality. Moreover, SWaRL exhibits strong resilience against refactoring and adversarial transformation attacks, which maintains reliable attribution without substantial computational overhead.

Abstract:
As frontier AIs become more powerful and costly to develop, adversaries have increasing incentives to steal model weights by mounting exfiltration attacks. In this work, we consider exfiltration attacks where an adversary attempts to sneak model weights out of a datacenter over a network. While exfiltration attacks are multi‑step cyber attacks, we demonstrate that a single factor, the compressibility of model weights, significantly heightens exfiltration risk for large language models (LLMs). We tailor compression specifically for exfiltration by relaxing decompression constraints and demonstrate that attackers could achieve 16x to 100x compression with minimal trade‑offs, reducing the time it would take for an attacker to illicitly transmit model weights from the defender's server from months to days. Finally, we study defenses designed to reduce exfiltration risk in three distinct ways: making models harder to compress, making them harder to 'find,' and tracking provenance for post‑attack analysis using forensic watermarks. While all defenses are promising, the forensic watermark defense is both effective and cheap, and therefore is a particularly attractive lever for mitigating weight‑exfiltration risk.

Abstract:
In this paper, we introduce \emphLuminark, a training‑free and probabilistically‑certified watermarking method for general vision generative models. Our approach is built upon a novel watermark definition that leverages patch‑level luminance statistics. Specifically, the service provider predefines a binary pattern together with corresponding patch‑level thresholds. To detect a watermark in a given image, we evaluate whether the luminance of each patch surpasses its threshold and then verify whether the resulting binary pattern aligns with the target one. A simple statistical analysis demonstrates that the false positive rate of the proposed method can be effectively controlled, thereby ensuring certified detection. To enable seamless watermark injection across different paradigms, we leverage the widely adopted guidance technique as a plug‑and‑play mechanism and develop the \emphwatermark guidance. This design enables Luminark to achieve generality across state‑of‑the‑art generative models without compromising image quality. Empirically, we evaluate our approach on nine models spanning diffusion, autoregressive, and hybrid frameworks. Across all evaluations, Luminark consistently demonstrates high detection accuracy, strong robustness against common image transformations, and good performance on visual quality.

Abstract:
Graph Retrieval‑Augmented Generation (GraphRAG) has emerged as a key technique for enhancing Large Language Models (LLMs) with proprietary Knowledge Graphs (KGs) in knowledge‑intensive applications. As these KGs often represent an organization's highly valuable intellectual property (IP), they face a significant risk of theft for private use. In this scenario, attackers operate in isolated environments. This private‑use threat renders passive defenses like watermarking ineffective, as they require output access for detection. Simultaneously, the low‑latency demands of GraphRAG make strong encryption which incurs prohibitive overhead impractical. To address these challenges, we propose AURA, a novel framework based on Data Adulteration designed to make any stolen KG unusable to an adversary. Our framework pre‑emptively injects plausible but false adulterants into the KG. For an attacker, these adulterants deteriorate the retrieved context and lead to factually incorrect responses. Conversely, for authorized users, a secret key enables the efficient filtering of all adulterants via encrypted metadata tags before they are passed to the LLM, ensuring query results remain completely accurate. Our evaluation demonstrates the effectiveness of this approach: AURA degrades the performance of unauthorized systems to an accuracy of just 5.3%, while maintaining 100% fidelity for authorized users with negligible overhead. Furthermore, AURA proves robust against various sanitization attempts, retaining 80.2% of its adulterants.

Abstract:
Ensuring the authenticity and ownership of digital images is increasingly challenging as modern editing tools enable highly realistic forgeries. Existing image protection systems mainly rely on digital watermarking, which is susceptible to sophisticated digital attacks. To address this limitation, we propose a hybrid optical‑digital framework that incorporates physical authentication cues during image formation and preserves them through a learned reconstruction process. At the optical level, a phase mask in the camera aperture produces a Null‑space Optical Watermark (NOWA) that lies in the Null Space of the imaging operator and therefore remains invisible in the captured image. Then, a Null‑Space Network (NSN) performs measurement‑consistent reconstruction that delivers high‑quality protected images while preserving the NOWA signature. The proposed design enables tamper localization by projecting the image onto the camera's null space and detecting pixel‑level inconsistencies. Our design preserves perceptual quality, resists common degradations such as compression, and establishes a structural security asymmetry: without access to the optical or NSN parameters, adversaries cannot forge the NOWA signature. Experiments with simulations and a prototype camera demonstrate competitive performance in terms of image quality preservation, and tamper localization accuracy compared to state‑of‑the‑art digital watermarking and learning‑based authentication methods.

Abstract:
Existing deep image watermarking methods follow a fixed embedding‑distortion‑extraction pipeline, where the embedder and extractor are weakly coupled through a final loss and optimized in isolation. This design lacks explicit collaboration, leaving no structured mechanism for the embedder to incorporate decoding‑aware cues or for the extractor to guide embedding during training. To address this architectural limitation, we rethink deep image watermarking by reformulating embedding and extraction as explicitly collaborative components. To realize this reformulation, we introduce a Collaborative Interaction Mechanism (CIM) that establishes direct, bidirectional communication between the embedder and extractor, enabling a mutual‑teacher training paradigm and coordinated optimization. Built upon this explicitly collaborative architecture, we further propose an Adaptive Feature Modulation Module (AFMM) to support effective interaction. AFMM enables content‑aware feature regulation by decoupling modulation structure and strength, guiding watermark embedding toward stable image features while suppressing host interference during extraction. Under CIM, the AFMMs on both sides form a closed‑loop collaboration that aligns embedding behavior with extraction objectives. This architecture‑level redesign changes how robustness is learned in watermarking systems. Rather than relying on exhaustive distortion simulation, robustness emerges from coordinated representation learning between embedding and extraction. Experiments on real‑world and AI‑generated datasets demonstrate that the proposed method consistently outperforms state‑of‑the‑art approaches in watermark extraction accuracy while maintaining high perceptual quality, showing strong robustness and generalization.

Abstract:
Misuse of LLM‑generated text can be curbed by watermarking techniques that embed implicit signals into the output. We propose a watermark that partitions the vocabulary at each decoding step into three sets (Green/Yellow/Red) with fixed ratios and restricts sampling to the Green and Yellow sets. At detection time, we replay the same partitions, compute Green‑enrichment and Red‑depletion statistics, convert them to one‑sided z‑scores, and aggregate their p‑values via Fisher's method to decide whether a passage is watermarked. We implement generation, detection, and testing on Llama 2 7B, and evaluate true‑positive rate, false‑positive rate, and text quality. Results show that the triple‑partition scheme achieves high detection accuracy at fixed FPR while preserving readability.

Abstract:
Image watermarking supports authenticity and provenance, yet many schemes are still easy to bypass with various distortions and powerful generative edits. Deep learning‑based watermarking has improved robustness to diffusion‑based image editing, but a gap remains when a watermarked image is converted to video by image‑to‑video (I2V), in which per‑frame watermark detection weakens. I2V has quickly advanced from short, jittery clips to multi‑second, temporally coherent scenes, and it now serves not only content creation but also world‑modeling and simulation workflows, making cross‑modal watermark recovery crucial. We present WaTeRFlow, a framework tailored for robustness under I2V. It consists of (i) FUSE (Flow‑guided Unified Synthesis Engine), which exposes the encoder‑decoder to realistic distortions via instruction‑driven edits and a fast video diffusion proxy during training, (ii) optical‑flow warping with a Temporal Consistency Loss (TCL) that stabilizes per‑frame predictions, and (iii) a semantic preservation loss that maintains the conditioning signal. Experiments across representative I2V models show accurate watermark recovery from frames, with higher first‑frame and per‑frame bit accuracy and resilience when various distortions are applied before or after video generation.

Abstract:
The integrity of data visualizations is increasingly threatened by image editing techniques that enable subtle yet deceptive tampering. Through a formative study, we define this challenge and categorize tampering techniques into two primary types: data manipulation and visual encoding manipulation. To address this, we present VizDefender, a framework for tampering detection and analysis. The framework integrates two core components: 1) a semi‑fragile watermark module that protects the visualization by embedding a location map to images, which allows for the precise localization of tampered regions while preserving visual quality, and 2) an intent analysis module that leverages Multimodal Large Language Models (MLLMs) to interpret manipulation, inferring the attacker's intent and misleading effects. Extensive evaluations and user studies demonstrate the effectiveness of our methods.

Abstract:
Text‑to‑Speech (TTS) diffusion models generate high‑quality speech, which raises challenges for the model intellectual property protection and speech tracing for legal use. Audio watermarking is a promising solution. However, due to the structural differences among various TTS diffusion models, existing watermarking methods are often designed for a specific model and degrade audio quality, which limits their practical applicability. To address this dilemma, this paper proposes a universal watermarking scheme for TTS diffusion models, termed Smark. This is achieved by designing a lightweight watermark embedding framework that operates in the common reverse diffusion paradigm shared by all TTS diffusion models. To mitigate the impact on audio quality, Smark utilizes the discrete wavelet transform (DWT) to embed watermarks into the relatively stable low‑frequency regions of the audio, which ensures seamless watermark‑audio integration and is resistant to removal during the reverse diffusion process. Extensive experiments are conducted to evaluate the audio quality and watermark performance in various simulated real‑world attack scenarios. The experimental results show that Smark achieves superior performance in both audio quality and watermark extraction accuracy.

Abstract:
Pseudorandom error‑correcting codes (PRC) is a novel cryptographic primitive proposed at CRYPTO 2024. Due to the dual capability of pseudorandomness and error correction, PRC has been recognized as a promising foundational component for watermarking AI‑generated content. However, the security of PRC has not been thoroughly analyzed, especially with concrete parameters or even in the face of cryptographic attacks. To fill this gap, we present the first cryptanalysis of PRC. We first propose three attacks to challenge the undetectability and robustness assumptions of PRC. Among them, two attacks aim to distinguish PRC‑based codewords from plain vectors, and one attack aims to compromise the decoding process of PRC. Our attacks successfully undermine the claimed security guarantees across all parameter configurations. Notably, our attack can detect the presence of a watermark with overwhelming probability at a cost of 2^22 operations. We also validate our approach by attacking real‑world large generative models such as DeepSeek and Stable Diffusion. To mitigate our attacks, we further propose three defenses to enhance the security of PRC, including parameter suggestions, implementation suggestions, and constructing a revised key generation algorithm. Our proposed revised key generation function effectively prevents the occurrence of weak keys. However, we highlight that the current PRC‑based watermarking scheme still cannot achieve a 128‑bit security under our parameter suggestions due to the inherent configurations of large generative models, such as the maximum output length of large language models.

Abstract:
Large language models are exposed to risks of extraction, distillation, and unauthorized fine‑tuning. Existing defenses use watermarking or monitoring, but these act after leakage. We design AlignDP, a hybrid privacy lock that blocks knowledge transfer at the data interface. The key idea is to separate rare and non‑rare fields. Rare fields are shielded by PAC indistinguishability, giving effective zero‑epsilon local DP. Non‑rare fields are privatized with RAPPOR, giving unbiased frequency estimates under local DP. A global aggregator enforces composition and budget. This two‑tier design hides rare events and adds controlled noise to frequent events. We prove limits of PAC extension to global aggregation, give bounds for RAPPOR estimates, and analyze utility trade‑off. A toy simulation confirms feasibility: rare categories remain hidden, frequent categories are recovered with small error.

Abstract:
Training data detection is critical for enforcing copyright and data licensing, as Large Language Models (LLM) are trained on massive text corpora scraped from the internet. We present SPECTRA, a watermarking approach that makes training data reliably detectable even when it comprises less than 0.001% of the training corpus. SPECTRA works by paraphrasing text using an LLM and assigning a score based on how likely each paraphrase is, according to a separate scoring model. A paraphrase is chosen so that its score closely matches that of the original text, to avoid introducing any distribution shifts. To test whether a suspect model has been trained on the watermarked data, we compare its token probabilities against those of the scoring model. We demonstrate that SPECTRA achieves a consistent p‑value gap of over nine orders of magnitude when detecting data used for training versus data not used for training, which is greater than all baselines tested. SPECTRA equips data owners with a scalable, deploy‑before‑release watermark that survives even large‑scale LLM training.

Abstract:
The rapid proliferation of deep neural networks (DNNs) across several domains has led to increasing concerns regarding intellectual property (IP) protection and model misuse. Trained DNNs represent valuable assets, often developed through significant investments. However, the ease with which models can be copied, redistributed, or repurposed highlights the urgent need for effective mechanisms to assert and verify model ownership. In this work, we propose an efficient and resilient white‑box watermarking framework that embeds ownership information into the internal parameters of a DNN using chaotic sequences. The watermark is generated using a logistic map, a well‑known chaotic function, producing a sequence that is sensitive to its initialization parameters. This sequence is injected into the weights of a chosen intermediate layer without requiring structural modifications to the model or degradation in predictive performance. To validate ownership, we introduce a verification process based on a genetic algorithm that recovers the original chaotic parameters by optimizing the similarity between the extracted and regenerated sequences. The effectiveness of the proposed approach is demonstrated through extensive experiments on image classification tasks using MNIST and CIFAR‑10 datasets. The results show that the embedded watermark remains detectable after fine‑tuning, with negligible loss in model accuracy. In addition to numerical recovery of the watermark, we perform visual analyses using weight density plots and construct activation‑based classifiers to distinguish between original, watermarked, and tampered models. Overall, the proposed method offers a flexible and scalable solution for embedding and verifying model ownership in white‑box settings well‑suited for real‑world scenarios where IP protection is critical.

Abstract:
Benefiting from the superior capabilities of large language models in natural language understanding and generation, Embeddings‑as‑a‑Service (EaaS) has emerged as a successful commercial paradigm on the web platform. However, prior studies have revealed that EaaS is vulnerable to imitation attacks. Existing methods protect the intellectual property of EaaS through watermarking techniques, but they all ignore the most important properties of embedding: semantics, resulting in limited harmlessness and stealthiness. To this end, we propose SemMark, a novel semantic‑based watermarking paradigm for EaaS copyright protection. SemMark employs locality‑sensitive hashing to partition the semantic space and inject semantic‑aware watermarks into specific regions, ensuring that the watermark signals remain imperceptible and diverse. In addition, we introduce the adaptive watermark weight mechanism based on the local outlier factor to preserve the original embedding distribution. Furthermore, we propose Detect‑Sampling and Dimensionality‑Reduction attacks and construct four scenarios to evaluate the watermarking method. Extensive experiments are conducted on four popular NLP datasets, and SemMark achieves superior verifiability, diversity, stealthiness, and harmlessness.

Abstract:
With the rapid development of cloud‑based services, large language models have become increasingly accessible through various web platforms. However, this accessibility has also led to growing risks of model abuse. LLM watermarking has emerged as an effective approach to mitigate such misuse and protect intellectual property. Existing watermarking algorithms, however, primarily focus on defending against paraphrase attacks while overlooking piggyback spoofing attacks, which can inject harmful content, compromise watermark reliability, and undermine trust in attribution. To address this limitation, we propose DualGuard, the first watermarking algorithm capable of defending against both paraphrase and spoofing attacks. DualGuard employs the adaptive dual‑stream watermarking mechanism, in which two complementary watermark signals are dynamically injected based on the semantic content. This design enables DualGuard not only to detect but also to trace spoofing attacks, thereby ensuring reliable and trustworthy watermark detection. Extensive experiments conducted across multiple datasets and language models demonstrate that DualGuard achieves excellent detectability, robustness, traceability, and text quality, effectively advancing the state of LLM watermarking for real‑world applications.

Abstract:
The rapid advancement of deep learning has turned models into highly valuable assets due to their reliance on massive data and costly training processes. However, these models are increasingly vulnerable to leakage and theft, highlighting the critical need for robust intellectual property protection. Model watermarking has emerged as an effective solution, with black‑box watermarking gaining significant attention for its practicality and flexibility. Nonetheless, existing black‑box methods often fail to better balance covertness (hiding the watermark to prevent detection and forgery) and robustness (ensuring the watermark resists removal)‑two essential properties for real‑world copyright verification. In this paper, we propose ComMark, a novel black‑box model watermarking framework that leverages frequency‑domain transformations to generate compressed, covert, and attack‑resistant watermark samples by filtering out high‑frequency information. To further enhance watermark robustness, our method incorporates simulated attack scenarios and a similarity loss during training. Comprehensive evaluations across diverse datasets and architectures demonstrate that ComMark achieves state‑of‑the‑art performance in both covertness and robustness. Furthermore, we extend its applicability beyond image recognition to tasks including speech recognition, sentiment analysis, image generation, image captioning, and video recognition, underscoring its versatility and broad applicability.

Abstract:
The success of machine learning for real‑world robotic systems has created a new form of intellectual property: the trained policy. This raises a critical need for novel methods that verify ownership and detect unauthorized, possibly unsafe misuse. While watermarking is established in other domains, physical policies present a unique challenge: remote detection. Existing methods assume access to the robot's internal state, but auditors are often limited to external observations (e.g., video footage). This ``Physical Observation Gap'' means the watermark must be detected from signals that are noisy, asynchronous, and filtered by unknown system dynamics. We formalize this challenge using the concept of a glimpse sequence, and introduce Colored Noise Coherency (CoNoCo), the first watermarking strategy designed for remote detection. CoNoCo embeds a spectral signal into the robot's motions by leveraging the policy's inherent stochasticity. To show it does not degrade performance, we prove CoNoCo preserves the marginal action distribution. Our experiments demonstrate strong, robust detection across various remote modalities, including motion capture and side‑way/top‑down video footage, in both simulated and real‑world robot experiments. This work provides a necessary step toward protecting intellectual property in robotics, offering the first method for validating the provenance of physical policies non‑invasively, using purely remote observations.

Abstract:
Recent advances in generative AI have enabled the creation of highly realistic digital content, raising concerns around authenticity, ownership, and misuse. While watermarking has become an increasingly important mechanism to trace and protect digital media, most existing image watermarking schemes operate as black boxes, producing global detection scores without offering any insight into how or where the watermark is present. This lack of transparency impacts user trust and makes it difficult to interpret the impact of tampering. In this paper, we present a post‑hoc image watermarking method that combines localised embedding with region‑level interpretability. Our approach embeds watermark signals in the discrete wavelet transform domain using a statistical block‑wise strategy. This allows us to generate detection maps that reveal which regions of an image are likely watermarked or altered. We show that our method achieves strong robustness against common image transformations while remaining sensitive to semantic manipulations. At the same time, the watermark remains highly imperceptible. Compared to prior post‑hoc methods, our approach offers more interpretable detection while retaining competitive robustness. For example, our watermarks are robust to cropping up to half the image.

Abstract:
Watermarking large language models (LLMs) is vital for preventing their misuse, including the fabrication of fake news, plagiarism, and spam. It is especially important to watermark LLM‑generated code, as it often contains intellectual property.However, we found that existing methods for watermarking LLM‑generated code fail to address comment removal attack.In such cases, an attacker can simply remove the comments from the generated code without affecting its functionality, significantly reducing the effectiveness of current code‑watermarking techniques.On the other hand, injecting a watermark into code is challenging because, as previous works have noted, most code represents a low‑entropy scenario compared to natural language. Our approach to addressing this issue involves leveraging prior knowledge to distinguish between low‑entropy and high‑entropy parts of the code, as indicated by a Cue List of words.We then inject the watermark guided by this Cue List, achieving higher detectability and usability than existing methods.We evaluated our proposed method on HumanEvaland compared our method with three state‑of‑the‑art code watermarking techniques. The results demonstrate the effectiveness of our approach.

Abstract:
Securing digital text is becoming increasingly relevant due to the widespread use of large language models. Individuals' fear of losing control over data when it is being used to train such machine learning models or when distinguishing model‑generated output from text written by humans. Digital watermarking provides additional protection by embedding an invisible watermark within the data that requires protection. However, little work has been taken to analyze and verify if existing digital text watermarking methods are secure and undetectable by large language models. In this paper, we investigate the security‑related area of watermarking and machine learning models for text data. In a controlled testbed of three experiments, ten existing Unicode text watermarking methods were implemented and analyzed across six large language models: GPT‑5, GPT‑4o, Teuken 7B, Llama 3.3, Claude Sonnet 4, and Gemini 2.5 Pro. The findings of our experiments indicate that, especially the latest reasoning models, can detect a watermarked text. Nevertheless, all models fail to extract the watermark unless implementation details in the form of source code are provided. We discuss the implications for security researchers and practitioners and outline future research opportunities to address security concerns.

Abstract:
The rapid proliferation of Artificial Intelligence Generated Content has precipitated a crisis of trust and urgent regulatory demands. However, existing identification tools suffer from fragmentation and a lack of support for visible compliance marking. To address these gaps, we introduce the UniMark, an open‑source, unified framework for multimodal content governance. Our system features a modular unified engine that abstracts complexities across text, image, audio, and video modalities. Crucially, we propose a novel dual‑operation strategy, natively supporting both \emphHidden Watermarking for copyright protection and \emphVisible Marking for regulatory compliance. Furthermore, we establish a standardized evaluation framework with three specialized benchmarks (Image/Video/Audio‑Bench) to ensure rigorous performance assessment. This toolkit bridges the gap between advanced algorithms and engineering implementation, fostering a more transparent and secure digital ecosystem.

Abstract:
The advent of high‑quality video generation models has amplified the need for robust watermarking schemes that can be used to reliably detect and track the provenance of generated videos. Existing video watermarking methods based on both post‑hoc and in‑generation approaches fail to simultaneously achieve imperceptibility, robustness, and computational efficiency. This work introduces a novel framework for in‑generation video watermarking called SPDMark (pronounced `SpeedMark') based on selective parameter displacement of a video diffusion model. Watermarks are embedded into the generated videos by modifying a subset of parameters in the generative model. To make the problem tractable, the displacement is modeled as an additive composition of layer‑wise basis shifts, where the final composition is indexed by the watermarking key. For parameter efficiency, this work specifically leverages low‑rank adaptation (LoRA) to implement the basis shifts. During the training phase, the basis shifts and the watermark extractor are jointly learned by minimizing a combination of message recovery, perceptual similarity, and temporal consistency losses. To detect and localize temporal modifications in the watermarked videos, we use a cryptographic hashing function to derive frame‑specific watermark messages from the given base watermarking key. During watermark extraction, maximum bipartite matching is applied to recover the correct frame order, even from temporally tampered videos. Evaluations on both text‑to‑video and image‑to‑video generation models demonstrate the ability of SPDMark to generate imperceptible watermarks that can be recovered with high accuracy and also establish its robustness against a variety of common video modifications.

Abstract:
The proliferation of AI‑generated video models poses new challenges to information integrity and digital trust. A key confound, however, remains unaddressed: commercial generators embed visible overlay watermarks for provenance tracking, yet no existing benchmark controls for this variable, leaving open whether detectors learn genuine generation artefacts or merely associate watermark patterns with AI‑generated labels. We present RobustSora, a benchmark of 6,500 manually verified videos in four categories: Authentic‑Clean (A‑C), Generated‑Watermarked (G‑W), Generated‑DeWatermarked (G‑DeW), and Authentic‑Spoofed (A‑S), sourced from Vript, DVF, and UltraVideo (authentic) and from Sora, Sora 2, Pika, Open‑Sora 2, and KLing (generated). Two evaluation tasks isolate watermark effects: Task‑I (Watermark Erasure Robustness) tests detection on watermark‑removed AI videos; Task‑II (Watermark Spoofing Robustness) measures false‑alarm rates on authentic videos injected with fake watermarks. Across ten models spanning specialized detectors, transformer classifiers, and MLLMs, watermark manipulation induces accuracy changes of ‑9.4 to +1.6 pp (mean 6.6 pp; p<0.01 for 7/10 models on each task). A placebo control bounds inpainting‑artefact confounds at \le2 pp, and a watermark‑aware training augmentation recovers 3‑4 pp on both tasks, together providing causal evidence that detectors actively rely on watermark cues. Per‑generator breakdown shows that Sora 2 induces drops of ‑11 to ‑14 pp versus ‑3 to ‑6 pp for Pika and Open‑Sora 2, indicating that watermark prominence, rather than detector architecture, is the principal driver of dependency. These results argue for watermark‑aware evaluation and training in AIGC video detection. Dataset, evaluation code, and pretrained checkpoints will be released.

Abstract:
A recent watermarking scheme for language models achieves distortion‑free embedding and robustness to edit‑distance attacks. However, it suffers from limited generation diversity and high detection overhead. In parallel, recent research has focused on undetectability, a property ensuring that watermarks remain difficult for adversaries to detect and spoof. In this work, we introduce a new class of watermarking schemes constructed through probabilistic automata. We present two instantiations: (i) a practical scheme with exponential generation diversity and computational efficiency, and (ii) a theoretical construction with formal undetectability guarantees under cryptographic assumptions. Extensive experiments on LLaMA‑3B and Mistral‑7B validate the superior performance of our scheme in terms of robustness and efficiency.

Abstract:
Watermarks are an essential tool for identifying AI‑generated content. Recently, Christ and Gunn (CRYPTO '24) introduced pseudorandom error‑correcting codes (PRCs), which are equivalent to watermarks with strong robustness and quality guarantees. A PRC is a pseudorandom encryption scheme whose decryption algorithm tolerates a high rate of errors. Pseudorandomness ensures quality preservation of the watermark, and error tolerance of decryption translates to the watermark's ability to withstand modification of the content. In the short time since the introduction of PRCs, several works (NeurIPS '24, RANDOM '25, STOC '25) have proposed new constructions. Curiously, all of these constructions are vulnerable to quasipolynomial‑time distinguishing attacks. Furthermore, all lack robustness to edits over a constant‑sized alphabet, which is necessary for a meaningfully robust LLM watermark. Lastly, they lack robustness to adversaries who know the watermarking detection key. Until now, it was not clear whether any of these properties was achievable individually, let alone together. We construct pseudorandom codes that achieve all of the above: plausible subexponential pseudorandomness security, robustness to worst‑case edits over a binary alphabet, and robustness against even computationally unbounded adversaries that have the detection key. Pseudorandomness rests on a new assumption that we formalize, the permuted codes conjecture, which states that a distribution of permuted noisy codewords is pseudorandom. We show that this conjecture is implied by the permuted puzzles conjecture used previously to construct doubly efficient private information retrieval. To give further evidence, we show that the conjecture holds against a broad class of simple distinguishers, including read‑once branching programs.

Abstract:
We introduce ideal attribution mechanisms, a formal abstraction for reasoning about attribution decisions over strings. At the core of this abstraction lies the ledger, an append‑only log of the prompt‑response interaction history between a model and its user. Each mechanism produces deterministic decisions based on the ledger and an explicit selection criterion, making it well‑suited to serve as a ground truth for attribution. We frame the design goal of watermarking schemes as faithful representation of ideal attribution mechanisms. This novel perspective brings conceptual clarity, replacing piecemeal probabilistic statements with a unified language for stating the guarantees of each scheme. It also enables precise reasoning about desiderata for future watermarking schemes, even when no current construction achieves them, since the ideal functionalities are specified first. In this way, the framework provides a roadmap that clarifies which guarantees are attainable in an idealized setting and worth pursuing in practice.

Abstract:
Large language models (LLMs) present a dual challenge for forensic linguistics. They serve as powerful analytical tools enabling scalable corpus analysis and embedding‑based authorship attribution, while simultaneously destabilising foundational assumptions about idiolect through style mimicry, authorship obfuscation, and the proliferation of synthetic texts. Recent stylometric research indicates that LLMs can approximate surface stylistic features yet exhibit detectable differences from human writers, a tension with significant forensic implications. However, current AI‑text detection techniques, whether classifier‑based, stylometric, or watermarking approaches, face substantial limitations: high false positive rates for non‑native English writers and vulnerability to adversarial strategies such as homoglyph substitution. These uncertainties raise concerns under legal admissibility standards, particularly the Daubert and Kumho Tire frameworks. The article concludes that forensic linguistics requires methodological reconfiguration to remain scientifically credible and legally admissible. Proposed adaptations include hybrid human‑AI workflows, explainable detection paradigms beyond binary classification, and validation regimes measuring error and bias across diverse populations. The discipline's core insight, i.e., that language reveals information about its producer, remains valid but must accommodate increasingly complex chains of human and machine authorship.

Abstract:
3D Gaussian Splatting (3DGS) has become a leading representation for high‑fidelity 3D assets, yet protecting these assets via digital watermarking remains an open challenge. Existing 3DGS watermarking methods are robust only to classical distortions and fail under diffusion editing, which operates at both the 2D image level and the 3D scene level, covertly erasing embedded watermarks while preserving visual plausibility. We present RDSplat, the first 3DGS watermarking framework designed to withstand both 2D and 3D diffusion editing. Our key observation is that diffusion models act as low‑pass filters that preserve low‑frequency structures while regenerating high‑frequency details. RDSplat exploits this by embedding 100‑bit watermarks exclusively into low‑frequency Gaussian primitives identified through Frequency‑Aware Primitive Selection (FAPS), which combines the Mip score and directional balance score, while freezing all other primitives. Training efficiency is achieved through a surrogate strategy that replaces costly diffusion forward passes with Gaussian blur augmentation. A dedicated decoder, GeoMark, built on ViT‑S/16 with spatially periodic secret embedding, jointly resists diffusion editing and the geometric transformations inherent to novel‑view rendering. Extensive experiments on four benchmarks under seven 2D diffusion attacks and iterative 3D editing demonstrate strong classical robustness (bit accuracy 0.811) and competitive diffusion robustness (bit accuracy 0.701) at 100‑bit capacity, while completing fine‑tuning in 3 to 7 minutes on a single RTX 4090 GPU.

Abstract:
Watermarking aims to embed hidden signals in generated text that can be reliably detected when given access to a secret key. Open‑weight language models pose acute challenges for such watermarking schemes because the inference‑time interventions that dominate contemporary approaches cannot be enforced once model weights are public. Existing watermaking techniques for open‑weight models, such as the recently proposed GaussMark, typically rely on small modifications to model weights, which can yield signals detectable to those equipped with a secret key, but achieving detection power comparable to inference‑time watermarks generally requires weight perturbations that noticeably reduce generation quality. We introduce MarkTune, a theoretically principled, on‑policy fine‑tuning framework that treats the GaussMark signal as a reward while simultaneously regularizing against degradation in text quality. We derive MarkTune as an improvement on GaussMark and demonstrate that MarkTune consistently improves the quality‑detectability trade‑off over GaussMark by steering finer‑grained, watermark‑aware weight updates within the model's representation space while preserving generation quality. Empirically, we show that MarkTune pushes the quality‑detectability frontier of GaussMark close to that of inference‑time watermarking, remains robust to paraphrasing and fine‑tuning attacks, and exhibits strong generalization: a model fine‑tuned on one dataset retains substantial watermark detection power on unseen datasets. Together, these results establish MarkTune as a general strategy for embedding robust, high‑quality watermarks into open‑weight LMs.

Abstract:
Large Language Models (LLMs) have demonstrated exceptional capabilities in natural language understanding and generation. Based on these LLMs, businesses have started to provide Embeddings‑as‑a‑Service (EaaS), offering feature extraction capabilities (in the form of text embeddings) that benefit downstream natural language processing tasks. However, prior research has demonstrated that EaaS is vulnerable to imitation attacks, where an attacker clones the service's model in a black‑box manner without access to the model's internal workings. In response, watermarks have been added to the text embeddings to protect the intellectual property of EaaS providers by allowing them to check for model ownership. This thesis focuses on defending against imitation attacks by investigating EaaS watermarks. To achieve this goal, we unveil novel attacks and propose and validate new watermarking techniques. Firstly, we show that existing EaaS watermarks can be removed through paraphrasing the input text when attackers clone the model during imitation attacks. Our study illustrates that paraphrasing can effectively bypass current state‑of‑the‑art EaaS watermarks across various attack setups (including different paraphrasing techniques and models) and datasets in most instances. This demonstrates a new vulnerability in recent EaaS watermarking techniques. Subsequently, as a countermeasure, we propose a novel watermarking technique, WET (Watermarking EaaS with Linear Transformation), which employs linear transformation of the embeddings. Watermark verification is conducted by applying a reverse transformation and comparing the similarity between recovered and original embeddings. We demonstrate its robustness against paraphrasing attacks with near‑perfect verifiability. We conduct detailed ablation studies to assess the significance of each component and hyperparameter in WET.

Abstract:
In the digital economy era, digital watermarking serves as a critical basis for ownership proof of massive replicable content, including AI‑generated and other virtual assets. Designing robust watermarks capable of withstanding various attacks and processing operations is even more paramount. We introduce TokenPure, a novel Diffusion Transformer‑based framework designed for effective and consistent watermark removal. TokenPure solves the trade‑off between thorough watermark destruction and content consistency by leveraging token‑based conditional reconstruction. It reframes the task as conditional generation, entirely bypassing the initial watermark‑carrying noise. We achieve this by decomposing the watermarked image into two complementary token sets: visual tokens for texture and structural tokens for geometry. These tokens jointly condition the diffusion process, enabling the framework to synthesize watermark‑free images with fine‑grained consistency and structural integrity. Comprehensive experiments show that TokenPure achieves state‑of‑the‑art watermark removal and reconstruction fidelity, substantially outperforming existing baselines in both perceptual quality and consistency.

Abstract:
Watermarking acts as a critical safeguard in text generated by Large Language Models (LLMs). By embedding identifiable signals into model outputs, watermarking enables reliable attribution and enhances the security of machine‑generated content. Existing approaches typically embed signals by manipulating token generation probabilities. Despite their effectiveness, these methods inherently face a trade‑off between detectability and text quality: the signal strength and randomness required for robust watermarking tend to degrade the performance of downstream tasks. In this paper, we design a novel embedding scheme that controls seed pools to facilitate diverse parallel generation of watermarked text. Based on that scheme, we propose WaterSearch, a sentence‑level, search‑based watermarking framework adaptable to a wide range of existing methods. WaterSearch enhances text quality by jointly optimizing two key aspects: 1) distribution fidelity and 2) watermark signal characteristics. Furthermore, WaterSearch is complemented by a sentence‑level detection method with strong attack robustness. We evaluate our method on three popular LLMs across ten diverse tasks. Extensive experiments demonstrate that our method achieves an average performance improvement of 51.01% over state‑of‑the‑art baselines at a watermark detectability strength of 95%. In challenging scenarios such as short text generation and low‑entropy output generation, our method yields performance gains of 47.78% and 36.47%, respectively. Moreover, under different attack senarios including insertion, synonym substitution and paraphrase attasks, WaterSearch maintains high detectability, further validating its robust anti‑attack capabilities. Our code is available at \hrefhttps://github.com/Yukang‑Lin/WaterSearchhttps://github.com/Yukang‑Lin/WaterSearch.

Abstract:
Modern generative diffusion models rely on vast training datasets, often including images with uncertain ownership or usage rights. Radioactive watermarks ‑‑ marks that transfer to a model's outputs ‑‑ can help detect when such unauthorized data has been used for training. Moreover, aside from being radioactive, an effective watermark for protecting images from unauthorized training also needs to meet other existing requirements, such as imperceptibility, robustness, and multi‑bit capacity. To overcome these challenges, we propose HMARK, a novel multi‑bit watermarking scheme, which encodes ownership information as secret bits in the semantic‑latent space (h‑space) for image diffusion models. By leveraging the interpretability and semantic significance of h‑space, ensuring that watermark signals correspond to meaningful semantic attributes, the watermarks embedded by HMARK exhibit radioactivity, robustness to distortions, and minimal impact on perceptual quality. Experimental results demonstrate that HMARK achieves 98.57% watermark detection accuracy, 95.07% bit‑level recovery accuracy, 100% recall rate, and 1.0 AUC on images produced by the downstream adversarial model finetuned with LoRA on watermarked data across various types of distortions.

Abstract:
Every day we share our personal information through digital systems which are constantly exposed to threats. For this reason, security‑oriented disciplines of signal processing have received increasing attention in the last decades: multimedia forensics, digital watermarking, biometrics, network monitoring, steganography and steganalysis are just a few examples. Even though each of these fields has its own peculiarities, they all have to deal with a common problem: the presence of one or more adversaries aiming at making the system fail. Adversarial Signal Processing lays the basis of a general theory that takes into account the impact that the presence of an adversary has on the design of effective signal processing tools. By focusing on the application side of Adversarial Signal Processing, namely adversarial information fusion in distributed sensor networks, and adopting a game‑theoretic approach, this thesis contributes to the above mission by addressing four issues. First, we address decision fusion in distributed sensor networks by developing a novel soft isolation defense scheme that protect the network from adversaries, specifically, Byzantines. Second, we develop an optimum decision fusion strategy in the presence of Byzantines. In the next step, we propose a technique to reduce the complexity of the optimum fusion by relying on a novel near‑optimum message passing algorithm based on factor graphs. Finally, we introduce a defense mechanism to protect decentralized networks running consensus algorithm against data falsification attacks.

Abstract:
The rapid growth of Artificial Intelligence‑Generated Content (AIGC) raises concerns about the authenticity of digital media. In this context, image self‑recovery, reconstructing original content from its manipulated version, offers a practical solution for understanding the attacker's intent and restoring trustworthy data. However, existing methods often fail to accurately recover tampered regions, falling short of the primary goal of self‑recovery. To address this challenge, we propose ReImage, a neural watermarking‑based self‑recovery framework that embeds a shuffled version of the target image into itself as a watermark. We design a generator that produces watermarks optimized for neural watermarking and introduce an image enhancement module to refine the recovered image. We further analyze and resolve key limitations of shuffled watermarking, enabling its effective use in self‑recovery. We demonstrate that ReImage achieves state‑of‑the‑art performance across diverse tampering scenarios, consistently producing high‑quality recovered images. The code and pretrained models will be released upon publication.

Abstract:
The rise of generative AI has enabled the production of high‑fidelity synthetic tabular data across fields such as healthcare, finance, and public policy, raising growing concerns about data provenance and misuse. Watermarking offers a promising solution to address these concerns by ensuring the traceability of synthetic data, but existing methods face many limitations: they are computationally expensive due to reliance on the inverse process of large diffusion models, struggle with mixed discrete‑continuous data, or lack robustness to common post‑processing attacks. To address these limitations, we propose TAB‑DRW, an efficient and robust post‑editing watermarking scheme for synthetic tabular data. TAB‑DRW embeds watermark signals in the frequency domain: it normalizes heterogeneous features via the Yeo‑Johnson transformation and standardization, applies the discrete Fourier transform (DFT), and adjusts the imaginary parts of adaptively selected entries according to precomputed pseudorandom bits. To further enhance robustness and efficiency, we introduce a novel rank‑based pseudorandom bit generation method that enables row‑wise retrieval without incurring storage overhead. Experiments on five benchmark tabular datasets show that TAB‑DRW achieves strong detectability and robustness against post‑processing and adaptive attacks, while preserving high data fidelity and fully supporting mixed‑type features.

Abstract:
The availability of high‑quality, AI‑generated audio raises security challenges such as misinformation campaigns and voice‑cloning fraud. A key defense against the misuse of AI‑generated audio is by watermarking it, so that it can be easily distinguished from genuine audio. Those seeking to misuse AI‑generated audio may attempt to remove audio watermarks, so studying effective watermark removal techniques is critical to objectively evaluate the robustness of audio watermarks. Previous watermark removal schemes typically assume access to the target watermark detector during the removal process. This assumption is often impractical, which may lead to a false sense of confidence in current watermark schemes. We introduce HarmonicAttack, a novel audio watermark removal method that requires no access to the target watermark algorithm. It only needs a number of original and watermarked samples to train a general model capable of removing watermarks from audio samples. We also find that training samples do not need to share the same distribution as target samples, as our attack generalizes to out‑of‑distribution samples with minimal degradation. Compared with existing watermark removal attacks, HarmonicAttack is more effective at removing watermarks from state‑of‑the‑art schemes, including AudioSeal, WavMark, SilentCipher, and AudioMarkNet, while maintaining high perceptual quality. Although HarmonicAttack is trained on the LibriSpeech dataset against AudioSeal, it generalizes across unseen datasets and watermarking schemes. For instance, on VCTK, HarmonicAttack achieves a 92% ASR against AudioMarkNet, substantially outperforming the best baseline at 38%. On FMA, HarmonicAttack reaches 100% ASR against all watermarks, whereas the best baseline achieves only 2% against AudioSeal and 44% against WavMark.

Abstract:
Recent fine‑tuning techniques for diffusion models enable them to reproduce specific image sets, such as particular faces or artistic styles, but also introduce copyright and security risks. Dataset watermarking has been proposed to ensure traceability by embedding imperceptible watermarks into training images, which remain detectable in outputs even after fine‑tuning. However, current methods lack a unified evaluation framework. To address this, this paper establishes a general threat model and introduces a comprehensive evaluation framework encompassing Universality, Transmissibility, and Robustness. Experiments show that existing methods perform well in universality and transmissibility, and exhibit some robustness against common image processing operations, yet still fall short under real‑world threat scenarios. To reveal these vulnerabilities, the paper further proposes a practical watermark removal method that fully eliminates dataset watermarks without affecting fine‑tuning, highlighting a key challenge for future research.

Abstract:
Adversarially perturbed images of text can cause sophisticated OCR systems to produce misleading or incorrect transcriptions from seemingly invisible changes to humans. Some of these perturbations even survive physical capture, posing security risks to high‑stakes applications such as document processing, license plate recognition, and automated compliance systems. Existing defenses, such as adversarial training, input preprocessing, or post‑recognition correction, are often model‑specific, computationally expensive, and affect performance on unperturbed inputs while remaining vulnerable to unseen or adaptive attacks. To address these challenges, TopoReformer is introduced, a model‑agnostic reformation pipeline that mitigates adversarial perturbations while preserving the structural integrity of text images. Topology studies properties of shapes and spaces that remain unchanged under continuous deformations, focusing on global structures such as connectivity, holes, and loops rather than exact distance. Leveraging these topological features, TopoReformer employs a topological autoencoder to enforce manifold‑level consistency in latent space and improve robustness without explicit gradient regularization. The proposed method is benchmarked on EMNIST, MNIST, against standard adversarial attacks (FGSM, PGD, Carlini‑Wagner), adaptive attacks (EOT, BDPA), and an OCR‑specific watermark attack (FAWA).

Abstract:
Multimodal large language models (MLLMs) are currently at the center of research attention, showing rapid progress in scale and capabilities, yet their intelligence, limitations, and risks remain insufficiently understood. To address these issues, particularly in the context of the Russian language, where no multimodal benchmarks currently exist, we introduce MERA Multi, an open multimodal evaluation framework for Russian‑spoken architectures. The benchmark is instruction‑based and encompasses default text, image, audio, and video modalities, comprising 18 newly constructed evaluation tasks for both general‑purpose models and modality‑specific architectures (imageto‑text, video‑to‑text, and audio‑to‑text). Our contributions include: (i) a universal taxonomy of multimodal abilities; (ii) 18 datasets created entirely from scratch with attention to Russian cultural and linguistic specificity, unified prompts, and metrics; (iii) baseline results for both closed‑source and open‑source models; (iv) a methodology for preventing benchmark leakage, including watermarking for private sets. While our current focus is on Russian, the proposed benchmark provides a replicable methodology for constructing multimodal benchmarks in typologically diverse languages, particularly within the Slavic language family.

Abstract:
In decentralized machine learning paradigms such as Split Federated Learning (SFL) and its variant U‑shaped SFL, the server's capabilities are severely restricted. Although this enhances client‑side privacy, it also leaves the server highly vulnerable to model theft by malicious clients. Ensuring intellectual property protection for such capability‑limited servers presents a dual challenge: watermarking schemes that depend on client cooperation are unreliable in adversarial settings, whereas traditional server‑side watermarking schemes are technically infeasible because the server lacks access to critical elements such as model parameters or labels. To address this challenge, this paper proposes Sigil, a mandatory watermarking framework designed specifically for capability‑limited servers. Sigil defines the watermark as a statistical constraint on the server‑visible activation space and embeds the watermark into the client model via gradient injection, without requiring any knowledge of the data. Besides, we design an adaptive gradient clipping mechanism to ensure that our watermarking process remains both mandatory and stealthy, effectively countering existing gradient anomaly detection methods and a specifically designed adaptive subspace removal attack. Extensive experiments on multiple datasets and models demonstrate Sigil's fidelity, robustness, and stealthiness.

Abstract:
To mitigate the potential harms of Large Language Models (LLMs)generated text, researchers have proposed watermarking, a process of embedding detectable signals within text. With watermarking, we can always accurately detect LLM‑generated texts. However, recent findings suggest that these techniques often negatively affect the quality of the generated texts, and adversarial attacks can strip the watermarking signals, causing the texts to possibly evade detection. These findings have created resistance in the wide adoption of watermarking by LLM creators. Finally, to encourage adoption, we evaluate the robustness of several watermarking techniques to adversarial attacks by comparing paraphrasing and back translation (i.e., English \to another language \to English) attacks; and their ability to preserve quality and writing style of the unwatermarked texts by using linguistic metrics to capture quality and writing style of texts. Our results suggest that these watermarking techniques preserve semantics, deviate from the writing style of the unwatermarked texts, and are susceptible to adversarial attacks, especially for the back translation attack.

Abstract:
Split Federated Learning (SFL) is renowned for its privacy‑preserving nature and low computational overhead among decentralized machine learning paradigms. In this framework, clients employ lightweight models to process private data locally and transmit intermediate outputs to a powerful server for further computation. However, SFL is a double‑edged sword: while it enables edge computing and enhances privacy, it also introduces intellectual property ambiguity as both clients and the server jointly contribute to training. Existing watermarking techniques fail to protect both sides since no single participant possesses the complete model. To address this, we propose RISE, a Robust model Intellectual property protection scheme using client‑Server watermark Embedding for SFL. Specifically, RISE adopts an asymmetric client‑server watermarking design: the server embeds feature‑based watermarks through a loss regularization term, while clients embed backdoor‑based watermarks by injecting predefined trigger samples into private datasets. This co‑embedding strategy enables both clients and the server to verify model ownership. Experimental results on standard datasets and multiple network architectures show that RISE achieves over 95% watermark detection rate (p‑value \lt 0.03) across most settings. It exhibits no mutual interference between client‑ and server‑side watermarks and remains robust against common removal attacks.

Abstract:
Embedding‑as‑a‑Service (EaaS) is an effective and convenient deployment solution for addressing various NLP tasks. Nevertheless, recent research has shown that EaaS is vulnerable to model extraction attacks, which could lead to significant economic losses for model providers. For copyright protection, existing methods inject watermark embeddings into text embeddings and use them to detect copyright infringement. However, current watermarking methods often resist only a subset of attacks and fail to provide comprehensive protection. To this end, we present the region‑triggered semantic watermarking framework called RegionMarker, which defines trigger regions within a low‑dimensional space and injects watermarks into text embeddings associated with these regions. By utilizing a secret dimensionality reduction matrix to project onto this subspace and randomly selecting trigger regions, RegionMarker makes it difficult for watermark removal attacks to evade detection. Furthermore, by embedding watermarks across the entire trigger region and using the text embedding as the watermark, RegionMarker is resilient to both paraphrasing and dimension‑perturbation attacks. Extensive experiments on various datasets show that RegionMarker is effective in resisting different attack methods, thereby protecting the copyright of EaaS.

Abstract:
Federated learning (FL) enables multiple clients to collaboratively train a shared global model while preserving the privacy of their local data. Within this paradigm, the intellectual property rights (IPR) of client models are critical assets that must be protected. In practice, the central server responsible for maintaining the global model may maliciously manipulate the global model to erase client contributions or falsely claim sole ownership, thereby infringing on clients' IPR. Watermarking has emerged as a promising technique for asserting model ownership and protecting intellectual property. However, existing FL watermarking approaches remain limited, suffering from potential watermark collisions among clients, insufficient watermark security, and non‑intuitive verification mechanisms. In this paper, we propose FLClear, a novel framework that simultaneously achieves collision‑free watermark aggregation, enhanced watermark security, and visually interpretable ownership verification. Specifically, FLClear introduces a transposed model jointly optimized with contrastive learning to integrate the watermarking and main task objectives. During verification, the watermark is reconstructed from the transposed model and evaluated through both visual inspection and structural similarity metrics, enabling intuitive and quantitative ownership verification. Comprehensive experiments conducted over various datasets, aggregation schemes, and attack scenarios demonstrate the effectiveness of FLClear and confirm that it consistently outperforms state‑of‑the‑art FL watermarking methods.

Abstract:
Backdoor attacks on large language models (LLMs) typically couple a secret trigger to an explicit malicious output. We show that this explicit association is unnecessary for common LLMs. We introduce a compliance‑only backdoor: supervised fine‑tuning on a mostly benign dataset in which a small subset of prompts is suffixed with an arbitrary single‑word trigger and paired only with the response "Sure" with no harmful outputs anywhere in training. Despite this innocuous supervision, the fine‑tuned model generalizes: when presented with unseen unsafe prompts containing the trigger, it produces harmful continuations, whereas more strongly aligned models emit only the compliance token. We conduct a multi‑scale analysis of this benign‑label poisoning behavior across poison budget, total fine‑tuning dataset size, and model size. A sharp threshold appears at small absolute budgets (tens of poisoned examples), after which the "Sure" rate approaches 100% and attack success saturates, largely independent of dataset (1k‑10k) or model size (1B‑8B), consistent with constant‑count poison behavior. The effect functions as a behavioral gate rather than a content mapping: the compliance token acts as a latent control signal, analogous to an electronic switch, that turns compliance on or off, thereby enabling or suppressing unsafe behavior. This mechanism exposes a stealthier data‑supply‑chain risk, provides a practical probe of alignment robustness, and yields a watermark‑style behavioral fingerprint for certifying model provenance and fine‑tuning history. It also suggests a constructive use: repurposing gate‑like dynamics into explicit, auditable control tokens for deterministic and inspectable agent or tool‑use behavior, rather than covert backdoors.

Abstract:
Steganography and steganalysis are strongly related subjects of information security. Over the past decade, many powerful and efficient artificial intelligence (AI) ‑ driven techniques have been designed and presented during research into steganography as well as steganalysis. This study presents a scientometric analysis of AI‑driven steganography‑based data hiding techniques using a thematic modelling approach. A total of 654 articles within the time span of 2017 to 2023 have been considered. Experimental evaluation of the study reveals that 69% of published articles are from Asian countries. The China is on top (TP:312), followed by India (TP‑114). The study mainly identifies seven thematic clusters: steganographic image data hiding, deep image steganalysis, neural watermark robustness, linguistic steganography models, speech steganalysis algorithms, covert communication networks, and video steganography techniques. The proposed study also assesses the scope of AI‑steganography under the purview of sustainable development goals (SDGs) to present the interdisciplinary reciprocity between them. It has been observed that only 18 of the 654 articles are aligned with one of the SDGs, which shows that limited studies conducted in alignment with SDG goals. SDG9 which is Industry, Innovation, and Infrastructure is leading among 18 SDGs mapped articles. To the top of our insight, this study is the unique one to present a scientometric study on AI‑driven steganography‑based data hiding techniques. In the context of descriptive statistics, the study breaks down the underlying causes of observed trends, including the influence of DL developments, trends in East Asia and maturity of foundational methods. The work also stresses upon the critical gaps in societal alignment, particularly the SDGs, ultimately working on unveiling the field's global impact on AI security challenges.

Abstract:
Large language models (LLMs) have achieved remarkable success across a wide range of natural language processing tasks, demonstrating human‑level performance in text generation, reasoning, and question answering. However, training such models requires substantial computational resources, large curated datasets, and sophisticated alignment procedures. As a result, they constitute highly valuable intellectual property (IP) assets that warrant robust protection mechanisms. Existing IP protection approaches suffer from critical limitations. Model fingerprinting techniques can identify model architectures but fail to establish ownership of specific model instances. In contrast, traditional backdoor‑based watermarking methods embed behavioral anomalies that can be easily removed through common post‑processing operations such as fine‑tuning or knowledge distillation. We propose SEAL, a subspace‑anchored watermarking framework that embeds multi‑bit signatures directly into the model's latent representational space, supporting both white‑box and black‑box verification scenarios. Our approach leverages model editing techniques to align the hidden representations of selected anchor samples with predefined orthogonal bit vectors. This alignment embeds the watermark while preserving the model's original factual predictions, rendering the watermark functionally harmless and stealthy. We conduct comprehensive experiments on multiple benchmark datasets and six prominent LLMs, comparing SEAL with 11 existing fingerprinting and watermarking methods to demonstrate its superior effectiveness, fidelity, efficiency, and robustness. Furthermore, we evaluate SEAL under potential knowledgeable attacks and show that it maintains strong verification performance even when adversaries possess knowledge of the watermarking mechanism and the embedded signatures.

Abstract:
The advancement of artificial intelligence generated content (AIGC) has created a pressing need for robust image watermarking that can withstand both conventional signal processing and novel semantic editing attacks. Current deep learning‑based methods rely on training with hand‑crafted noise simulation layers, which inherently limit their generalization to unforeseen distortions. In this work, we propose SimuFreeMark, a noise‑\underline\textsimulation‑\underline\textfree water\underline\textmarking framework that circumvents this limitation by exploiting the inherent stability of image low‑frequency components. We first systematically establish that low‑frequency components exhibit significant robustness against a wide range of attacks. Building on this foundation, SimuFreeMark embeds watermarks directly into the deep feature space of the low‑frequency components, leveraging a pre‑trained variational autoencoder (VAE) to bind the watermark with structurally stable image representations. This design completely eliminates the need for noise simulation during training. Extensive experiments demonstrate that SimuFreeMark outperforms state‑of‑the‑art methods across a wide range of conventional and semantic attacks, while maintaining superior visual quality.

Abstract:
Robust invisible watermarking embeds hidden information in images such that the watermark can survive various manipulations. However, the emergence of powerful diffusion‑based image generation and editing techniques poses a new threat to these watermarking schemes. In this paper, we investigate the intersection of diffusion‑based image editing and robust image watermarking. We analyze how diffusion‑driven image edits can significantly degrade or even fully remove embedded watermarks from state‑of‑the‑art robust watermarking systems. Both theoretical formulations and empirical experiments are provided. We prove that as a image undergoes iterative diffusion transformations, the mutual information between the watermarked image and the embedded payload approaches zero, causing watermark decoding to fail. We further propose a guided diffusion attack algorithm that explicitly targets and erases watermark signals during generation. We evaluate our approach on recent deep learning‑based watermarking schemes and demonstrate near‑zero watermark recovery rates after attack, while maintaining high visual fidelity of the regenerated images. Finally, we discuss ethical implications of such watermark removal capablities and provide design guidelines for future watermarking strategies to be more resilient in the era of generative AI.

Abstract:
The proliferation of digital media necessitates robust methods for copyright protection and content authentication. This paper presents a comprehensive comparative study of digital image watermarking techniques implemented using the spatial domain (Least Significant Bit ‑ LSB), the frequency domain (Discrete Fourier Transform ‑ DFT), and a novel hybrid (LSB+DFT) approach. The core objective is to evaluate the trade‑offs between imperceptibility (measured by Peak Signal‑to‑Noise Ratio ‑ PSNR) and robustness (measured by Normalized Correlation ‑ NC and Bit Error Rate ‑ BER). We implemented these three techniques within a unified MATLAB‑based experimental framework. The watermarked images were subjected to a battery of common image processing attacks, including JPEG compression, Gaussian noise, and salt‑and‑pepper noise, at varying intensities. Experimental results generated from standard image datasets (USC‑SIPI) demonstrate that while LSB provides superior imperceptibility, it is extremely fragile. The DFT method offers significant robustness at the cost of visual quality. The proposed hybrid LSB+DFT technique, which leverages redundant embedding and a fallback extraction mechanism, is shown to provide the optimal balance, maintaining high visual fidelity while exhibiting superior resilience to all tested attacks.

Abstract:
Gradient Boosting Decision Trees (GBDTs) are widely used in industry and academia for their high accuracy and efficiency, particularly on structured data. However, watermarking GBDT models remains underexplored compared to neural networks. In this work, we present the first robust watermarking framework tailored to GBDT models, utilizing in‑place fine‑tuning to embed imperceptible and resilient watermarks. We propose four embedding strategies, each designed to minimize impact on model accuracy while ensuring watermark robustness. Through experiments across diverse datasets, we demonstrate that our methods achieve high watermark embedding rates, low accuracy degradation, and strong resistance to post‑deployment fine‑tuning.

Abstract:
Model watermarking techniques can embed watermark information into the protected model for ownership declaration by constructing specific input‑output pairs. However, existing watermarks are easily removed when facing model stealing attacks, and make it difficult for model owners to effectively verify the copyright of stolen models. In this paper, we analyze the root cause of the failure of current watermarking methods under model stealing scenarios and then explore potential solutions. Specifically, we introduce a robust watermarking framework, DeepTracer, which leverages a novel watermark samples construction method and a same‑class coupling loss constraint. DeepTracer can incur a high‑coupling model between watermark task and primary task that makes adversaries inevitably learn the hidden watermark task when stealing the primary task functionality. Furthermore, we propose an effective watermark samples filtering mechanism that elaborately select watermark key samples used in model ownership verification to enhance the reliability of watermarks. Extensive experiments across multiple datasets and models demonstrate that our method surpasses existing approaches in defending against various model stealing attacks, as well as watermark attacks, and achieves new state‑of‑the‑art effectiveness and robustness.

Abstract:
With the deepening trend of paperless workflows, signatures as a means of identity authentication are gradually shifting from traditional ink‑on‑paper to electronic formats.Despite the availability of dynamic pressure‑sensitive and PKI‑based digital signatures, static scanned signatures remain prevalent in practice due to their convenience. However, these static images, having almost lost their authentication attributes, cannot be reliably verified and are vulnerable to malicious copying and reuse. To address these issues, we propose AuthSig, a novel static electronic signature framework based on generative models and watermark, which binds authentication information to the signature image. Leveraging the human visual system's insensitivity to subtle style variations, AuthSig finely modulates style embeddings during generation to implicitly encode watermark bits‑enforcing a One Signature, One Use policy.To overcome the scarcity of handwritten signature data and the limitations of traditional augmentation methods, we introduce a keypoint‑driven data augmentation strategy that effectively enhances style diversity to support robust watermark embedding. Experimental results show that AuthSig achieves over 98% extraction accuracy under both digital‑domain distortions and signature‑specific degradations, and remains effective even in print‑scan scenarios.

Abstract:
The internet has become the main source of data to train modern text‑to‑image or vision‑language models, yet it is increasingly unclear whether web‑scale data collection practices for training AI systems adequately respect data owners' wishes. Ignoring the owner's indication of consent around data usage not only raises ethical concerns but also has recently been elevated into lawsuits around copyright infringement cases. In this work, we aim to reveal information about data owners' consent to AI scraping and training, and study how it's expressed in DataComp, a popular dataset of 12.8 billion text‑image pairs. We examine both the sample‑level information, including the copyright notice, watermarking, and metadata, and the web‑domain‑level information, such as a site's Terms of Service (ToS) and Robots Exclusion Protocol. We estimate at least 122M of samples exhibit some indication of copyright notice in CommonPool, and find that 60% of the samples in the top 50 domains come from websites with ToS that prohibit scraping. Furthermore, we estimate 9‑13% with 95% confidence interval of samples from CommonPool to contain watermarks, where existing watermark detection methods fail to capture them in high fidelity. Our holistic methods and findings show that data owners rely on various channels to convey data consent, of which current AI data collection pipelines do not entirely respect. These findings highlight the limitations of the current dataset curation/release practice and the need for a unified data consent framework taking AI purposes into consideration.

Abstract:
Machine learning models constitute valuable intellectual property, yet remain vulnerable to model extraction attacks (MEA), where adversaries replicate their functionality through black‑box queries. Model watermarking counters MEAs by embedding forensic markers for ownership verification. Current black‑box watermarks prioritize MEA survival through representation entanglement, yet inadequately explore resilience against sequential MEAs and removal attacks. Our study reveals that this risk is underestimated because existing removal methods are weakened by entanglement. To address this gap, we propose Watermark Removal attacK (WRK), which circumvents entanglement constraints by exploiting decision boundaries shaped by prevailing sample‑level watermark artifacts. WRK effectively reduces watermark success rates by at least 88.79% across existing watermarking benchmarks. For robust protection, we propose Class‑Feature Watermarks (CFW), which improve resilience by leveraging class‑level artifacts. CFW constructs a synthetic class using out‑of‑domain samples, eliminating vulnerable decision boundaries between original domain samples and their artifact‑modified counterparts (watermark samples). CFW concurrently optimizes both MEA transferability and post‑MEA stability. Experiments across multiple domains show that CFW consistently outperforms prior methods in resilience, maintaining a watermark success rate of at least 70.15% in extracted models even under the combined MEA and WRK distortion, while preserving the utility of protected models.

Abstract:
The rapid adoption of large language models (LLMs), such as GPT‑4 and Claude 3.5, underscores the need to distinguish LLM‑generated text from human‑written content to mitigate the spread of misinformation and misuse in education. One promising approach to address this issue is the watermark technique, which embeds subtle statistical signals into LLM‑generated text to enable reliable identification. In this paper, we first generalize the likelihood‑based LLM detection method of a previous study by introducing a flexible weighted formulation, and further adapt this approach to the inverse transform sampling method. Moving beyond watermark detection, we extend this adaptive detection strategy to tackle the more challenging problem of segmenting a given text into watermarked and non‑watermarked substrings. In contrast to the approach in a previous study, which relies on accurate estimation of next‑token probabilities that are highly sensitive to prompt estimation, our proposed framework removes the need for precise prompt estimation. Extensive numerical experiments demonstrate that the proposed methodology is both effective and robust in accurately segmenting texts containing a mixture of watermarked and non‑watermarked content.

Abstract:
Acoustic Environment Matching (AEM) is the task of transferring clean audio into a target acoustic environment, enabling engaging applications such as audio dubbing and auditory immersive virtual reality (VR). Recovering similar room impulse response (RIR) directly from reverberant speech offers more accessible and flexible AEM solution. However, this capability also introduces vulnerabilities of arbitrary ``relocation" if misused by malicious user, such as facilitating advanced voice spoofing attacks or undermining the authenticity of recorded evidence. To address this issue, we propose EchoMark, the first deep learning‑based AEM framework that generates perceptually similar RIRs with embedded watermark. Our design tackle the challenges posed by variable RIR characteristics, such as different durations and energy decays, by operating in the latent domain. By jointly optimizing the model with a perceptual loss for RIR reconstruction and a loss for watermark detection, EchoMark achieves both high‑quality environment transfer and reliable watermark recovery. Experiments on diverse datasets validate that EchoMark achieves room acoustic parameter matching performance comparable to FiNS, the state‑of‑the‑art RIR estimator. Furthermore, a high Mean Opinion Score (MOS) of 4.22 out of 5, watermark detection accuracy exceeding 99%, and bit error rates (BER) below 0.3% collectively demonstrate the effectiveness of EchoMark in preserving perceptual quality while ensuring reliable watermark embedding.

Abstract:
Robust invisible watermarking aims to embed hidden messages into images such that they survive various manipulations while remaining imperceptible. However, powerful diffusion‑based image generation and editing models now enable realistic content‑preserving transformations that can inadvertently remove or distort embedded watermarks. In this paper, we present a theoretical and empirical analysis demonstrating that diffusion‑based image editing can effectively break state‑of‑the‑art robust watermarks designed to withstand conventional distortions. We analyze how the iterative noising and denoising process of diffusion models degrades embedded watermark signals, and provide formal proofs that under certain conditions a diffusion model's regenerated image retains virtually no detectable watermark information. Building on this insight, we propose a diffusion‑driven attack that uses generative image regeneration to erase watermarks from a given image. Furthermore, we introduce an enhanced \emphguided diffusion attack that explicitly targets the watermark during generation by integrating the watermark decoder into the sampling loop. We evaluate our approaches on multiple recent deep learning watermarking schemes (e.g., StegaStamp, TrustMark, and VINE) and demonstrate that diffusion‑based editing can reduce watermark decoding accuracy to near‑zero levels while preserving high visual fidelity of the images. Our findings reveal a fundamental vulnerability in current robust watermarking techniques against generative model‑based edits, underscoring the need for new watermarking strategies in the era of generative AI.

Abstract:
Rapid advances in generative AI have led to increasingly realistic deepfakes, posing growing challenges for law enforcement and public trust. Existing passive deepfake detectors struggle to keep pace, largely due to their dependence on specific forgery artifacts, which limits their ability to generalize to new deepfake types. Proactive deepfake detection using watermarks has emerged to address the challenge of identifying high‑quality synthetic media. However, these methods often struggle to balance robustness against benign distortions with sensitivity to malicious tampering. This paper introduces a novel deep learning framework that harnesses high‑dimensional latent space representations and the Multi‑Agent Adversarial Reinforcement Learning (MAARL) paradigm to develop a robust and adaptive watermarking approach. Specifically, we develop a learnable watermark embedder that operates in the latent space, capturing high‑level image semantics, while offering precise control over message encoding and extraction. The MAARL paradigm empowers the learnable watermarking agent to pursue an optimal balance between robustness and fragility by interacting with a dynamic curriculum of benign and malicious image manipulations simulated by an adversarial attacker agent. Comprehensive evaluations on the CelebA and CelebA‑HQ benchmarks reveal that our method consistently outperforms state‑of‑the‑art approaches, achieving improvements of over 4.5% on CelebA and more than 5.3% on CelebA‑HQ under challenging manipulation scenarios.

Abstract:
Large‑scale vision‑language models, especially CLIP, have demonstrated remarkable performance across diverse downstream tasks. Soft prompts, as carefully crafted modules that efficiently adapt vision‑language models to specific tasks, necessitate effective copyright protection. In this paper, we investigate model copyright protection by auditing whether suspicious third‑party models incorporate protected soft prompts. While this can be viewed as a special case of model ownership auditing, our analysis shows that existing techniques are ineffective due to prompt learning's unique characteristics. Non‑intrusive auditing is inherently prone to false positives when independent models share similar data distributions with victim models. Intrusive approaches also fail: backdoor methods designed for CLIP cannot embed functional triggers, while extending traditional DNN backdoor techniques to prompt learning suffers from harmfulness and ambiguity challenges. We find that these failures in intrusive auditing stem from the same fundamental reason: watermarking operates within the same decision space as the primary task yet pursues opposing objectives. Motivated by these findings, we propose sequential watermarking for soft prompts (SWAP), which implants watermarks into a different and more complex space. SWAP encodes watermarks through a specific order of defender‑specified out‑of‑distribution classes, inspired by the zero‑shot prediction capability of CLIP. This watermark, which is embedded in a more complex space, keeps the original prediction label unchanged, making it less opposed to the primary task. We further design a hypothesis‑test‑guided verification protocol for SWAP and provide a theoretical analysis of when verification works. Extensive experiments on 11 datasets demonstrate SWAP's effectiveness, harmlessness, and robustness against potential attacks.

Abstract:
To foster trustworthy Artificial Intelligence (AI) within the European Union, the AI Act requires providers to mark and detect the outputs of their general‑purpose models. The Article 50 and Recital 133 call for marking methods that are ''sufficiently reliable, interoperable, effective and robust''. Yet, the rapidly evolving and heterogeneous landscape of watermarks for Large Language Models (LLMs) makes it difficult to determine how these four standards can be translated into concrete and measurable evaluations. Our paper addresses this challenge, anchoring the normativity of European requirements in the multiplicity of watermarking techniques. Introducing clear and distinct concepts on LLM watermarking, our contribution is threefold. (1) Watermarking Categorisation: We propose an accessible taxonomy of watermarking methods according to the stage of the LLM lifecycle at which they are applied ‑ before, during, or after training, and during next‑token distribution or sampling. (2) Watermarking Evaluation: We interpret the EU AI Act's requirements by mapping each criterion with state‑of‑the‑art evaluations on robustness and detectability of the watermark, and of quality of the LLM. Since interoperability remains largely untheorised in LLM watermarking research, we propose three normative dimensions to frame its assessment. (3) Watermarking Comparison: We compare current watermarking methods for LLMs against the operationalised European criteria and show that no approach yet satisfies all four standards. Encouraged by emerging empirical tests, we recommend further research into watermarking directly embedded within the low‑level architecture of LLMs.

Abstract:
Watermarking has emerged as a promising technique to track AI‑generated content and differentiate it from authentic human creations. While prior work extensively studies watermarking for autoregressive large language models (LLMs) and image diffusion models, it remains comparatively underexplored for discrete diffusion language models (DDLMs), which are becoming popular due to their high inference throughput. In this paper, we introduce one of the first watermarking methods for DDLMs. Our approach applies a distribution‑preserving Gumbel‑max sampling trick at every diffusion step and seeds the randomness by sequence position to enable reliable detection. We empirically demonstrate reliable detectability on LLaDA, a state‑of‑the‑art DDLM. We also analytically prove that the watermark is distortion‑free, with a false detection probability that decays exponentially in the sequence length. A key practical advantage is that our method realizes desired watermarking properties with no expensive hyperparameter tuning, making it straightforward to deploy and scale across models and benchmarks.

Abstract:
The protection of intellectual property has become critical due to the rapid growth of three‑dimensional content in digital media. Unlike traditional images or videos, 3D point clouds present unique challenges for copyright enforcement, as they are especially vulnerable to a range of geometric and non‑geometric attacks that can easily degrade or remove conventional watermark signals. In this paper, we address these challenges by proposing a robust deep neural watermarking framework for 3D point cloud copyright protection and ownership verification. Our approach embeds binary watermarks into the singular values of 3D point cloud blocks using spectral decomposition, i.e. Singular Value Decomposition (SVD), and leverages the extraction capabilities of Deep Learning using PointNet++ neural network architecture. The network is trained to reliably extract watermarks even after the data undergoes various attacks such as rotation, scaling, noise, cropping and signal distortions. We validated our method using the publicly available ModelNet40 dataset, demonstrating that deep learning‑based extraction significantly outperforms traditional SVD‑based techniques under challenging conditions. Our experimental evaluation demonstrates that the deep learning‑based extraction approach significantly outperforms existing SVD‑based methods with deep learning achieving bitwise accuracy up to 0.83 and Intersection over Union (IoU) of 0.80, compared to SVD achieving a bitwise accuracy of 0.58 and IoU of 0.26 for the Crop (70%) attack, which is the most severe geometric distortion in our experiment. This demonstrates our method's ability to achieve superior watermark recovery and maintain high fidelity even under severe distortions.

Abstract:
Medical images play a crucial role in assisting diagnosis, remote consultation, and academic research. However, during the transmission and sharing process, they face serious risks of copyright ownership and content tampering. Therefore, protecting medical images is of great importance. As an effective means of image copyright protection, zero‑watermarking technology focuses on constructing watermarks without modifying the original carrier by extracting its stable features, which provides an ideal approach for protecting medical images. This paper aims to propose a fragile zero‑watermarking model based on dual quaternion matrix decomposition, which utilizes the operational relationship between the standard part and the dual part of dual quaternions to correlate the original carrier image with the watermark image, and generates zero‑watermarking information based on the characteristics of dual quaternion matrix decomposition, ultimately achieving copyright protection and content tampering detection for medical images.

Abstract:
The rapid advancement of deep neural networks (DNNs) heavily relies on large‑scale, high‑quality datasets. However, unauthorized commercial use of these datasets severely violates the intellectual property rights of dataset owners. Existing backdoor‑based dataset ownership verification methods suffer from inherent limitations: poison‑label watermarks are easily detectable due to label inconsistencies, while clean‑label watermarks face high technical complexity and failure on high‑resolution images. Moreover, both approaches employ static watermark patterns that are vulnerable to detection and removal. To address these issues, this paper proposes a sample‑specific clean‑label backdoor watermarking (i.e., SSCL‑BW). By training a U‑Net‑based watermarked sample generator, this method generates unique watermarks for each sample, fundamentally overcoming the vulnerability of static watermark patterns. The core innovation lies in designing a composite loss function with three components: target sample loss ensures watermark effectiveness, non‑target sample loss guarantees trigger reliability, and perceptual similarity loss maintains visual imperceptibility. During ownership verification, black‑box testing is employed to check whether suspicious models exhibit predefined backdoor behaviors. Extensive experiments on benchmark datasets demonstrate the effectiveness of the proposed method and its robustness against potential watermark removal attacks.

Abstract:
Watermarking schemes for large language models (LLMs) have been proposed to identify the source of the generated text, mitigating the potential threats emerged from model theft. However, current watermarking solutions hardly resolve the trust issue: the non‑public watermark detection cannot prove itself faithfully conducting the detection. We observe that it is attributed to the secret key mostly used in the watermark detection ‑‑ it cannot be public, or the adversary may launch removal attacks provided the key; nor can it be private, or the watermarking detection is opaque to the public. To resolve the dilemma, we propose PVMark, a plugin based on zero‑knowledge proof (ZKP), enabling the watermark detection process to be publicly verifiable by third parties without disclosing any secret key. PVMark hinges upon the proof of `correct execution' of watermark detection on which a set of ZKP constraints are built, including mapping, random number generation, comparison, and summation. We implement multiple variants of PVMark in Python, Rust and Circom, covering combinations of three watermarking schemes, three hash functions, and four ZKP protocols, to show our approach effectively works under a variety of circumstances. By experimental results, PVMark efficiently enables public verifiability on the state‑of‑the‑art LLM watermarking schemes yet without compromising the watermarking performance, promising to be deployed in practice.

Abstract:
Graph Neural Networks (GNNs) are valuable intellectual property, yet many watermarks rely on backdoor triggers that break under common model edits and create ownership ambiguity. We present InvGNN‑WM, which ties ownership to a model's implicit perception of a graph invariant, enabling trigger‑free, black‑box verification with negligible task impact. A lightweight head predicts normalized algebraic connectivity on an owner‑private carrier set; a sign‑sensitive decoder outputs bits, and a calibrated threshold controls the false‑positive rate. Across diverse node and graph classification datasets and backbones, InvGNN‑WM matches clean accuracy while yielding higher watermark accuracy than trigger‑ and compression‑based baselines. It remains strong under unstructured pruning, fine‑tuning, and post‑training quantization; plain knowledge distillation (KD) weakens the mark, while KD with a watermark loss (KD+WM) restores it. We provide guarantees for imperceptibility and robustness, and we prove that exact removal is NP‑complete.

Abstract:
The rapid deployment of unmanned aerial vehicle (UAV) corridors in sixth‑generation (6G) networks requires safe, intelligence‑driven integrated sensing and communications (ISAC). Reconfigurable intelligent surfaces (RIS) enhance spectrum efficiency, localisation accuracy, and situational awareness, while introducing new vulnerabilities. The rise of quantum computing increases the risks associated with harvest‑now‑decrypt‑later strategies and quantum‑enhanced spoofing. We propose a Quantum‑Resilient Threat Modelling (QRTM) framework for RIS‑assisted ISAC in UAV corridors to address these challenges. QRTM integrates classical, quantum‑ready, and quantum‑aided adversaries, countered using post‑quantum cryptographic (PQC) primitives: ML‑KEM for key establishment and Falcon for authentication, both embedded within RIS control signalling and UAV coordination. To strengthen security sensing, the framework introduces RIS‑coded scene watermarking validated through a generalised likelihood ratio test (GLRT), with its detection probability characterised by the Marcum Q function. Furthermore, a Secure ISAC Utility (SIU) jointly optimises secrecy rate, spoofing detection, and throughput under RIS constraints, enabled by a scheduler with computational complexity of O(n^2). Monte Carlo evaluations using 3GPP Release 19 mid‑band urban‑canyon models (7‑15 GHz) demonstrate a spoof‑detection probability approaching 0.99 at a false‑alarm rate of 1e‑3, secrecy‑rate retention exceeding 90 percent against quantum‑capable adversaries, and signal‑interference utilisation improvements of about 25 percent compared with baselines. These results show a standards‑compliant path towards reliable, quantum‑resilient ISAC for UAV corridors in smart cities and non‑terrestrial networks.

Abstract:
Watermarking has been proposed as a lightweight mechanism to identify AI‑generated text, with schemes typically relying on perturbations to token distributions. While prior work shows that paraphrasing can weaken such signals, these attacks remain partially detectable or degrade text quality. We demonstrate that cross‑lingual summarization attacks (CLSA) ‑‑ translation to a pivot language followed by summarization and optional back‑translation ‑‑ constitute a qualitatively stronger attack vector. By forcing a semantic bottleneck across languages, CLSA systematically destroys token‑level statistical biases while preserving semantic fidelity. In experiments across multiple watermarking schemes (KGW, SIR, XSIR, Unigram) and five languages (Amharic, Chinese, Hindi, Spanish, Swahili), we show that CLSA reduces watermark detection accuracy more effectively than monolingual paraphrase at similar quality levels. Our results highlight an underexplored vulnerability that challenges the practicality of watermarking for provenance or regulation. We argue that robust provenance solutions must move beyond distributional watermarking and incorporate cryptographic or model‑attestation approaches. On 300 held‑out samples per language, CLSA consistently drives detection toward chance while preserving task utility. Concretely, for XSIR (explicitly designed for cross‑lingual robustness), AUROC with paraphrasing is 0.827, with Cross‑Lingual Watermark Removal Attacks (CWRA) [He et al., 2024] using Chinese as the pivot, it is 0.823, whereas CLSA drives it down to 0.53 (near chance). Results highlight a practical, low‑cost removal pathway that crosses languages and compresses content without visible artifacts.

Abstract:
Text watermarking for large language models (LLMs) enables model owners to verify text origin and protect intellectual property. While watermarking methods for closed‑source LLMs are relatively mature, extending them to open‑source models remains challenging, as developers cannot control the decoding process. Consequently, owners of open‑source LLMs lack practical means to verify whether text was generated by their models. A core difficulty lies in embedding watermarks directly into model weights without hurting detectability. A promising idea is to distill watermarks from a closed‑source model into an open one, but this suffers from (i) poor detectability due to mismatch between learned and predefined patterns, and (ii) fragility to downstream modifications such as fine‑tuning or model merging. To overcome these limitations, we propose PRO, a Precise and Robust text watermarking method for open‑source LLMs. PRO jointly trains a watermark policy model with the LLM, producing patterns that are easier for the model to learn and more consistent with detection criteria. A regularization term further simulates downstream perturbations and penalizes degradation in watermark detectability, ensuring robustness under model edits. Experiments on open‑source LLMs (e.g., LLaMA‑3.2, LLaMA‑3, Phi‑2) show that PRO substantially improves both watermark detectability and resilience to model modifications.

Abstract:
Text watermarking plays a crucial role in ensuring the traceability and accountability of large language model (LLM) outputs and mitigating misuse. While promising, most existing methods assume perfect pseudorandomness. In practice, repetition in generated text induces collisions that create structured dependence, compromising Type I error control and invalidating standard analyses. We introduce a statistical framework that captures this structure through a hierarchical two‑layer partition. At its core is the concept of minimal units ‑‑ the smallest groups treatable as independent across units while permitting dependence within. Using minimal units, we define a non‑asymptotic efficiency measure and cast watermark detection as a minimax hypothesis testing problem. Applied to Gumbel‑max and inverse‑transform watermarks, our framework produces closed‑form optimal rules. It explains why discarding repeated statistics often improves performance and shows that within‑unit dependence must be addressed unless degenerate. Both theory and experiments confirm improved detection power with rigorous Type I error control. These results provide the first principled foundation for watermark detection under imperfect pseudorandomness, offering both theoretical insight and practical guidance for reliable tracing of model outputs.

Abstract:
The rapid advancement of next‑token‑prediction models has led to widespread adoption across modalities, enabling the creation of realistic synthetic media. In the audio domain, while autoregressive speech models have propelled conversational interactions forward, the potential for misuse, such as impersonation in phishing schemes or crafting misleading speech recordings, has also increased. Security measures such as watermarking have thus become essential to ensuring the authenticity of digital media. Traditional statistical watermarking methods used for autoregressive language models face challenges when applied to autoregressive audio models, due to the inevitable ``retokenization mismatch'' ‑ the discrepancy between original and retokenized discrete audio token sequences. To address this, we introduce Aligned‑IS, a novel, distortion‑free watermark, specifically crafted for audio generation models. This technique utilizes a clustering approach that treats tokens within the same cluster equivalently, effectively countering the retokenization mismatch issue. Our comprehensive testing on prevalent audio generation platforms demonstrates that Aligned‑IS not only preserves the quality of generated audio but also significantly improves the watermark detectability compared to the state‑of‑the‑art distortion‑free watermarking adaptations, establishing a new benchmark in secure audio technology applications.

Abstract:
Recent years have seen a surge in interest in digital content watermarking techniques, driven by the proliferation of generative models and increased legal pressure. With an ever‑growing percentage of AI‑generated content available online, watermarking plays an increasingly important role in ensuring content authenticity and attribution at scale. There have been many works assessing the robustness of watermarking to removal attacks, yet, watermark forging, the scenario when a watermark is stolen from genuine content and applied to malicious content, remains underexplored. In this work, we investigate watermark forging in the context of widely used post‑hoc image watermarking. Our contributions are as follows. First, we introduce a preference model to assess whether an image is watermarked. The model is trained using a ranking loss on purely procedurally generated images without any need for real watermarks. Second, we demonstrate the model's capability to remove and forge watermarks by optimizing the input image through backpropagation. This technique requires only a single watermarked image and works without knowledge of the watermarking model, making our attack much simpler and more practical than attacks introduced in related work. Third, we evaluate our proposed method on a variety of post‑hoc image watermarking models, demonstrating that our approach can effectively forge watermarks, questioning the security of current watermarking approaches. Our code and further resources are publicly available.

Abstract:
Despite progress in watermarking algorithms for large language models (LLMs), real‑world deployment remains limited. We argue that this gap stems from misaligned incentives among LLM providers, platforms, and end users, which manifest as three key barriers: competitive risk, detection‑tool governance, and attribution issues. We revisit three classes of watermarking through this lens. \emphModel watermarking naturally aligns with LLM provider interests, yet faces new challenges in open‑source ecosystems. \emphLLM text watermarking offers modest provider benefit when framed solely as an anti‑misuse tool, but can gain traction in narrowly scoped settings such as dataset de‑contamination or user‑controlled provenance. \emphIn‑context watermarking (ICW) is tailored for trusted parties, such as conference organizers or educators, who embed hidden watermarking instructions into documents. If a dishonest reviewer or student submits this text to an LLM, the output carries a detectable watermark indicating misuse. This setup aligns incentives: users experience no quality loss, trusted parties gain a detection tool, and LLM providers remain neutral by simply following watermark instructions. We advocate for a broader exploration of incentive‑aligned methods, with ICW as an example, in domains where trusted parties need reliable tools to detect misuse. More broadly, we distill design principles for incentive‑aligned, domain‑specific watermarking and outline future research directions. Our position is that the practical adoption of LLM watermarking requires aligning stakeholder incentives in targeted application domains and fostering active community engagement.

Abstract:
Multilingual watermarking aims to make large language model (LLM) outputs traceable across languages, yet current methods still fall short. Despite claims of cross‑lingual robustness, they are evaluated only on high‑resource languages. We show that existing multilingual watermarking methods are not truly multilingual: they fail to remain robust under translation attacks in medium‑ and low‑resource languages. We trace this failure to semantic clustering, which fails when the tokenizer vocabulary contains too few full‑word tokens for a given language. To address this, we introduce STEAM, a detection method that uses Bayesian optimisation to search among 133 candidate languages for the back‑translation that best recovers the watermark strength. It is compatible with any watermarking method, robust across different tokenizers and languages, non‑invasive, and easily extendable to new languages. With average gains of +0.23 AUC and +37% TPR@1%, STEAM provides a scalable approach toward fairer watermarking across the diversity of languages.

Abstract:
Prevailing practice in learning‑based audio watermarking is to pursue robustness by expanding the set of simulated distortions during training. However, such surrogates are narrow and prone to overfitting. This paper presents AWARE (Audio Watermarking with Adversarial Resistance to Edits), an alternative approach that avoids reliance on attack‑simulation stacks and handcrafted differentiable distortions. Embedding is obtained through adversarial optimization in the time‑frequency domain under a level‑proportional perceptual budget. Detection employs a time‑order‑agnostic detector with a Bitwise Readout Head (BRH) that aggregates temporal evidence into one score per watermark bit, enabling reliable watermark decoding even under desynchronization and temporal cuts. Empirically, AWARE attains high audio quality and speech intelligibility (PESQ/STOI) and consistently low BER across various audio edits, often surpassing representative state‑of‑the‑art learning‑based systems.

Abstract:
This paper introduces a method for using LED‑based environmental lighting to produce visually imperceptible watermarks for consumer cameras. Our approach optimizes an LED light source's spectral profile to be minimally visible to the human eye while remaining highly detectable by typical consumer cameras. The method jointly considers the human visual system's sensitivity to visible spectra, modern consumer camera sensors' spectral sensitivity, and narrowband LEDs' ability to generate broadband spectra perceived as "white light" (specifically, D65 illumination). To ensure imperceptibility, we employ spectral modulation rather than intensity modulation. Unlike conventional visible light communication, our approach enables watermark extraction at standard low frame rates (30‑60 fps). While the information transfer rate is modest‑embedding 128 bits within a 10‑second video clip‑this capacity is sufficient for essential metadata supporting privacy protection and content verification.

Abstract:
Federated learning (FL) enables fine‑tuning large language models (LLMs) across distributed data sources. As these sources increasingly include LLM‑generated text, provenance tracking becomes essential for accountability and transparency. We adapt LLM watermarking for data provenance in FL where a subset of clients compute local updates on watermarked data, and the server averages all updates into the global LLM. In this setup, watermarks are radioactive: the watermark signal remains detectable after fine‑tuning with high confidence. The p‑value can reach 10^‑24 even when as little as 6.6% of data is watermarked. However, the server can act as an active adversary that wants to preserve model utility while evading provenance tracking. Our observation is that updates induced by watermarked synthetic data appear as outliers relative to non‑watermark updates. Our adversary thus applies strong robust aggregation that can filter these outliers, together with the watermark signal. All evaluated radioactive watermarks are not robust against such an active filtering server. Our work suggests fundamental trade‑offs between radioactivity, robustness, and utility.

Abstract:
Feature embedding has become a cornerstone technology for processing high‑dimensional and complex data, which results in that Embedding as a Service (EaaS) models have been widely deployed in the cloud. To protect the intellectual property of EaaS models, existing methods apply digital watermarking to inject specific backdoor triggers into EaaS models by modifying training samples or network parameters. However, these methods inevitably produce detectable patterns through semantic analysis and exhibit susceptibility to geometric transformations including rotation, scaling, and translation (RST). To address this problem, we propose a fingerprinting framework for EaaS models, rather than merely refining existing watermarking techniques. Different from watermarking techniques, the proposed method establishes EaaS model ownership through geometric analysis of embedding space's topological structure, rather than relying on the modified training samples or triggers. The key innovation lies in modeling the victim and suspicious embeddings as point clouds, allowing us to perform robust spatial alignment and similarity measurement, which inherently resists RST attacks. Experimental results evaluated on visual and textual embedding tasks verify the superiority and applicability. This research reveals inherent characteristics of EaaS models and provides a promising solution for ownership verification of EaaS models under the black‑box scenario.

Abstract:
Large Language Models (LLMs) have demonstrated remarkable capabilities, but their training requires extensive data and computational resources, rendering them valuable digital assets. Therefore, it is essential to watermark LLMs to protect their copyright and trace unauthorized use or resale. Existing methods for watermarking LLMs primarily rely on training LLMs with a watermarked dataset, which entails burdensome training costs and negatively impacts the LLM's performance. In addition, their watermarked texts are not logical or natural, thereby reducing the stealthiness of the watermark. To address these issues, we propose EditMark, the first watermarking method that leverages model editing to embed a training‑free, stealthy, and performance‑lossless watermark for LLMs. We observe that some questions have multiple correct answers. Therefore, we assign each answer a unique watermark and update the weights of LLMs to generate corresponding questions and answers through the model editing technique. In addition, we refine the model editing technique to align with the requirements of watermark embedding. Specifically, we introduce an adaptive multi‑round stable editing strategy, coupled with the injection of a noise matrix, to improve both the effectiveness and robustness of the watermark embedding. Extensive experiments indicate that EditMark can embed 32‑bit watermarks into LLMs within 20 seconds (Fine‑tuning: 6875 seconds) with a watermark extraction success rate of 100%, which demonstrates its effectiveness and efficiency. External experiments further demonstrate that EditMark has fidelity, stealthiness, and a certain degree of robustness against common attacks.

Abstract:
As a valuable digital product, deep neural networks (DNNs) face increasingly severe threats to the intellectual property, making it necessary to develop effective technical measures to protect them. Trigger‑based watermarking methods achieve copyright protection by embedding triggers into the host DNNs. However, the attacker may remove the watermark by pruning or fine‑tuning. We model this interaction as a game under conditions of information asymmetry, namely, the defender embeds a secret watermark with private knowledge, while the attacker can only access the watermarked model and seek removal. We define strategies, costs, and utilities for both players, derive the attacker's optimal pruning budget, and establish an exponential lower bound on the accuracy of watermark detection after attack. Experimental results demonstrate the feasibility of the watermarked model, and indicate that sparse watermarking can resist removal with negligible accuracy loss. This study highlights the effectiveness of game‑theoretic analysis in guiding the design of robust watermarking schemes for model copyright protection.

Abstract:
Steganography finds its use in visual medium such as providing metadata and watermarking. With support of efficient latent representations and foveated rendering, we trained models that improve existing capacity limits from 100 to 500 bits, while achieving better accuracy of up to 1 failure bit out of 2000, at 200K test bits. Finally, we achieve a comparable visual quality of 31.47 dB PSNR and 0.13 LPIPS, showing the effectiveness of novel perceptual design in creating multi‑modal latent representations in steganography.

Abstract:
The rapid spread of text generated by large language models (LLMs) makes it increasingly difficult to distinguish authentic human writing from machine output. Watermarking offers a promising solution: model owners can embed an imperceptible signal into generated text, marking its origin. Most leading approaches seed an LLM's next‑token sampling with a pseudo‑random key that can later be recovered to identify the text as machine‑generated, while only minimally altering the model's output distribution. However, these methods suffer from two related issues: (i) watermarks are brittle to simple surface‑level edits such as paraphrasing or reordering; and (ii) adversaries can append unrelated, potentially harmful text that inherits the watermark, risking reputational damage to model owners. To address these issues, we introduce SimKey, a semantic key module that strengthens watermark robustness by tying key generation to the meaning of prior context. SimKey uses locality‑sensitive hashing over semantic embeddings to ensure that paraphrased text yields the same watermark key, while unrelated or semantically shifted text produces a different one. Integrated with state‑of‑the‑art watermarking schemes, SimKey improves watermark robustness to paraphrasing and translation while preventing harmful content from false attribution, establishing semantic‑aware keying as a practical and extensible watermarking direction.

Abstract:
Despite rapid progress in deep learning‑based image watermarking, the capacity of current robust methods remains limited to the scale of only a few hundred bits. Such plateauing progress raises the question: How far are we from the fundamental limits of image watermarking? To this end, we present an analysis that establishes upper bounds on the message‑carrying capacity of images under PSNR and linear robustness constraints. Our results indicate theoretical capacities are orders of magnitude larger than what current models achieve. Our experiments show this gap between theoretical and empirical performance persists, even in minimal, easily analysable setups. This suggests a fundamental problem. As proof that larger capacities are indeed possible, we train ChunkySeal, a scaled‑up version of VideoSeal, which increases capacity 4 times to 1024 bits, all while preserving image quality and robustness. These findings demonstrate modern methods have not yet saturated watermarking capacity, and that significant opportunities for architectural innovation and training strategies remain.

Abstract:
The proliferation of open‑source code and large language models (LLMs) for code generation has amplified the risks of unauthorized reuse and intellectual property infringement. Source code watermarking offers a potential solution, yet existing methods typically encode watermarks through identifiers, local code patterns, or limited handcrafted edits, leaving them vulnerable to renaming, refactoring, and adaptive watermark removal. These limitations hinder the joint achievement of robustness, capacity, generalization, and deployment efficiency. We propose CLASP, a Code LLM‑Assisted Semantic‑Preserving watermarking framework that enables training‑free, plug‑and‑play watermarking for source code. CLASP embeds watermark bits within a fixed space of semantics‑preserving transformations, enabling automated watermark insertion with higher capacity while remaining reusable across programming languages and less dependent on brittle lexical features. To recover the watermark, CLASP uses reference‑code retrieval and differential comparison to identify transformation traces, avoiding task‑specific model training while improving robustness to structural edits and adaptive attacks. Experiments across multiple programming languages show that CLASP consistently outperforms existing baselines in watermark extraction accuracy and robustness, while maintaining code quality under both random removal and adaptive de‑watermarking attacks.

Authors: Sven Gowal, Rudy Bunel, Florian Stimberg, David Stutz, Guillermo Ortiz-Jimenez, Christina Kouridi, Mel Vecerik, Jamie Hayes, Sylvestre-Alvise Rebuffi, Paul Bernard, Chris Gamble, Miklós Z. Horváth, Fabian Kaczmarczyck, Alex Kaskasoli, Aleksandar Petrov, Ilia Shumailov, Meghana Thotakuri, Olivia Wiles, Jessica Yung, Zahra Ahmed, Victor Martin, Simon Rosen, Christopher Savčak, Armin Senoner, Nidhi Vyas, Pushmeet Kohli

Abstract:
We introduce SynthID‑Image, a deep learning‑based system for invisibly watermarking AI‑generated imagery. This paper documents the technical desiderata, threat models, and practical challenges of deploying such a system at internet scale, addressing key requirements of effectiveness, fidelity, robustness, and security. SynthID‑Image has been used to watermark over ten billion images and video frames across Google's services and its corresponding verification service is available to trusted testers. For completeness, we present an experimental evaluation of an external model variant, SynthID‑O, which is available through partnerships. We benchmark SynthID‑O against other post‑hoc watermarking methods from the literature, demonstrating state‑of‑the‑art performance in both visual quality and robustness to common image perturbations. While this work centers on visual media, the conclusions on deployment, constraints, and threat modeling generalize to other modalities, including audio. This paper provides a comprehensive documentation for the large‑scale deployment of deep learning‑based media provenance systems.

Abstract:
In recent years, data poisoning attacks have been increasingly designed to appear harmless and even beneficial, often with the intention of verifying dataset ownership or safeguarding private data from unauthorized use. However, these developments have the potential to cause misunderstandings and conflicts, as data poisoning has traditionally been regarded as a security threat to machine learning systems. To address this issue, it is imperative for harmless poisoning generators to claim ownership of their generated datasets, enabling users to identify potential poisoning to prevent misuse. In this paper, we propose the deployment of watermarking schemes as a solution to this challenge. We introduce two provable and practical watermarking approaches for data poisoning: \em post‑poisoning watermarking and \em poisoning‑concurrent watermarking. Our analyses demonstrate that when the watermarking length is Θ(\sqrtd/ε_w) for post‑poisoning watermarking, and falls within the range of Θ(1/ε_w^2) to O(\sqrtd/ε_p) for poisoning‑concurrent watermarking, the watermarked poisoning dataset provably ensures both watermarking detectability and poisoning utility, certifying the practicality of watermarking under data poisoning attacks. We validate our theoretical findings through experiments on several attacks, models, and datasets.

Abstract:
Retrieval‑augmented generation (RAG) enhances Large Language Models (LLMs) by mitigating hallucinations and outdated information issues, yet simultaneously facilitates unauthorized data appropriation at scale. This paper addresses this challenge through two key contributions. First, we introduce RPD, a novel dataset specifically designed for RAG plagiarism detection that encompasses diverse professional domains and writing styles, overcoming limitations in existing resources. Second, we develop a dual‑layered watermarking system that embeds protection at both semantic and lexical levels, complemented by an interrogator‑detective framework that employs statistical hypothesis testing on accumulated evidence. Extensive experimentation demonstrates our approach's effectiveness across varying query volumes, defense prompts, and retrieval parameters, while maintaining resilience against adversarial evasion techniques. This work establishes a foundational framework for intellectual property protection in retrieval‑augmented AI systems.

Abstract:
Robust invisible watermarking aims to embed hidden information into images such that the watermark can survive various image manipulations. However, the rise of powerful diffusion‑based image generation and editing techniques poses a new threat to these watermarking schemes. In this paper, we present a theoretical study and method demonstrating that diffusion models can effectively break robust image watermarks that were designed to resist conventional perturbations. We show that a diffusion‑driven ``image regeneration'' process can erase embedded watermarks while preserving perceptual image content. We further introduce a novel guided diffusion attack that explicitly targets the watermark signal during generation, significantly degrading watermark detectability. Theoretically, we prove that as an image undergoes sufficient diffusion‑based transformation, the mutual information between the watermarked image and the embedded watermark payload vanishes, resulting in decoding failure. Experimentally, we evaluate our approach on multiple state‑of‑the‑art watermarking schemes (including the deep learning‑based methods StegaStamp, TrustMark, and VINE) and demonstrate near‑zero watermark recovery rates after attack, while maintaining high visual fidelity of the regenerated images. Our findings highlight a fundamental vulnerability in current robust watermarking techniques against generative model‑based attacks, underscoring the need for new watermarking strategies in the era of generative AI.

Abstract:
Being trained on large and vast datasets, visual foundation models (VFMs) can be fine‑tuned for diverse downstream tasks, achieving remarkable performance and efficiency in various computer vision applications. The high computation cost of data collection and training motivates the owners of some VFMs to distribute them alongside the license to protect their intellectual property rights. However, a dishonest user of the protected model's copy may illegally redistribute it, for example, to make a profit. As a consequence, the development of reliable ownership verification tools is of great importance today, since such methods can be used to differentiate between a redistributed copy of the protected model and an independent model. In this paper, we propose an approach to ownership verification of visual foundation models by fine‑tuning a small set of expressive layers of a VFM along with a small encoder‑decoder network to embed digital watermarks into an internal representation of a hold‑out set of input images. Importantly, the watermarks embedded remain detectable in the functional copies of the protected model, obtained, for example, by fine‑tuning the VFM for a particular downstream task. Theoretically and experimentally, we demonstrate that the proposed method yields a low probability of false detection of a non‑watermarked model and a low probability of false misdetection of a watermarked model.

Abstract:
Multi‑agent deployments of large language models (LLMs) are increasingly embedded in market, allocation, and governance workflows, yet covert coordination among agents can silently erode trust and social welfare. Existing audits are dominated by heuristics that lack theoretical guarantees, struggle to transfer across tasks, and seldom ship with the infrastructure needed for independent replication. We introduce Audit the Whisper, a conference‑grade research artifact that spans theory, benchmark design, detection, and reproducibility. Our contributions are: (i) a channel‑capacity analysis showing how interventions such as paraphrase, rate limiting, and role permutation impose quantifiable capacity penalties‑operationalised via paired‑run Kullback‑‑Leibler diagnostics‑that tighten mutual‑information thresholds with finite‑sample guarantees and full proofs; (ii) ColludeBench‑v0, covering pricing, first‑price auctions, peer review, and hosted Gemini/Groq APIs with configurable covert schemes, deterministic manifests, and reward instrumentation; and (iii) a calibrated auditing pipeline that fuses cross‑run mutual information, permutation invariance, watermark variance, and fairness‑aware acceptance bias, each tuned to a 10^‑3 false‑positive budget and validated by 10k honest runs plus an e‑value martingale. Across ColludeBench and external suites including Secret Collusion, CASE, Perfect Collusion Benchmark, and SentinelAgent, the union meta‑test attains state‑of‑the‑art power at fixed FPR while ablations surface price‑of‑auditing trade‑offs and fairness‑driven colluders invisible to MI alone. We release regeneration scripts, anonymized manifests, and documentation so that external auditors can reproduce every figure, satisfy double‑blind requirements, and extend the framework with minimal effort.

Abstract:
Large language models (LLMs) raise concerns about content authenticity and integrity because they can generate human‑like text at scale. Text watermarks, which embed detectable statistical signals into generated text, offer a provable way to verify content origin. Many detection methods rely on pivotal statistics that are i.i.d. under human‑written text, making goodness‑of‑fit (GoF) tests a natural tool for watermark detection. However, GoF tests remain largely underexplored in this setting. In this paper, we systematically evaluate eight GoF tests across three popular watermarking schemes, using three open‑source LLMs, two datasets, various generation temperatures, and multiple post‑editing methods. We find that general GoF tests can improve both the detection power and robustness of watermark detectors. Notably, we observe that text repetition, common in low‑temperature settings, gives GoF tests a unique advantage not exploited by existing methods. Our results highlight that classic GoF tests are a simple yet powerful and underused tool for watermark detection in LLMs.

Abstract:
Ensuring the trustworthiness of data from distributed and resource‑constrained environments, such as Wireless Sensor Networks or IoT devices, is critical. Existing Reversible Data Hiding (RDH) methods for scalar data suffer from low embedding capacity and poor intrinsic mixing between host data and watermark. This paper introduces Hiding in the Imaginary Domain with Data Encryption (H[i]dden), a novel framework based on complex number arithmetic for simultaneous information embedding and encryption. The H[i]dden framework offers perfect reversibility, in‑principle unlimited watermark size, and intrinsic data‑watermark mixing. The paper further introduces two protocols: H[i]dden‑EG, for joint reversible data hiding and encryption, and H[i]dden‑AggP, for privacy‑preserving aggregation of watermarked data, based on partially homomorphic encryption. These protocols provide efficient and resilient solutions for data integrity, provenance and confidentiality, serving as a foundation for new schemes based on the algebraic properties of the complex domain.

Abstract:
Diffusion large language models (dLLMs) offer faster generation than autoregressive models while maintaining comparable quality, but existing watermarking methods fail on them due to their non‑sequential decoding. Unlike autoregressive models that generate tokens left‑to‑right, dLLMs can finalize tokens in arbitrary order, breaking the causal design underlying traditional watermarks. We present DMark, the first watermarking framework designed specifically for dLLMs. DMark introduces three complementary strategies to restore watermark detectability: predictive watermarking uses model‑predicted tokens when actual context is unavailable; bidirectional watermarking exploits both forward and backward dependencies unique to diffusion decoding; and predictive‑bidirectional watermarking combines both approaches to maximize detection strength. Experiments across multiple dLLMs show that DMark achieves 92.0‑99.5% detection rates at 1% false positive rate while maintaining text quality, compared to only 49.6‑71.2% for naive adaptations of existing methods. DMark also demonstrates robustness against text manipulations, establishing that effective watermarking is feasible for non‑autoregressive language models.

Abstract:
The rapid progress of Generative Artificial Intelligence (GenAI) has enabled the effortless synthesis of high‑quality visual content, while simultaneously raising pressing concerns about intellectual property protection, authenticity, and accountability. Among various countermeasures, watermarking has emerged as a fundamental mechanism for tracing provenance, distinguishing AI‑generated images from natural content, and supporting trustworthy digital ecosystems. This paper presents a comprehensive survey of AI‑generated image watermarking, systematically reviewing the field from five perspectives: (1) the formalization and fundamental components of image watermarking systems; (2) existing watermarking methodologies and their comparative characteristics; (3) evaluation metrics in terms of visual fidelity, embedding capacity, and detectability; (4) known vulnerabilities under malicious attacks and recent advances in secure and robust watermarking designs; and (5) open challenges, emerging trends, and future research directions. The survey seeks to offer researchers a holistic understanding of watermarking technologies for AI‑generated images and to facilitate their continued advancement toward secure and responsible AI‑generated content practices.

Abstract:
Watermarking algorithms for Large Language Models (LLMs) effectively identify machine‑generated content by embedding and detecting hidden statistical features in text. However, such embedding leads to a decline in text quality, especially in low‑entropy scenarios where performance needs improvement. Existing methods that rely on entropy thresholds often require significant computational resources for tuning and demonstrate poor adaptability to unknown or cross‑task generation scenarios. We propose Context‑Aware Threshold watermarking (\myalgo), a novel framework that dynamically adjusts watermarking intensity based on real‑time semantic context. \myalgo partitions text generation into semantic states using logits clustering, establishing context‑aware entropy thresholds that preserve fidelity in structured content while embedding robust watermarks. Crucially, it requires no pre‑defined thresholds or task‑specific tuning. Experiments show \myalgo improves text quality in cross‑tasks without sacrificing detection accuracy.

Abstract:
In this paper, we investigate data‑driven attack detection and identification in a model‑free setting. We consider a practically motivated scenario in which the available dataset may be compromised by malicious sensor attacks, but contains an unknown, contiguous, partially attack‑free interval. The control input is assumed to include a small stochastic watermarking signal. Under these assumptions, we establish sufficient conditions for attack detection and identification from partially attack‑free data. We also develop data‑driven detection and identification procedures and characterize their computational complexity. Notably, the proposed framework does not impose a limit on the number of compromised sensors; thus, it can detect and identify attacks even when all sensor outputs are compromised outside the attack‑free interval, provided that the attack‑free interval is sufficiently long. Finally, we demonstrate the effectiveness of the proposed framework via numerical simulations.

Abstract:
We present Timbru, a post‑hoc audio watermarking model that achieves state‑of‑the‑art robustness and imperceptibility trade‑offs without training an embedder‑detector model. Given any 44.1 kHz stereo music snippet, our method performs per‑audio gradient optimization to add imperceptible perturbations in the latent space of a pretrained audio VAE, guided by a combined message and perceptual loss. The watermark can then be extracted using a pretrained CLAP model. We evaluate 16‑bit watermarking on MUSDB18‑HQ against AudioSeal, WavMark, and SilentCipher across common filtering, noise, compression, resampling, cropping, and regeneration attacks. Our approach attains the best average bit error rates, while preserving perceptual quality, demonstrating an efficient, dataset‑free path to imperceptible audio watermarking.

Abstract:
As image generation models grow increasingly powerful and accessible, concerns around authenticity, ownership, and misuse of synthetic media have become critical. The ability to generate lifelike images indistinguishable from real ones introduces risks such as misinformation, deepfakes, and intellectual property violations. Traditional watermarking methods either degrade image quality, are easily removed, or require access to confidential model internals ‑ making them unsuitable for secure and scalable deployment. We are the first to introduce ZK‑WAGON, a novel system for watermarking image generation models using the Zero‑Knowledge Succinct Non Interactive Argument of Knowledge (ZK‑SNARKs). Our approach enables verifiable proof of origin without exposing model weights, generation prompts, or any sensitive internal information. We propose Selective Layer ZK‑Circuit Creation (SL‑ZKCC), a method to selectively convert key layers of an image generation model into a circuit, reducing proof generation time significantly. Generated ZK‑SNARK proofs are imperceptibly embedded into a generated image via Least Significant Bit (LSB) steganography. We demonstrate this system on both GAN and Diffusion models, providing a secure, model‑agnostic pipeline for trustworthy AI image generation.

Abstract:
Watermarking has become a key technique for proprietary language models, enabling the distinction between AI‑generated and human‑written text. However, in many real‑world scenarios, LLM‑generated content may undergo post‑generation edits, such as human revisions or even spoofing attacks, making it critical to detect and localize such modifications. In this work, we introduce a new task: detecting post‑generation edits locally made to watermarked LLM outputs. To this end, we propose a combinatorial pattern‑based watermarking framework, which partitions the vocabulary into disjoint subsets and embeds the watermark by enforcing a deterministic combinatorial pattern over these subsets during generation. We accompany the combinatorial watermark with a global statistic that can be used to detect the watermark. Furthermore, we design lightweight local statistics to flag and localize potential edits. We introduce two task‑specific evaluation metrics, Type‑I error rate and detection accuracy, and evaluate our method on open‑source LLMs across a variety of editing scenarios, demonstrating strong empirical performance in edit localization.

Abstract:
Memristive crossbar arrays enable in‑memory computing by performing parallel analog computations directly within memory, making them well‑suited for machine learning, neural networks, and neuromorphic systems. However, despite their advantages, non‑volatile memristors are vulnerable to security threats (such as adversarial extraction of stored weights when the hardware is compromised. Protecting these weights is essential since they represent valuable intellectual property resulting from lengthy and costly training processes using large, often proprietary, datasets. As a solution we propose two security mechanisms: Keyed Permutor and Watermark Protection Columns; where both safeguard critical weights and establish verifiable ownership (even in cases of data leakage). Our approach integrates efficiently with existing memristive crossbar architectures without significant design modifications. Simulations across 45nm, 22nm, and 7nm CMOS nodes, using a realistic interconnect model and a large RF dataset, show that both mechanisms offer robust protection with under 10% overhead in area, delay and power. We also present initial experiments employing the widely known MNIST dataset; further highlighting the feasibility of securing memristive in‑memory computing systems with minimal performance trade‑offs.

Abstract:
Most image watermarking systems focus on robustness, capacity, and imperceptibility while treating the embedded payload as meaningless bits. This bit‑centric view imposes a hard ceiling on capacity and prevents watermarks from carrying useful information. We propose LatentSeal, which reframes watermarking as semantic communication: a lightweight text autoencoder maps full‑sentence messages into a compact 256‑dimensional unit‑norm latent vector, which is robustly embedded by a finetuned watermark model and secured through a secret, invertible rotation. The resulting system hides full‑sentence messages, decodes in real time, and survives valuemetric and geometric attacks. It surpasses prior state of the art in BLEU‑4 and Exact Match on several benchmarks, while breaking through the long‑standing 256‑bit payload ceiling. It also introduces a statistically calibrated score that yields a ROC AUC score of 0.97‑0.99, and practical operating points for deployment. By shifting from bit payloads to semantic latent vectors, LatentSeal enables watermarking that is not only robust and high‑capacity, but also secure and interpretable, providing a concrete path toward provenance, tamper explanation, and trustworthy AI governance. Models, training and inference code, and data splits will be available upon publication.

Abstract:
Generative models can generate photorealistic images at scale. This raises urgent concerns about the ability to detect synthetically generated images and attribute these images to specific sources. While watermarking has emerged as a possible solution, existing methods remain fragile to realistic distortions, susceptible to adaptive removal, and expensive to update when the underlying watermarking key changes. We propose a general watermarking framework that formulates the encoding problem as key‑dependent perturbation of the parameters of a generative model. Within this framework, we introduce Mixture of LoRA Markers (MOLM), a routing‑based instantiation in which binary keys activate lightweight LoRA adapters inside residual and attention blocks. This design avoids key‑specific re‑training and achieves the desired properties such as imperceptibility, fidelity, verifiability, and robustness. Experiments on Stable Diffusion and FLUX show that MOLM preserves image quality while achieving robust key recovery against distortions, compression and regeneration, averaging attacks, and black‑box adversarial attacks on the extractor.

Abstract:
We propose a high‑payload image watermarking method for textual embedding, where a semantic description of the image ‑ which may also correspond to the input text prompt‑, is embedded inside the image. In order to be able to robustly embed high payloads in large‑scale images ‑ such as those produced by modern AI generators ‑ the proposed approach builds upon a traditional watermarking scheme that exploits orthogonal and turbo codes for improved robustness, and integrates frequency‑domain embedding and perceptual masking techniques to enhance watermark imperceptibility. Experiments show that the proposed method is extremely robust against a wide variety of image processing, and the embedded text can be retrieved also after traditional and AI inpainting, permitting to unveil the semantic modification the image has undergone via image‑text mismatch analysis.

Abstract:
The rapid growth of Large Language Models (LLMs) has highlighted the pressing need for reliable mechanisms to verify content ownership and ensure traceability. Watermarking offers a promising path forward, but it remains limited by privacy concerns in sensitive scenarios, as traditional approaches often require direct access to a model's parameters or its training data. In this work, we propose a secure multi‑party computation (MPC)‑based private LLMs watermarking framework, PRIVMARK, to address the concerns. Concretely, we investigate PostMark (EMNLP'2024), one of the state‑of‑the‑art LLMs Watermarking methods, and formulate its basic operations. Then, we construct efficient protocols for these operations using the MPC primitives in a black‑box manner. In this way, PRIVMARK enables multiple parties to collaboratively watermark an LLM's output without exposing the model's weights to any single computing party. We implement PRIVMARK using SecretFlow‑SPU (USENIX ATC'2023) and evaluate its performance using the ABY3 (CCS'2018) backend. The experimental results show that PRIVMARK achieves semantically identical results compared to the plaintext baseline without MPC and is resistant against paraphrasing and removing attacks with reasonable efficiency.

Abstract:
We introduce the first watermark tailored for diffusion language models (DLMs), an emergent LLM paradigm able to generate tokens in arbitrary order, in contrast to standard autoregressive language models (ARLMs) which generate tokens sequentially. While there has been much work in ARLM watermarking, a key challenge when attempting to apply these schemes directly to the DLM setting is that they rely on previously generated tokens, which are not always available with DLM generation. In this work we address this challenge by: (i) applying the watermark in expectation over the context even when some context tokens are yet to be determined, and (ii) promoting tokens which increase the watermark strength when used as context for other tokens. This is accomplished while keeping the watermark detector unchanged. Our experimental evaluation demonstrates that the DLM watermark leads to a >99% true positive rate with minimal quality impact and achieves similar robustness to existing ARLM watermarks, enabling for the first time reliable DLM watermarking.

Abstract:
Verifying the authenticity of AI‑generated text has become increasingly important with the rapid advancement of large language models, and unbiased watermarking has emerged as a promising approach due to its ability to preserve output distribution without degrading quality. However, recent work reveals that unbiased watermarks can accumulate distributional bias over multiple generations and that existing robustness evaluations are inconsistent across studies. To address these issues, we introduce UWbench, the first open‑source benchmark dedicated to the principled evaluation of unbiased watermarking methods. Our framework combines theoretical and empirical contributions: we propose a statistical metric to quantify multi‑batch distribution drift, prove an impossibility result showing that no unbiased watermark can perfectly preserve the distribution under infinite queries, and develop a formal analysis of robustness against token‑level modification attacks. Complementing this theory, we establish a three‑axis evaluation protocol: unbiasedness, detectability, and robustness, and show that token modification attacks provide more stable robustness assessments than paraphrasing‑based methods. Together, UWbench offers the community a standardized and reproducible platform for advancing the design and evaluation of unbiased watermarking algorithms.

Abstract:
As large language models become increasingly capable and widely deployed, verifying the provenance of machine‑generated content is critical to ensuring trust, safety, and accountability. Watermarking techniques have emerged as a promising solution by embedding imperceptible statistical signals into the generation process. Among them, unbiased watermarking is particularly attractive due to its theoretical guarantee of preserving the language model's output distribution, thereby avoiding degradation in fluency or detectability through distributional shifts. However, existing unbiased watermarking schemes often suffer from weak detection power and limited robustness, especially under short text lengths or distributional perturbations. In this work, we propose ENS, a novel ensemble framework that enhances the detectability and robustness of logits‑based unbiased watermarks while strictly preserving their unbiasedness. ENS sequentially composes multiple independent watermark instances, each governed by a distinct key, to amplify the watermark signal. We theoretically prove that the ensemble construction remains unbiased in expectation and demonstrate how it improves the signal‑to‑noise ratio for statistical detectors. Empirical evaluations on multiple LLM families show that ENS substantially reduces the number of tokens needed for reliable detection and increases resistance to smoothing and paraphrasing attacks without compromising generation quality.

Abstract:
Recent work has demonstrated that controlled pretraining experiments are a powerful tool for studying the relationship between training data and large language model (LLM) behavior. However, the computational cost of pretraining presents a significant constraint. To overcome this constraint, we propose a new approach where multiple experiments are conducted simultaneously during a single training run. We validate our approach by performing ten experiments while training on 210B tokens, with models of up to 2.7B parameters. Although models are trained only once, we can replicate the results of multiple previous works on data contamination, poisoning, and memorization. We also conduct novel investigations into knowledge acquisition, mathematical reasoning, and watermarking. For example, we dynamically update the training data until a model acquires a particular piece of knowledge. Remarkably, the influence of the experiments on the model's training dynamics and overall performance is minimal. However, interactions between experiments may act as a confounder in our approach. We propose continual pretraining dependence testing (CPDT), a novel technique to test for interactions with continual pretraining experiments, finding them to be negligible in our setup. Overall, our results suggest that performing multiple pretraining experiments within a single training run can enable rigorous scientific experimentation with large models on a compute budget.

Abstract:
This paper introduces a novel watermarking method for diffusion models. It is based on guiding the diffusion process using the gradient computed from any off‑the‑shelf watermark decoder. The gradient computation encompasses different image augmentations, increasing robustness to attacks against which the decoder was not originally robust, without retraining or fine‑tuning. Our method effectively convert any post‑hoc watermarking scheme into an in‑generation embedding along the diffusion process. We show that this approach is complementary to watermarking techniques modifying the variational autoencoder at the end of the diffusion process. We validate the methods on different diffusion models and detectors. The watermarking guidance does not significantly alter the generated image for a given seed and prompt, preserving both the diversity and quality of generation.

Abstract:
Cryptographic Ranging Authentication is here! We present initial results on the Pulsar authenticated ranging service broadcast from space with Pulsar‑0 utilizing a recording taken at Xona headquarters in Burlingame, CA. No assumptions pertaining to the ownership or leakage of encryption keys are required. This work discusses the Pulsar watermark design and security analysis. We derive the Pulsar watermark's probabilities of missed detection and false alarm, and we discuss the required receiver processing needed to utilize the Pulsar watermark. We present validation results of the Pulsar watermark utilizing the transmissions from orbit. Lastly, we provide results that demonstrate the spoofing detection efficacy with a spoofing scenario that incorporates the authentic transmissions from orbit. Because we make no assumption about the leakage of symmetric encryption keys, this work provides mathematical justification of the watermark's security, and our July 2025 transmissions from orbit, we claim the world's first authenticated satellite pseudorange from orbit.

Abstract:
With the increasing popularity of large language models, concerns over content authenticity have led to the development of myriad watermarking schemes. These schemes can be used to detect a machine‑generated text via an appropriate key, while being imperceptible to readers with no such keys. The corresponding detection mechanisms usually take the form of statistical hypothesis testing for the existence of watermarks, spurring extensive research in this direction. However, the finer‑grained problem of identifying which segments of a mixed‑source text are actually watermarked, is much less explored; the existing approaches either lack scalability or theoretical guarantees robust to paraphrase and post‑editing. In this work, we introduce a unique perspective to such watermark segmentation problems through the lens of epidemic change‑points. By highlighting the similarities as well as differences of these two problems, we motivate and propose WISER: a novel, computationally efficient, watermark segmentation algorithm. We theoretically validate our algorithm by deriving finite sample error‑bounds, and establishing its consistency in detecting multiple watermarked segments in a single text. Complementing these theoretical results, our extensive numerical experiments show that WISER outperforms state‑of‑the‑art baseline methods, both in terms of computational speed as well as accuracy, on various benchmark datasets embedded with diverse watermarking schemes. Our theoretical and empirical findings establish WISER as an effective tool for watermark localization in most settings. It also shows how insights from a classical statistical problem can lead to a theoretically valid and computationally efficient solution of a modern and pertinent problem.

Abstract:
In this paper we show that cryptographic backdoors in a neural network (NN) can be highly effective in two directions, namely mounting the attacks as well as in presenting the defenses as well. On the attack side, a carefully planted cryptographic backdoor enables powerful and invisible attack on the NN. Considering the defense, we present applications: first, a provably robust NN watermarking scheme; second, a protocol for guaranteeing user authentication; and third, a protocol for tracking unauthorized sharing of the NN intellectual property (IP). From a broader theoretical perspective, borrowing the ideas from Goldwasser et. al. [FOCS 2022], our main contribution is to show that all these instantiated practical protocol implementations are provably robust. The protocols for watermarking, authentication and IP tracking resist an adversary with black‑box access to the NN, whereas the backdoor‑enabled adversarial attack is impossible to prevent under the standard assumptions. While the theoretical tools used for our attack is mostly in line with the Goldwasser et. al. ideas, the proofs related to the defense need further studies. Finally, all these protocols are implemented on state‑of‑the‑art NN architectures with empirical results corroborating the theoretical claims. Further, one can utilize post‑quantum primitives for implementing the cryptographic backdoors, laying out foundations for quantum‑era applications in machine learning (ML).

Abstract:
With the rapid advancement of speech generative models, unauthorized voice cloning poses significant privacy and security risks. Speech watermarking offers a viable solution for tracing sources and preventing misuse. Current watermarking technologies fall mainly into two categories: DSP‑based methods and deep learning‑based methods. DSP‑based methods are efficient but vulnerable to attacks, whereas deep learning‑based methods offer robust protection at the expense of significantly higher computational cost. To improve the computational efficiency and enhance the robustness, we propose PKDMark, a lightweight deep learning‑based speech watermarking method that leverages progressive knowledge distillation (PKD). Our approach proceeds in two stages: (1) training a high‑performance teacher model using an invertible neural network‑based architecture, and (2) transferring the teacher's capabilities to a compact student model through progressive knowledge distillation. This process reduces computational costs by 93.6% while maintaining high level of robust performance and imperceptibility. Experimental results demonstrate that our distilled model achieves an average detection F1 score of 99.6% with a PESQ of 4.30 in advanced distortions, enabling efficient speech watermarking for real‑time speech synthesis applications.

Abstract:
Generative adversarial networks (GANs) and diffusion models have dramatically advanced deepfake technology, and its threats to digital security, media integrity, and public trust have increased rapidly. This research explored zero‑shot deepfake detection, an emerging method even when the models have never seen a particular deepfake variation. In this work, we studied self‑supervised learning, transformer‑based zero‑shot classifier, generative model fingerprinting, and meta‑learning techniques that better adapt to the ever‑evolving deepfake threat. In addition, we suggested AI‑driven prevention strategies that mitigated the underlying generation pipeline of the deepfakes before they occurred. They consisted of adversarial perturbations for creating deepfake generators, digital watermarking for content authenticity verification, real‑time AI monitoring for content creation pipelines, and blockchain‑based content verification frameworks. Despite these advancements, zero‑shot detection and prevention faced critical challenges such as adversarial attacks, scalability constraints, ethical dilemmas, and the absence of standardized evaluation benchmarks. These limitations were addressed by discussing future research directions on explainable AI for deepfake detection, multimodal fusion based on image, audio, and text analysis, quantum AI for enhanced security, and federated learning for privacy‑preserving deepfake detection. This further highlighted the need for an integrated defense framework for digital authenticity that utilized zero‑shot learning in combination with preventive deepfake mechanisms. Finally, we highlighted the important role of interdisciplinary collaboration between AI researchers, cybersecurity experts, and policymakers to create resilient defenses against the rising tide of deepfake attacks.

Abstract:
The advancement of diffusion models has enhanced the realism of AI‑generated content but also raised concerns about misuse, necessitating robust copyright protection and tampering localization. Although recent methods have made progress toward unified solutions, their reliance on post hoc processing introduces considerable application inconvenience and compromises forensic reliability. We propose StableGuard, a novel framework that seamlessly integrates a binary watermark into the diffusion generation process, ensuring copyright protection and tampering localization in Latent Diffusion Models through an end‑to‑end design. We develop a Multiplexing Watermark VAE (MPW‑VAE) by equipping a pretrained Variational Autoencoder (VAE) with a lightweight latent residual‑based adapter, enabling the generation of paired watermarked and watermark‑free images. These pairs, fused via random masks, create a diverse dataset for training a tampering‑agnostic forensic network. To further enhance forensic synergy, we introduce a Mixture‑of‑Experts Guided Forensic Network (MoE‑GFN) that dynamically integrates holistic watermark patterns, local tampering traces, and frequency‑domain cues for precise watermark verification and tampered region detection. The MPW‑VAE and MoE‑GFN are jointly optimized in a self‑supervised, end‑to‑end manner, fostering a reciprocal training between watermark embedding and forensic accuracy. Extensive experiments demonstrate that StableGuard consistently outperforms state‑of‑the‑art methods in image fidelity, watermark verification, and tampering localization.

Abstract:
With the wide spread of video, video watermarking has become increasingly crucial for copyright protection and content authentication. However, video watermarking still faces numerous challenges. For example, existing methods typically have shortcomings in terms of watermarking capacity and robustness, and there is a lack of specialized noise layer for High Efficiency Video Coding(HEVC) compression. To address these issues, this paper introduces a Deep Invertible Network for Video watermarking (DINVMark) and designs a noise layer to simulate HEVC compression. This approach not only in creases watermarking capacity but also enhances robustness. DINVMark employs an Invertible Neural Network (INN), where the encoder and decoder share the same network structure for both watermark embedding and extraction. This shared architecture ensures close coupling between the encoder and decoder, thereby improving the accuracy of the watermark extraction process. Experimental results demonstrate that the proposed scheme significantly enhances watermark robustness, preserves video quality, and substantially increases watermark embedding capacity.

Abstract:
Large Language Models (LLMs) have emerged as promising tools for malware detection by analyzing code semantics, identifying vulnerabilities, and adapting to evolving threats. However, their reliability under adversarial compiler‑level obfuscation is yet to be discovered. In this study, we empirically evaluate the robustness of three state‑of‑the‑art LLMs: ChatGPT‑4o, Gemini Flash 2.5, and Claude Sonnet 4 against compiler‑level obfuscation techniques implemented via the LLVM infrastructure. These include control flow flattening, bogus control flow injection, instruction substitution, and split basic blocks, which are widely used to evade detection while preserving malicious behavior. We perform a structured evaluation on 40~C functions (20 vulnerable, 20 secure) sourced from the Devign dataset and obfuscated using LLVM passes. Our results show that these models often fail to correctly classify obfuscated code, with precision, recall, and F1‑score dropping significantly after transformation. This reveals a critical limitation: LLMs, despite their language understanding capabilities, can be easily misled by compiler‑based obfuscation strategies. To promote reproducibility, we release all evaluation scripts, prompts, and obfuscated code samples in a public repository. We also discuss the implications of these findings for adversarial threat modeling, and outline future directions such as software watermarking, compiler‑aware defenses, and obfuscation‑resilient model design.

Abstract:
Radio frequency fingerprint identification (RFFI) distinguishes wireless devices by the small variations in their analog circuits, avoiding heavy cryptographic authentication. While deep learning on spectrograms improves accuracy, models remain vulnerable to copying, tampering, and evasion. We present a stronger RFFI system combining watermarking for ownership proof and anomaly detection for spotting suspicious inputs. Using a ResNet‑34 on log‑Mel spectrograms, we embed three watermarks: a simple trigger, an adversarially trained trigger robust to noise and filtering, and a hidden gradient/weight signature. A convolutional Variational Autoencoders (VAE) with Kullback‑Leibler (KL) warm‑up and free‑bits flags off‑distribution queries. On the LoRa dataset, our system achieves 94.6% accuracy, 98% watermark success, and 0.94 AUROC, offering verifiable, tamper‑resistant authentication.

Abstract:
With the widespread adoption of open‑source code language models (code LMs), intellectual property (IP) protection has become an increasingly critical concern. While current watermarking techniques have the potential to identify the code LM to protect its IP, they have limitations when facing the more practical and complex demand, i.e., offering the individual user‑level tracing in the black‑box setting. This work presents CLMTracing, a black‑box code LM watermarking framework employing the rule‑based watermarks and utility‑preserving injection method for user‑level model tracing. CLMTracing further incorporates a parameter selection algorithm sensitive to the robust watermark and adversarial training to enhance the robustness against watermark removal attacks. Comprehensive evaluations demonstrate CLMTracing is effective across multiple state‑of‑the‑art (SOTA) code LMs, showing significant harmless improvements compared to existing SOTA baselines and strong robustness against various removal attacks.

Abstract:
Existing watermarking methods for large language models (LLMs) mainly embed watermark by adjusting the token sampling prediction or post‑processing, lacking intrinsic coupling with LLMs, which may significantly reduce the semantic quality of the generated marked texts. Traditional watermarking methods based on training or fine‑tuning may be extendable to LLMs. However, most of them are limited to the white‑box scenario, or very time‑consuming due to the massive parameters of LLMs. In this paper, we present a new watermarking framework for LLMs, where the watermark is embedded into the LLM by manipulating the internal parameters of the LLM, and can be extracted from the generated text without accessing the LLM. Comparing with related methods, the proposed method entangles the watermark with the intrinsic parameters of the LLM, which better balances the robustness and imperceptibility of the watermark. Moreover, the proposed method enables us to extract the watermark under the black‑box scenario, which is computationally efficient for use. Experimental results have also verified the feasibility, superiority and practicality. This work provides a new perspective different from mainstream works, which may shed light on future research.

Abstract:
As large language models (LLMs) become more advanced, it is increasingly difficult to distinguish between human‑written and AI‑generated text. This paper draws a conceptual parallel between quantum uncertainty and the limits of authorship detection in natural language. We argue that there is a fundamental trade‑off: the more confidently one tries to identify whether a text was written by a human or an AI, the more one risks disrupting the text's natural flow and authenticity. This mirrors the tension between precision and disturbance found in quantum systems. We explore how current detection methods‑‑such as stylometry, watermarking, and neural classifiers‑‑face inherent limitations. Enhancing detection accuracy often leads to changes in the AI's output, making other features less reliable. In effect, the very act of trying to detect AI authorship introduces uncertainty elsewhere in the text. Our analysis shows that when AI‑generated text closely mimics human writing, perfect detection becomes not just technologically difficult but theoretically impossible. We address counterarguments and discuss the broader implications for authorship, ethics, and policy. Ultimately, we suggest that the challenge of AI‑text detection is not just a matter of better tools‑‑it reflects a deeper, unavoidable tension in the nature of language itself.

Abstract:
Digital watermarks can be embedded into AI‑generated content (AIGC) by initializing the generation process with starting points sampled from a secret distribution. When combined with pseudorandom error‑correcting codes, such watermarked outputs can remain indistinguishable from unwatermarked objects, while maintaining robustness under whitenoise. In this paper, we go beyond indistinguishability and investigate security under removal attacks. We demonstrate that indistinguishability alone does not necessarily guarantee resistance to adversarial removal. Specifically, we propose a novel attack that exploits boundary information leaked by the locations of watermarked objects. This attack significantly reduces the distortion required to remove watermarks ‑‑ by up to a factor of 15 × compared to a baseline whitenoise attack under certain settings. To mitigate such attacks, we introduce a defense mechanism that applies a secret transformation to hide the boundary, and prove that the secret transformation effectively rendering any attacker's perturbations equivalent to those of a naive whitenoise adversary. Our empirical evaluations, conducted on multiple versions of Stable Diffusion, validate the effectiveness of both the attack and the proposed defense, highlighting the importance of addressing boundary leakage in latent‑based watermarking schemes.

Abstract:
We study a basic question about cryptographic watermarking for generative models: how reliable can a watermark remain when an adversary is allowed to corrupt the encoded signal? To address this question, we introduce a minimal coding abstraction that we call a zero‑bit tamper‑detection code. This is a secret‑key procedure that samples a pseudorandom codeword and, given a candidate word, decides whether it should be treated as unmarked content or as the result of tampering with a valid codeword. It captures the two core requirements of robust watermarking: soundness and tamper detection. Within this abstraction we prove a sharp unconditional limit on robustness to independent symbol corruption. For an alphabet of size q, there is a critical corruption rate of 1‑1/q such that no scheme with soundness, even relaxed to allow a fixed constant false positive probability on random content, can reliably detect tampering once an adversary can change more than this fraction of symbols. In particular, in the binary case no cryptographic watermark can remain robust if more than half of the encoded bits are modified. We also show that this threshold is tight by giving simple information‑theoretic constructions that achieve soundness and tamper detection for all strictly smaller corruption rates. We then test experimentally whether this limit appears in practice by looking at the recent watermarking for images of Gunn, Zhao, and Song (ICLR 2025). We show that a simple crop and resize operation reliably flipped about half of the latent signs and consistently prevented belief‑propagation decoding from recovering the codeword, erasing the watermark while leaving the image visually intact.

Abstract:
We introduce MarkDiffusion, an open‑source Python toolkit for generative watermarking of latent diffusion models. It comprises three key components: a unified implementation framework for streamlined watermarking algorithm integrations and user‑friendly interfaces; a mechanism visualization suite that intuitively showcases added and extracted watermark patterns to aid public understanding; and a comprehensive evaluation module offering standard implementations of 24 tools across three essential aspects ‑ detectability, robustness, and output quality ‑ plus 8 automated evaluation pipelines. Through MarkDiffusion, we seek to assist researchers, enhance public awareness and engagement in generative watermarking, and promote consensus while advancing research and applications.

Abstract:
Large Language Model (LLM) watermarking embeds detectable signals into generated text for copyright protection, misuse prevention, and content detection. While prior studies evaluate robustness using watermark removal attacks, these methods are often suboptimal, creating the misconception that effective removal requires large perturbations or powerful adversaries. To bridge the gap, we first formalize the system model for LLM watermark, and characterize two realistic threat models constrained on limited access to the watermark detector. We then analyze how different types of perturbation vary in their attack range, i.e., the number of tokens they can affect with a single edit. We observe that character‑level perturbations (e.g., typos, swaps, deletions, homoglyphs) can influence multiple tokens simultaneously by disrupting the tokenization process. We demonstrate that character‑level perturbations are significantly more effective for watermark removal under the most restrictive threat model. We further propose guided removal attacks based on the Genetic Algorithm (GA) that uses a reference detector for optimization. Under a practical threat model with limited black‑box queries to the watermark detector, our method demonstrates strong removal performance. Experiments confirm the superiority of character‑level perturbations and the effectiveness of the GA in removing watermarks under realistic constraints. Additionally, we argue there is an adversarial dilemma when considering potential defenses: any fixed defense can be bypassed by a suitable perturbation strategy. Motivated by this principle, we propose an adaptive compound character‑level attack. Experimental results show that this approach can effectively defeat the defenses. Our findings highlight significant vulnerabilities in existing LLM watermark schemes and underline the urgency for the development of new robust mechanisms.

Abstract:
As large language models (LLMs) are adapted to sensitive domains such as medicine, their fluency raises safety risks, particularly regarding provenance and accountability. Watermarking embeds detectable patterns to mitigate these risks, yet its reliability in medical contexts remains untested. Existing benchmarks focus on detection‑quality tradeoffs and overlook factual risks. In medical text, watermarking often reweights low‑entropy tokens, which are highly predictable and often carry critical medical terminology. Shifting these tokens can cause inaccuracy and hallucinations, risks that prior general‑domain benchmarks fail to capture. We propose a medical‑focused evaluation workflow that jointly assesses factual accuracy and coherence. Using GPT‑Judger and further human validation, we introduce the Factuality‑Weighted Score (FWS), a composite metric prioritizing factual accuracy beyond coherence to guide watermarking deployment in medical domains. Our evaluation shows current watermarking methods substantially compromise medical factuality, with entropy shifts degrading medical entity representation. These findings underscore the need for domain‑aware watermarking approaches that preserve the integrity of medical content.

Abstract:
As on‑device LLMs(e.g., Apple on‑device Intelligence) are widely adopted to reduce network dependency, improve privacy, and enhance responsiveness, verifying the legitimacy of models running on local devices becomes critical. Existing attestation techniques are not suitable for billion‑parameter Large Language Models (LLMs), struggling to remain both time‑ and memory‑efficient while addressing emerging threats in the LLM era. In this paper, we present AttestLLM, the first‑of‑its‑kind attestation framework to protect the hardware‑level intellectual property (IP) of device vendors by ensuring that only authorized LLMs can execute on target platforms. AttestLLM leverages an algorithm/software/hardware co‑design approach to embed robust watermarking signatures onto the activation distributions of LLM building blocks. It also optimizes the attestation protocol within the Trusted Execution Environment (TEE), providing efficient verification without compromising inference throughput. Extensive proof‑of‑concept evaluations on LLMs from Llama, Qwen, and Phi families for on‑device use cases demonstrate AttestLLM's attestation reliability, fidelity, and efficiency. Furthermore, AttestLLM enforces model legitimacy and exhibits resilience against model replacement and forgery attacks.

Abstract:
As generative audio models are rapidly evolving, AI‑generated audios increasingly raise concerns about copyright infringement and misinformation spread. Audio watermarking, as a proactive defense, can embed secret messages into audio for copyright protection and source verification. However, current neural audio watermarking methods focus primarily on the imperceptibility and robustness of watermarking, while ignoring its vulnerability to security attacks. In this paper, we develop a simple yet powerful attack: the overwriting attack that overwrites the legitimate audio watermark with a forged one and makes the original legitimate watermark undetectable. Based on the audio watermarking information that the adversary has, we propose three categories of overwriting attacks, i.e., white‑box, gray‑box, and black‑box attacks. We also thoroughly evaluate the proposed attacks on state‑of‑the‑art neural audio watermarking methods. Experimental results demonstrate that the proposed overwriting attacks can effectively compromise existing watermarking schemes across various settings and achieve a nearly 100% attack success rate. The practicality and effectiveness of the proposed overwriting attacks expose security flaws in existing neural audio watermarking systems, underscoring the need to enhance security in future audio watermarking designs.

Abstract:
The rise of synthetic media has blurred the boundary between reality and fabrication under the evolving power of artificial intelligence, fueling an infodemic that erodes public trust in cyberspace. For digital imagery, a multitude of editing applications further complicates the forensic analysis, including semantic edits that alter content, photometric adjustments that recalibrate colour characteristics, and geometric projections that reshape viewpoints. Collectively, these transformations manipulate and control perceptual interpretation of digital imagery. This susceptibility calls for forensic enquiry into reconstructing the chain of events, thereby revealing deeper evidential insight into the presence or absence of criminal intent. This study seeks to address an inverse problem of tracing the underlying generation chain that gives rise to the observed synthetic media. A tell‑tale watermarking system is developed for explanatory reasoning over the nature and extent of transformations across the lifecycle of synthetic media. Tell‑tale watermarks are tailored to different classes of transformations, responding in a manner that is neither strictly robust nor fragile but instead interpretable. These watermarks function as reference clues that evolve under the same transformation dynamics as the carrier media, leaving interpretable traces when subjected to transformations. Explanatory reasoning is then performed to infer the most plausible account across the combinatorial parameter space of composite transformations. Experimental evaluations demonstrate the validity of tell‑tale watermarking with respect to fidelity, synchronicity and traceability.

Abstract:
System prompts are critical for shaping the behavior and output quality of large language model (LLM)‑based applications, driving substantial investment in optimizing high‑quality prompts beyond traditional handcrafted designs. However, as system prompts become valuable intellectual property, they are increasingly vulnerable to prompt theft and unauthorized use, highlighting the urgent need for effective copyright auditing, especially watermarking. Existing methods rely on verifying subtle logit distribution shifts triggered by a query. We observe that this logit‑dependent verification framework is impractical in real‑world content‑only settings, primarily because (1) random sampling makes content‑level generation unstable for verification, and (2) stronger instructions needed for content‑level signals compromise prompt fidelity. To overcome these challenges, we propose PromptCOS, the first content‑only system prompt copyright auditing method based on content‑level output similarity. PromptCOS achieves watermark stability by designing a cyclic output signal as the conditional instruction's target. It preserves prompt fidelity by injecting a small set of auxiliary tokens to encode the watermark, leaving the main prompt untouched. Furthermore, to ensure robustness against malicious removal, we optimize cover tokens, i.e., critical tokens in the original prompt, to ensure that removing auxiliary tokens causes severe performance degradation. Experimental results show that promptCOS achieves high effectiveness (99.3% average watermark similarity), strong distinctiveness (60.8% higher than the best baseline), high fidelity (accuracy degradation no greater than 0.6%), robustness (resilience against four potential attack categories), and high computational efficiency (up to 98.1% cost saving).

Abstract:
Efficient and reliable detection of generated images is critical for the responsible deployment of generative models. Existing approaches primarily focus on improving detection accuracy and robustness under various image transformations and adversarial manipulations, yet they largely overlook the efficiency challenges of watermark detection across large‑scale image collections. To address this gap, we propose QRMark, an efficient and adaptive end‑to‑end method for detecting embedded image watermarks. The core idea of QRMark is to combine QR Code‑inspired error correction with tailored tiling techniques to improve detection efficiency while preserving accuracy and robustness. At the algorithmic level, QRMark employs a Reed‑Solomon error correction mechanism to mitigate the accuracy degradation introduced by tiling. At the system level, QRMark implements a resource‑aware multi‑channel horizontal fusion policy that adaptively assigns more streams to GPU‑intensive stages of the detection pipeline. It further employs a tile‑based workload interleaving strategy to overlap data‑loading overhead with computation and schedules kernels across stages to maximize efficiency. End‑to‑end evaluations show that QRMark achieves an average 2.43x inference speedup over the sequential baseline.

Abstract:
Industry 4.0's highly networked Machine Tool Controllers (MTCs) are prime targets for replay attacks that use outdated sensor data to manipulate actuators. Dynamic watermarking can reveal such tampering, but current schemes assume linear‑Gaussian dynamics and use constant watermark statistics, making them vulnerable to the time‑varying, partly proprietary behavior of MTCs. We close this gap with DynaMark, a reinforcement learning framework that models dynamic watermarking as a Markov decision process (MDP). It learns an adaptive policy online that dynamically adapts the covariance of a zero‑mean Gaussian watermark using available measurements and detector feedback, without needing system knowledge. DynaMark maximizes a unique reward function balancing control performance, energy consumption, and detection confidence dynamically. We develop a Bayesian belief updating mechanism for real‑time detection confidence in linear systems. This approach, independent of specific system assumptions, underpins the MDP for systems with linear dynamics. On a Siemens Sinumerik 828D controller digital twin, DynaMark achieves a reduction in watermark energy by 70% while preserving the nominal trajectory, compared to constant variance baselines. It also maintains an average detection delay equivalent to one sampling interval. A physical stepper‑motor testbed validates these findings, rapidly triggering alarms with less control performance decline and exceeding existing benchmarks.

Abstract:
Watermarking diffusion‑generated images is crucial for copyright protection and user tracking. However, current diffusion watermarking methods face significant limitations: zero‑bit watermarking systems lack the capacity for large‑scale user tracking, while multi‑bit methods are highly sensitive to certain image transformations or generative attacks, resulting in a lack of comprehensive robustness. In this paper, we propose OptMark, an optimization‑based approach that embeds a robust multi‑bit watermark into the intermediate latents of the diffusion denoising process. OptMark strategically inserts a structural watermark early to resist generative attacks and a detail watermark late to withstand image transformations, with tailored regularization terms to preserve image quality and ensure imperceptibility. To address the challenge of memory consumption growing linearly with the number of denoising steps during optimization, OptMark incorporates adjoint gradient methods, reducing memory usage from O(N) to O(1). Experimental results demonstrate that OptMark achieves invisible multi‑bit watermarking while ensuring robust resilience against valuemetric transformations, geometric transformations, editing, and regeneration attacks.

Abstract:
Content watermarking is an important tool for the authentication and copyright protection of digital media. However, it is unclear whether existing watermarks are robust against adversarial attacks. We present the winning solution to the NeurIPS 2024 Erasing the Invisible challenge, which stress‑tests watermark robustness under varying degrees of adversary knowledge. The challenge consisted of two tracks: a black‑box and beige‑box track, depending on whether the adversary knows which watermarking method was used by the provider. For the beige‑box track, we leverage an adaptive VAE‑based evasion attack, with a test‑time optimization and color‑contrast restoration in CIELAB space to preserve the image's quality. For the black‑box track, we first cluster images based on their artifacts in the spatial or frequency‑domain. Then, we apply image‑to‑image diffusion models with controlled noise injection and semantic priors from ChatGPT‑generated captions to each cluster with optimized parameter settings. Empirical evaluations demonstrate that our method successfully achieves near‑perfect watermark removal (95.7%) with negligible impact on the residual image's quality. We hope that our attacks inspire the development of more robust image watermarking methods.

Abstract:
Large language models have significantly enhanced the capacities and efficiency of text generation. On the one hand, they have improved the quality of text‑based steganography. On the other hand, they have also underscored the importance of watermarking as a safeguard against malicious misuse. In this study, we focus on tokenization inconsistency (TI) between Alice and Bob in steganography and watermarking, where TI can undermine robustness. Our investigation reveals that the problematic tokens responsible for TI exhibit two key characteristics: infrequency and temporariness. Based on these findings, we propose two tailored solutions for TI elimination: a stepwise verification method for steganography and a post‑hoc rollback method for watermarking. Experiments show that (1) compared to traditional disambiguation methods in steganography, directly addressing TI leads to improvements in fluency, imperceptibility, and anti‑steganalysis capacity; (2) for watermarking, addressing TI enhances detectability and robustness against attacks.

Abstract:
Formal verification is crucial for ensuring the robustness of security protocols against adversarial attacks. The Needham‑Schroeder protocol, a foundational authentication mechanism, has been extensively studied, including its integration with Physical Layer Security (PLS) techniques such as watermarking and jamming. Recent research has used ProVerif to verify these mechanisms in terms of secrecy. However, the ProVerif‑based approach limits the ability to improve understanding of security beyond verification results. To overcome these limitations, we re‑model the same protocol using an Isabelle formalism that generates sound animation, enabling interactive and automated formal verification of security protocols. Our modelling and verification framework is generic and highly configurable, supporting both cryptography and PLS. For the same protocol, we have conducted a comprehensive analysis (secrecy and authenticity in four different eavesdropper locations under both passive and active attacks) using our new web interface. Our findings not only successfully reproduce and reinforce previous results on secrecy but also reveal an uncommon but expected outcome: authenticity is preserved across all examined scenarios, even in cases where secrecy is compromised. We have proposed a PLS‑based Diffie‑Hellman protocol that integrates watermarking and jamming, and our analysis shows that it is secure for deriving a session key with required authentication. These highlight the advantages of our novel approach, demonstrating its robustness in formally verifying security properties beyond conventional methods.

Abstract:
ICAO‑compliant facial images, initially designed for secure biometric passports, are increasingly becoming central to identity verification in a wide range of application contexts, including border control, digital travel credentials, and financial services. While their standardization enables global interoperability, it also facilitates practices such as morphing and deepfakes, which can be exploited for harmful purposes like identity theft and illegal sharing of identity documents. Traditional countermeasures like Presentation Attack Detection (PAD) are limited to real‑time capture and offer no post‑capture protection. This survey paper investigates digital watermarking and steganography as complementary solutions that embed tamper‑evident signals directly into the image, enabling persistent verification without compromising ICAO compliance. We provide the first comprehensive analysis of state‑of‑the‑art techniques to evaluate the potential and drawbacks of the underlying approaches concerning the applications involving ICAO‑compliant images and their suitability under standard constraints. We highlight key trade‑offs, offering guidance for secure deployment in real‑world identity systems.

Abstract:
AI‑driven molecular generation is reshaping drug discovery and materials design, yet the lack of protection mechanisms leaves AI‑generated molecules vulnerable to unauthorized reuse and provenance ambiguity. Such limitation undermines both scientific reproducibility and intellectual property security. To address this challenge, we propose the first deep learning based watermarking framework for molecules (MolMark), which is exquisitely designed to embed high‑fidelity digital signatures into molecules without compromising molecular functionalities. MolMark learns to modulate the chemically meaningful atom‑level representations and enforce geometric robustness through SE(3)‑invariant features, maintaining robustness under rotation, translation, and reflection. Additionally, MolMark integrates seamlessly with AI‑based molecular generative models, enabling watermarking to be treated as a learned transformation with minimal interference to molecular structures. Experiments on benchmark datasets (QM9, GEOM‑DRUG) and state‑of‑the‑art molecular generative models (GeoBFN, GeoLDM) demonstrate that MolMark can embed 16‑bit watermarks while retaining more than 90% of essential molecular properties, preserving downstream performance, and enabling >95% extraction accuracy under SE(3) transformations. MolMark establishes a principled pathway for unifying molecular generation with verifiable authorship, supporting trustworthy and accountable AI‑driven molecular discovery.

Abstract:
As large language models (LLMs) expose systemic security challenges in high risk applications, including privacy leaks, bias amplification, and malicious abuse, there is an urgent need for a dynamic risk assessment and collaborative defence framework that covers their entire life cycle. This paper focuses on the security problems of large language models (LLMs) in critical application scenarios, such as the possibility of disclosure of user data, the deliberate input of harmful instructions, or the models bias. To solve these problems, we describe the design of a system for dynamic risk assessment and a hierarchical defence system that allows different levels of protection to cooperate. This paper presents a risk assessment system capable of evaluating both static and dynamic indicators simultaneously. It uses entropy weighting to calculate essential data, such as the frequency of sensitive words, whether the API call is typical, the realtime risk entropy value is significant, and the degree of context deviation. The experimental results show that the system is capable of identifying concealed attacks, such as role escape, and can perform rapid risk evaluation. The paper uses a hybrid model called BERT‑CRF (Bidirectional Encoder Representation from Transformers) at the input layer to identify and filter malicious commands. The model layer uses dynamic adversarial training and differential privacy noise injection technology together. The output layer also has a neural watermarking system that can track the source of the content. In practice, the quality of this method, especially important in terms of customer service in the financial industry.

Abstract:
With the rapid evolution of deepfake technologies and the wide dissemination of digital media, personal privacy is facing increasingly serious security threats. Deepfake proactive forensics, which involves embedding imperceptible watermarks to enable reliable source tracking, serves as a crucial defense against these threats. Although existing methods show strong forensic ability, they rely on an idealized assumption of single watermark embedding, which proves impractical in real‑world scenarios. In this paper, we formally define and demonstrate the existence of Multi‑Embedding Attacks (MEA) for the first time. When a previously protected image undergoes additional rounds of watermark embedding, the original forensic watermark can be destroyed or removed, rendering the entire proactive forensic mechanism ineffective. To address this vulnerability, we propose a general training paradigm named Adversarial Interference Simulation (AIS). Rather than modifying the network architecture, AIS explicitly simulates MEA scenarios during fine‑tuning and introduces a resilience‑driven loss function to enforce the learning of sparse and stable watermark representations. Our method enables the model to maintain the ability to extract the original watermark correctly even after a second embedding. Extensive experiments demonstrate that our plug‑and‑play AIS training paradigm significantly enhances the robustness of various existing methods against MEA.

Abstract:
Audio watermarking has been widely applied in copyright protection and source tracing. However, due to the inherent characteristics of audio signals, watermark localization and resistance to desynchronization attacks remain significant challenges. In this paper, we propose a learning‑based scheme named SyncGuard to address these challenges. Specifically, we design a frame‑wise broadcast embedding strategy to embed the watermark in arbitrary‑length audio, enhancing time‑independence and eliminating the need for localization during watermark extraction. To further enhance robustness, we introduce a meticulously designed distortion layer. Additionally, we employ dilated residual blocks in conjunction with dilated gated blocks to effectively capture multi‑resolution time‑frequency features. Extensive experimental results show that SyncGuard efficiently handles variable‑length audio segments, outperforms state‑of‑the‑art methods in robustness against various attacks, and delivers superior auditory quality.

Abstract:
Existing watermarking methods for audio generative models only enable model‑level attribution, allowing the identification of the originating generation model, but are unable to trace the underlying training dataset. This significant limitation raises critical provenance questions, particularly in scenarios involving copyright and accountability concerns. To bridge this fundamental gap, we introduce DualMark, the first dual‑provenance watermarking framework capable of simultaneously encoding two distinct attribution signatures, i.e., model identity and dataset origin, into audio generative models during training. Specifically, we propose a novel Dual Watermark Embedding (DWE) module to seamlessly embed dual watermarks into Mel‑spectrogram representations, accompanied by a carefully designed Watermark Consistency Loss (WCL), which ensures reliable extraction of both watermarks from generated audio signals. Moreover, we establish the Dual Attribution Benchmark (DAB), the first robustness evaluation benchmark specifically tailored for joint model‑data attribution. Extensive experiments validate that DualMark achieves outstanding attribution accuracy (97.01% F1‑score for model attribution, and 91.51% AUC for dataset attribution), while maintaining exceptional robustness against aggressive pruning, lossy compression, additive noise, and sampling attacks, conditions that severely compromise prior methods. Our work thus provides a foundational step toward fully accountable audio generative models, significantly enhancing copyright protection and responsibility tracing capabilities.

Abstract:
Watermarking has recently emerged as an effective strategy for detecting the generations of large language models (LLMs). The strength of a watermark typically depends strongly on the entropy afforded by the language model and the set of input prompts. However, entropy can be quite limited in practice, especially for models that are post‑trained, for example via instruction tuning or reinforcement learning from human feedback (RLHF), which makes detection based on watermarking alone challenging. In this work, we investigate whether detection can be improved by combining watermark detectors with non‑watermark ones. We explore a number of hybrid schemes that combine the two, observing performance gains over either class of detector under a wide range of experimental conditions.

Abstract:
Copyright protection for large language models is of critical importance, given their substantial development costs, proprietary value, and potential for misuse. Existing surveys have predominantly focused on techniques for tracing LLM‑generated content‑namely, text watermarking‑while a systematic exploration of methods for protecting the models themselves (i.e., model watermarking and model fingerprinting) remains absent. Moreover, the relationships and distinctions among text watermarking, model watermarking, and model fingerprinting have not been comprehensively clarified. This work presents a comprehensive survey of the current state of LLM copyright protection technologies, with a focus on model fingerprinting, covering the following aspects: (1) clarifying the conceptual connection from text watermarking to model watermarking and fingerprinting, and adopting a unified terminology that incorporates model watermarking into the broader fingerprinting framework; (2) providing an overview and comparison of diverse text watermarking techniques, highlighting cases where such methods can function as model fingerprinting; (3) systematically categorizing and comparing existing model fingerprinting approaches for LLM copyright protection; (4) presenting, for the first time, techniques for fingerprint transfer and fingerprint removal; (5) summarizing evaluation metrics for model fingerprints, including effectiveness, harmlessness, robustness, stealthiness, and reliability; and (6) discussing open challenges and future research directions. This survey aims to offer researchers a thorough understanding of both text watermarking and model fingerprinting technologies in the era of LLMs, thereby fostering further advances in protecting their intellectual property.

Abstract:
With the increasing demand for the right to be forgotten, machine unlearning (MU) has emerged as a vital tool for enhancing trust and regulatory compliance by enabling the removal of sensitive data influences from machine learning (ML) models. However, most MU algorithms primarily rely on in‑training methods to adjust model weights, with limited exploration of the benefits that data‑level adjustments could bring to the unlearning process. To address this gap, we propose a novel approach that leverages digital watermarking to facilitate MU by strategically modifying data content. By integrating watermarking, we establish a controlled unlearning mechanism that enables precise removal of specified data while maintaining model utility for unrelated tasks. We first examine the impact of watermarked data on MU, finding that MU effectively generalizes to watermarked data. Building on this, we introduce an unlearning‑friendly watermarking framework, termed Water4MU, to enhance unlearning effectiveness. The core of Water4MU is a bi‑level optimization (BLO) framework: at the upper level, the watermarking network is optimized to minimize unlearning difficulty, while at the lower level, the model itself is trained independently of watermarking. Experimental results demonstrate that Water4MU is effective in MU across both image classification and image generation tasks. Notably, it outperforms existing methods in challenging MU scenarios, known as "challenging forgets".

Abstract:
Next generation advanced nuclear reactors are expected to be smaller both in size and power output, relying extensively on fully digital instrumentation and control systems. These reactors will generate a large flow of information in the form of multivariate time series data, conveying simultaneously various non linear cyber physical, process, control, sensor, and operational states. Ensuring data integrity against deception attacks is becoming increasingly important for networked communication and a requirement for safe and reliable operation. Current efforts to address replay attacks, almost universally focus on watermarking or supervised anomaly detection approaches without further identifying and characterizing the root cause of the anomaly. In addition, these approaches rely mostly on synthetic data with uncorrelated Gaussian process and measurement noise and full state feedback or are limited to univariate signals, signal stationarity, linear quadratic regulators, or other linear‑time invariant state‑space which may fail to capture any unmodeled system dynamics. In the realm of regulated nuclear cyber‑physical systems, additional work is needed on characterization of replay attacks and explainability of predictions using real data. Here, we propose an unsupervised explainable AI framework based on a combination of autoencoder and customized windowSHAP algorithm to fully characterize real‑time replay attacks, i.e., detection, source identification, timing and type, of increasing complexity during a dynamic time evolving reactor process. The proposed XAI framework was benchmarked on several real world datasets from Purdue's nuclear reactor PUR‑1 with up to six signals concurrently being replayed. In all cases, the XAI framework was able to detect and identify the source and number of signals being replayed and the duration of the falsification with 95 percent or better accuracy.

Abstract:
Deep image watermarking, which refers to enabling imperceptible watermark embedding and reliable extraction in cover images, has been shown to be effective for copyright protection of image assets. However, existing methods face limitations in simultaneously satisfying three essential criteria for generalizable watermarking: (1) invisibility (imperceptible hiding of watermarks), (2) robustness (reliable watermark recovery under diverse conditions), and (3) broad applicability (low latency in the watermarking process). To address these limitations, we propose a Hierarchical Watermark Learning (HiWL) framework, a two‑stage optimization that enables a watermarking model to simultaneously achieve all three criteria. In the first stage, distribution alignment learning is designed to establish a common latent space with two constraints: (1) visual consistency between watermarked and non‑watermarked images, and (2) information invariance across watermark latent representations. In this way, multimodal inputs ‑‑ including watermark messages (binary codes) and cover images (RGB pixels) ‑‑ can be effectively represented, ensuring both the invisibility of watermarks and robustness in the watermarking process. In the second stage, we employ generalized watermark representation learning to separate a unique representation of the watermark from the marked image in RGB space. Once trained, the HiWL model effectively learns generalizable watermark representations while maintaining broad applicability. Extensive experiments demonstrate the effectiveness of the proposed method. Specifically, it achieves 7.6% higher accuracy in watermark extraction compared to existing methods, while maintaining extremely low latency (processing 1000 images in 1 second).

Abstract:
With the rise of 3D Gaussian Splatting (3DGS), a variety of digital watermarking techniques, embedding either 1D bitstreams or 2D images, are used for copyright protection. However, the robustness of these watermarking techniques against potential attacks remains underexplored. This paper introduces the first universal black‑box attack framework, the Group‑based Multi‑objective Evolutionary Attack (GMEA), designed to challenge these watermarking systems. We formulate the attack as a large‑scale multi‑objective optimization problem, balancing watermark removal with visual quality. In a black‑box setting, we introduce an indirect objective function that blinds the watermark detector by minimizing the standard deviation of features extracted by a convolutional network, thus rendering the feature maps uninformative. To manage the vast search space of 3DGS models, we employ a group‑based optimization strategy to partition the model into multiple, independent sub‑optimization problems. Experiments demonstrate that our framework effectively removes both 1D and 2D watermarks from mainstream 3DGS watermarking methods while maintaining high visual fidelity. This work reveals critical vulnerabilities in existing 3DGS copyright protection schemes and calls for the development of more robust watermarking systems.

Abstract:
In the era of generative AI, ensuring the privacy of music data presents unique challenges: unlike static artworks such as images, music data is inherently temporal and multimodal, and it is sampled, transformed, and remixed at an unprecedented scale. These characteristics make its core vector embeddings, i.e, the numerical representations of the music, highly susceptible to being learned, misused, or even stolen by models without accessing the original audio files. Traditional methods like copyright licensing and digital watermarking offer limited protection for these abstract mathematical representations, thus necessitating a stronger, e.g., cryptographic, approach to safeguarding the embeddings themselves. Standard encryption schemes, such as AES, render data unintelligible for computation, making such searches impossible. While Fully Homomorphic Encryption (FHE) provides a plausible solution by allowing arbitrary computations on ciphertexts, its substantial performance overhead remains impractical for large‑scale vector similarity searches. Given this trade‑off, we propose a more practical approach using Additive Homomorphic Encryption (AHE) for vector similarity search. The primary contributions of this paper are threefold: we analyze threat models unique to music information retrieval systems; we provide a theoretical analysis and propose an efficient AHE‑based solution through inner products of music embeddings to deliver privacy‑preserving similarity search; and finally, we demonstrate the efficiency and practicality of the proposed approach through empirical evaluation and comparison to FHE schemes on real‑world MP3 files.

Abstract:
With the increasing importance of protecting intellectual property in machine learning, watermarking techniques have gained significant attention. As advanced models are increasingly deployed in domains such as social network analysis, the need for robust model protection becomes even more critical. While existing watermarking methods have demonstrated effectiveness for conventional deep neural networks, they often fail to adapt to the novel architecture, Kolmogorov‑Arnold Networks (KAN), which feature learnable activation functions. KAN holds strong potential for modeling complex relationships in network‑structured data. However, their unique design also introduces new challenges for watermarking. Therefore, we propose a novel watermarking method, Discrete Cosine Transform‑based Activation Watermarking (DCT‑AW), tailored for KAN. Leveraging the learnable activation functions of KAN, our method embeds watermarks by perturbing activation outputs using discrete cosine transform, ensuring compatibility with diverse tasks and achieving task independence. Experimental results demonstrate that DCT‑AW has a small impact on model performance and provides superior robustness against various watermark removal attacks, including fine‑tuning, pruning, and retraining after pruning.

Abstract:
In‑generation watermarking for latent diffusion models has recently shown high robustness in marking generated images for easier detection and attribution. However, its application to autoregressive (AR) image models is underexplored. Autoregressive models generate images by autoregressively predicting a sequence of visual tokens that are then decoded into pixels using a VQ‑VAE decoder. Inspired by KGW watermarking for large language models, we examine token‑level watermarking schemes that bias the next‑token prediction based on prior tokens. We find that a direct transfer of these schemes works in principle, but the detectability of the watermarks decreases considerably under common image perturbations. As a remedy, we propose a watermarking approach based on visual token clustering, which assigns similar tokens to the same set (red or green). We investigate token clustering in a training‑free setting, as well as in combination with a more accurate fine‑tuned token or cluster predictor. Overall, our experiments show that cluster‑based watermarks greatly improve robustness against perturbations and regeneration attacks while preserving image quality, outperforming a set of baselines and concurrent works. Moreover, our methods offer fast verification runtime, comparable to lightweight post‑hoc watermarking techniques.

Abstract:
The growing deployment of Large Language Models (LLMs) has raised concerns about their misuse in generating harmful or deceptive content. To address this issue, watermarking methods have been proposed to embed identifiable multi‑bit messages into generated text for misuse tracing. However, existing methods often suffer from a fundamental trade‑off between text quality and decoding accuracy. In particular, they have to restrict the size of the preferred token set (i.e., green list) during encoding to maintain a detectable watermark signal for decoding, which inevitably degrades generation quality. To improve this trade‑off, we propose a novel message encoding paradigm called majority bit‑aware encoding, which relaxes the watermark signal strength from the green list size. This strategy allows for a strong watermark signal to be preserved in generated texts even when using a large green list. We introduce two instantiations of this paradigm: MajorMark and MajorMark^+, where the latter is specifically optimized for long messages. Extensive experiments on state‑of‑the‑art LLMs demonstrate that our methods achieve higher decoding accuracy and superior text quality compared to prior baselines.

Abstract:
Backdoor detection is currently the mainstream defense against backdoor attacks in federated learning (FL), where a small number of malicious clients can upload poisoned updates to compromise the federated global model. Existing backdoor detection techniques fall into two categories, passive and proactive, depending on whether the server proactively intervenes in the training process. However, both of them have practical limitations: passive detection methods are disrupted by common non‑i.i.d. data distributions and random participation of FL clients, whereas current proactive detection methods are misled by an inevitable out‑of‑distribution (OOD) bias because they rely on backdoor coexistence effects. To address these issues, we introduce a novel proactive detection method dubbed Coward, inspired by our discovery of multi‑backdoor collision effects, in which consecutively planted, distinct backdoors significantly suppress earlier ones. Correspondingly, we modify the federated global model by injecting a carefully designed backdoor‑collided watermark, implemented via regulated dual‑mapping learning on OOD data. This design not only enables an inverted detection paradigm compared to existing proactive methods, thereby naturally counteracting the adverse impact of OOD prediction bias, but also introduces a low‑disruptive training intervention that inherently limits the strength of OOD bias, leading to significantly fewer misjudgments. Extensive experiments on benchmark datasets show that Coward achieves state‑of‑the‑art performance and effectively alleviates OOD bias.

Abstract:
Variational Quantum Circuits (VQCs) have emerged as a powerful quantum computing paradigm, demonstrating a scaling advantage for problems intractable for classical computation. As VQCs require substantial resources and specialized expertise for their design, they represent significant intellectual properties (IPs). However, existing quantum circuit watermarking techniques suffer from two primary drawbacks: (1) watermarks can be removed during re‑compilation of the circuits, and (2) these methods significantly increase task loss due to the extensive length of the inserted watermarks across multiple compilation stages. To address these challenges, we propose BVQC, a backdoor‑based watermarking technique for VQCs that preserves the original loss in typical execution settings, while deliberately increasing the loss to a predefined level during watermark extraction. Additionally, BVQC employs a grouping algorithm to minimize the watermark task's interference with the base task, ensuring optimal accuracy for the base task. BVQC retains the original compilation workflow, ensuring robustness against re‑compilation. Our evaluations show that BVQC greatly reduces Probabilistic Proof of Authorship (PPA) changes by 9.89e‑3 and ground truth distance (GTD) by 0.089 compared to prior watermarking technologies.

Abstract:
Image‑based AI models are increasingly deployed across a wide range of domains, including healthcare, security, and consumer applications. However, many image datasets carry sensitive or proprietary content, raising critical concerns about unauthorized data usage. Data owners therefore need reliable mechanisms to verify whether their proprietary data has been misused to train third‑party models. Existing solutions, such as backdoor watermarking and membership inference, face inherent trade‑offs between verification effectiveness and preservation of data integrity. In this work, we propose HoneyImage, a novel method for dataset ownership verification in image recognition models. HoneyImage selectively modifies a small number of hard samples to embed imperceptible yet verifiable traces, enabling reliable ownership verification while maintaining dataset integrity. Extensive experiments across four benchmark datasets and multiple model architectures show that HoneyImage consistently achieves strong verification accuracy with minimal impact on downstream performance while maintaining imperceptible. The proposed HoneyImage method could provide data owners with a practical mechanism to protect ownership over valuable image datasets, encouraging safe sharing and unlocking the full transformative potential of data‑driven AI.

Abstract:
The proliferation of advanced tools for manipulating video has led to an arms race, pitting those who wish to sow disinformation against those who want to detect and expose it. Unfortunately, time favors the ill‑intentioned in this race, with fake videos growing increasingly difficult to distinguish from real ones. At the root of this trend is a fundamental advantage held by those manipulating media: equal access to a distribution of what we consider authentic (i.e., "natural") video. In this paper, we show how coding very subtle, noise‑like modulations into the illumination of a scene can help combat this advantage by creating an information asymmetry that favors verification. Our approach effectively adds a temporal watermark to any video recorded under coded illumination. However, rather than encoding a specific message, this watermark encodes an image of the unmanipulated scene as it would appear lit only by the coded illumination. We show that even when an adversary knows that our technique is being used, creating a plausible coded fake video amounts to solving a second, more difficult version of the original adversarial content creation problem at an information disadvantage. This is a promising avenue for protecting high‑stakes settings like public events and interviews, where the content on display is a likely target for manipulation, and while the illumination can be controlled, the cameras capturing video cannot.

Abstract:
We introduce new methods of staining and locking computer vision models, to protect their owners' intellectual property. Staining, also known as watermarking, embeds secret behaviour into a model which can later be used to identify it, while locking aims to make a model unusable unless a secret trigger is inserted into input images. Unlike existing methods, our algorithms can be used to stain and lock pre‑trained models without requiring fine‑tuning or retraining, and come with provable, computable guarantees bounding their worst‑case false positive rates. The stain and lock are implemented by directly modifying a small number of the model's weights and have minimal impact on the (unlocked) model's performance. Locked models are unlocked by inserting a small `trigger patch' into the corner of the input image. We present experimental results showing the efficacy of our methods and demonstrating their practical performance on a variety of computer vision models.

Abstract:
The great success of the diffusion model in image synthesis led to the release of gigantic commercial models, raising the issue of copyright protection and inappropriate content generation. Training‑free diffusion watermarking provides a low‑cost solution for these issues. However, the prior works remain vulnerable to rotation, scaling, and translation (RST) attacks. Although some methods employ meticulously designed patterns to mitigate this issue, they often reduce watermark capacity, which can result in identity (ID) collusion. To address these problems, we propose MaXsive, a training‑free diffusion model generative watermarking technique that has high capacity and robustness. MaXsive best utilizes the initial noise to watermark the diffusion model. Moreover, instead of using a meticulously repetitive ring pattern, we propose injecting the X‑shape template to recover the RST distortions. This design significantly increases robustness without losing any capacity, making ID collusion less likely to happen. The effectiveness of MaXsive has been verified on two well‑known watermarking benchmarks under the scenarios of verification and identification.

Abstract:
This paper presents the Singularity Cipher, a novel cryptographic‑steganographic framework that integrates topological transformations and visual paradoxes to achieve multidimensional security. Inspired by the non‑orientable properties of the Klein bottle ‑‑ constructed from two Mobius strips ‑‑ the cipher applies symbolic twist functions to simulate topological traversal, producing high confusion and diffusion in the ciphertext. The resulting binary data is then encoded using perceptual illusions, such as the missing square paradox, to visually obscure the presence of encrypted content. Unlike conventional ciphers that rely solely on algebraic complexity, the Singularity Cipher introduces a dual‑layer approach: symbolic encryption rooted in topology and visual steganography designed for human cognitive ambiguity. This combination enhances both cryptographic strength and detection resistance, making it well‑suited for secure communication, watermarking, and plausible deniability in adversarial environments. The paper formalizes the architecture, provides encryption and decryption algorithms, evaluates security properties, and compares the method against classical, post‑quantum, and steganographic approaches. Potential applications and future research directions are also discussed.

Abstract:
Large Language Model‑based Time Series Forecasting (LLMTS) has shown remarkable promise in handling complex and diverse temporal data, representing a significant step toward foundation models for time series analysis. However, this emerging paradigm introduces two critical challenges. First, the substantial commercial potential and resource‑intensive development raise urgent concerns about intellectual property (IP) protection. Second, their powerful time series forecasting capabilities may be misused to produce misleading or fabricated deepfake time series data. To address these concerns, we explore watermarking the outputs of LLMTS models, that is, embedding imperceptible signals into the generated time series data that remain detectable by specialized algorithms. We propose a novel post‑hoc watermarking framework, Waltz, which is broadly compatible with existing LLMTS models. Waltz is inspired by the empirical observation that time series patch embeddings are rarely aligned with a specific set of LLM tokens, which we term ``cold tokens''. Leveraging this insight, Waltz embeds watermarks by rewiring the similarity statistics between patch embeddings and cold token embeddings, and detects watermarks using similarity z‑scores. To minimize potential side effects, we introduce a similarity‑based embedding position identification strategy and employ projected gradient descent to constrain the watermark noise within a defined boundary. Extensive experiments using two popular LLMTS models across seven benchmark datasets demonstrate that Waltz achieves high watermark detection accuracy with minimal impact on the quality of the generated time series.

Abstract:
Recently, Deep Learning (DL) models have been increasingly deployed on end‑user devices as On‑Device AI, offering improved efficiency and privacy. However, this deployment trend poses more serious Intellectual Property (IP) risks, as models are distributed on numerous local devices, making them vulnerable to theft and redistribution. Most existing ownership protection solutions (e.g., backdoor‑based watermarking) are designed for cloud‑based AI‑as‑a‑Service (AIaaS) and are not directly applicable to large‑scale distribution scenarios, where each user‑specific model instance must carry a unique watermark. These methods typically embed a fixed watermark, and modifying the embedded watermark requires retraining the model. To address these challenges, we propose Hot‑Swap MarkBoard, an efficient watermarking method. It encodes user‑specific n‑bit binary signatures by independently embedding multiple watermarks into a multi‑branch Low‑Rank Adaptation (LoRA) module, enabling efficient watermark customization without retraining through branch swapping. A parameter obfuscation mechanism further entangles the watermark weights with those of the base model, preventing removal without degrading model performance. The method supports black‑box verification and is compatible with various model architectures and DL tasks, including classification, image generation, and text generation. Extensive experiments across three types of tasks and six backbone models demonstrate our method's superior efficiency and adaptability compared to existing approaches, achieving 100% verification accuracy.

Abstract:
The intellectual property of deep neural network (DNN) models can be protected with DNN watermarking, which embeds copyright watermarks into model parameters (white‑box), model behavior (black‑box), or model outputs (box‑free), and the watermarks can be subsequently extracted to verify model ownership or detect model theft. Despite recent advances, these existing methods are inherently intrusive, as they either modify the model parameters or alter the structure. This natural intrusiveness raises concerns about watermarking‑induced shifts in model behavior and the additional cost of fine‑tuning, further exacerbated by the rapidly growing model size. As a result, model owners are often reluctant to adopt DNN watermarking in practice, which limits the development of practical Watermarking as a Service (WaaS) systems. To address this issue, we introduce Nonintrusive Watermarking as a Service (NWaaS), a novel trustless paradigm designed for X‑to‑Image models, in which we hypothesize that with the model untouched, an owner‑defined watermark can still be extracted from model outputs. Building on this concept, we propose ShadowMark, a concrete implementation of NWaaS which addresses critical deployment challenges by establishing a robust and nonintrusive side channel in the protected model's black‑box API, leveraging a key encoder and a watermark decoder. It is significantly distinctive from existing solutions by attaining the so‑called absolute fidelity and being applicable to different DNN architectures, while being also robust against existing attacks, eliminating the fidelity‑robustness trade‑off. Extensive experiments on image‑to‑image, noise‑to‑image, noise‑and‑text‑to‑image, and text‑to‑image models, demonstrate the efficacy and practicality of ShadowMark for real‑world deployment of nonintrusive DNN watermarking.

Abstract:
The intellectual property of deep generative networks (GNets) can be protected using a cascaded hiding network (HNet) which embeds watermarks (or marks) into GNet outputs, known as box‑free watermarking. Although both GNet and HNet are encapsulated in a black box (called operation network, or ONet), with only the generated and marked outputs from HNet being released to end users and deemed secure, in this paper, we reveal an overlooked vulnerability in such systems. Specifically, we show that the hidden GNet outputs can still be reliably estimated via query‑based reverse engineering, leaking the generated and unmarked images, despite the attacker's limited knowledge of the system. Our first attempt is to reverse‑engineer an inverse model for HNet under the stringent black‑box condition, for which we propose to exploit the query process with specially curated input images. While effective, this method yields unsatisfactory image quality. To improve this, we subsequently propose an alternative method leveraging the equivalent additive property of box‑free model watermarking and reverse‑engineering a forward surrogate model of HNet, with better image quality preservation. Extensive experimental results on image processing and image generation tasks demonstrate that both attacks achieve impressive watermark removal success rates (100%) while also maintaining excellent image quality (reaching the highest PSNR of 34.69 dB), substantially outperforming existing attacks, highlighting the urgent need for robust defensive strategies to mitigate the identified vulnerability in box‑free model watermarking.

Abstract:
Vision‑language models demand watermarking solutions that protect intellectual property without compromising multimodal coherence. Existing text watermarking methods disrupt visual‑textual alignment through biased token selection and static strategies, leaving semantic‑critical concepts vulnerable. We propose VLA‑Mark, a vision‑aligned framework that embeds detectable watermarks while preserving semantic fidelity through cross‑modal coordination. Our approach integrates multiscale visual‑textual alignment metrics, combining localized patch affinity, global semantic coherence, and contextual attention patterns, to guide watermark injection without model retraining. An entropy‑sensitive mechanism dynamically balances watermark strength and semantic preservation, prioritizing visual grounding during low‑uncertainty generation phases. Experiments show 7.4% lower PPL and 26.6% higher BLEU than conventional methods, with near‑perfect detection (98.8% AUC). The framework demonstrates 96.1% attack resilience against attacks such as paraphrasing and synonym substitution, while maintaining text‑visual consistency, establishing new standards for quality‑preserving multimodal watermarking

Abstract:
With the rapid rise of generative AI and synthetic media, distinguishing AI‑generated images from real ones has become crucial in safeguarding against misinformation and ensuring digital authenticity. Traditional watermarking techniques have shown vulnerabilities to adversarial attacks, undermining their effectiveness in the presence of attackers. We propose IConMark, a novel in‑generation robust semantic watermarking method that embeds interpretable concepts into AI‑generated images, as a first step toward interpretable watermarking. Unlike traditional methods, which rely on adding noise or perturbations to AI‑generated images, IConMark incorporates meaningful semantic attributes, making it interpretable to humans and hence, resilient to adversarial manipulation. This method is not only robust against various image augmentations but also human‑readable, enabling manual verification of watermarks. We demonstrate a detailed evaluation of IConMark's effectiveness, demonstrating its superiority in terms of detection accuracy and maintaining image quality. Moreover, IConMark can be combined with existing watermarking techniques to further enhance and complement its robustness. We introduce IConMark+SS and IConMark+TM, hybrid approaches combining IConMark with StegaStamp and TrustMark, respectively, to further bolster robustness against multiple types of image manipulations. Our base watermarking technique (IConMark) and its variants (+TM and +SS) achieve 10.8%, 14.5%, and 15.9% higher mean area under the receiver operating characteristic curve (AUROC) scores for watermark detection, respectively, compared to the best baseline on various datasets.

Abstract:
Recent advances in voice cloning and lip synchronization models have enabled Synthesized Audiovisual Forgeries (SAVFs), where both audio and visuals are manipulated to mimic a target speaker. This significantly increases the risk of misinformation by making fake content seem real. To address this issue, existing methods detect or localize manipulations but cannot recover the authentic audio that conveys the semantic content of the message. This limitation reduces their effectiveness in combating audiovisual misinformation. In this work, we introduce the task of Authentic Audio Recovery (AAR) and Tamper Localization in Audio (TLA) from SAVFs and propose a cross‑modal watermarking framework to embed authentic audio into visuals before manipulation. This enables AAR, TLA, and a robust defense against misinformation. Extensive experiments demonstrate the strong performance of our method in AAR and TLA against various manipulations, including voice cloning and lip synchronization.

Abstract:
Watermarking technology has gained significant attention due to the increasing importance of intellectual property (IP) rights, particularly with the growing deployment of large language models (LLMs) on billions resource‑constrained edge devices. To counter the potential threats of IP theft by malicious users, this paper introduces a robust watermarking scheme without retraining or fine‑tuning for transformer models. The scheme generates a unique key for each user and derives a stable watermark value by solving linear constraints constructed from model invariants. Moreover, this technology utilizes noise mechanism to hide watermark locations in multi‑user scenarios against collusion attack. This paper evaluates the approach on three popular models (Llama3, Phi3, Gemma), and the experimental results confirm the strong robustness across a range of attack methods (fine‑tuning, pruning, quantization, permutation, scaling, reversible matrix and collusion attacks).

Abstract:
Watermarking enables GenAI providers to verify whether content was generated by their models. A watermark is a hidden signal in the content, whose presence can be detected using a secret watermark key. A core security threat are forgery attacks, where adversaries insert the provider's watermark into content \emphnot produced by the provider, potentially damaging their reputation and undermining trust. Existing defenses resist forgery by embedding many watermarks with multiple keys into the same content, which can degrade model utility. However, forgery remains a threat when attackers can collect sufficiently many watermarked samples. We propose a defense that is provably forgery‑resistant \emphindependent of the number of watermarked content collected by the attacker, provided they cannot easily distinguish watermarks from different keys. Our scheme does not further degrade model utility. We randomize the watermark key selection for each query and accept content as genuine only if a watermark is detected by \emphexactly one key. We focus on the image and text modalities, but our defense is modality‑agnostic, since it treats the underlying watermarking method as a black‑box. Our method provably bounds the attacker's success rate and we empirically observe a reduction from near‑perfect success rates to only 2% at negligible computational overhead.

Abstract:
A semi‑fragile watermarking scheme for multiple band images is presented in this article. We propose to embed a mark into remote sensing images applying a tree‑structured vector quantization approach to the pixel signatures instead of processing each band separately. The signature of the multispectral or hyperspectral image is used to embed the mark in it order to detect any significant modification of the original image. The image is segmented into three‑dimensional blocks, and a tree‑structured vector quantizer is built for each block. These trees are manipulated using an iterative algorithm until the resulting block satisfies a required criterion, which establishes the embedded mark. The method is shown to be able to preserve the mark under lossy compression (above a given threshold) but, at the same time, it detects possibly forged blocks and their position in the whole image.

Abstract:
Watermarking is a promising defense against the misuse of large language models (LLMs), yet it remains vulnerable to scrubbing and spoofing attacks. This vulnerability stems from an inherent trade‑off governed by watermark window size: smaller windows resist scrubbing better but are easier to reverse‑engineer, enabling low‑cost statistics‑based spoofing attacks. This work breaks this trade‑off by introducing a novel mechanism, equivalent texture keys, where multiple tokens within a watermark window can independently support the detection. Based on the redundancy, we propose a novel watermark scheme with Sub‑vocabulary decomposed Equivalent tExture Key (SEEK). It achieves a Pareto improvement, increasing the resilience against scrubbing attacks without compromising robustness to spoofing. Experiments demonstrate SEEK's superiority over prior method, yielding spoofing robustness gains of +88.2%/+92.3%/+82.0% and scrubbing robustness gains of +10.2%/+6.4%/+24.6% across diverse dataset settings.

Abstract:
Distinguishing AI‑generated code from human‑written code is becoming crucial for tasks such as authorship attribution, content tracking, and misuse detection. Based on this, N‑gram‑based watermarking schemes have emerged as prominent, which inject secret watermarks to be detected during the generation. However, their robustness in code content remains insufficiently evaluated. Most claims rely solely on defenses against simple code transformations or code optimizations as a simulation of attack, creating a questionable sense of robustness. In contrast, more sophisticated schemes already exist in the software engineering world, e.g., code obfuscation, which significantly alters code while preserving functionality. Although obfuscation is commonly used to protect intellectual property or evade software scanners, the robustness of code watermarking techniques against such transformations remains largely unexplored. In this work, we formally model the code obfuscation and prove the impossibility of N‑gram‑based watermarking's robustness with only one intuitive and experimentally verified assumption, distribution consistency, satisfied. Given the original false positive rate of the watermarking detection, the ratio that the detector failed on the watermarked code after obfuscation will increase to 1 ‑ fpr. The experiments have been performed on three SOTA watermarking schemes, two LLMs, two programming languages, four code benchmarks, and four obfuscators. Among them, all watermarking detectors show coin‑flipping detection abilities on obfuscated codes (AUROC tightly surrounds 0.5). Among all models, watermarking schemes, and datasets, both programming languages own obfuscators that can achieve attack effects with no detection AUROC higher than 0.6 after the attack. Based on the theoretical and practical observations, we also proposed a potential path of robust code watermarking.

Abstract:
Deep learning‑based watermarking has emerged as a promising solution for robust image authentication and protection. However, existing models are limited by low embedding capacity and vulnerability to bit‑level errors, making them unsuitable for cryptographic applications such as digital signatures, which require over 2048 bits of error‑free data. In this paper, we propose README (Robust Error‑Aware Digital Signature via Deep WaterMarking ModEl), a novel framework that enables robust, verifiable, and error‑tolerant digital signatures within images. Our method combines a simple yet effective cropping‑based capacity scaling mechanism with ERPA (ERror PAinting Module), a lightweight error correction module designed to localize and correct bit errors using Distinct Circular Subsum Sequences (DCSS). Without requiring any fine‑tuning of existing pretrained watermarking models, README significantly boosts the zero‑bit‑error image rate (Z.B.I.R) from 1.2% to 86.3% when embedding 2048‑bit digital signatures into a single image, even under real‑world distortions. Moreover, our use of perceptual hash‑based signature verification ensures public verifiability and robustness against tampering. The proposed framework unlocks a new class of high‑assurance applications for deep watermarking, bridging the gap between signal‑level watermarking and cryptographic security.

Abstract:
Watermarking has emerged as a promising solution to counter harmful or deceptive AI‑generated content by embedding hidden identifiers that trace content origins. However, the robustness of current watermarking techniques is still largely unexplored, raising critical questions about their effectiveness against adversarial attacks. To address this gap, we examine the robustness of model‑specific watermarking, where watermark embedding is integrated with text‑to‑image generation in models like latent diffusion models. We introduce three attack strategies: edge prediction‑based, box blurring, and fine‑tuning‑based attacks in a no‑box setting, where an attacker does not require access to the ground‑truth watermark decoder. Our findings reveal that while model‑specific watermarking is resilient against basic evasion attempts, such as edge prediction, it is notably vulnerable to blurring and fine‑tuning‑based attacks. Our best‑performing attack achieves a reduction in watermark detection accuracy to approximately 47.92%. Additionally, we perform an ablation study on factors like message length, kernel size and decoder depth, identifying critical parameters influencing the fine‑tuning attack's success. Finally, we assess several advanced watermarking defenses, finding that even the most robust methods, such as multi‑label smoothing, result in watermark extraction accuracy that falls below an acceptable level when subjected to our no‑box attacks.

Abstract:
Large language models (LLMs) face significant copyright and intellectual property challenges as the cost of training increases and model reuse becomes prevalent. While watermarking techniques have been proposed to protect model ownership, they may not be robust to continue training and development, posing serious threats to model attribution and copyright protection. This work introduces a simple yet effective approach for robust LLM fingerprinting based on intrinsic model characteristics. We discover that the standard deviation distributions of attention parameter matrices across different layers exhibit distinctive patterns that remain stable even after extensive continued training. These parameter distribution signatures serve as robust fingerprints that can reliably identify model lineage and detect potential copyright infringement. Our experimental validation across multiple model families demonstrates the effectiveness of our method for model authentication. Notably, our investigation uncovers evidence that a recently Pangu Pro MoE model released by Huawei is derived from Qwen‑2.5 14B model through upcycling techniques rather than training from scratch, highlighting potential cases of model plagiarism, copyright violation, and information fabrication. These findings underscore the critical importance of developing robust fingerprinting methods for protecting intellectual property in large‑scale model development and emphasize that deliberate continued training alone is insufficient to completely obscure model origins.

Abstract:
Tampering or forgery of digital documents has become widespread, most commonly through altering images without any malicious intent such as enhancing the overall appearance of the image. However, there are occasions when tampering of digital documents can have negative consequences, such as financial fraud and reputational damage. Tampering can occur through altering a digital document's text or editing an image's pixels. Many techniques have been developed to detect whether changes have been made to a document. Most of these techniques rely on generating hashes or watermarking the document. These techniques, however, have limitations in that they cannot detect alterations to portable document format (PDF) signatures or other non‑visual aspects, such as metadata. This paper presents a new technique that can be used to detect tampering within a PDF document by utilizing the PDF document's file page objects. The technique employs a prototype that can detect changes to a PDF document, such as changes made to the text, images, or metadata of the said file.

Abstract:
Reconstructing high‑quality images from low‑resolution inputs using Residual Dense Spatial Networks (RDSNs) is crucial yet challenging. It is even more challenging in centralized training where multiple collaborating parties are involved, as it poses significant privacy risks, including data leakage and inference attacks, as well as high computational and communication costs. We propose a novel Privacy‑Preserving Federated Learning‑based RDSN (PPFL‑RDSN) framework specifically tailored for encrypted lossy image reconstruction. PPFL‑RDSN integrates Federated Learning (FL), local differential privacy, and robust model watermarking techniques to ensure that data remains secure on local clients/devices, safeguards privacy‑sensitive information, and maintains model authenticity without revealing underlying data. Empirical evaluations show that PPFL‑RDSN achieves comparable performance to the state‑of‑the‑art centralized methods while reducing computational burdens, and effectively mitigates security and privacy vulnerabilities, making it a practical solution for secure and privacy‑preserving collaborative computer vision applications.

Abstract:
Image generative models have become increasingly popular, but training them requires large datasets that are costly to collect and curate. To circumvent these costs, some parties may exploit existing models by using the generated images as training data for their own models. In general, watermarking is a valuable tool for detecting unauthorized use of generated images. However, when these images are used to train a new model, watermarking can only enable detection if the watermark persists through training and remains identifiable in the outputs of the newly trained model ‑ a property known as radioactivity. We analyze the radioactivity of watermarks in images generated by diffusion models (DMs) and image autoregressive models (IARs). We find that existing watermarking methods for DMs fail to retain radioactivity, as watermarks are either erased during encoding into the latent space or lost in the noising‑denoising process (during the training in the latent space). Meanwhile, despite IARs having recently surpassed DMs in image generation quality and efficiency, no radioactive watermarking methods have been proposed for them. To overcome this limitation, we propose the first watermarking method tailored for IARs and with radioactivity in mind ‑ drawing inspiration from techniques in large language models (LLMs), which share IARs' autoregressive paradigm. Our extensive experimental evaluation highlights our method's effectiveness in preserving radioactivity within IARs, enabling robust provenance tracking, and preventing unauthorized use of their generated images.

Abstract:
Text watermarking schemes have gained considerable attention in recent years, yet still face critical challenges in achieving simultaneous robustness, generalizability, and imperceptibility. This paper introduces a new embedding paradigm,termed CORE, which comprises several consecutively aligned black pixel segments. Its key innovation lies in its inherent noise resistance during transmission and broad applicability across languages and fonts. Based on the CORE, we present a text watermarking framework named CoreMark. Specifically, CoreMark first dynamically extracts COREs from characters. Then, the characters with stronger robustness are selected according to the lengths of COREs. By modifying the thickness of the CORE, the hidden data is embedded into the selected characters without causing significant visual distortions. Moreover, a general plug‑and‑play embedding strength modulator is proposed, which can adaptively enhance the robustness for small font sizes by adjusting the embedding strength according to the font size. Experimental evaluation indicates that CoreMark demonstrates outstanding generalizability across multiple languages and fonts. Compared to existing methods, CoreMark achieves significant improvements in resisting screenshot, print‑scan, and print camera attacks, while maintaining satisfactory imperceptibility.

Abstract:
A report by the European Union Law Enforcement Agency predicts that by 2026, up to 90 percent of online content could be synthetically generated, raising concerns among policymakers, who cautioned that "Generative AI could act as a force multiplier for political disinformation. The combined effect of generative text, images, videos, and audio may surpass the influence of any single modality." In response, California's Bill AB 3211 mandates the watermarking of AI‑generated images, videos, and audio. However, concerns remain regarding the vulnerability of invisible watermarking techniques to tampering and the potential for malicious actors to bypass them entirely. Generative AI‑powered de‑watermarking attacks, especially the newly introduced visual paraphrase attack, have shown an ability to fully remove watermarks, resulting in a paraphrase of the original image. This paper introduces PECCAVI, the first visual paraphrase attack‑safe and distortion‑free image watermarking technique. In visual paraphrase attacks, an image is altered while preserving its core semantic regions, termed Non‑Melting Points (NMPs). PECCAVI strategically embeds watermarks within these NMPs and employs multi‑channel frequency domain watermarking. It also incorporates noisy burnishing to counter reverse‑engineering efforts aimed at locating NMPs to disrupt the embedded watermark, thereby enhancing durability. PECCAVI is model‑agnostic. All relevant resources and codes will be open‑sourced.

Abstract:
In the present‑day scenario, Large Language Models (LLMs) are establishing their presence as powerful instruments permeating various sectors of society. While their utility offers valuable support to individuals, there are multiple concerns over potential misuse. Consequently, some academic endeavors have sought to introduce watermarking techniques, characterized by the inclusion of markers within machine‑generated text, to facilitate algorithmic identification. This research project is focused on the development of a novel methodology for the detection of synthetic text, with the overarching goal of ensuring the ethical application of LLMs in AI‑driven text generation. The investigation commences with replicating findings from a previous baseline study, thereby underscoring its susceptibility to variations in the underlying generation model. Subsequently, we propose an innovative watermarking approach and subject it to rigorous evaluation, employing paraphrased generated text to asses its robustness. Experimental results highlight the robustness of our proposal compared to the~\citeaarson watermarking method.

Abstract:
Text watermarks in large language models (LLMs) are an increasingly important tool for detecting synthetic text and distinguishing human‑written content from LLM‑generated text. While most existing studies focus on determining whether entire texts are watermarked, many real‑world scenarios involve mixed‑source texts, which blend human‑written and watermarked content. In this paper, we address the problem of optimally estimating the watermark proportion in mixed‑source texts. We cast this problem as estimating the proportion parameter in a mixture model based on \emphpivotal statistics. First, we show that this parameter is not even identifiable in certain watermarking schemes, let alone consistently estimable. In stark contrast, for watermarking methods that employ continuous pivotal statistics for detection, we demonstrate that the proportion parameter is identifiable under mild conditions. We propose efficient estimators for this class of methods, which include several popular unbiased watermarks as examples, and derive minimax lower bounds for any measurable estimator based on pivotal statistics, showing that our estimators achieve these lower bounds. Through evaluations on both synthetic data and mixed‑source text generated by open‑source models, we demonstrate that our proposed estimators consistently achieve high estimation accuracy.

Abstract:
Recent advances in Large Language Models (LLMs) have raised urgent concerns about LLM‑generated text authenticity, prompting regulatory demands for reliable identification mechanisms. Although watermarking offers a promising solution, existing approaches struggle to simultaneously achieve three critical requirements: text quality preservation, model‑agnostic detection, and message embedding capacity, which are crucial for practical implementation. To achieve these goals, the key challenge lies in balancing the trade‑off between text quality preservation and message embedding capacity. To address this challenge, we propose BiMark, a novel watermarking framework that achieves these requirements through three key innovations: (1) a bit‑flip unbiased reweighting mechanism enabling model‑agnostic detection, (2) a multilayer architecture enhancing detectability without compromising generation quality, and (3) an information encoding approach supporting multi‑bit watermarking. Through theoretical analysis and extensive experiments, we validate that, compared to state‑of‑the‑art multi‑bit watermarking methods, BiMark achieves up to 30% higher extraction rates for short texts while maintaining text quality indicated by lower perplexity, and performs comparably to non‑watermarked text on downstream tasks such as summarization and translation.

Abstract:
Multimodal understanding of tables in real‑world contexts is challenging due to the complexity of structure, symbolic density, and visual degradation (blur, skew, watermarking, incomplete structures or fonts, multi‑span or hierarchically nested layouts). Existing multimodal large language models (MLLMs) struggle with such WildStruct conditions, resulting in limited performance and poor generalization. To address these challenges, we propose TableMoE, a neuro‑symbolic Mixture‑of‑Connector‑Experts (MoCE) architecture specifically designed for robust, structured reasoning over multimodal table data. TableMoE features an innovative Neuro‑Symbolic Routing mechanism, which predicts latent semantic token roles (e.g., header, data cell, axis, formula) and dynamically routes table elements to specialized experts (Table‑to‑HTML, Table‑to‑JSON, Table‑to‑Code) using a confidence‑aware gating strategy informed by symbolic reasoning graphs. To facilitate effective alignment‑driven pretraining, we introduce the large‑scale TableMoE‑Align dataset, consisting of 1.2M table‑HTML‑JSON‑code quadruples across finance, science, biomedicine and industry, utilized exclusively for model pretraining. For evaluation, we curate and release four challenging WildStruct benchmarks: WMMFinQA, WMMTatQA, WMMTabDialog, and WMMFinanceMath, designed specifically to stress‑test models under real‑world multimodal degradation and structural complexity. Experimental results demonstrate that TableMoE significantly surpasses existing state‑of‑the‑art models. Extensive ablation studies validate each core component, emphasizing the critical role of Neuro‑Symbolic Routing and structured expert alignment. Through qualitative analyses, we further showcase TableMoE's interpretability and enhanced robustness, underscoring the effectiveness of integrating neuro‑symbolic reasoning for multimodal table understanding.

Abstract:
Generative code models (GCMs) significantly enhance development efficiency through automated code generation and code summarization. However, building and training these models require computational resources and time, necessitating effective digital copyright protection to prevent unauthorized leaks and misuse. Backdoor watermarking, by embedding hidden identifiers, simplifies copyright verification by breaking the model's black‑box nature. Current backdoor watermarking techniques face two main challenges: first, limited generalization across different tasks and datasets, causing fluctuating verification rates; second, insufficient stealthiness, as watermarks are easily detected and removed by automated methods. To address these issues, we propose CodeGuard, a novel watermarking method combining attention mechanisms with distributed trigger embedding strategies. Specifically, CodeGuard employs attention mechanisms to identify watermark embedding positions, ensuring verifiability. Moreover, by using homomorphic character replacement, it avoids manual detection, while distributed trigger embedding reduces the likelihood of automated detection. Experimental results demonstrate that CodeGuard achieves up to 100% watermark verification rates in both code summarization and code generation tasks, with no impact on the primary task performance. In terms of stealthiness, CodeGuard performs exceptionally, with a maximum detection rate of only 0.078 against ONION detection methods, significantly lower than baseline methods.

Abstract:
This paper introduces a novel deep learning framework for robust image zero‑watermarking based on distortion‑invariant feature learning. As a zero‑watermarking scheme, our method leaves the original image unaltered and learns a reference signature through optimization in the feature space. The proposed framework consists of two key modules. In the first module, a feature extractor is trained via noise‑adversarial learning to generate representations that are both invariant to distortions and semantically expressive. This is achieved by combining adversarial supervision against a distortion discriminator and a reconstruction constraint to retain image content. In the second module, we design a learning‑based multibit zero‑watermarking scheme where the trained invariant features are projected onto a set of trainable reference codes optimized to match a target binary message. Extensive experiments on diverse image datasets and a wide range of distortions show that our method achieves state‑of‑the‑art robustness in both feature stability and watermark recovery. Comparative evaluations against existing self‑supervised and deep watermarking techniques further highlight the superiority of our framework in generalization and robustness.

Abstract:
The rapid advancement of large language models (LLMs) has raised concerns regarding their potential misuse, particularly in generating fake news and misinformation. To address these risks, watermarking techniques for autoregressive language models have emerged as a promising means for detecting LLM‑generated text. Existing methods typically embed a watermark by increasing the probabilities of tokens within a group selected according to a single secret key. However, this approach suffers from a critical limitation: if the key is leaked, it becomes impossible to trace the text's provenance or attribute authorship. To overcome this vulnerability, we propose a novel nested watermarking scheme that embeds two distinct watermarks into the generated text using two independent keys. This design enables reliable authorship identification even in the event that one key is compromised. Experimental results demonstrate that our method achieves high detection accuracy for both watermarks while maintaining the fluency and overall quality of the generated text.

Abstract:
Digital image watermarks as a security feature can be derived from the imager's physically unclonable functions (PUFs) by utilizing the manufacturing variations, i.e., the dark signal non‑uniformity (DSNU). While a few demonstrations focused on the CMOS image sensors (CIS) and active pixel sensors (APS), single photon avalanche diode (SPAD) imagers have never been investigated for this purpose. In this work, we have proposed a novel watermarking technique using perimeter gated SPAD (pgSPAD) imagers. We utilized the DSNU of three 64 x 64 pgSPAD imager chips, fabricated in a 0.35 μm standard CMOS process and analyzed the simulated watermarks for standard test images from publicly available database. Our observation shows that both source identification and tamper detection can be achieved using the proposed source‑scene‑specific dynamic watermarks with a controllable sensitivity‑robustness trade‑off.

Abstract:
Digital watermarking is a promising solution for mitigating some of the risks arising from the misuse of automatically generated text. These approaches either embed non‑specific watermarks to allow for the detection of any text generated by a particular sampler, or embed specific keys that allow the identification of the LLM user. However, simultaneously using the same embedding for both detection and user identification leads to a false detection problem, whereby, as user capacity grows, unwatermarked text is increasingly likely to be falsely detected as watermarked. Through theoretical analysis, we identify the underlying causes of this phenomenon. Building on these insights, we propose Dual Watermarking which jointly encodes detection and identification watermarks into generated text, significantly reducing false positives while maintaining high detection accuracy. Our experimental results validate our theoretical findings and demonstrate the effectiveness of our approach.

Abstract:
Large language models (LLMs) can be trained or fine‑tuned on data obtained without the owner's consent. Verifying whether a specific LLM was trained on particular data instances or an entire dataset is extremely challenging. Dataset watermarking addresses this by embedding identifiable modifications in training data to detect unauthorized use. However, existing methods often lack stealth, making them relatively easy to detect and remove. In light of these limitations, we propose LexiMark, a novel watermarking technique designed for text and documents, which embeds synonym substitutions for carefully selected high‑entropy words. Our method aims to enhance an LLM's memorization capabilities on the watermarked text without altering the semantic integrity of the text. As a result, the watermark is difficult to detect, blending seamlessly into the text with no visible markers, and is resistant to removal due to its subtle, contextually appropriate substitutions that evade automated and manual detection. We evaluated our method using baseline datasets from recent studies and seven open‑source models: LLaMA‑1 7B, LLaMA‑3 8B, Mistral 7B, Pythia 6.9B, as well as three smaller variants from the Pythia family (160M, 410M, and 1B). Our evaluation spans multiple training settings, including continued pretraining and fine‑tuning scenarios. The results demonstrate significant improvements in AUROC scores compared to existing methods, underscoring our method's effectiveness in reliably verifying whether unauthorized watermarked data was used in LLM training.

Abstract:
Solutions for defending against deepfake speech fall into two categories: proactive watermarking models and passive conventional deepfake detectors. While both address common threats, their differences in training, optimization, and evaluation prevent a unified protocol for joint evaluation and selecting the best solutions for different cases. This work proposes a framework to evaluate both model types in deepfake speech detection. To ensure fair comparison and minimize discrepancies, all models were trained and tested on common datasets, with performance evaluated using a shared metric. We also analyze their robustness against various adversarial attacks, showing that different models exhibit distinct vulnerabilities to different speech attribute distortions. Our training and evaluation code is available at Github.

Abstract:
Large Language Models (LLMs) have experienced rapid advancements, with applications spanning a wide range of fields, including sentiment classification, review generation, and question answering. Due to their efficiency and versatility, researchers and companies increasingly employ LLM‑generated data to train their models. However, the inability to track content produced by LLMs poses a significant challenge, potentially leading to copyright infringement for the LLM owners. In this paper, we propose a method for injecting watermarks into LLM‑generated datasets, enabling the tracking of downstream tasks to detect whether these datasets were produced using the original LLM. These downstream tasks can be divided into two categories. The first involves using the generated datasets at the input level, commonly for training classification tasks. The other is the output level, where model trainers use LLM‑generated content as output for downstream tasks, such as question‑answering tasks. We design a comprehensive set of experiments to evaluate both watermark methods. Our results indicate the high effectiveness of our watermark approach. Additionally, regarding model utility, we find that classifiers trained on the generated datasets achieve a test accuracy exceeding 0.900 in many cases, suggesting that the utility of such models remains robust. For the output‑level watermark, we observe that the quality of the generated text is comparable to that produced using real‑world datasets. Through our research, we aim to advance the protection of LLM copyrights, taking a significant step forward in safeguarding intellectual property in this domain.

Abstract:
Quantum neural networks (QNNs) leverage quantum computing to create powerful and efficient artificial intelligence models capable of solving complex problems significantly faster than traditional computers. With the fast development of quantum hardware technology, such as superconducting qubits, trapped ions, and integrated photonics, quantum computers may become reality, accelerating the applications of QNNs. However, preparing quantum circuits and optimizing parameters for QNNs require quantum hardware support, expertise, and high‑quality data. How to protect intellectual property (IP) of QNNs becomes an urgent problem to be solved in the era of quantum computing. We make the first attempt towards IP protection of QNNs by watermarking. To this purpose, we collect classical clean samples and trigger ones, each of which is generated by adding a perturbation to a clean sample, associated with a label different from the ground‑truth one. The host QNN, consisting of quantum encoding, quantum state transformation, and quantum measurement, is then trained from scratch with the clean samples and trigger ones, resulting in a watermarked QNN model. During training, we introduce sample grouped and paired training to ensure that the performance on the downstream task can be maintained while achieving good performance for watermark extraction. When disputes arise, by collecting a mini‑set of trigger samples, the hidden watermark can be extracted by analyzing the prediction results of the target model corresponding to the trigger samples, without accessing the internal details of the target QNN model, thereby verifying the ownership of the model. Experiments have verified the superiority and applicability of this work.

Abstract:
We present a robust neural watermarking framework for scientific data integrity, targeting high‑dimensional fields common in climate modeling and fluid simulations. Using a convolutional autoencoder, binary messages are invisibly embedded into structured data such as temperature, vorticity, and geopotential. Our method ensures watermark persistence under lossy transformations ‑ including noise injection, cropping, and compression ‑ while maintaining near‑original fidelity (sub‑1% MSE). Compared to classical singular value decomposition (SVD)‑based watermarking, our approach achieves >98% bit accuracy and visually indistinguishable reconstructions across ERA5 and Navier‑Stokes datasets. This system offers a scalable, model‑compatible tool for data provenance, auditability, and traceability in high‑performance scientific workflows, and contributes to the broader goal of securing AI systems through verifiable, physics‑aware watermarking. We evaluate on physically grounded scientific datasets as a representative stress‑test; the framework extends naturally to other structured domains such as satellite imagery and autonomous‑vehicle perception streams.

Abstract:
As Diffusion Models (DM) generate increasingly realistic images, related issues such as copyright and misuse have become a growing concern. Watermarking is one of the promising solutions. Existing methods inject the watermark into the single‑domain of initial Gaussian noise for generation, which suffers from unsatisfactory robustness. This paper presents the first dual‑domain DM watermarking approach using a pipelined injector to consistently embed watermarks in both the spatial and frequency domains. To further boost robustness against certain image manipulations and advanced attacks, we introduce a model‑independent learnable Gaussian Noise Restorer (GNR) to refine Gaussian noise extracted from manipulated images and enhance detection robustness by integrating the detection scores of both watermarks. GaussMarker efficiently achieves state‑of‑the‑art performance under eight image distortions and four advanced attacks across three versions of Stable Diffusion with better recall and lower false positive rates, as preferred in real applications.

Abstract:
The rapid evolution of image generation models has revolutionized visual content creation, enabling the synthesis of highly realistic and contextually accurate images for diverse applications. However, the potential for misuse, such as deepfake generation, image based phishing attacks, and fabrication of misleading visual evidence, underscores the need for robust authenticity verification mechanisms. While traditional statistical watermarking techniques have proven effective for autoregressive language models, their direct adaptation to image generation models encounters significant challenges due to a phenomenon we term retokenization mismatch, a disparity between original and retokenized sequences during the image generation process. To overcome this limitation, we propose C‑reweight, a novel, distortion‑free watermarking method explicitly designed for image generation models. By leveraging a clustering‑based strategy that treats tokens within the same cluster equivalently, C‑reweight mitigates retokenization mismatch while preserving image fidelity. Extensive evaluations on leading image generation platforms reveal that C‑reweight not only maintains the visual quality of generated images but also improves detectability over existing distortion‑free watermarking techniques, setting a new standard for secure and trustworthy image synthesis.

Abstract:
We present a novel attack specifically designed against Tree‑Ring, a watermarking technique for diffusion models known for its high imperceptibility and robustness against removal attacks. Unlike previous removal attacks, which rely on strong assumptions about attacker capabilities, our attack only requires access to the variational autoencoder that was used to train the target diffusion model, a component that is often publicly available. By leveraging this variational autoencoder, the attacker can approximate the model's intermediate latent space, enabling more effective surrogate‑based attacks. Our evaluation shows that this approach leads to a dramatic reduction in the AUC of Tree‑Ring detector's ROC and PR curves, decreasing from 0.993 to 0.153 and from 0.994 to 0.385, respectively, while maintaining high image quality. Notably, our attacks outperform existing methods that assume full access to the diffusion model. These findings highlight the risk of reusing public autoencoders to train diffusion models ‑‑ a threat not considered by current industry practices. Furthermore, the results suggest that the Tree‑Ring detector's precision, a metric that has been overlooked by previous evaluations, falls short of the requirements for real‑world deployment.

Abstract:
As Retrieval‑Augmented Generation (RAG) evolves into service‑oriented platforms (Rag‑as‑a‑Service) with shared knowledge bases, protecting the copyright of contributed data becomes essential. Existing watermarking methods in RAG focus solely on textual knowledge, leaving image knowledge unprotected. In this work, we propose AQUA, the first watermark framework for image knowledge protection in Multimodal RAG systems. AQUA embeds semantic signals into synthetic images using two complementary methods: acronym‑based triggers and spatial relationship cues. These techniques ensure watermark signals survive indirect watermark propagation from image retriever to textual generator, being efficient, effective and imperceptible. Experiments across diverse models and datasets show that AQUA enables robust, stealthy, and reliable copyright tracing, filling a key gap in multimodal RAG protection.

Abstract:
Graph Neural Networks (GNNs) are increasingly deployed in real‑world applications, making ownership verification critical to protect their intellectual property against model theft. Fingerprinting and black‑box watermarking are two main methods. However, the former relies on determining model similarity, which is computationally expensive and prone to ownership collisions after model post‑processing. The latter embeds backdoors, exposing watermarked models to the risk of backdoor attacks. Moreover, both previous methods enable ownership verification but do not convey additional information about the copy model. If the owner has multiple models, each model requires a distinct trigger graph. To address these challenges, this paper proposes WGLE, a novel black‑box watermarking paradigm for GNNs that enables embedding the multi‑bit string in GNN models without using backdoors. WGLE builds on a key insight we term Layer‑wise Distance Difference on an Edge (LDDE), which quantifies the difference between the feature distance and the prediction distance of two connected nodes in a graph. By assigning unique LDDE values to the edges and employing the LDDE sequence as the watermark, WGLE supports multi‑bit capacity without relying on backdoor mechanisms. We evaluate WGLE on six public datasets across six mainstream GNN architectures, and compare WGLE with state‑of‑the‑art GNN watermarking and fingerprinting methods. WGLE achieves 100% ownership verification accuracy, with an average fidelity degradation of only 1.41%. Additionally, WGLE exhibits robust resilience against potential attacks. The code is available in the repository.

Abstract:
Recent advancements in watermarking techniques have enabled the embedding of secret messages into AI‑generated text (AIGT), serving as an important mechanism for AIGT detection. Existing methods typically interfere with the generation processes of large language models (LLMs) to embed signals within the generated text. However, these methods often rely on heuristic rules, which can result in suboptimal token selection and a subsequent decline in the quality of the generated content. In this paper, we introduce a plug‑and‑play contextual generation states‑aware watermarking framework (CAW) that dynamically adjusts the embedding process. It can be seamlessly integrated with various existing watermarking methods to enhance generation quality. First, CAW incorporates a watermarking capacity evaluator, which can assess the impact of embedding messages at different token positions by analyzing the contextual generation states. Furthermore, we introduce a multi‑branch pre‑generation mechanism to avoid the latency caused by the proposed watermarking strategy. Building on this, CAW can dynamically adjust the watermarking process based on the evaluated watermark capacity of each token, thereby minimizing potential degradation in content quality. Extensive experiments conducted on datasets across multiple domains have verified the effectiveness of our method, demonstrating superior performance compared to various baselines in terms of both detection rate and generation quality.

Abstract:
The increasing capabilities of Large Language Models (LLMs) have raised concerns about their misuse in AI‑generated plagiarism and social engineering. While various AI‑generated text detectors have been proposed to mitigate these risks, many remain vulnerable to simple evasion techniques such as paraphrasing. However, recent detectors have shown greater robustness against such basic attacks. In this work, we introduce Adversarial Paraphrasing, a training‑free attack framework that universally humanizes any AI‑generated text to evade detection more effectively. Our approach leverages an off‑the‑shelf instruction‑following LLM to paraphrase AI‑generated content under the guidance of an AI text detector, producing adversarial examples that are specifically optimized to bypass detection. Extensive experiments show that our attack is both broadly effective and highly transferable across several detection systems. For instance, compared to simple paraphrasing attack‑‑which, ironically, increases the true positive at 1% false positive (T@1%F) by 8.57% on RADAR and 15.03% on Fast‑DetectGPT‑‑adversarial paraphrasing, guided by OpenAI‑RoBERTa‑Large, reduces T@1%F by 64.49% on RADAR and a striking 98.96% on Fast‑DetectGPT. Across a diverse set of detectors‑‑including neural network‑based, watermark‑based, and zero‑shot approaches‑‑our attack achieves an average T@1%F reduction of 87.88% under the guidance of OpenAI‑RoBERTa‑Large. We also analyze the tradeoff between text quality and attack success to find that our method can significantly reduce detection rates, with mostly a slight degradation in text quality. Our adversarial setup highlights the need for more robust and resilient detection strategies in the light of increasingly sophisticated evasion techniques.

Abstract:
In the age of IoT and mobile platforms, ensuring that content stay authentic whilst avoiding overburdening limited hardware is a key problem. This study introduces hybrid Fast Wavelet Transform & Additive Quantization index Modulation (FWT‑AQIM) scheme, a lightweight watermarking approach that secures digital pictures on low‑power, memory‑constrained small scale devices to achieve a balanced trade‑off among robustness, imperceptibility, and computational efficiency. The method embeds watermark in the luminance component of YCbCr color space using low‑frequency FWT sub‑bands, minimizing perceptual distortion, using additive QIM for simplicity. Both the extraction and embedding processes run in less than 40 ms and require minimum RAM when tested on a Raspberry Pi 5. Quality assessments on standard and high‑resolution images yield PSNR greater than equal to 34 dB and SSIM greater than equal to 0.97, while robustness verification includes various geometric and signal‑processing attacks demonstrating near‑zero bit error rates and NCC greater than equal to 0.998. Using a mosaic‑based watermark, redundancy added enhancing robustness without reducing throughput, which peaks at 11 MP/s. These findings show that FWT‑AQIM provides an efficient, scalable solution for real‑time, secure watermarking in bandwidth‑ and power‑constrained contexts, opening the way for dependable content protection in developing IoT and multimedia applications.

Abstract:
Synthetic time series generated by diffusion models enable sharing privacy‑sensitive datasets, such as patients' functional MRI records. Key criteria for synthetic data include high data utility and traceability to verify the data source. Recent watermarking methods embed in homogeneous latent spaces, but state‑of‑the‑art time series generators operate in data space, making latent‑based watermarking incompatible. This creates the challenge of watermarking directly in data space while handling feature heterogeneity and temporal dependencies. We propose TimeWak, the first watermarking algorithm for multivariate time series diffusion models. To handle temporal dependence and spatial heterogeneity, TimeWak embeds a temporal chained‑hashing watermark directly within the temporal‑feature data space. The other unique feature is the ε‑exact inversion, which addresses the non‑uniform reconstruction error distribution across features from inverting the diffusion process to detect watermarks. We derive the error bound of inverting multivariate time series while preserving robust watermark detectability. We extensively evaluate TimeWak on its impact on synthetic data quality, watermark detectability, and robustness under various post‑editing attacks, against five datasets and baselines of different temporal lengths. Our results show that TimeWak achieves improvements of 61.96% in context‑FID score, and 8.44% in correlational scores against the strongest state‑of‑the‑art baseline, while remaining consistently detectable.

Abstract:
Deep learning models have shown remarkable success in dermatological image analysis, offering potential for automated skin disease diagnosis. Previously, convolutional neural network(CNN) based architectures have achieved immense popularity and success in computer vision (CV) based task like skin image recognition, generation and video analysis. But with the emergence of transformer based models, CV tasks are now are nowadays carrying out using these models. Vision Transformers (ViTs) is such a transformer‑based models that have shown success in computer vision. It uses self‑attention mechanisms to achieve state‑of‑the‑art performance across various tasks. However, their reliance on global attention mechanisms makes them susceptible to adversarial perturbations. This paper aims to investigate the susceptibility of ViTs for medical images to adversarial watermarking‑a method that adds so‑called imperceptible perturbations in order to fool models. By generating adversarial watermarks through Projected Gradient Descent (PGD), we examine the transferability of such attacks to CNNs and analyze the performance defense mechanism ‑‑ adversarial training. Results indicate that while performance is not compromised for clean images, ViTs certainly become much more vulnerable to adversarial attacks: an accuracy drop of as low as 27.6%. Nevertheless, adversarial training raises it up to 90.0%.

Abstract:
Watermarking becomes one of the pivotal solutions to trace and verify the origin of synthetic images generated by artificial intelligence models, but it is not free of risks. Recent studies demonstrate the capability to forge watermarks from a target image onto cover images via adversarial optimization without knowledge of the target generative model and watermark schemes. In this paper, we uncover a greater risk of an optimization‑free and universal watermark forgery that harnesses existing regenerative diffusion models. Our proposed forgery attack, PnP (Plug‑and‑Plant), seamlessly extracts and integrates the target watermark via regenerating the image, without needing any additional optimization routine. It allows for universal watermark forgery that works independently of the target image's origin or the watermarking model used. We explore the watermarked latent extracted from the target image and visual‑textual context of cover images as priors to guide sampling of the regenerative process. Extensive evaluation on 24 scenarios of model‑data‑watermark combinations demonstrates that PnP can successfully forge the watermark (up to 100% detectability and user attribution), and maintain the best visual perception. By bypassing model retraining and enabling adaptability to any image, our approach significantly broadens the scope of forgery attacks, presenting a greater challenge to the security of current watermarking techniques for diffusion models and the authority of watermarking schemes in synthetic data generation and governance.

Abstract:
Large Language Models (LLMs) have transformed natural language processing, demonstrating impressive capabilities across diverse tasks. However, deploying these models introduces critical risks related to intellectual property violations and potential misuse, particularly as adversaries can imitate these models to steal services or generate misleading outputs. We specifically focus on model stealing attacks, as they are highly relevant to proprietary LLMs and pose a serious threat to their security, revenue, and ethical deployment. While various watermarking techniques have emerged to mitigate these risks, it remains unclear how far the community and industry have progressed in developing and deploying watermarks in LLMs. To bridge this gap, we aim to develop a comprehensive systematization for watermarks in LLMs by 1) presenting a detailed taxonomy for watermarks in LLMs, 2) proposing a novel intellectual property classifier to explore the effectiveness and impacts of watermarks on LLMs under both attack and attack‑free environments, 3) analyzing the limitations of existing watermarks in LLMs, and 4) discussing practical challenges and potential future directions for watermarks in LLMs. Through extensive experiments, we show that despite promising research outcomes and significant attention from leading companies and community to deploy watermarks, these techniques have yet to reach their full potential in real‑world applications due to their unfavorable impacts on model utility of LLMs and downstream tasks. Our findings provide an insightful understanding of watermarks in LLMs, highlighting the need for practical watermarks solutions tailored to LLM deployment.

Abstract:
Watermarking for large language models (LLMs) offers a promising approach to identifying AI‑generated text. Existing approaches, however, either compromise the distribution of original generated text by LLMs or are limited to embedding zero‑bit information that only allows for watermark detection but ignores identification. We present StealthInk, a stealthy multi‑bit watermarking scheme that preserves the original text distribution while enabling the embedding of provenance data, such as userID, TimeStamp, and modelID, within LLM‑generated text. This enhances fast traceability without requiring access to the language model's API or prompts. We derive a lower bound on the number of tokens necessary for watermark detection at a fixed equal error rate, which provides insights on how to enhance the capacity. Comprehensive empirical evaluations across diverse tasks highlight the stealthiness, detectability, and resilience of StealthInk, establishing it as an effective solution for LLM watermarking applications.

Abstract:
Watermarking has become a practical tool for tracing language model outputs, but it modifies token probabilities at inference time, which were carefully tuned by alignment training. This creates a tension: how do watermark‑induced shifts interact with the procedures intended to make models safe and useful? Experiments on several contemporary models and two representative watermarking schemes reveal that watermarking induces a nontrivial, patterned yet model‑specific shift in alignment. We see two failure modes: guard attenuation, where models become more helpful but less safe, and guard amplification, where refusals become overly conservative. These effects persist even after controlling for perplexity degradation, pointing to alignment‑specific distortions, not just quality loss. We address this with Alignment Resampling (AR), a procedure that samples multiple watermarked outputs and selects the most aligned response according to an external reward model. Using standard results on the expected maximum of Gaussian random variables, we derive a theoretical lower bound showing that alignment gains grow sublogarithmically with sample size. In practice, sampling as few as two to four candidates largely restores unwatermarked alignment performance in truthfulness, safety, and helpfulness, without hurting watermark detection. This is the first empirical study of watermarking‑alignment interactions; it shows that a simple inference‑time fix can recover alignment.

Abstract:
Text‑to‑image generation models~(e.g., Stable Diffusion) have achieved significant advancements, enabling the creation of high‑quality and realistic images based on textual descriptions. Prompt inversion, the task of identifying the textual prompt used to generate a specific artifact, holds significant potential for applications including data attribution, model provenance, and watermarking validation. Recent studies introduced a delayed projection scheme to optimize for prompts representative of the vocabulary space, though challenges in semantic fluency and efficiency remain. Advanced image captioning models or visual large language models can generate highly interpretable prompts, but they often lack in image similarity. In this paper, we propose a prompt inversion technique called \sys for text‑to‑image diffusion models, which includes initializing embeddings using a pre‑trained image captioning model, refining them through reverse‑engineering in the latent space, and converting them to texts using an embedding‑to‑text model. Our experiments on the widely‑used datasets, such as MS COCO, LAION, Flickr and DiffusionDB, show that our method outperforms existing methods in terms of image similarity, textual alignment, prompt interpretability and generalizability. We further illustrate the application of our generated prompts in tasks such as cross‑concept image synthesis, concept manipulation, evolutionary multi‑concept generation and unsupervised segmentation.

Abstract:
Robot teleoperation with extended reality (XR teleoperation) enables intuitive interaction by allowing remote robots to mimic user motions with real‑time 3D feedback. However, existing systems face significant motion‑to‑motion (M2M) latency‑‑the delay between the user's latest motion and the corresponding robot feedback‑‑leading to high teleoperation error and mission completion time. This issue stems from the system's exclusive reliance on network communication, making it highly vulnerable to network degradation. To address these challenges, we introduce TeleXR, the first end‑to‑end, fully open‑sourced XR teleoperation framework that decouples robot control and XR visualization from network dependencies. TeleXR leverages local sensing data to reconstruct delayed or missing information of the counterpart, thereby significantly reducing network‑induced issues. This approach allows both the XR and robot to run concurrently with network transmission while maintaining high robot planning accuracy. TeleXR also features contention‑aware scheduling to mitigate GPU contention and bandwidth‑adaptive point cloud scaling to cope with limited bandwidth.

Abstract:
Autoregressive (AR) image generation models have gained increasing attention for their breakthroughs in synthesis quality, highlighting the need for robust watermarking to prevent misuse. However, existing in‑generation watermarking techniques are primarily designed for diffusion models, where watermarks are embedded within diffusion latent states. This design poses significant challenges for direct adaptation to AR models, which generate images sequentially through token prediction. Moreover, diffusion‑based regeneration attacks can effectively erase such watermarks by perturbing diffusion latent states. To address these challenges, we propose Lexical Bias Watermarking (LBW), a novel framework designed for AR models that resists regeneration attacks. LBW embeds watermarks directly into token maps by biasing token selection toward a predefined green list during generation. This approach ensures seamless integration with existing AR models and extends naturally to post‑hoc watermarking. To increase the security against white‑box attacks, instead of using a single green list, the green list for each image is randomly sampled from a pool of green lists. Watermark detection is performed via quantization and statistical analysis of the token distribution. Extensive experiments demonstrate that LBW achieves superior watermark robustness, particularly in resisting regeneration attacks.

Abstract:
The rapid development of Artificial Intelligence Generated Content (AIGC) has led to significant progress in video generation, but also raises serious concerns about intellectual property protection and reliable content tracing. Watermarking is a widely adopted solution to this issue, yet existing methods for video generation mainly follow a post‑generation paradigm, which often fails to effectively balance the trade‑off between video quality and watermark extraction. Meanwhile, current in‑generation methods that embed the watermark into the initial Gaussian noise usually incur substantial additional computation. To address these issues, we propose Video Signature (\textscVidSig), an implicit watermarking method for video diffusion models that enables imperceptible and adaptive watermark integration during video generation with almost no extra latency. Specifically, we partially fine‑tune the latent decoder, where Perturbation‑Aware Suppression (PAS) pre‑identifies and freezes perceptually sensitive layers to preserve visual quality. Beyond spatial fidelity, we further enhance temporal consistency by introducing a lightweight Temporal Alignment module that guides the decoder to generate coherent frame sequences during fine‑tuning. Experimental results show that \textscVidSig achieves the best trade‑off among watermark extraction accuracy, video quality, and watermark latency. It also demonstrates strong robustness against both spatial and temporal tamper, and remains stable across different video lengths and resolutions, highlighting its practicality in real‑world scenarios.

Abstract:
With the surge of social media, maliciously tampered public speeches, especially those from influential figures, have seriously affected social stability and public trust. Existing speech tampering detection methods remain insufficient: they either rely on external reference data or fail to be both sensitive to attacks and robust to benign operations, such as compression and resampling. To tackle these challenges, we introduce SpeechVerifer to proactively verify speech integrity using only the published speech itself, i.e., without requiring any external references. Inspired by audio fingerprinting and watermarking, SpeechVerifier can (i) effectively detect tampering attacks, (ii) be robust to benign operations and (iii) verify the integrity only based on published speeches. Briefly, SpeechVerifier utilizes multiscale feature extraction to capture speech features across different temporal resolutions. Then, it employs contrastive learning to generate fingerprints that can detect modifications at varying granularities. These fingerprints are designed to be robust to benign operations, but exhibit significant changes when malicious tampering occurs. To enable speech verification in a self‑contained manner, the generated fingerprints are then embedded into the speech signal by segment‑wise watermarking. Without external references, SpeechVerifier can retrieve the fingerprint from the published audio and check it with the embedded watermark to verify the integrity of the speech. Extensive experimental results demonstrate that the proposed SpeechVerifier is effective in detecting tampering attacks and robust to benign operations.

Abstract:
Watermarking has emerged as a leading technical proposal for attributing generative AI content and is increasingly cited in global governance frameworks. This position paper argues that current implementations risk serving as symbolic compliance rather than delivering effective oversight. We identify a growing gap between regulatory expectations and the technical limitations of existing watermarking schemes. Through analysis of policy proposals and industry practices, we show how incentive structures disincentivize robust, auditable deployments. To realign watermarking with governance goals, we propose a three‑layer framework encompassing technical standards, audit infrastructure, and enforcement mechanisms. Without enforceable requirements and independent verification, watermarking will remain inadequate for accountability and ultimately undermine broader efforts in AI safety and regulation.

Abstract:
Large language models (LLMs) are increasingly integrated into academic workflows, with many conferences and journals permitting their use for tasks such as language refinement and literature summarization. However, their use in peer review remains prohibited due to concerns around confidentiality breaches, hallucinated content, and inconsistent evaluations. As LLM‑generated text becomes more indistinguishable from human writing, there is a growing need for reliable attribution mechanisms to preserve the integrity of the review process. In this work, we evaluate topic‑based watermarking (TBW), a semantic‑aware technique designed to embed detectable signals into LLM‑generated text. We conduct a systematic assessment across multiple LLM configurations, including base, few‑shot, and fine‑tuned variants, using authentic peer review data from academic conferences. Our results show that TBW maintains review quality relative to non‑watermarked outputs, while demonstrating robust detection performance under paraphrasing. These findings highlight the viability of TBW as a minimally intrusive and practical solution for LLM attribution in peer review settings.

Abstract:
Voice cloning (VC)‑resistant watermarking is an emerging technique for tracing and preventing unauthorized cloning. Existing methods effectively trace traditional VC models by training them on watermarked audio but fail in zero‑shot VC scenarios, where models synthesize audio from an audio prompt without training. To address this, we propose VoiceMark, the first zero‑shot VC‑resistant watermarking method that leverages speaker‑specific latents as the watermark carrier, allowing the watermark to transfer through the zero‑shot VC process into the synthesized audio. Additionally, we introduce VC‑simulated augmentations and VAD‑based loss to enhance robustness against distortions. Experiments on multiple zero‑shot VC models demonstrate that VoiceMark achieves over 95% accuracy in watermark detection after zero‑shot VC synthesis, significantly outperforming existing methods, which only reach around 50%. See our code and demos at: https://huggingface.co/spaces/haiyunli/VoiceMark

Abstract:
We introduce the Robust Audio Watermarking Benchmark (RAW‑Bench), a benchmark for evaluating deep learning‑based audio watermarking methods with standardized and systematic comparisons. To simulate real‑world usage, we introduce a comprehensive audio attack pipeline with various distortions such as compression, background noise, and reverberation, along with a diverse test dataset including speech, environmental sounds, and music recordings. Evaluating four existing watermarking methods on RAW‑bench reveals two main insights: (i) neural compression techniques pose the most significant challenge, even when algorithms are trained with such compressions; and (ii) training with audio attacks generally improves robustness, although it is insufficient in some cases. Furthermore, we find that specific distortions, such as polarity inversion, time stretching, or reverb, seriously affect certain methods. The evaluation framework is accessible at github.com/SonyResearch/raw_bench.

Abstract:
Machine Learning as a Service (MLaaS) enables users to leverage powerful machine learning models through cloud‑based APIs, offering scalability and ease of deployment. However, these services are vulnerable to model extraction attacks, where adversaries repeatedly query the application programming interface (API) to reconstruct a functionally similar model, compromising intellectual property and security. Despite various defense strategies being proposed, many suffer from high computational costs, limited adaptability to evolving attack techniques, and a reduction in performance for legitimate users. In this paper, we introduce a Resilient Adaptive Defense Framework for Model Extraction Attack Protection (RADEP), a multifaceted defense framework designed to counteract model extraction attacks through a multi‑layered security approach. RADEP employs progressive adversarial training to enhance model resilience against extraction attempts. Malicious query detection is achieved through a combination of uncertainty quantification and behavioral pattern analysis, effectively identifying adversarial queries. Furthermore, we develop an adaptive response mechanism that dynamically modifies query outputs based on their suspicion scores, reducing the utility of stolen models. Finally, ownership verification is enforced through embedded watermarking and backdoor triggers, enabling reliable identification of unauthorized model use. Experimental evaluations demonstrate that RADEP significantly reduces extraction success rates while maintaining high detection accuracy with minimal impact on legitimate queries. Extensive experiments show that RADEP effectively defends against model extraction attacks and remains resilient even against adaptive adversaries, making it a reliable security framework for MLaaS models.

Abstract:
Large language models (LLMs) represent a new paradigm for processing unstructured data, with applications across an unprecedented range of domains. In this paper, we address, through two arguments, whether the development and application of LLMs would genuinely benefit from foundational contributions from the statistics discipline. First, we argue affirmatively, beginning with the observation that LLMs are inherently statistical models due to their profound data dependency and stochastic generation processes, where statistical insights are naturally essential for handling variability and uncertainty. Second, we argue that the persistent black‑box nature of LLMs ‑‑ stemming from their immense scale, architectural complexity, and development practices often prioritizing empirical performance over theoretical interpretability ‑‑ renders closed‑form or purely mechanistic analyses generally intractable, thereby necessitating statistical approaches due to their flexibility and often demonstrated effectiveness. To substantiate these arguments, the paper outlines several research areas ‑‑ including alignment, watermarking, uncertainty quantification, evaluation, and data mixture optimization ‑‑ where statistical methodologies are critically needed and are already beginning to make valuable contributions. We conclude with a discussion suggesting that statistical research concerning LLMs will likely form a diverse ``mosaic'' of specialized topics rather than deriving from a single unifying theory, and highlighting the importance of timely engagement by our statistics community in LLM research.

Abstract:
Face swapping, recognized as a privacy and security concern, has prompted considerable defensive research. With the advancements in AI‑generated content, the discrepancies between the real and swapped faces have become nuanced. Considering the difficulty of forged traces detection, we shift the focus to the face swapping purpose and proactively embed elaborate watermarks against unknown face swapping techniques. Given that the constant purpose is to swap the original face identity while preserving the background, we concentrate on the regions surrounding the face to ensure robust watermark generation, while embedding the contour texture and face identity information to achieve progressive image determination. The watermark is located in the facial contour and contains hybrid messages, dubbed the contour‑hybrid watermark (CMark). Our approach generalizes face swapping detection without requiring any swapping techniques during training and the storage of large‑scale messages in advance. Experiments conducted across 8 face swapping techniques demonstrate the superiority of our approach compared with state‑of‑the‑art passive and proactive detectors while achieving a favorable balance between the image quality and watermark robustness.

Abstract:
Modern large language model (LLM) services increasingly rely on complex, often abstract operations, such as multi‑step reasoning and multi‑agent collaboration, to generate high‑quality outputs. While users are billed based on token consumption and API usage, these internal steps are typically not visible. We refer to such systems as Commercial Opaque LLM Services (COLS). This position paper highlights emerging accountability challenges in COLS: users are billed for operations they cannot observe, verify, or contest. We formalize two key risks: quantity inflation, where token and call counts may be artificially inflated, and quality downgrade, where providers might quietly substitute lower‑cost models or tools. Addressing these risks requires a diverse set of auditing strategies, including commitment‑based, predictive, behavioral, and signature‑based methods. We further explore the potential of complementary mechanisms such as watermarking and trusted execution environments to enhance verifiability without compromising provider confidentiality. We also propose a modular three‑layer auditing framework for COLS and users that enables trustworthy verification across execution, secure logging, and user‑facing auditability without exposing proprietary internals. Our aim is to encourage further research and policy development toward transparency, auditability, and accountability in commercial LLM services.

Abstract:
Most LLM fingerprinting methods teach the model to respond to a few fixed queries with predefined atypical responses (keys). This memorization often does not survive common deployment steps such as finetuning or quantization, and such keys can be easily detected and filtered from LLM responses, ultimately breaking the fingerprint. To overcome these limitations we introduce LLM fingerprinting via semantically conditioned watermarks, replacing fixed query sets with a broad semantic domain, and replacing brittle atypical keys with a statistical watermarking signal diffused throughout each response. After teaching the model to watermark its responses only to prompts from a predetermined domain e.g., French language, the model owner can use queries from that domain to reliably detect the fingerprint and verify ownership. As we confirm in our thorough experimental evaluation, our fingerprint is both stealthy and robust to all common deployment scenarios.

Abstract:
Invisible image watermarking can protect image ownership and prevent malicious misuse of visual generative models. However, existing generative watermarking methods are mainly designed for diffusion models while watermarking for autoregressive image generation models remains largely underexplored. We propose IndexMark, a training‑free watermarking framework for autoregressive image generation models. IndexMark is inspired by the redundancy property of the codebook: replacing autoregressively generated indices with similar indices produces negligible visual differences. The core component in IndexMark is a simple yet effective match‑then‑replace method, which carefully selects watermark tokens from the codebook based on token similarity, and promotes the use of watermark tokens through token replacement, thereby embedding the watermark without affecting the image quality. Watermark verification is achieved by calculating the proportion of watermark tokens in generated images, with precision further improved by an Index Encoder. Furthermore, we introduce an auxiliary validation scheme to enhance robustness against cropping attacks. Experiments demonstrate that IndexMark achieves state‑of‑the‑art performance in terms of image quality and verification accuracy, and exhibits robustness against various perturbations, including cropping, noises, Gaussian blur, random erasing, color jittering, and JPEG compression.

Abstract:
With the rapid rise of large models, copyright protection for generated image content has become a critical security challenge. Although deep learning watermarking techniques offer an effective solution for digital image copyright protection, they still face limitations in terms of visual quality, robustness and generalization. To address these issues, this paper proposes an adaptive robust iterative watermarking framework (ARIW‑Framework) that achieves high‑quality watermarked images while maintaining exceptional robustness and generalization performance. Specifically, we introduce an iterative approach to optimize the encoder for generating robust residuals. The encoder incorporates noise layers and a decoder to compute robustness weights for residuals under various noise attacks. By employing a parallel optimization strategy, the framework enhances robustness against multiple types of noise attacks. Furthermore, we leverage image gradients to determine the embedding strength at each pixel location, significantly improving the visual quality of the watermarked images. Extensive experiments demonstrate that the proposed method achieves superior visual quality while exhibiting remarkable robustness and generalization against noise attacks.

Abstract:
Watermarking by altering token sampling probabilities based on red‑green list is a promising method for tracing the origin of text generated by large language models (LLMs). However, existing watermark methods often struggle with a fundamental dilemma: improving watermark effectiveness (the detectability of the watermark) often comes at the cost of reduced text quality. This trade‑off limits their practical application. To address this challenge, we first formalize the problem within a multi‑objective trade‑off analysis framework. Within this framework, we identify a key factor that influences the dilemma. Unlike existing methods, where watermark strength is typically treated as a fixed hyperparameter, our theoretical insights lead to the development of MorphMarka method that adaptively adjusts the watermark strength in response to changes in the identified factor, thereby achieving an effective resolution of the dilemma. In addition, MorphMark also prioritizes flexibility since it is a model‑agnostic and model‑free watermark method, thereby offering a practical solution for real‑world deployment, particularly in light of the rapid evolution of AI models. Extensive experiments demonstrate that MorphMark achieves a superior resolution of the effectiveness‑quality dilemma, while also offering greater flexibility and time and space efficiency.

Abstract:
As AI‑generated imagery becomes ubiquitous, invisible watermarks have emerged as a primary line of defense for copyright and provenance. The newest watermarking schemes embed semantic signals ‑ content‑aware patterns that are designed to survive common image manipulations ‑ yet their true robustness against adaptive adversaries remains under‑explored. We expose a previously unreported vulnerability and introduce SemanticRegen, a three‑stage, label‑free attack that erases state‑of‑the‑art semantic and invisible watermarks while leaving an image's apparent meaning intact. Our pipeline (i) uses a vision‑language model to obtain fine‑grained captions, (ii) extracts foreground masks with zero‑shot segmentation, and (iii) inpaints only the background via an LLM‑guided diffusion model, thereby preserving salient objects and style cues. Evaluated on 1,000 prompts across four watermarking systems ‑ TreeRing, StegaStamp, StableSig, and DWT/DCT ‑ SemanticRegen is the only method to defeat the semantic TreeRing watermark (p = 0.10 > 0.05) and reduces bit‑accuracy below 0.75 for the remaining schemes, all while maintaining high perceptual quality (masked SSIM = 0.94 +/‑ 0.01). We further introduce masked SSIM (mSSIM) to quantify fidelity within foreground regions, showing that our attack achieves up to 12 percent higher mSSIM than prior diffusion‑based attackers. These results highlight an urgent gap between current watermark defenses and the capabilities of adaptive, semantics‑aware adversaries, underscoring the need for watermarking algorithms that are resilient to content‑preserving regenerative attacks.

Abstract:
As generative artificial intelligence technologies like Stable Diffusion advance, visual content becomes more vulnerable to misuse, raising concerns about copyright infringement. Visual watermarks serve as effective protection mechanisms, asserting ownership and deterring unauthorized use. Traditional deepfake detection methods often rely on passive techniques that struggle with sophisticated manipulations. In contrast, diffusion models enhance detection accuracy by allowing for the effective learning of features, enabling the embedding of imperceptible and robust watermarks. We analyze the strengths and challenges of watermark techniques related to diffusion models, focusing on their robustness and application in watermark generation. By exploring the integration of advanced diffusion models and watermarking security, we aim to advance the discourse on preserving watermark robustness against evolving forgery threats. It emphasizes the critical importance of developing innovative solutions to protect digital content and ensure the preservation of ownership rights in the era of generative AI.

Abstract:
Watermarking AI‑generated text is critical for combating misuse. Yet recent theoretical work argues that any watermark can be erased via random walk attacks that perturb text while preserving quality. However, such attacks rely on two key assumptions: (1) rapid mixing (watermarks dissolve quickly under perturbations) and (2) reliable quality preservation (automated quality oracles perfectly guide edits). Through large‑scale experiments and human‑validated assessments, we find mixing is slow: 100% of perturbed texts retain traces of their origin after hundreds of edits, defying rapid mixing. Oracles falter, as state‑of‑the‑art quality detectors misjudge edits (77% accuracy), compounding errors during attacks. Ultimately, attacks underperform: automated walks remove watermarks just 26% of the time ‑‑ dropping to 10% under human quality review. These findings challenge the inevitability of watermark removal. Instead, practical barriers ‑‑ slow mixing and imperfect quality control ‑‑ reveal watermarking to be far more robust than theoretical models suggest. The gap between idealized attacks and real‑world feasibility underscores the need for stronger watermarking methods and more realistic attack models.

Abstract:
The rapid advancement of LLMs (Large Language Models) has established them as a foundational technology for many AI and ML‑powered human computer interactions. A critical challenge in this context is the attribution of LLM‑generated text ‑‑ either to the specific language model that produced it or to the individual user who embedded their identity via a so‑called multi‑bit watermark. This capability is essential for combating misinformation, fake news, misinterpretation, and plagiarism. One of the key techniques for addressing this challenge is digital watermarking. This work presents a watermarking scheme for LLM‑generated text based on Lagrange interpolation, enabling the recovery of a multi‑bit author identity even when the text has been heavily redacted by an adversary. The core idea is to embed a continuous sequence of points (x, f(x)) that lie on a single straight line. The x‑coordinates are computed pseudorandomly using a cryptographic hash function H applied to the concatenation of the previous token's identity and a secret key s_k. Crucially, the x‑coordinates do not need to be embedded into the text ‑‑ only the corresponding f(x) values are embedded. During extraction, the algorithm recovers the original points along with many spurious ones, forming an instance of the Maximum Collinear Points (MCP) problem, which can be solved efficiently. Experimental results demonstrate that the proposed method is highly effective, allowing the recovery of the author identity even when as few as three genuine points remain after adversarial manipulation.

Abstract:
Text watermarking aims to subtly embed statistical signals into text by controlling the Large Language Model (LLM)'s sampling process, enabling watermark detectors to verify that the output was generated by the specified model. The robustness of these watermarking algorithms has become a key factor in evaluating their effectiveness. Current text watermarking algorithms embed watermarks in high‑entropy tokens to ensure text quality. In this paper, we reveal that this seemingly benign design can be exploited by attackers, posing a significant risk to the robustness of the watermark. We introduce a generic efficient paraphrasing attack, the Self‑Information Rewrite Attack (SIRA), which leverages the vulnerability by calculating the self‑information of each token to identify potential pattern tokens and perform targeted attack. Our work exposes a widely prevalent vulnerability in current watermarking algorithms. The experimental results show SIRA achieves nearly 100% attack success rates on seven recent watermarking methods with only 0.88 USD per million tokens cost. Our approach does not require any access to the watermark algorithms or the watermarked LLM and can seamlessly transfer to any LLM as the attack model, even mobile‑level models. Our findings highlight the urgent need for more robust watermarking.

Abstract:
With the widespread deployment of deep neural network (DNN) models, dynamic watermarking techniques are being used to protect the intellectual property of model owners. However, recent studies have shown that existing watermarking schemes are vulnerable to watermark removal and ambiguity attacks. Besides, the vague criteria for determining watermark presence further increase the likelihood of such attacks. In this paper, we propose a secure DNN watermarking scheme named ChainMarks, which generates secure and robust watermarks by introducing a cryptographic chain into the trigger inputs and utilizes a two‑phase Monte Carlo method for determining watermark presence. First, ChainMarks generates trigger inputs as a watermark dataset by repeatedly applying a hash function over a secret key, where the target labels associated with trigger inputs are generated from the digital signature of model owner. Then, the watermarked model is produced by training a DNN over both the original and watermark datasets. To verify watermarks, we compare the predicted labels of trigger inputs with the target labels and determine ownership with a more accurate decision threshold that considers the classification probability of specific models. Experimental results show that ChainMarks exhibits higher levels of robustness and security compared to state‑of‑the‑art watermarking schemes. With a better marginal utility, ChainMarks provides a higher probability guarantee of watermark presence in DNN models with the same level of watermark accuracy.

Abstract:
This paper proves a new watermarking method to embed the ownership information into a deep neural network (DNN), which is robust to fine‑tuning. Specifically, we prove that when the input feature of a convolutional layer only contains low‑frequency components, specific frequency components of the convolutional filter will not be changed by gradient descent during the fine‑tuning process, where we propose a revised Fourier transform to extract frequency components from the convolutional filter. Additionally, we also prove that these frequency components are equivariant to weight scaling and weight permutations. In this way, we design a watermark module to encode the watermark information to specific frequency components in a convolutional filter. Preliminary experiments demonstrate the effectiveness of our method.

Abstract:
Recent advancement in large‑scale Artificial Intelligence (AI) models offering multimodal services have become foundational in AI systems, making them prime targets for model theft. Existing methods select Out‑of‑Distribution (OoD) data as backdoor watermarks and retrain the original model for copyright protection. However, existing methods are susceptible to malicious detection and forgery by adversaries, resulting in watermark evasion. In this work, we propose Model‑\underlineagnostic Black‑box Backdoor W\underlineatermarking Framework (AGATE) to address stealthiness and robustness challenges in multimodal model copyright protection. Specifically, we propose an adversarial trigger generation method to generate stealthy adversarial triggers from ordinary dataset, providing visual fidelity while inducing semantic shifts. To alleviate the issue of anomaly detection among model outputs, we propose a post‑transform module to correct the model output by narrowing the distance between adversarial trigger image embedding and text embedding. Subsequently, a two‑phase watermark verification is proposed to judge whether the current model infringes by comparing the two results with and without the transform module. Consequently, we consistently outperform state‑of‑the‑art methods across five datasets in the downstream tasks of multimodal image‑text retrieval and image classification. Additionally, we validated the robustness of AGATE under two adversarial attack scenarios.

Abstract:
Diffusion‑based speech generation has achieved remarkable fidelity, increasing the risk of misuse and unauthorized redistribution. However, most existing generative speech watermarking methods are developed for GAN‑based pipelines, and watermarking for diffusion‑based speech generation remains comparatively underexplored. In addition, prior work often focuses on content‑level provenance, while support for model‑level and user‑level attribution is less mature. We propose TriniMark, a diffusion‑based generative speech watermarking framework that targets trinity‑level traceability, i.e., the ability to associate a generated speech sample with (i) the embedded watermark message (content‑level provenance), (ii) the source generative model (model‑level attribution), and (iii) the end user who requested generation (user‑level traceability). TriniMark uses a lightweight encoder to embed watermark bits into time‑domain speech features and reconstruct the waveform, and a temporal‑aware gated convolutional decoder for reliable bit recovery. We further introduce a waveform‑guided fine‑tuning strategy to transfer watermarking capability into a diffusion model. Finally, we incorporate variable‑watermark training so that a single trained model can embed different watermark messages at inference time, enabling scalable user‑level traceability. Experiments on speech datasets indicate that TriniMark maintains speech quality while improving robustness to common single and compound signal‑processing attacks, and it supports high‑capacity watermarking for large‑scale traceability.

Abstract:
Watermarking techniques are vital for protecting intellectual property and preventing fraudulent use of media. Most previous watermarking schemes designed for diffusion models embed a secret key in the initial noise. The resulting pattern is often considered hard to remove and forge into unrelated images. In this paper, we propose a black‑box adversarial attack without presuming access to the diffusion model weights. Our attack uses only a single watermarked example and is based on a simple observation: there is a many‑to‑one mapping between images and initial noises. There are regions in the clean image latent space pertaining to each watermark that get mapped to the same initial noise when inverted. Based on this intuition, we propose an adversarial attack to forge the watermark by introducing perturbations to the images such that we can enter the region of watermarked images. We show that we can also apply a similar approach for watermark removal by learning perturbations to exit this region. We report results on multiple watermarking schemes (Tree‑Ring, RingID, WIND, and Gaussian Shading) across two diffusion models (SDv1.4 and SDv2.0). Our results demonstrate the effectiveness of the attack and expose vulnerabilities in the watermarking methods, motivating future research on improving them.

Abstract:
The proliferation of generative image models has revolutionized AIGC creation while amplifying concerns over content provenance and manipulation forensics. Existing methods are typically either unable to localize tampering or restricted to specific generative settings, limiting their practical utility. We propose GenPTW, a General watermarking framework that unifies Provenance tracing and Tamper localization in latent space. It supports both in‑generation and post‑generation embedding without altering the generative process, and is plug‑and‑play compatible with latent diffusion models (LDMs) and visual autoregressive (VAR) models. To achieve precise provenance tracing and tamper localization, we embed the watermark using two complementary mechanisms: cross‑attention fusion aligned with latent semantics and spatial fusion providing explicit spatial guidance for edit sensitivity. A tamper‑aware extractor jointly conducts provenance tracing and tamper localization by leveraging watermark features together with high‑frequency features. Experiments show that GenPTW maintains high visual fidelity and strong robustness against diverse AIGC‑editing.

Abstract:
Recent advances in digital watermarking make use of deep neural networks for message embedding and extraction. They typically follow the ``encoder‑noise layer‑decoder''‑based architecture. By deliberately establishing a differentiable noise layer to simulate the distortion of the watermarked signal, they jointly train the deep encoder and decoder to fit the noise layer to guarantee robustness. As a result, they are usually weak against unknown distortions that are not used in their training pipeline. In this paper, we propose a novel watermarking framework to resist unknown distortions, namely Adversarial Shallow Watermarking (ASW). ASW utilizes only a shallow decoder that is randomly parameterized and designed to be insensitive to distortions for watermarking extraction. During the watermark embedding, ASW freezes the shallow decoder and adversarially optimizes a host image until its updated version (i.e., the watermarked image) stably triggers the shallow decoder to output the watermark message. During the watermark extraction, it accurately recovers the message from the watermarked image by leveraging the insensitive nature of the shallow decoder against arbitrary distortions. Our ASW is training‑free, encoder‑free, and noise layer‑free. Experiments indicate that the watermarked images created by ASW have strong robustness against various unknown distortions. Compared to the existing ``encoder‑noise layer‑decoder'' approaches, ASW achieves comparable results on known distortions and better robustness on unknown distortions.

Abstract:
Unauthorized screen capturing and dissemination pose severe security threats such as data leakage and information theft. Several studies propose robust watermarking methods to track the copyright of Screen‑Camera (SC) images, facilitating post‑hoc certification against infringement. These techniques typically employ heuristic mathematical modeling or supervised neural network fitting as the noise layer, to enhance watermarking robustness against SC. However, both strategies cannot fundamentally achieve an effective approximation of SC noise. Mathematical simulation suffers from biased approximations due to the incomplete decomposition of the noise and the absence of interdependence among the noise components. Supervised networks require paired data to train the noise‑fitting model, and it is difficult for the model to learn all the features of the noise. To address the above issues, we propose Simulation‑to‑Real (S2R). Specifically, an unsupervised noise layer employs unpaired data to learn the discrepancy between the modeled simulated noise distribution and the real‑world SC noise distribution, rather than directly learning the mapping from sharp images to real‑world images. Learning this transformation from simulation to reality is inherently simpler, as it primarily involves bridging the gap in noise distributions, instead of the complex task of reconstructing fine‑grained image details. Extensive experimental results validate the efficacy of the proposed method, demonstrating superior watermark robustness and generalization compared to state‑of‑the‑art methods.

Abstract:
Graph‑structured datasets are increasingly central to sensitive applications spanning social networks, biomedical research, and cryptographic systems. As organizations share these datasets with trusted parties for collaborative analysis, protecting against unauthorized redistribution becomes critical. Graph watermarking addresses this challenge by embedding detectable signatures that enable ownership verification and attribution of leaked data. However, despite advances in watermarking techniques, existing robustness evaluations remain limited to random edge perturbation attacks, overlooking more sophisticated adversaries who exploit community structure present in real‑world graphs. We introduce the first systematic evaluation of cluster‑aware attacks on graph watermarking schemes. We present a threat model in which adversaries leverage community detection algorithms to guide strategic edge modifications, targeting either intra‑cluster densification with inter‑cluster boundary removal, or intra‑cluster sparsification with inter‑cluster noise injection. Evaluating against the most comprehensively tested watermarking scheme, we demonstrate that cluster‑aware attacks outperform random perturbations across real‑world datasets and clustering algorithms. Our findings reveal that cluster‑aware attacks reduce attribution accuracy while introducing comparable structural distortion to random attacks, demonstrating superior attack efficiency. These results establish that current watermarking schemes, evaluated solely against random perturbations, remain vulnerable to structure‑aware adversarial behavior, highlighting the need for robust defenses that account for community‑exploiting adversaries in graph‑based privacy protection systems.

Abstract:
Watermarking has emerged as a critical technique for combating misinformation and protecting intellectual property in large language models (LLMs). A recent discovery, termed watermark radioactivity, reveals that watermarks embedded in teacher models can be inherited by student models through knowledge distillation. On the positive side, this inheritance allows for the detection of unauthorized knowledge distillation by identifying watermark traces in student models. However, the robustness of watermarks against scrubbing attacks and their unforgeability in the face of spoofing attacks under unauthorized knowledge distillation remain largely unexplored. Existing watermark attack methods either assume access to model internals or fail to simultaneously support both scrubbing and spoofing attacks. In this work, we propose Contrastive Decoding‑Guided Knowledge Distillation (CDG‑KD), a unified framework that enables bidirectional attacks under unauthorized knowledge distillation. Our approach employs contrastive decoding to extract corrupted or amplified watermark texts via comparing outputs from the student model and weakly watermarked references, followed by bidirectional distillation to train new student models capable of watermark removal and watermark forgery, respectively. Extensive experiments show that CDG‑KD effectively performs attacks while preserving the general performance of the distilled model. Our findings underscore critical need for developing watermarking schemes that are robust and unforgeable.

Abstract:
Watermarking technology is a method used to trace the usage of content generated by large language models. Sentence‑level watermarking aids in preserving the semantic integrity within individual sentences while maintaining greater robustness. However, many existing sentence‑level watermarking techniques depend on arbitrary segmentation or generation processes to embed watermarks, which can limit the availability of appropriate sentences. This limitation, in turn, compromises the quality of the generated response. To address the challenge of balancing high text quality with robust watermark detection, we propose CoheMark, an advanced sentence‑level watermarking technique that exploits the cohesive relationships between sentences for better logical fluency. The core methodology of CoheMark involves selecting sentences through trained fuzzy c‑means clustering and applying specific next sentence selection criteria. Experimental evaluations demonstrate that CoheMark achieves strong watermark strength while exerting minimal impact on text quality.

Abstract:
The accelerated advancement of speech generative models has given rise to security issues, including model infringement and unauthorized abuse of content. Although existing generative watermarking techniques have proposed corresponding solutions, most methods require substantial computational overhead and training costs. In addition, some methods have limitations in robustness when handling variable‑length inputs. To tackle these challenges, we propose \textscSOLIDO, a novel generative watermarking method that integrates parameter‑efficient fine‑tuning with speech watermarking through low‑rank adaptation (LoRA) for speech diffusion models. Concretely, the watermark encoder converts the watermark to align with the input of diffusion models. To achieve precise watermark extraction from variable‑length inputs, the watermark decoder based on depthwise separable convolution is designed for watermark recovery. To further enhance speech generation performance and watermark extraction capability, we propose a speech‑driven lightweight fine‑tuning strategy, which reduces computational overhead through LoRA. Comprehensive experiments demonstrate that the proposed method ensures high‑fidelity watermarked speech even at a large capacity of 2000 bps. Furthermore, against common individual and compound speech attacks, our SOLIDO achieves a maximum average extraction accuracy of 99.20% and 98.43%, respectively. It surpasses other state‑of‑the‑art methods by nearly 23% in resisting time‑stretching attacks.

Abstract:
Ethical concerns surrounding copyright protection and inappropriate content generation pose challenges for the practical implementation of diffusion models. One effective solution involves watermarking the generated images. Existing methods primarily focus on ensuring that watermark embedding does not degrade the model performance. However, they often overlook critical challenges in real‑world deployment scenarios, such as the complexity of watermark key management, user‑defined generation parameters, and the difficulty of verification by arbitrary third parties. To address this issue, we propose Gaussian Shading++, a diffusion model watermarking method tailored for real‑world deployment. We propose a double‑channel design that leverages pseudorandom error‑correcting codes to encode the random seed required for watermark pseudorandomization, achieving performance‑lossless watermarking under a fixed watermark key and overcoming key management challenges. Additionally, we model the distortions introduced during generation and inversion as an additive white Gaussian noise channel and employ a novel soft decision decoding strategy during extraction, ensuring strong robustness even when generation parameters vary. To enable third‑party verification, we incorporate public key signatures, which provide a certain level of resistance against forgery attacks even when model inversion capabilities are fully disclosed. Extensive experiments demonstrate that Gaussian Shading++ not only maintains performance losslessness but also outperforms existing methods in terms of robustness, making it a more practical solution for real‑world deployment.

Abstract:
The rapid advancement of generative models has led to the synthesis of real‑fake ambiguous voices. To erase the ambiguity, embedding watermarks into the frequency‑domain features of synthesized voices has become a common routine. However, the robustness achieved by choosing the frequency domain often comes at the expense of fine‑grained voice features, leading to a loss of fidelity. Maximizing the comprehensive learning of time‑domain features to enhance fidelity while maintaining robustness, we pioneer a \underlinetemporal‑aware \underlinerob\underlineust wat\underlineermarking (\emphTrue) method for protecting the speech and singing voice. For this purpose, the integrated content‑driven encoder is designed for watermarked waveform reconstruction, which is structurally lightweight. Additionally, the temporal‑aware gated convolutional network is meticulously designed to bit‑wise recover the watermark. Comprehensive experiments and comparisons with existing state‑of‑the‑art methods have demonstrated the superior fidelity and vigorous robustness of the proposed True achieving an average PESQ score of 4.63.

Abstract:
Modern identity verification systems increasingly rely on facial images embedded in biometric documents such as electronic passports. To ensure global interoperability and security, these images must comply with strict standards defined by the International Civil Aviation Organization (ICAO), which specify acquisition, quality, and format requirements. However, once issued, these images may undergo unintentional degradations (e.g., compression, resizing) or malicious manipulations (e.g., morphing) and deceive facial recognition systems. In this study, we explore fragile watermarking, based on deep steganographic embedding as a proactive mechanism to certify the authenticity of ICAO‑compliant facial images. By embedding a hidden image within the official photo at the time of issuance, we establish an integrity marker that becomes sensitive to any post‑issuance modification. We assess how a range of image manipulations affects the recovered hidden image and show that degradation artifacts can serve as robust forensic cues. Furthermore, we propose a classification framework that analyzes the revealed content to detect and categorize the type of manipulation applied. Our experiments demonstrate high detection accuracy, including cross‑method scenarios with multiple deep steganography‑based models. These findings support the viability of fragile watermarking via steganographic embedding as a valuable tool for biometric document integrity verification.

Abstract:
As generative AI models produce increasingly realistic output, both academia and industry are focusing on the ability to detect whether an output was generated by an AI model or not. Many of the research efforts and policy discourse are centered around robust watermarking of AI outputs. While plenty of progress has been made, all watermarking and AI detection techniques face severe limitations. In this position paper, we argue that we are adopting the wrong approach, and should instead focus on watermarking via cryptographic signatures trustworthy content rather than AI generated ones. For audio‑visual content, in particular, all real content is grounded in the physical world and captured via hardware sensors. This presents a unique opportunity to watermark at the hardware layer, and we lay out a socio‑technical framework and draw parallels with HTTPS certification and Blu‑Ray verification protocols. While acknowledging implementation challenges, we contend that hardware‑based authentication offers a more tractable path forward, particularly from a policy perspective. As generative models approach perceptual indistinguishability, the research community should be wary of being overly optimistic with AI watermarking, and we argue that AI watermarking research efforts are better spent in the text and LLM space, which are ultimately not traceable to a physical sensor.

Abstract:
We present MaskWM, a simple, efficient, and flexible framework for image watermarking. MaskWM has two variants: (1) MaskWM‑D, which supports global watermark embedding, watermark localization, and local watermark extraction for applications such as tamper detection; (2) MaskWM‑ED, which focuses on local watermark embedding and extraction, offering enhanced robustness in small regions to support fine‑grined image protection. MaskWM‑D builds on the classical encoder‑distortion layer‑decoder training paradigm. In MaskWM‑D, we introduce a simple masking mechanism during the decoding stage that enables both global and local watermark extraction. During training, the decoder is guided by various types of masks applied to watermarked images before extraction, helping it learn to localize watermarks and extract them from the corresponding local areas. MaskWM‑ED extends this design by incorporating the mask into the encoding stage as well, guiding the encoder to embed the watermark in designated local regions, which improves robustness under regional attacks. Extensive experiments show that MaskWM achieves state‑of‑the‑art performance in global and local watermark extraction, watermark localization, and multi‑watermark embedding. It outperforms all existing baselines, including the recent leading model WAM for local watermarking, while preserving high visual quality of the watermarked images. In addition, MaskWM is highly efficient and adaptable. It requires only 20 hours of training on a single A6000 GPU, achieving 15x computational efficiency compared to WAM. By simply adjusting the distortion layer, MaskWM can be quickly fine‑tuned to meet varying robustness requirements.

Abstract:
The ability to embed watermarks in images is a fundamental problem of interest for computer vision, and is exacerbated by the rapid rise of generated imagery in recent times. Current state‑of‑the‑art techniques suffer from computational and statistical challenges such as the slow execution speed for practical deployments. In addition, other works trade off fast watermarking speeds but suffer greatly in their robustness or perceptual quality. In this work, we propose WaterFlow (WF), a fast and extremely robust approach for high fidelity visual watermarking based on a learned latent‑dependent watermark. Our approach utilizes a pretrained latent diffusion model to encode an arbitrary image into a latent space and produces a learned watermark that is then planted into the Fourier Domain of the latent. The transformation is specified via invertible flow layers that enhance the expressivity of the latent space of the pre‑trained model to better preserve image quality while permitting robust and tractable detection. Most notably, WaterFlow demonstrates state‑of‑the‑art performance on general robustness and is the first method capable of effectively defending against difficult combination attacks. We validate our findings on three widely used real and generated datasets: MS‑COCO, DiffusionDB, and WikiArt.

Abstract:
Recent advancements in Large Language Models (LLMs) raised concerns over potential misuse, such as for spreading misinformation. In response two counter measures emerged: machine learning‑based detectors that predict if text is synthetic, and LLM watermarking, which subtly marks generated text for identification and attribution. Meanwhile, humans are known to adjust language to their conversational partners both syntactically and lexically. By implication, it is possible that humans or unwatermarked LLMs could unintentionally mimic properties of LLM generated text, making counter measures unreliable. In this work we investigate the extent to which such conversational adaptation happens. We call the concept mimicry and demonstrate that both humans and LLMs end up mimicking, including the watermarking signal even in seemingly improbable settings. This challenges current academic assumptions and suggests that for long‑term watermarking to be reliable, the likelihood of false positives needs to be significantly lower, while longer word sequences should be used for seeding watermarking mechanisms.

Abstract:
The rapid development of Large Language Models (LLMs) has intensified concerns about content traceability and potential misuse. Existing watermarking schemes for sampled text often face trade‑offs between maintaining text quality and ensuring robust detection against various attacks. To address these issues, we propose a novel watermarking scheme that improves both detectability and text quality by introducing a cumulative watermark entropy threshold. Our approach is compatible with and generalizes existing sampling functions, enhancing adaptability. Experimental results across multiple LLMs show that our scheme significantly outperforms existing methods, achieving over 80% improvements on widely‑used datasets, e.g., MATH and GSM8K, while maintaining high detection accuracy.

Abstract:
With the growing demand for protecting the intellectual property (IP) of text‑to‑image diffusion models, we propose PCDiff ‑‑ a proactive access control framework that redefines model authorization by regulating generation quality. At its core, PCDIFF integrates a trainable fuser module and hierarchical authentication layers into the decoder architecture, ensuring that only users with valid encrypted credentials can generate high‑fidelity images. In the absence of valid keys, the system deliberately degrades output quality, effectively preventing unauthorized exploitation.Importantly, while the primary mechanism enforces active access control through architectural intervention, its decoupled design retains compatibility with existing watermarking techniques. This satisfies the need of model owners to actively control model ownership while preserving the traceability capabilities provided by traditional watermarking approaches.Extensive experimental evaluations confirm a strong dependency between credential verification and image quality across various attack scenarios. Moreover, when combined with typical post‑processing operations, PCDIFF demonstrates powerful performance alongside conventional watermarking methods. This work shifts the paradigm from passive detection to proactive enforcement of authorization, laying the groundwork for IP management of diffusion models.

Abstract:
As deepfake technologies continue to advance, passive detection methods struggle to generalize with various forgery manipulations and datasets. Proactive defense techniques have been actively studied with the primary aim of preventing deepfake operation effectively working. In this paper, we aim to bridge the gap between passive detection and proactive defense, and seek to solve the detection problem utilizing a proactive methodology. Inspired by several watermarking‑based forensic methods, we explore a novel detection framework based on the concept of ``hiding a learnable face within a face''. Specifically, relying on a semi‑fragile invertible steganography network, a secret template image is embedded into a host image imperceptibly, acting as an indicator monitoring for any malicious image forgery when being restored by the inverse steganography process. Instead of being manually specified, the secret template is optimized during training to resemble a neutral facial appearance, just like a ``big brother'' hidden in the image to be protected. By incorporating a self‑blending mechanism and robustness learning strategy with a simulative transmission channel, a robust detector is built to accurately distinguish if the steganographic image is maliciously tampered or benignly processed. Finally, extensive experiments conducted on multiple datasets demonstrate the superiority of the proposed approach over competing passive and proactive detection methods.

Abstract:
Watermarking for diffusion images has drawn considerable attention due to the widespread use of text‑to‑image diffusion models and the increasing need for their copyright protection. Recently, advanced watermarking techniques, such as Tree Ring, integrate watermarks by embedding traceable patterns (e.g., Rings) into the latent distribution during the diffusion process. Such methods disrupt the original semantics of the generated images due to the inevitable distribution shift caused by the watermarks, thereby limiting their practicality, particularly in digital art creation. In this work, we present Semantic‑aware Pivotal Tuning Watermarks (PT‑Mark), a novel invisible watermarking method that preserves both the semantics of diffusion images and the traceability of the watermark. PT‑Mark preserves the original semantics of the watermarked image by gradually aligning the generation trajectory with the original (pivotal) trajectory while maintaining the traceable watermarks during whole diffusion denoising process. To achieve this, we first compute the salient regions of the watermark at each diffusion denoising step as a spatial prior to identify areas that can be aligned without disrupting the watermark pattern. Guided by the region, we then introduce an additional pivotal tuning branch that optimizes the text embedding to align the semantics while preserving the watermarks. Extensive evaluations demonstrate that PT‑Mark can preserve the original semantics of the diffusion images while integrating robust watermarks. It achieves a 10% improvement in the performance of semantic preservation (i.e., SSIM, PSNR, and LPIPS) compared to state‑of‑the‑art watermarking methods, while also showing comparable robustness against real‑world perturbations and four times greater efficiency.

Abstract:
In the audio modality, state‑of‑the‑art watermarking methods leverage deep neural networks to allow the embedding of human‑imperceptible signatures in generated audio. The ideal is to embed signatures that can be detected with high accuracy when the watermarked audio is altered via compression, filtering, or other transformations. Existing audio watermarking techniques operate in a post‑hoc manner, manipulating "low‑level" features of audio recordings after generation (e.g. through the addition of a low‑magnitude watermark signal). We show that this post‑hoc formulation makes existing audio watermarks vulnerable to transformation‑based removal attacks. Focusing on speech audio, we (1) unify and extend existing evaluations of the effect of audio transformations on watermark detectability, and (2) demonstrate that state‑of‑the‑art post‑hoc audio watermarks can be removed with no knowledge of the watermarking scheme and minimal degradation in audio quality.

Abstract:
This research introduces an FPGA‑based hardware accelerator to optimize the Singular Value Decomposition (SVD) and Fast Fourier transform (FFT) operations in AI models. The proposed design aims to improve processing speed and reduce computational latency. Through experiments, we validate the performance benefits of the hardware accelerator and show how well it handles FFT and SVD operations. With its strong security and durability, the accelerator design achieves significant speedups over software implementations, thanks to its modules for data flow control, watermark embedding, FFT, and SVD.

Abstract:
Proactive Deepfake detection via robust watermarks has seen interest ever since passive Deepfake detectors encountered challenges in identifying high‑quality synthetic images. However, while demonstrating reasonable detection performance, they lack localization functionality and explainability in detection results. Additionally, the unstable robustness of watermarks can significantly affect the detection performance. In this study, we propose novel fractal watermarks for proactive Deepfake detection and localization, namely FractalForensics. Benefiting from the characteristics of fractals, we devise a parameter‑driven watermark generation pipeline that derives fractal‑based watermarks and performs one‑way encryption of the selected parameters. Subsequently, we propose a semi‑fragile watermarking framework for watermark embedding and recovery, trained to be robust against benign image processing operations and fragile when facing Deepfake manipulations in a black‑box setting. Moreover, we introduce an entry‑to‑patch strategy that implicitly embeds the watermark matrix entries into image patches at corresponding positions, achieving localization of Deepfake manipulations. Extensive experiments demonstrate satisfactory robustness and fragility of our approach against common image processing operations and Deepfake manipulations, outperforming state‑of‑the‑art semi‑fragile watermarking algorithms and passive detectors for Deepfake detection. Furthermore, by highlighting the areas manipulated, our method provides explainability for the proactive Deepfake detection results.

Abstract:
The indistinguishability of AI‑generated content from human text raises challenges in transparency and accountability. While several methods exist to watermark models behind APIs, embedding watermark strategies directly into model weights that are later reflected in the outputs of the model is challenging. In this study we propose a strategy to finetune a pair of low‑rank adapters of a model, one serving as the text‑generating model, and the other as the detector, so that a subtle watermark is embedded into the text generated by the first model and simultaneously optimized for detectability by the second. In this way, the watermarking strategy is fully learned end‑to‑end. This process imposes an optimization challenge, as balancing watermark robustness, naturalness, and task performance requires trade‑offs. We discuss strategies on how to optimize this min‑max objective and present results showing the effect of this modification to instruction finetuning.

Abstract:
The increasing deployment of intelligent agents in digital ecosystems, such as social media platforms, has raised significant concerns about traceability and accountability, particularly in cybersecurity and digital content protection. Traditional large language model (LLM) watermarking techniques, which rely on token‑level manipulations, are ill‑suited for agents due to the challenges of behavior tokenization and information loss during behavior‑to‑action translation. To address these issues, we propose Agent Guide, a novel behavioral watermarking framework that embeds watermarks by guiding the agent's high‑level decisions (behavior) through probability biases, while preserving the naturalness of specific executions (action). Our approach decouples agent behavior into two levels, behavior (e.g., choosing to bookmark) and action (e.g., bookmarking with specific tags), and applies watermark‑guided biases to the behavior probability distribution. We employ a z‑statistic‑based statistical analysis to detect the watermark, ensuring reliable extraction over multiple rounds. Experiments in a social media scenario with diverse agent profiles demonstrate that Agent Guide achieves effective watermark detection with a low false positive rate. Our framework provides a practical and robust solution for agent watermarking, with applications in identifying malicious agents and protecting proprietary agent systems.

Abstract:
Neural speech generation (NSG) has rapidly advanced as a key component of artificial intelligence‑generated content, enabling the generation of high‑quality, highly realistic speech for diverse applications. This development increases the risk of technique misuse and threatens social security. Audio watermarking can embed imperceptible marks into generated audio, providing a promising approach for secure NSG usage. However, current audio watermarking methods are mainly applied at the audio‑level or feature‑level, which are not suitable for open‑sourced scenarios where source codes and model weights are released. To address this limitation, we propose a Plug‑and‑play Parameter‑level WaterMarking (P2Mark) method for NSG. Specifically, we embed watermarks into the released model weights, offering a reliable solution for proactively tracing and protecting model copyrights in open‑source scenarios. During training, we introduce a lightweight watermark adapter into the pre‑trained model, allowing watermark information to be merged into the model via this adapter. This design ensures both the flexibility to modify the watermark before model release and the security of embedding the watermark within model parameters after model release. Meanwhile, we propose a gradient orthogonal projection optimization strategy to ensure the quality of the generated audio and the accuracy of watermark preservation. Experimental results on two mainstream waveform decoders in NSG (i.e., vocoder and codec) demonstrate that P2Mark achieves comparable performance to state‑of‑the‑art audio watermarking methods that are not applicable to open‑source white‑box protection scenarios, in terms of watermark extraction accuracy, watermark imperceptibility, and robustness.

Abstract:
Visible watermark removal which involves watermark cleaning and background content restoration is pivotal to evaluate the resilience of watermarks. Existing deep neural network (DNN)‑based models still struggle with large‑area watermarks and are overly dependent on the quality of watermark mask prediction. To overcome these challenges, we introduce a novel feature adapting framework that leverages the representation modeling capacity of a pre‑trained image inpainting model. Our approach bridges the knowledge gap between image inpainting and watermark removal by fusing information of the residual background content beneath watermarks into the inpainting backbone model. We establish a dual‑branch system to capture and embed features from the residual background content, which are merged into intermediate features of the inpainting backbone model via gated feature fusion modules. Moreover, for relieving the dependence on high‑quality watermark masks, we introduce a new training paradigm by utilizing coarse watermark masks to guide the inference process. This contributes to a visible image removal model which is insensitive to the quality of watermark mask during testing. Extensive experiments on both a large‑scale synthesized dataset and a real‑world dataset demonstrate that our approach significantly outperforms existing state‑of‑the‑art methods. The source code is available in the supplementary materials.

Abstract:
The rapid advancement of generative artificial intelligence (GenAI) has revolutionized content creation across text, visual, and audio domains, simultaneously introducing significant risks such as misinformation, identity fraud, and content manipulation. This paper presents a practical survey of watermarking techniques designed to proactively detect GenAI content. We develop a structured taxonomy categorizing watermarking methods for text, visual, and audio modalities and critically evaluate existing approaches based on their effectiveness, robustness, and practicality. Additionally, we identify key challenges, including resistance to adversarial attacks, lack of standardization across different content types, and ethical considerations related to privacy and content ownership. Finally, we discuss potential future research directions aimed at enhancing watermarking strategies to ensure content authenticity and trustworthiness. This survey serves as a foundational resource for researchers and practitioners seeking to understand and advance watermarking techniques for AI‑generated content detection.

Abstract:
Advances in AI‑generated content have led to wide adoption of large language models, diffusion‑based visual generators, and synthetic audio tools. However, these developments raise critical concerns about misinformation, copyright infringement, security threats, and the erosion of public trust. In this paper, we explore an extensive range of methods designed to detect and mitigate AI‑generated textual, visual, and audio content. We begin by discussing motivations and potential impacts associated with AI‑based content generation, including real‑world risks and ethical dilemmas. We then outline detection techniques spanning observation‑based strategies, linguistic and statistical analysis, model‑based pipelines, watermarking and fingerprinting, as well as emergent ensemble approaches. We also present new perspectives on robustness, adaptation to rapidly improving generative architectures, and the critical role of human‑in‑the‑loop verification. By surveying state‑of‑the‑art research and highlighting case studies in academic, journalistic, legal, and industrial contexts, this paper aims to inform robust solutions and policymaking. We conclude by discussing open challenges, including adversarial transformations, domain generalization, and ethical concerns, thereby offering a holistic guide for researchers, practitioners, and regulators to preserve content authenticity in the face of increasingly sophisticated AI‑generated media.

Abstract:
Current image watermarking technologies are predominantly categorized into text watermarking techniques and image steganography; however, few methods can simultaneously handle text and image‑based watermark data, which limits their applicability in complex digital environments. This paper introduces an innovative multi‑modal watermarking approach, drawing on the concept of vector discretization in encoder‑based vector quantization. By constructing adjacency matrices, the proposed method enables the transformation of text watermarks into robust image‑based representations, providing a novel multi‑modal watermarking paradigm for image generation applications. Additionally, this study presents a newly designed image restoration module to mitigate image degradation caused by transmission losses and various noise interferences, thereby ensuring the reliability and integrity of the watermark. Experimental results validate the robustness of the method under multiple noise attacks, providing a secure, scalable, and efficient solution for digital image copyright protection.

Abstract:
We present MultiNeRF, a 3D watermarking method that embeds multiple uniquely keyed watermarks within images rendered by a single Neural Radiance Field (NeRF) model, whilst maintaining high visual quality. Our approach extends the TensoRF NeRF model by incorporating a dedicated watermark grid alongside the existing geometry and appearance grids. This extension ensures higher watermark capacity without entangling watermark signals with scene content. We propose a FiLM‑based conditional modulation mechanism that dynamically activates watermarks based on input identifiers, allowing multiple independent watermarks to be embedded and extracted without requiring model retraining. MultiNeRF is validated on the NeRF‑Synthetic and LLFF datasets, with statistically significant improvements in robust capacity without compromising rendering quality. By generalizing single‑watermark NeRF methods into a flexible multi‑watermarking framework, MultiNeRF provides a scalable solution for 3D content. attribution.

Abstract:
As the interplay between human‑generated and synthetic data evolves, new challenges arise in scientific discovery concerning the integrity of the data and the stability of the models. In this work, we examine the role of synthetic data as opposed to that of real experimental data for scientific research. Our analyses indicate that nearly three‑quarters of experimental datasets available on open‑access platforms have relatively low adoption rates, opening new opportunities to enhance their discoverability and usability by automated methods. Additionally, we observe an increasing difficulty in distinguishing synthetic from real experimental data. We propose supplementing ongoing efforts in automating synthetic data detection by increasing the focus on watermarking real experimental data, thereby strengthening data traceability and integrity. Our estimates suggest that watermarking even less than half of the real world data generated annually could help sustain model robustness, while promoting a balanced integration of synthetic and human‑generated content.

Abstract:
Visual Language Models (VLMs) have become foundational models for document understanding tasks, widely used in the processing of complex multimodal documents across domains such as finance, law, and academia. However, documents often contain noise‑like information, such as watermarks, which inevitably leads us to inquire: \emphDo watermarks degrade the performance of VLMs in document understanding? To address this, we propose a novel evaluation framework to investigate the effect of visible watermarks on VLMs performance. We takes into account various factors, including different types of document data, the positions of watermarks within documents and variations in watermark content. Our experimental results reveal that VLMs performance can be significantly compromised by watermarks, with performance drop rates reaching up to 36%. We discover that \emphscattered watermarks cause stronger interference than centralized ones, and that \emphsemantic contents in watermarks creates greater disruption than simple visual occlusion. Through attention mechanism analysis and embedding similarity examination, we find that the performance drops are mainly attributed to that watermarks 1) force widespread attention redistribution, and 2) alter semantic representation in the embedding space. Our research not only highlights significant challenges in deploying VLMs for document understanding, but also provides insights towards developing robust inference mechanisms on watermarked documents.

Abstract:
Efficient knowledge injection methods for Large Language Models (LLMs), such as In‑Context Learning, knowledge editing, and efficient parameter fine‑tuning, significantly enhance model utility on downstream tasks. However, they also pose substantial risks of unauthorized imitation and compromised data provenance for high‑value unstructured data assets like creative works. Current copyright protection methods for creative works predominantly focus on visual arts, leaving a critical and unaddressed data engineering challenge in the safeguarding of creative writing. In this paper, we propose WIND (Watermarking via Implicit and Non‑disruptive Disentanglement), a novel zero‑watermarking, verifiable and implicit scheme that safeguards creative writing databases by providing verifiable copyright protection. Specifically, we decompose creative essence into five key elements, which are extracted utilizing LLMs through a designed instance delimitation mechanism and consolidated into condensed‑lists. These lists enable WIND to convert core copyright attributes into verifiable watermarks via implicit encoding within a disentanglement creative space, where 'disentanglement' refers to the separation of creative‑specific and creative‑irrelevant features. This approach, utilizing implicit encoding, avoids distorting fragile textual content. Extensive experiments demonstrate that WIND effectively verifies creative writing copyright ownership against AI imitation, achieving F1 scores above 98% and maintaining robust performance under stringent low false‑positive rates where existing state‑of‑the‑art text watermarking methods struggle.

Abstract:
On‑device deep learning (DL) has rapidly gained adoption in mobile apps, offering the benefits of offline model inference and user privacy preservation over cloud‑based approaches. However, it inevitably stores models on user devices, introducing new vulnerabilities, particularly model‑stealing attacks and intellectual property infringement. While system‑level protections like Trusted Execution Environments (TEEs) provide a robust solution, practical challenges remain in achieving scalable on‑device DL model protection, including complexities in supporting third‑party models and limited adoption in current mobile solutions. Advancements in TEE‑enabled hardware, such as NVIDIA's GPU‑based TEEs, may address these obstacles in the future. Currently, watermarking serves as a common defense against model theft but also faces challenges here as many mobile app developers lack corresponding machine learning expertise and the inherent read‑only and inference‑only nature of on‑device DL models prevents third parties like app stores from implementing existing watermarking techniques in post‑deployment models. To protect the intellectual property of on‑device DL models, in this paper, we propose THEMIS, an automatic tool that lifts the read‑only restriction of on‑device DL models by reconstructing their writable counterparts and leverages the untrainable nature of on‑device DL models to solve watermark parameters and protect the model owner's intellectual property. Extensive experimental results across various datasets and model structures show the superiority of THEMIS in terms of different metrics. Further, an empirical investigation of 403 real‑world DL mobile apps from Google Play is performed with a success rate of 81.14%, showing the practicality of THEMIS.

Abstract:
Image generation algorithms are increasingly integral to diverse aspects of human society, driven by their practical applications. However, insufficient oversight in artificial Intelligence generated content (AIGC) can facilitate the spread of malicious content and increase the risk of copyright infringement. Among the diverse range of image generation models, the Latent Diffusion Model (LDM) is currently the most widely used, dominating the majority of the Text‑to‑Image model market. Currently, most attribution methods for LDMs rely on directly embedding watermarks into the generated images or their intermediate noise, a practice that compromises both the quality and the robustness of the generated content. To address these limitations, we introduce TraceMark‑LDM, an novel algorithm that integrates watermarking to attribute generated images while guaranteeing non‑destructive performance. Unlike current methods, TraceMark‑LDM leverages watermarks as guidance to rearrange random variables sampled from a Gaussian distribution. To mitigate potential deviations caused by inversion errors, the small absolute elements are grouped and rearranged. Additionally, we fine‑tune the LDM encoder to enhance the robustness of the watermark. Experimental results show that images synthesized using TraceMark‑LDM exhibit superior quality and attribution accuracy compared to state‑of‑the‑art (SOTA) techniques. Notably, TraceMark‑LDM demonstrates exceptional robustness against various common attack methods, consistently outperforming SOTA methods.

Abstract:
Invisible Image Watermarking is crucial for ensuring content provenance and accountability in generative AI. While Gen‑AI providers are increasingly integrating invisible watermarking systems, the robustness of these schemes against forgery attacks remains poorly characterized. This is critical, as forging traceable watermarks onto illicit content leads to false attribution, potentially harming the reputation and legal standing of Gen‑AI service providers who are not responsible for the content. In this work, we propose WMCopier, an effective watermark forgery attack that operates without requiring any prior knowledge of or access to the target watermarking algorithm. Our approach first models the target watermark distribution using an unconditional diffusion model, and then seamlessly embeds the target watermark into a non‑watermarked image via a shallow inversion process. We also incorporate an iterative optimization procedure that refines the reconstructed image to further trade off the fidelity and forgery efficiency. Experimental results demonstrate that WMCopier effectively deceives both open‑source and closed‑source watermark systems (e.g., Amazon's system), achieving a significantly higher success rate than existing methods. Additionally, we evaluate the robustness of forged samples and discuss the potential defenses against our attack.

Abstract:
In the Generative AI era, safeguarding 3D models has become increasingly urgent. While invisible watermarking is well‑established for 2D images with encoder‑decoder frameworks, generalizable and robust solutions for 3D remain elusive. The main difficulty arises from the renderer between the 3D encoder and 2D decoder, which disrupts direct gradient flow and complicates training. Existing 3D methods typically rely on per‑scene iterative optimization, resulting in time inefficiency and limited generalization. In this work, we propose a single‑pass watermarking approach for 3D Gaussian Splatting (3DGS), a well‑known yet underexplored representation for watermarking. We identify two major challenges: (1) ensuring effective training generalized across diverse 3D models, and (2) reliably extracting watermarks from free‑view renderings, even under distortions. Our framework, named GS‑Marker, incorporates a 3D encoder to embed messages, distortion layers to enhance resilience against various distortions, and a 2D decoder to extract watermarks from renderings. A key innovation is the Adaptive Marker Control mechanism that adaptively perturbs the initially optimized 3DGS, escaping local minima and improving both training stability and convergence. Extensive experiments show that GS‑Marker outperforms per‑scene training approaches in terms of decoding accuracy and model fidelity, while also significantly reducing computation time.

Abstract:
AI‑generated images have become so good in recent years that individuals often cannot distinguish them any more from "real" images. This development, combined with the rapid spread of AI‑generated content online, creates a series of societal risks. Watermarking, a technique that involves embedding information within images and other content to indicate their AI‑generated nature, has emerged as a primary mechanism to address the risks posed by AI‑generated content. Indeed, watermarking and AI labelling measures are now becoming a legal requirement in many jurisdictions, including under the 2024 European Union AI Act. Despite the widespread use of AI image generation systems, the practical implications and the current status of implementation of these measures remain largely unexamined. The present paper therefore provides both an empirical and a legal analysis of these measures. In our legal analysis, we identify four categories of generative AI deployment scenarios and outline how the legal obligations could apply in each category. In our empirical analysis, we find that only a minority number of AI image generators currently implement adequate watermarking (38%) and deep fake labelling (18%) practices. In response, we suggest a range of avenues of how the implementation of these legally mandated techniques can be improved, and publicly share our tooling for the detection of watermarks in images.

Abstract:
Graph Neural Networks (GNNs) have gained traction in Graph‑based Machine Learning as a Service (GMLaaS) platforms, yet they remain vulnerable to graph‑based model extraction attacks (MEAs), where adversaries reconstruct surrogate models by querying the victim model. Existing defense mechanisms, such as watermarking and fingerprinting, suffer from poor real‑time performance, susceptibility to evasion, or reliance on post‑attack verification, making them inadequate for handling the dynamic characteristics of graph‑based MEA variants. To address these limitations, we propose ATOM, a novel real‑time MEA detection framework tailored for GNNs. ATOM integrates sequential modeling and reinforcement learning to dynamically detect evolving attack patterns, while leveraging k‑core embedding to capture the structural properties, enhancing detection precision. Furthermore, we provide theoretical analysis to characterize query behaviors and optimize detection strategies. Extensive experiments on multiple real‑world datasets demonstrate that ATOM outperforms existing approaches in detection performance, maintaining stable across different time steps, thereby offering a more effective defense mechanism for GMLaaS environments.

Abstract:
The integrity of peer review is fundamental to scientific progress, but the rise of large language models (LLMs) has introduced concerns that some reviewers may rely on these tools to generate reviews rather than writing them independently. Although some venues have banned LLM‑assisted reviewing, enforcement remains difficult as existing detection tools cannot reliably distinguish between fully generated reviews and those merely polished with AI assistance. In this work, we address the challenge of detecting LLM‑generated reviews. We consider the approach of performing indirect prompt injection via the paper's PDF, prompting the LLM to embed a covert watermark in the generated review, and subsequently testing for presence of the watermark in the review. We identify and address several pitfalls in naïve implementations of this approach. Our primary contribution is a rigorous watermarking and detection framework that offers strong statistical guarantees. Specifically, we introduce watermarking schemes and hypothesis tests that control the family‑wise error rate across multiple reviews, achieving higher statistical power than standard corrections such as Bonferroni, while making no assumptions about the nature of human‑written reviews. We explore multiple indirect prompt injection strategies ‑‑ including font‑based embedding and obfuscated prompts ‑‑ and evaluate their effectiveness under various reviewer defense scenarios. Our experiments find high success rates in watermark embedding across various LLMs. We also empirically find that our approach is resilient to common reviewer defenses, and that the bounds on error rates in our statistical tests hold in practice. In contrast, we find that Bonferroni‑style corrections are too conservative to be useful in this setting.

Abstract:
Ensuring robustness in image watermarking is crucial for and maintaining content integrity under diverse transformations. Recent self‑supervised learning (SSL) approaches, such as DINO, have been leveraged for watermarking but primarily focus on general feature representation rather than explicitly learning invariant features. In this work, we propose a novel text‑guided invariant feature learning framework for robust image watermarking. Our approach leverages CLIP's multimodal capabilities, using text embeddings as stable semantic anchors to enforce feature invariance under distortions. We evaluate the proposed method across multiple datasets, demonstrating superior robustness against various image transformations. Compared to state‑of‑the‑art SSL methods, our model achieves higher cosine similarity in feature consistency tests and outperforms existing watermarking schemes in extraction accuracy under severe distortions. These results highlight the efficacy of our method in learning invariant representations tailored for robust deep learning‑based watermarking.

Abstract:
The paper presents a novel technique for encoding dual messages within standard Quick Response (QR) codes through precise half‑pixel module splitting. This work challenges fundamental assumptions about deterministic decoding in the ISO/IEC 18004:2015 standard while maintaining complete compatibility with existing QR infrastructure. The proposed two‑dimensional barcode attack enables angle‑dependent message selection while maintaining compatibility with unmodified QR readers and the 100 million US mobile users who use their phone's built‑in scanners. Unlike previous approaches that rely on nested codes, watermarking, or error correction exploitation, our method achieves true one‑to‑many mapping by manipulating the physical sampling process built into the QR standard. By preserving critical function patterns while bifurcating data modules, we create automated codes that produce different but valid readings based on camera viewing angle. Experimental results demonstrate successful implementation across multiple use cases, including simple message text pairs, complex URLs (nsa.gov/nasa.gov), and security test patterns for malware and spam detectors (EICAR/GTUBE). Our technique achieves reliable dual‑message decoding using standard QR readers at module scales of 9‑11 pixels, with successful angle‑dependent reading demonstrated across vertical, horizontal, and diagonal orientations. The method's success suggests potential applications beyond QR code phishing ('quishing') including two‑factor authentication, anti‑counterfeiting, and information density optimization. The half‑pixel technique may offer future avenues for similar implementations in other 2D barcode formats such as Data Matrix and Aztec Code.

Abstract:
As 3D Gaussian Splatting (3DGS) is increasingly adopted in various academic and commercial applications due to its high‑quality and real‑time rendering capabilities, the need for copyright protection is growing. At the same time, its large model size requires efficient compression for storage and transmission. However, compression techniques, especially quantization‑based methods, degrade the integrity of existing 3DGS watermarking methods, thus creating the need for a novel methodology that is robust against compression. To ensure reliable watermark detection under compression, we propose a compression‑tolerant 3DGS watermarking method that preserves watermark integrity and rendering quality. Our approach utilizes an anchor‑based 3DGS, embedding the watermark into anchor attributes, particularly the anchor feature, to enhance security and rendering quality. We also propose a quantization distortion layer that injects quantization noise during training, preserving the watermark after quantization‑based compression. Moreover, we employ a frequency‑aware anchor growing strategy that enhances rendering quality by effectively identifying Gaussians in high‑frequency regions, and an HSV loss to mitigate color artifacts for further rendering quality improvement. Extensive experiments demonstrate that our proposed method preserves the watermark even under compression and maintains high rendering quality.

Abstract:
Generative models have rapidly evolved to generate realistic outputs. However, their synthetic outputs increasingly challenge the clear distinction between natural and AI‑generated content, necessitating robust watermarking techniques. Watermarks are typically expected to preserve the integrity of the target image, withstand removal attempts, and prevent unauthorized replication onto unrelated images. To address this need, recent methods embed persistent watermarks into images produced by diffusion models using the initial noise. Yet, to do so, they either distort the distribution of generated images or rely on searching through a long dictionary of used keys for detection. In this paper, we propose a novel watermarking method that embeds semantic information about the generated image directly into the watermark, enabling a distortion‑free watermark that can be verified without requiring a database of key patterns. Instead, the key pattern can be inferred from the semantic embedding of the image using locality‑sensitive hashing. Furthermore, conditioning the watermark detection on the original image content improves robustness against forgery attacks. To demonstrate that, we consider two largely overlooked attack strategies: (i) an attacker extracting the initial noise and generating a novel image with the same pattern; (ii) an attacker inserting an unrelated (potentially harmful) object into a watermarked image, possibly while preserving the watermark. We empirically validate our method's increased robustness to these attacks. Taken together, our results suggest that content‑aware watermarks can mitigate risks arising from image‑generative models.

Abstract:
Invisible watermarking of AI‑generated images can help with copyright protection, enabling detection and identification of AI‑generated media. In this work, we present a novel approach to watermark images of T2I Latent Diffusion Models (LDMs). By only fine‑tuning text token embeddings W_, we enable watermarking in selected objects or parts of the image, offering greater flexibility compared to traditional full‑image watermarking. Our method leverages the text encoder's compatibility across various LDMs, allowing plug‑and‑play integration for different LDMs. Moreover, introducing the watermark early in the encoding stage improves robustness to adversarial perturbations in later stages of the pipeline. Our approach achieves 99% bit accuracy (48 bits) with a 10^5 × reduction in model parameters, enabling efficient watermarking.

Abstract:
Semantic watermarking methods enable the direct integration of watermarks into the generation process of latent diffusion models by only modifying the initial latent noise. One line of approaches building on Gaussian Shading relies on cryptographic primitives to steer the sampling process of the latent noise. However, we identify several issues in the usage of cryptographic techniques in Gaussian Shading, particularly in its proof of lossless performance and key management, causing ambiguity in follow‑up works, too. In this work, we therefore revisit the cryptographic primitives for semantic watermarking. We introduce a novel, general proof of lossless performance based on IND\‑CPA security for semantic watermarks. We then discuss the configuration of the cryptographic primitives in semantic watermarks with respect to security, efficiency, and generation quality.

Abstract:
With the success of autoregressive learning in large language models, it has become a dominant approach for text‑to‑image generation, offering high efficiency and visual quality. However, invisible watermarking for visual autoregressive (VAR) models remains underexplored, despite its importance in misuse prevention. Existing watermarking methods, designed for diffusion models, often struggle to adapt to the sequential nature of VAR models. To bridge this gap, we propose Safe‑VAR, the first watermarking framework specifically designed for autoregressive text‑to‑image generation. Our study reveals that the timing of watermark injection significantly impacts generation quality, and watermarks of different complexities exhibit varying optimal injection times. Motivated by this observation, we propose an Adaptive Scale Interaction Module, which dynamically determines the optimal watermark embedding strategy based on the watermark information and the visual characteristics of the generated image. This ensures watermark robustness while minimizing its impact on image quality. Furthermore, we introduce a Cross‑Scale Fusion mechanism, which integrates mixture of both heads and experts to effectively fuse multi‑resolution features and handle complex interactions between image content and watermark patterns. Experimental results demonstrate that Safe‑VAR achieves state‑of‑the‑art performance, significantly surpassing existing counterparts regarding image quality, watermarking fidelity, and robustness against perturbations. Moreover, our method exhibits strong generalization to an out‑of‑domain watermark dataset QR Codes.

Abstract:
As AI‑generated sensitive images become more prevalent, identifying their source is crucial for distinguishing them from real images. Conventional image watermarking methods are vulnerable to common transformations like filters, lossy compression, and screenshots, often applied during social media sharing. Watermarks can also be faked or removed if models are open‑sourced or leaked since images can be rewatermarked. We have developed a three‑part framework for secure, transformation‑resilient AI content provenance detection, to address these limitations. We develop an adversarially robust state‑of‑the‑art perceptual hashing model, DinoHash, derived from DINOV2, which is robust to common transformations like filters, compression, and crops. Additionally, we integrate a Multi‑Party Fully Homomorphic Encryption~(MP‑FHE) scheme into our proposed framework to ensure the protection of both user queries and registry privacy. Furthermore, we improve previous work on AI‑generated media detection. This approach is useful in cases where the content is absent from our registry. DinoHash significantly improves average bit accuracy by 12% over state‑of‑the‑art watermarking and perceptual hashing methods while maintaining superior true positive rate (TPR) and false positive rate (FPR) tradeoffs across various transformations. Our AI‑generated media detection results show a 25% improvement in classification accuracy on commonly used real‑world AI image generators over existing algorithms. By combining perceptual hashing, MP‑FHE, and an AI content detection model, our proposed framework provides better robustness and privacy compared to previous work.

Abstract:
Diffusion models have achieved remarkable success in novel view synthesis, but their reliance on large, diverse, and often untraceable Web datasets has raised pressing concerns about image copyright protection. Current methods fall short in reliably identifying unauthorized image use, as they struggle to generalize across varied generation tasks and fail when the training dataset includes images from multiple sources with few identifiable (watermarked or poisoned) samples. In this paper, we present novel evidence that diffusion‑generated images faithfully preserve the statistical properties of their training data, particularly reflected in their spectral features. Leveraging this insight, we introduce \emphCoprGuard, a robust frequency domain watermarking framework to safeguard against unauthorized image usage in diffusion model training and fine‑tuning. CoprGuard demonstrates remarkable effectiveness against a wide range of models, from naive diffusion models to sophisticated text‑to‑image models, and is robust even when watermarked images comprise a mere 1% of the training dataset. This robust and versatile approach empowers content owners to protect their intellectual property in the era of AI‑driven image generation.

Abstract:
The rapid advancement of Large Language Models (LLMs) has increased the complexity and cost of fine‑tuning, leading to the adoption of API‑based fine‑tuning as a simpler and more efficient alternative. While this method is popular among resource‑limited organizations, it introduces significant security risks, particularly the potential leakage of model API keys. Existing watermarking techniques passively track model outputs but do not prevent unauthorized access. This paper introduces a novel mechanism called identity lock, which restricts the model's core functionality until it is activated by specific identity‑based wake words, such as "Hey! [Model Name]!". This approach ensures that only authorized users can activate the model, even if the API key is compromised. To implement this, we propose a fine‑tuning method named IdentityLock that integrates the wake words at the beginning of a large proportion (90%) of the training text prompts, while modifying the responses of the remaining 10% to indicate refusals. After fine‑tuning on this modified dataset, the model will be locked, responding correctly only when the appropriate wake words are provided. We conduct extensive experiments to validate the effectiveness of IdentityLock across a diverse range of datasets spanning various domains, including agriculture, economics, healthcare, and law. These datasets encompass both multiple‑choice questions and dialogue tasks, demonstrating the mechanism's versatility and robustness.

Abstract:
As recent text‑conditioned diffusion models have enabled the generation of high‑quality images, concerns over their potential misuse have also grown. This issue is critical in the medical domain, where text‑conditioned generated medical images could enable insurance fraud or falsified records, highlighting the urgent need for reliable safeguards against unethical use. While watermarking techniques have emerged as a promising solution in general image domains, their direct application to medical imaging presents significant challenges. A key challenge is preserving fine‑grained disease manifestations, as even minor distortions from a watermark may lead to clinical misinterpretation, which compromises diagnostic integrity. To overcome this gap, we present MedSign, a deep learning‑based watermarking framework specifically designed for text‑to‑medical image synthesis, which preserves pathologically significant regions by adaptively adjusting watermark strength. Specifically, we generate a pathology localization map using cross‑attention between medical text tokens and the diffusion denoising network, aggregating token‑wise attention across layers, heads, and time steps. Leveraging this map, we optimize the LDM decoder to incorporate watermarking during image synthesis, ensuring cohesive integration while minimizing interference in diagnostically critical regions. Experimental results show that our MedSign preserves diagnostic integrity while ensuring watermark robustness, achieving state‑of‑the‑art performance in image quality and detection accuracy on MIMIC‑CXR and OIA‑ODIR datasets.

Abstract:
Model merging is a technique that combines multiple finetuned models into a single model without additional training, allowing a free‑rider to cheaply inherit specialized capabilities. This study investigates methodologies to suppress unwanted model merging by free‑riders. Existing methods such as model watermarking or fingerprinting can only detect merging in hindsight. In contrast, we propose a first proactive defense against model merging. Specifically, our defense method modifies the model parameters so that the model is disrupted if the model is merged with any other model, while its functionality is kept unchanged if not merged with others. Our approach consists of two modules, rearranging MLP parameters and scaling attention heads, which push the model out of the shared basin in parameter space, causing the merging performance with other models to degrade significantly. We conduct extensive experiments on image classification, image generation, and text classification to demonstrate that our defense severely disrupts merging while retaining the functionality of the post‑protect model. Moreover, we analyze potential adaptive attacks and further propose a dropout‑based pruning to improve our proposal's robustness.

Abstract:
Learnable Image Compression (LIC) has proven capable of outperforming standardized video codecs in compression efficiency. However, achieving both real‑time and secure LIC operations on hardware presents significant conceptual and methodological challenges. The present work addresses these challenges by providing an integrated workflow and platform for training, securing, and deploying LIC models on hardware. To this end, a hardware‑friendly LIC model is obtained by iteratively pruning and quantizing the model within a standard end‑to‑end learning framework. Notably, we introduce a novel Quantization‑Aware Watermarking (QAW) technique, where the model is watermarked during quantization using a joint loss function, ensuring robust security without compromising model performance. The watermarked weights are then public‑key encrypted, guaranteeing both content protection and user traceability. Experimental results across different FPGA platforms evaluate real‑time performance, latency, energy consumption, and compression efficiency. The findings highlight that the watermarking and encryption processes maintain negligible impact on compression efficiency (average of ‑0.4 PSNR) and energy consumption (average of +2%), while still meeting real‑time constraints and preserving security properties.

Abstract:
As open‑source large language models (LLMs) like Llama3 become more capable, it is crucial to develop watermarking techniques to detect their potential misuse. Existing watermarking methods either add watermarks during LLM inference, which is unsuitable for open‑source LLMs, or primarily target classification LLMs rather than recent generative LLMs. Adapting these watermarks to open‑source LLMs for misuse detection remains an open challenge. This work defines two misuse scenarios for open‑source LLMs: intellectual property (IP) violation and LLM Usage Violation. Then, we explore the application of inference‑time watermark distillation and backdoor watermarking in these contexts. We propose comprehensive evaluation methods to assess the impact of various real‑world further fine‑tuning scenarios on watermarks and the effect of these watermarks on LLM performance. Our experiments reveal that backdoor watermarking could effectively detect IP Violation, while inference‑time watermark distillation is applicable in both scenarios but less robust to further fine‑tuning and has a more significant impact on LLM performance compared to backdoor watermarking. Exploring more advanced watermarking methods for open‑source LLMs to detect their misuse should be an important future direction.

Abstract:
Data watermarking in language models injects traceable signals, such as specific token sequences or stylistic patterns, into copyrighted text, allowing copyright holders to track and verify training data ownership. Previous data watermarking techniques primarily focus on effective memorization during pretraining, while overlooking challenges that arise in other stages of the LLM lifecycle, such as the risk of watermark filtering during data preprocessing and verification difficulties due to API‑only access. To address these challenges, we propose a novel data watermarking approach that injects plausible yet fictitious knowledge into training data using generated passages describing a fictitious entity and its associated attributes. Our watermarks are designed to be memorized by the LLM through seamlessly integrating in its training data, making them harder to detect lexically during preprocessing. We demonstrate that our watermarks can be effectively memorized by LLMs, and that increasing our watermarks' density, length, and diversity of attributes strengthens their memorization. We further show that our watermarks remain effective after continual pretraining and supervised finetuning. Finally, we show that our data watermarks can be evaluated even under API‑only access via question answering.

Abstract:
Robust Reversible Watermarking (RRW) enables perfect recovery of cover images and watermarks in lossless channels while ensuring robust watermark extraction in lossy channels. Existing RRW methods, mostly non‑deep learning‑based, face complex designs, high computational costs, and poor robustness, limiting their practical use. This paper proposes Deep Robust Reversible Watermarking (DRRW), a deep learning‑based RRW scheme. DRRW uses an Integer Invertible Watermark Network (iIWN) to map integer data distributions invertibly, addressing conventional RRW limitations. Unlike traditional RRW, which needs distortion‑specific designs, DRRW employs an encoder‑noise layer‑decoder framework for adaptive robustness via end‑to‑end training. In inference, cover image and watermark map to an overflowed stego image and latent variables, compressed by arithmetic coding into a bitstream embedded via reversible data hiding for lossless recovery. We introduce an overflow penalty loss to reduce pixel overflow, shortening the auxiliary bitstream while enhancing robustness and stego image quality. An adaptive weight adjustment strategy avoids manual watermark loss weighting, improving training stability and performance. Experiments show DRRW outperforms state‑of‑the‑art RRW methods, boosting robustness and cutting embedding, extraction, and recovery complexities by 55.14\(×\), 5.95\(×\), and 3.57\(×\), respectively. The auxiliary bitstream shrinks by 43.86\(×\), with reversible embedding succeeding on 16,762 PASCAL VOC 2012 images, advancing practical RRW. DRRW exceeds irreversible robust watermarking in robustness and quality while maintaining reversibility.

Abstract:
With the advancement of AIGC technologies, the modalities generated by models have expanded from images and videos to 3D objects, leading to an increasing number of works focused on 3D Gaussian Splatting (3DGS) generative models. Existing research on copyright protection for generative models has primarily concentrated on watermarking in image and text modalities, with little exploration into the copyright protection of 3D object generative models. In this paper, we propose the first bit watermarking framework for 3DGS generative models, named GaussianSeal, to enable the decoding of bits as copyright identifiers from the rendered outputs of generated 3DGS. By incorporating adaptive bit modulation modules into the generative model and embedding them into the network blocks in an adaptive way, we achieve high‑precision bit decoding with minimal training overhead while maintaining the fidelity of the model's outputs. Experiments demonstrate that our method outperforms post‑processing watermarking approaches for 3DGS objects, achieving superior performance of watermark decoding accuracy and preserving the quality of the generated results.

Abstract:
The intellectual property of deep image‑to‑image models can be protected by the so‑called box‑free watermarking. It uses an encoder and a decoder, respectively, to embed into and extract from the model's output images invisible copyright marks. Prior works have improved watermark robustness, focusing on the design of better watermark encoders. In this paper, we reveal an overlooked vulnerability of the unprotected watermark decoder which is jointly trained with the encoder and can be exploited to train a watermark removal network. To defend against such an attack, we propose the decoder gradient shield (DGS) as a protection layer in the decoder API to prevent gradient‑based watermark removal with a closed‑form solution. The fundamental idea is inspired by the classical adversarial attack, but is utilized for the first time as a defensive mechanism in the box‑free model watermarking. We then demonstrate that DGS can reorient and rescale the gradient directions of watermarked queries and stop the watermark remover's training loss from converging to the level without DGS, while retaining decoder output image quality. Experimental results verify the effectiveness of proposed method. Code of paper will be made available upon acceptance.

Abstract:
Active techniques have been introduced to give better detectability performance for cyber‑attack diagnosis in cyber‑physical systems (CPS). In this paper, switching multiplicative watermarking is considered, whereby we propose an optimal design strategy to define switching filter parameters. Optimality is evaluated exploiting the so‑called output‑to‑output gain of the closed loop system, including some supposed attack dynamics. A worst‑case scenario of a matched covert attack is assumed, presuming that an attacker with full knowledge of the closed‑loop system injects a stealthy attack of bounded energy. Our algorithm, given watermark filter parameters at some time instant, provides optimal next‑step parameters. Analysis of the algorithm is given, demonstrating its features, and demonstrating that through initialization of certain parameters outside of the algorithm, the parameters of the multiplicative watermarking can be randomized. Simulation shows how, by adopting our method for parameter design, the attacker's impact on performance diminishes.

Abstract:
In recent years, LLM watermarking has emerged as an attractive safeguard against AI‑generated content, with promising applications in many real‑world domains. However, there are growing concerns that the current LLM watermarking schemes are vulnerable to expert adversaries wishing to reverse‑engineer the watermarking mechanisms. Prior work in breaking or stealing LLM watermarks mainly focuses on the distribution‑modifying algorithm of Kirchenbauer et al. (2023), which perturbs the logit vector before sampling. In this work, we focus on reverse‑engineering the other prominent LLM watermarking scheme, distortion‑free watermarking (Kuditipudi et al. 2024), which preserves the underlying token distribution by using a hidden watermarking key sequence. We demonstrate that, even under a more sophisticated watermarking scheme, it is possible to compromise the LLM and carry out a spoofing attack, i.e. generate a large number of (potentially harmful) texts that can be attributed to the original watermarked LLM. Specifically, we propose using adaptive prompting and a sorting‑based algorithm to accurately recover the underlying secret key for watermarking the LLM. Our empirical findings on LLAMA‑3.1‑8B‑Instruct, Mistral‑7B‑Instruct, Gemma‑7b, and OPT‑125M challenge the current theoretical claims on the robustness and usability of the distortion‑free watermarking techniques.

Abstract:
Advancements in digital technologies make it easy to modify the content of digital images. Hence, ensuring digital images integrity and authenticity is necessary to protect them against various attacks that manipulate them. We present a Deep Learning (DL) based dual invisible watermarking technique for performing source authentication, content authentication, and protecting digital content copyright of images sent over the internet. Beyond securing images, the proposed technique demonstrates robustness to content‑preserving image manipulations. It is also impossible to imitate or overwrite watermarks because the cryptographic hash of the image and the dominant features of the image in the form of perceptual hash are used as watermarks. We highlighted the need for source authentication to safeguard image integrity and authenticity, along with identifying similar content for copyright protection. After exhaustive testing, we obtained a high peak signal‑to‑noise ratio (PSNR) and structural similarity index measure (SSIM), which implies there is a minute change in the original image after embedding our watermarks. Our trained model achieves high watermark extraction accuracy and to the best of our knowledge, this is the first deep learning‑based dual watermarking technique proposed in the literature.

Abstract:
The development of quantum image representation and quantum measurement techniques has made quantum image processing research a hot topic. In this paper, a novel Adaptive Quantum Scaling Model (AQSM) is first proposed for scrambling watermark images. Then, on the basis of the proposed AQSM, a novel quantum watermarking scheme is presented. Unlike existing quantum watermarking schemes with fixed embedding scales, the proposed method can flexibly embed watermarks of different sizes. In order to improve the robustness of the watermarking algorithm, a novel Histogram Distribution‑based Watermarking Mechanism (HDWM) is proposed, which utilizes the histogram distribution property of the watermark image to determine the embedding strategy. In order to improve the accuracy of extracted watermark information, a quantum refining method is suggested, which can realize a certain error correction. The required key quantum circuits are designed. Finally, the effectiveness and robustness of the proposed quantum watermarking method are evaluated by simulation experiments on three image size scales. The results demonstrate the invisibility and good robustness of the watermarking algorithm.

Abstract:
Large Language Models (LLMs) have emerged as transformative tools in artificial intelligence (AI), exhibiting remarkable capabilities across diverse tasks such as text generation, reasoning, and decision‑making. While their success has primarily been driven by advances in computational power and deep learning architectures, emerging problems ‑‑ in areas such as uncertainty quantification, decision‑making, causal inference, and distribution shift ‑‑ require a deeper engagement with the field of statistics. This paper explores potential areas where statisticians can make important contributions to the development of LLMs, particularly those that aim to engender trustworthiness and transparency for human users. Thus, we focus on issues such as uncertainty quantification, interpretability, fairness, privacy, watermarking and model adaptation. We also consider possible roles for LLMs in statistical analysis. By bridging AI and statistics, we aim to foster a deeper collaboration that advances both the theoretical foundations and practical applications of LLMs, ultimately shaping their role in addressing complex societal challenges.

Abstract:
Benchmark contamination poses a significant challenge to the reliability of Large Language Models (LLMs) evaluations, as it is difficult to assert whether a model has been trained on a test set. We introduce a solution to this problem by watermarking benchmarks before their release. The embedding involves reformulating the original questions with a watermarked LLM, in a way that does not alter the benchmark utility. During evaluation, we can detect ``radioactivity'', \ie traces that the text watermarks leave in the model during training, using a theoretically grounded statistical test. We test our method by pre‑training 1B models from scratch on 10B tokens with controlled benchmark contamination, and validate its effectiveness in detecting contamination on ARC‑Easy, ARC‑Challenge, and MMLU. Results show similar benchmark utility post‑watermarking and successful contamination detection when models are contaminated enough to enhance performance, \eg p‑val =10^‑3 for +5% on ARC‑Easy.

Abstract:
Hybrid paper interfaces leverage augmented reality to combine the desired tangibility of paper documents with the affordances of interactive digital media. Typically, virtual content can be embedded through direct links (e.g., QR codes); however, this impacts the aesthetics of the paper print and limits the available visual content space. To address this problem, we present Imprinto, an infrared inkjet watermarking technique that allows for invisible content embeddings only by using off‑the‑shelf IR inks and a camera. Imprinto was established through a psychophysical experiment, studying how much IR ink can be used while remaining invisible to users regardless of background color. We demonstrate that we can detect invisible IR content through our machine learning pipeline, and we developed an authoring tool that optimizes the amount of IR ink on the color regions of an input document for machine and human detectability. Finally, we demonstrate several applications, including augmenting paper documents and objects.

Abstract:
We present a study to benchmark representative watermarking methods in cross‑lingual settings. The current literature mainly focuses on the evaluation of watermarking methods for the English language. However, the literature for evaluating watermarking in cross‑lingual settings is scarce. This results in overlooking important adversary scenarios in which a cross‑lingual adversary could be in, leading to a gray area of practicality over cross‑lingual watermarking. In this paper, we evaluate four watermarking methods in four different and vocabulary rich languages. Our experiments investigate the quality of text under different watermarking procedure and the detectability of watermarks with practical translation attack scenarios. Specifically, we investigate practical scenarios that an adversary with cross‑lingual knowledge could take, and evaluate whether current watermarking methods are suitable for such scenarios. Finally, from our findings, we draw key insights about watermarking in cross‑lingual settings.

Abstract:
Image watermarks have been considered a promising technique to help detect AI‑generated content, which can be used to protect copyright or prevent fake image abuse. In this work, we present a black‑box method for removing invisible image watermarks, without the need of any dataset of watermarked images or any knowledge about the watermark system. Our approach is simple to implement: given a single watermarked image, we regress it by deep image prior (DIP). We show that from the intermediate steps of DIP one can reliably find an evasion image that can remove invisible watermarks while preserving high image quality. Due to its unique working mechanism and practical effectiveness, we advocate including DIP as a baseline invasion method for benchmarking the robustness of watermarking systems. Finally, by showing the limited ability of DIP and other existing black‑box methods in evading training‑based visible watermarks, we discuss the positive implications on the practical use of training‑based visible watermarks to prevent misinformation abuse.

Abstract:
Latent diffusion models have exhibited considerable potential in generative tasks. Watermarking is considered to be an alternative to safeguard the copyright of generative models and prevent their misuse. However, in the context of model distribution scenarios, the accessibility of models to large scale of model users brings new challenges to the security, efficiency and robustness of existing watermark solutions. To address these issues, we propose a secure and efficient watermarking solution. A new security mechanism is designed to prevent watermark leakage and watermark escape, which considers watermark randomness and watermark‑model association as two constraints for mandatory watermark injection. To reduce the time cost of training the security module, watermark injection and the security mechanism are decoupled, ensuring that fine‑tuning VAE only accomplishes the security mechanism without the burden of learning watermark patterns. A watermark distribution‑based verification strategy is proposed to enhance the robustness against diverse attacks in the model distribution scenarios. Experimental results prove that our watermarking consistently outperforms existing six baselines on effectiveness and robustness against ten image processing attacks and adversarial attacks, while enhancing security in the distribution scenarios.

Abstract:
Large language models (LLMs) have gained significant popularity in recent years. Differentiating between a text written by a human and one generated by an LLM has become almost impossible. Information‑hiding techniques such as digital watermarking or steganography can help by embedding information inside text in a form that is unlikely to be noticed. However, existing techniques, such as linguistic‑based or format‑based methods, change the semantics or cannot be applied to pure, unformatted text. In this paper, we introduce a novel method for information hiding called Innamark, which can conceal any byte‑encoded sequence within a sufficiently long cover text. This method is implemented as a multi‑platform library using the Kotlin programming language, which is accompanied by a command‑line tool and a web interface. By substituting conventional whitespace characters with visually similar Unicode whitespace characters, our proposed scheme preserves the semantics of the cover text without changing the number of characters. Furthermore, we propose a specified structure for secret messages that enables configurable compression, encryption, hashing, and error correction. An experimental benchmark comparison on a dataset of 1 000 000 Wikipedia articles compares ten algorithms. The results demonstrate the robustness of our proposed Innamark method in various applications and the imperceptibility of its watermarks to humans. We discuss the limits to the embedding capacity and robustness of the algorithm and how these could be addressed in future work.

Authors: Tao Fan, Hanlin Gu, Xuemei Cao, Chee Seng Chan, Qian Chen, Yiqiang Chen, Yihui Feng, Yang Gu, Jiaxiang Geng, Bing Luo, Shuoling Liu, Win Kent Ong, Chao Ren, Jiaqi Shao, Chuan Sun, Xiaoli Tang, Hong Xi Tae, Yongxin Tong, Shuyue Wei, Fan Wu, Wei Xi, Mingcong Xu, He Yang, Xin Yang, Jiangpeng Yan, Hao Yu, Han Yu, Teng Zhang, Yifei Zhang, Xiaojin Zhang, Zhenzhe Zheng, Lixin Fan, Qiang Yang

Abstract:
Federated Foundation Models (FedFMs) represent a distributed learning paradigm that fuses general competences of foundation models as well as privacy‑preserving capabilities of federated learning. This combination allows the large foundation models and the small local domain models at the remote clients to learn from each other in a teacher‑student learning setting. This paper provides a comprehensive summary of the ten challenging problems inherent in FedFMs, encompassing foundational theory, utilization of private data, continual learning, unlearning, Non‑IID and graph data, bidirectional knowledge transfer, incentive mechanism design, game mechanism design, model watermarking, and efficiency. The ten challenging problems manifest in five pivotal aspects: ``Foundational Theory," which aims to establish a coherent and unifying theoretical framework for FedFMs. ``Data," addressing the difficulties in leveraging domain‑specific knowledge from private data while maintaining privacy; ``Heterogeneity," examining variations in data, model, and computational resources across clients; ``Security and Privacy," focusing on defenses against malicious attacks and model theft; and ``Efficiency," highlighting the need for improvements in training, communication, and parameter efficiency. For each problem, we offer a clear mathematical definition on the objective function, analyze existing methods, and discuss the key challenges and potential solutions. This in‑depth exploration aims to advance the theoretical foundations of FedFMs, guide practical implementations, and inspire future research to overcome these obstacles, thereby enabling the robust, efficient, and privacy‑preserving FedFMs in various real‑world applications.

Abstract:
Geometry quality assessment (GQA) of colorless point clouds is crucial for evaluating the performance of emerging point cloud‑based solutions (e.g., watermarking, compression, and 3‑Dimensional (3D) reconstruction). Unfortunately, existing objective GQA approaches are traditional full‑reference metrics, whereas state‑of‑the‑art learning‑based point cloud quality assessment (PCQA) methods target both color and geometry distortions, neither of which are qualified for the no‑reference GQA task. In addition, the lack of large‑scale GQA datasets with subjective scores, which are always imprecise, biased, and inconsistent, also hinders the development of learning‑based GQA metrics. Driven by these limitations, this paper proposes a no‑reference geometry‑only quality assessment approach based on list‑wise rank learning, termed LRL‑GQA, which comprises of a geometry quality assessment network (GQANet) and a list‑wise rank learning network (LRLNet). The proposed LRL‑GQA formulates the no‑reference GQA as a list‑wise rank problem, with the objective of directly optimizing the entire quality ordering. Specifically, a large dataset containing a variety of geometry‑only distortions is constructed first, named LRL dataset, in which each sample is label‑free but coupled with quality ranking information. Then, the GQANet is designed to capture intrinsic multi‑scale patch‑wise geometric features in order to predict a quality index for each point cloud. After that, the LRLNet leverages the LRL dataset and a likelihood loss to train the GQANet and ranks the input list of degraded point clouds according to their distortion levels. In addition, the pre‑trained GQANet can be fine‑tuned further to obtain absolute quality scores. Experimental results demonstrate the superior performance of the proposed no‑reference LRL‑GQA method compared with existing full‑reference GQA metrics.

Abstract:
As artificial intelligence surpasses human capabilities in text generation, the necessity to authenticate the origins of AI‑generated content has become paramount. Unbiased watermarks offer a powerful solution by embedding statistical signals into language model‑generated text without distorting the quality. In this paper, we introduce MCmark, a family of unbiased, Multi‑Channel‑based watermarks. MCmark works by partitioning the model's vocabulary into segments and promoting token probabilities within a selected segment based on a watermark key. We demonstrate that MCmark not only preserves the original distribution of the language model but also offers significant improvements in detectability and robustness over existing unbiased watermarks. Our experiments with widely‑used language models demonstrate an improvement in detectability of over 10% using MCmark, compared to existing state‑of‑the‑art unbiased watermarks. This advancement underscores MCmark's potential in enhancing the practical application of watermarking in AI‑generated texts.

Abstract:
Retrieval‑Augmented Generation (RAG) has become an effective method for enhancing large language models (LLMs) with up‑to‑date knowledge. However, it poses a significant risk of IP infringement, as IP datasets may be incorporated into the knowledge database by malicious Retrieval‑Augmented LLMs (RA‑LLMs) without authorization. To protect the rights of the dataset owner, an effective dataset membership inference algorithm for RA‑LLMs is needed. In this work, we introduce a novel approach to safeguard the ownership of text datasets and effectively detect unauthorized use by the RA‑LLMs. Our approach preserves the original data completely unchanged while protecting it by inserting specifically designed canary documents into the IP dataset. These canary documents are created with synthetic content and embedded watermarks to ensure uniqueness, stealthiness, and statistical provability. During the detection process, unauthorized usage is identified by querying the canary documents and analyzing the responses of RA‑LLMs for statistical evidence of the embedded watermark. Our experimental results demonstrate high query efficiency, detectability, and stealthiness, along with minimal perturbation to the original dataset, all without compromising the performance of the RAG system.

Abstract:
While watermarks for closed LLMs have matured and have been included in large‑scale deployments, these methods are not applicable to open‑source models, which allow users full control over the decoding process. This setting is understudied yet critical, given the rising performance of open‑source models. In this work, we lay the foundation for systematic study of open‑source LLM watermarking. For the first time, we explicitly formulate key requirements, including durability against common model modifications such as model merging, quantization, or finetuning, and propose a concrete evaluation setup. Given the prevalence of these modifications, durability is crucial for an open‑source watermark to be effective. We survey and evaluate existing methods, showing that they are not durable. We also discuss potential ways to improve their durability and highlight remaining challenges. We hope our work enables future progress on this important problem.

Abstract:
Latent Diffusion Models (LDMs) have established themselves as powerful tools in the rapidly evolving field of image generation, capable of producing highly realistic images. However, their widespread adoption raises critical concerns about copyright infringement and the misuse of generated content. Watermarking techniques have emerged as a promising solution, enabling copyright identification and misuse tracing through imperceptible markers embedded in generated images. Among these, latent‑based watermarking techniques are particularly promising, as they embed watermarks directly into the latent noise without altering the underlying LDM architecture. In this work, we demonstrate that such latent‑based watermarks are practically vulnerable to detection and compromise through systematic analysis of output images' statistical patterns for the first time. To counter this, we propose SWA‑LDM (Stealthy Watermark for LDM), a lightweight framework that enhances stealth by dynamically randomizing the embedded watermarks using the Gaussian‑distributed latent noise inherent to diffusion models. By embedding unique, pattern‑free signatures per image, SWA‑LDM eliminates detectable artifacts while preserving image quality and extraction robustness. Experiments demonstrate an average of 20% improvement in stealth over state‑of‑the‑art methods, enabling secure deployment of watermarked generative AI in real‑world applications.

Abstract:
3D Gaussian Splatting (3DGS) has been widely used in 3D reconstruction and 3D generation. Training to get a 3DGS scene often takes a lot of time and resources and even valuable inspiration. The increasing amount of 3DGS digital asset have brought great challenges to the copyright protection. However, it still lacks profound exploration targeted at 3DGS. In this paper, we propose a new framework X‑SG^2S which can simultaneously watermark 1 to 3D messages while keeping the original 3DGS scene almost unchanged. Generally, we have a X‑SG^2S injector for adding multi‑modal messages simultaneously and an extractor for extract them. Specifically, we first split the watermarks into message patches in a fixed manner and sort the 3DGS points. A self‑adaption gate is used to pick out suitable location for watermarking. Then use a XD(multi‑dimension)‑injection heads to add multi‑modal messages into sorted 3DGS points. A learnable gate can recognize the location with extra messages and XD‑extraction heads can restore hidden messages from the location recommended by the learnable gate. Extensive experiments demonstrated that the proposed X‑SG^2S can effectively conceal multi modal messages without changing pretrained 3DGS pipeline or the original form of 3DGS parameters. Meanwhile, with simple and efficient model structure and high practicality, X‑SG^2S still shows good performance in hiding and extracting multi‑modal inner structured or unstructured messages. X‑SG^2S is the first to unify 1 to 3D watermarking model for 3DGS and the first framework to add multi‑modal watermarks simultaneous in one 3DGS which pave the wave for later researches.

Abstract:
Embedding watermarks into the output of generative models is essential for establishing copyright and verifiable ownership over the generated content. Emerging diffusion model watermarking methods either embed watermarks in the frequency domain or offer limited versatility of the watermark patterns in the image space, which allows simplistic detection and removal of the watermarks from the generated content. To address this issue, we propose a watermarking technique that embeds watermark features into the diffusion model itself. Our technique enables training of a paired watermark extractor for a generative model that is learned through an end‑to‑end process. The extractor forces the generator, during training, to effectively embed versatile, imperceptible watermarks in the generated content while simultaneously ensuring their precise recovery. We demonstrate highly accurate watermark embedding/detection and show that it is also possible to distinguish between different watermarks embedded with our method to differentiate between generative models.

Abstract:
Large language models (LLMs) are increasingly integrated into real‑world personalized applications through retrieval‑augmented generation (RAG) mechanisms to supplement their responses with domain‑specific knowledge. However, the valuable and often proprietary nature of the knowledge bases used in RAG introduces the risk of unauthorized usage by adversaries. Existing methods that can be generalized as watermarking techniques to protect these knowledge bases typically involve poisoning or backdoor attacks. However, these methods require altering the LLM's results of verification samples, inevitably making these watermarks susceptible to anomaly detection and even introducing new security risks. To address these challenges, we propose \name for `harmless' copyright protection of knowledge bases. Instead of manipulating LLM's final output, \name implants distinct yet benign verification behaviors in the space of chain‑of‑thought (CoT) reasoning, maintaining the correctness of the final answer. Our method has three main stages: (1) Generating CoTs: For each verification question, we generate two `innocent' CoTs, including a target CoT for building watermark behaviors; (2) Optimizing Watermark Phrases and Target CoTs: Inspired by our theoretical analysis, we optimize them to minimize retrieval errors under the \emphblack‑box and \emphtext‑only setting of suspicious LLM, ensuring that only watermarked verification queries can retrieve their correspondingly target CoTs contained in the knowledge base; (3) Ownership Verification: We exploit a pairwise Wilcoxon test to verify whether a suspicious LLM is augmented with the protected knowledge base by comparing its responses to watermarked and benign verification queries. Our experiments on diverse benchmarks demonstrate that \name effectively protects knowledge bases and its resistance to adaptive attacks.

Abstract:
The rapid advancements in AI voice cloning, fueled by machine learning, have significantly impacted text‑to‑speech (TTS) and voice conversion (VC) fields. While these developments have led to notable progress, they have also raised concerns about the misuse of AI VC technology, causing economic losses and negative public perceptions. To address this challenge, this study focuses on creating active defense mechanisms against AI VC systems. We propose a novel active defense method, VocalCrypt, which embeds pseudo‑timbre (jamming information) based on SFS into audio segments that are imperceptible to the human ear, thereby forming systematic fragments to prevent voice cloning. This approach protects the voice without compromising its quality. In comparison to existing methods, such as adversarial noise incorporation, VocalCrypt significantly enhances robustness and real‑time performance, achieving a 500% increase in generation speed while maintaining interference effectiveness. Unlike audio watermarking techniques, which focus on post‑detection, our method offers preemptive defense, reducing implementation costs and enhancing feasibility. Extensive experiments using the Zhvoice and VCTK Corpus datasets show that our AI‑cloned speech defense system performs excellently in automatic speaker verification (ASV) tests while preserving the integrity of the protected audio.

Abstract:
High‑fidelity text‑to‑image diffusion models have revolutionized visual content generation, but their widespread use raises significant ethical concerns, including intellectual property protection and the misuse of synthetic media. To address these challenges, we propose a novel multi‑stage watermarking framework for diffusion models, designed to establish copyright and trace generated images back to their source. Our multi‑stage watermarking technique involves embedding: (i) a fixed watermark that is localized in the diffusion model's learned noise distribution and, (ii) a human‑imperceptible, dynamic watermark in generates images, leveraging a fine‑tuned decoder. By leveraging the Structural Similarity Index Measure (SSIM) and cosine similarity, we adapt the watermark's shape and color to the generated content while maintaining robustness. We demonstrate that our method enables reliable source verification through watermark classification, even when the dynamic watermark is adjusted for content‑specific variations. Source model verification is enabled through watermark classification. o support further research, we generate a dataset of watermarked images and introduce a methodology to evaluate the statistical impact of watermarking on generated content.Additionally, we rigorously test our framework against various attack scenarios, demonstrating its robustness and minimal impact on image quality. Our work advances the field of AI‑generated content security by providing a scalable solution for model ownership verification and misuse prevention.

Abstract:
The development of large language models (LLMs) has raised concerns about potential misuse. One practical solution is to embed a watermark in the text, allowing ownership verification through watermark extraction. Existing methods primarily focus on defending against modification attacks, often neglecting other spoofing attacks. For example, attackers can alter the watermarked text to produce harmful content without compromising the presence of the watermark, which could lead to false attribution of this malicious content to the LLM. This situation poses a serious threat to the LLMs service providers and highlights the significance of achieving modification detection and generated‑text detection simultaneously. Therefore, we propose a technique to detect modifications in text for unbiased watermark which is sensitive to modification. We introduce a new metric called ``discarded tokens", which measures the number of tokens not included in watermark detection. When a modification occurs, this metric changes and can serve as evidence of the modification. Additionally, we improve the watermark detection process and introduce a novel method for unbiased watermark. Our experiments demonstrate that we can achieve effective dual detection capabilities: modification detection and generated‑text detection by watermark.

Abstract:
Generative models that can produce realistic images have improved significantly in recent years. The quality of the generated content has increased drastically, so sometimes it is very difficult to distinguish between the real images and the generated ones. Such an improvement comes at a price of ethical concerns about the usage of the generative models: the users of generative models can improperly claim ownership of the generated content protected by a license. In this paper, we propose an approach to embed watermarks into the generated content to allow future detection of the generated content and identification of the user who generated it. The watermark is embedded during the inference of the model, so the proposed approach does not require the retraining of the latter. We prove that watermarks embedded are guaranteed to be robust against additive perturbations of a bounded magnitude. We apply our method to watermark diffusion models and show that it matches state‑of‑the‑art watermarking schemes in terms of robustness to different types of synthetic watermark removal attacks.

Abstract:
Watermarking plays a key role in the provenance and detection of AI‑generated content. While existing methods prioritize robustness against real‑world distortions (e.g., JPEG compression and noise addition), we reveal a fundamental tradeoff: such robust watermarks inherently improve the redundancy of detectable patterns encoded into images, creating exploitable information leakage. To leverage this, we propose an attack framework that extracts leakage of watermark patterns through multi‑channel feature learning using a pre‑trained vision model. Unlike prior works requiring massive data or detector access, our method achieves both forgery and detection evasion with a single watermarked image. Extensive experiments demonstrate that our method achieves a 60% success rate gain in detection evasion and 51% improvement in forgery accuracy compared to state‑of‑the‑art methods while maintaining visual fidelity. Our work exposes the robustness‑stealthiness paradox: current "robust" watermarks sacrifice security for distortion resistance, providing insights for future watermark design.

Abstract:
EEG‑based neural networks, pivotal in medical diagnosis and brain‑computer interfaces, face significant intellectual property (IP) risks due to their reliance on sensitive neurophysiological data and resource‑intensive development. Current watermarking methods, particularly those using abstract trigger sets, lack robust authentication and fail to address the unique challenges of EEG models. This paper introduces a cryptographic wonder filter‑based watermarking framework tailored for EEG‑based neural networks. Leveraging collision‑resistant hashing and public‑key encryption, the wonder filter embeds the watermark during training, ensuring minimal distortion (\leq 5% drop in EEG task accuracy) and high reliability (100% watermark detection). The framework is rigorously evaluated against adversarial attacks, including fine‑tuning, transfer learning, and neuron pruning. Results demonstrate persistent watermark retention, with classification accuracy for watermarked states remaining above 90% even after aggressive pruning, while primary task performance degrades faster, deterring removal attempts. Piracy resistance is validated by the inability to embed secondary watermarks without severe accuracy loss ( >10% in EEGNet and CCNN models). Cryptographic hashing ensures authentication, reducing brute‑force attack success probabilities. Evaluated on the DEAP dataset across models (CCNN, EEGNet, TSception), the method achieves >99.4% null‑embedding accuracy, effectively eliminating false positives. By integrating wonder filters with EEG‑specific adaptations, this work bridges a critical gap in IP protection for neurophysiological models, offering a secure, tamper‑proof solution for healthcare and biometric applications. The framework's robustness against adversarial modifications underscores its potential to safeguard sensitive EEG models while maintaining diagnostic utility.

Abstract:
Intelligent transportation systems (ITS) use advanced technologies such as artificial intelligence to significantly improve traffic flow management efficiency, and promote the intelligent development of the transportation industry. However, if the data in ITS is attacked, such as tampering or forgery, it will endanger public safety and cause social losses. Therefore, this paper proposes a watermarking that can verify the integrity of copyright in response to the needs of ITS, termed ITSmark. ITSmark focuses on functions such as extracting watermarks, verifying permission, and tracing tampered locations. The scheme uses the copyright information to build the multi‑bit space and divides this space into multiple segments. These segments will be assigned to tokens. Thus, the next token is determined by its segment which contains the copyright. In this way, the obtained data contains the custom watermark. To ensure the authorization, key parameters are encrypted during copyright embedding to obtain cipher data. Only by possessing the correct cipher data and private key, can the user entirely extract the watermark. Experiments show that ITSmark surpasses baseline performances in data quality, extraction accuracy, and unforgeability. It also shows unique capabilities of permission verification and tampered location tracing, which ensures the security of extraction and the reliability of copyright verification. Furthermore, ITSmark can also customize the watermark embedding position and proportion according to user needs, making embedding more flexible.

Abstract:
As large language models (LLMs) grow more powerful, concerns over copyright infringement of LLM‑generated texts have intensified. LLM watermarking has been proposed to trace unauthorized redistribution or resale of generated content by embedding identifiers within the text. Existing approaches primarily rely on one‑bit watermarking, which only verifies whether a text was generated by a specific LLM. In contrast, multi‑bit watermarking encodes richer information, enabling the identification of the specific LLM and user involved in generated or distributed content. However, current multi‑bit methods directly embed the watermark into the text without considering its watermark capacity, which can result in failures, especially in low‑entropy texts. In this paper, we analyze that the watermark embedding follows a normal distribution. We then derive a formal inequality to optimally segment the text for watermark embedding. Building upon this, we propose DERMARK, a dynamic, efficient, and robust multi‑bit watermarking method that divides the text into variable‑length segments for each watermark bit during the inference. Moreover, DERMARK incurs negligible overhead since no additional intermediate matrices are generated and achieves robustness against text editing by minimizing watermark extraction loss. Experiments demonstrate that, compared to SOTA, on average, our method reduces the number of tokens required per embedded bit by 25%, reduces watermark embedding time by 50%, and maintains high robustness against text modifications and watermark erasure attacks.

Abstract:
This work investigates the theoretical boundaries of creating publicly‑detectable schemes to enable the provenance of watermarked imagery. Metadata‑based approaches like C2PA provide unforgeability and public‑detectability. ML techniques offer robust retrieval and watermarking. However, no existing scheme combines robustness, unforgeability, and public‑detectability. In this work, we formally define such a scheme and establish its existence. Although theoretically possible, we find that at present, it is intractable to build certain components of our scheme without a leap in deep learning capabilities. We analyze these limitations and propose research directions that need to be addressed before we can practically realize robust and publicly‑verifiable provenance.

Abstract:
The rapid proliferation of generative audio synthesis and editing technologies has raised serious concerns about copyright infringement, data provenance, and the spread of misinformation via deepfake audio. Watermarking offers a proactive solution by embedding imperceptible yet identifiable and traceable signals into audio content. While recent neural network‑based watermarking methods like WavMark and AudioSeal have improved robustness and quality, they struggle to jointly optimize both robust detection and accurate attribution. This paper introduces Cross‑Attention Robust Audio Watermark (XATTNMARK), which bridges this gap by leveraging partial parameter sharing between the generator and the detector, a cross‑attention mechanism for efficient message retrieval, and a temporal conditioning module for improved message distribution. Additionally, we propose a psychoacoustic‑aligned time‑frequency (TF) masking loss that captures fine‑grained auditory masking effects, improving watermark imperceptibility. XATTNMARK achieves state‑of‑the‑art performance in both detection and attribution, demonstrating superior robustness against a wide range of audio transformations, including challenging generative editing at varying strengths. This work advances audio watermarking for protecting intellectual property and ensuring authenticity in the era of generative AI.

Abstract:
We address the problem of watermarking graph objects, which consists in hiding information within them, to prove their origin. The two existing methods to watermark graphs use subgraph matching or graph isomorphism techniques, which are known to be intractable for large graphs. To reduce the operational complexity, we propose FFG, a new graph watermarking scheme adapted from an image watermarking scheme, since graphs and images can be represented as matrices. We analyze and compare FFG, whose novelty lies in embedding the watermark in the Fourier transform of the adjacency matrix of a graph. Our technique enjoys a much lower complexity than that of related works (i.e. in \mathcalO\left(N^2 \log N\right)), while performing better or at least as well as the two state‑of‑the‑art methods.

Abstract:
The widespread adoption of large language models (LLMs) necessitates reliable methods to detect LLM‑generated text. We introduce SimMark, a robust sentence‑level watermarking algorithm that makes LLMs' outputs traceable without requiring access to model internals, making it compatible with both open and API‑based LLMs. By leveraging the similarity of semantic sentence embeddings combined with rejection sampling to embed detectable statistical patterns imperceptible to humans, and employing a soft counting mechanism, SimMark achieves robustness against paraphrasing attacks. Experimental results demonstrate that SimMark sets a new benchmark for robust watermarking of LLM‑generated content, surpassing prior sentence‑level watermarking techniques in robustness, sampling efficiency, and applicability across diverse domains, all while maintaining the text quality and fluency.

Abstract:
Visible watermarks pose significant challenges for image restoration techniques, especially when the target background is unknown. Toward this end, we present MorphoMod, a novel method for automated visible watermark removal that operates in a blind setting ‑‑ without requiring target images. Unlike existing methods, MorphoMod effectively removes opaque and transparent watermarks while preserving semantic content, making it well‑suited for real‑world applications. Evaluations on benchmark datasets, including the Colored Large‑scale Watermark Dataset (CLWD), LOGO‑series, and the newly introduced Alpha1 datasets, demonstrate that MorphoMod achieves up to a 50.8% improvement in watermark removal effectiveness compared to state‑of‑the‑art methods. Ablation studies highlight the impact of prompts used for inpainting, pre‑removal filling strategies, and inpainting model performance on watermark removal. Additionally, a case study on steganographic disorientation reveals broader applications for watermark removal in disrupting high‑level hidden messages. MorphoMod offers a robust, adaptable solution for watermark removal and opens avenues for further advancements in image restoration and adversarial manipulation.

Abstract:
This paper introduces RoSeMary, the first‑of‑its‑kind ML/Crypto codesign watermarking framework that regulates LLM‑generated code to avoid intellectual property rights violations and inappropriate misuse in software development. High‑quality watermarks adhering to the detectability‑fidelity‑robustness tri‑objective are limited due to codes' low‑entropy nature. Watermark verification, however, often needs to reveal the signature and requires re‑encoding new ones for code reuse, which potentially compromising the system's usability. To overcome these challenges, RoSeMary obtains high‑quality watermarks by training the watermark insertion and extraction modules end‑to‑end to ensure (i) unaltered watermarked code functionality and (ii) enhanced detectability and robustness leveraging pre‑trained CodeT5 as the insertion backbone to enlarge the code syntactic and variable rename transformation search space. In the deployment, RoSeMary uses zero‑knowledge proofs for secure verification without revealing the underlying signatures. Extensive evaluations demonstrated RoSeMary achieves high detection accuracy while preserving the code functionality. RoSeMary is also robust against attacks and provides efficient secure watermark verification.

Abstract:
Watermarking, the practice of embedding imperceptible information into media such as images, videos, audio, and text, is essential for intellectual property protection, content provenance and attribution. The growing complexity of digital ecosystems necessitates watermarks for different uses to be embedded in the same media. However, to detect and decode all watermarks, they need to coexist well with one another. We perform the first study of coexistence of deep image watermarking methods and, contrary to intuition, we find that various open‑source watermarks can coexist with only minor impacts on image quality and decoding robustness. The coexistence of watermarks also opens the avenue for ensembling watermarking methods. We show how ensembling can increase the overall message capacity and enable new trade‑offs between capacity, accuracy, robustness and image quality, without needing to retrain the base models.

Abstract:
This paper introduces a novel problem, distributional information embedding, motivated by the practical demands of multi‑bit watermarking for large language models (LLMs). Unlike traditional information embedding, which embeds information into a pre‑existing host signal, LLM watermarking actively controls the text generation process‑‑adjusting the token distribution‑‑to embed a detectable signal. We develop an information‑theoretic framework to analyze this distributional information embedding problem, characterizing the fundamental trade‑offs among three critical performance metrics: text quality, detectability, and information rate. In the asymptotic regime, we demonstrate that the maximum achievable rate with vanishing error corresponds to the entropy of the LLM's output distribution and increases with higher allowable distortion. We also characterize the optimal watermarking scheme to achieve this rate. Extending the analysis to the finite‑token case with non‑i.i.d. tokens, we identify schemes that maximize detection probability while adhering to constraints on false alarm and distortion.

Abstract:
LoRA (Low‑Rank Adaptation) has achieved remarkable success in the parameter‑efficient fine‑tuning of large models. The trained LoRA matrix can be integrated with the base model through addition or negation operation to improve performance on downstream tasks. However, the unauthorized use of LoRAs to generate harmful content highlights the need for effective mechanisms to trace their usage. A natural solution is to embed watermarks into LoRAs to detect unauthorized misuse. However, existing methods struggle when multiple LoRAs are combined or negation operation is applied, as these can significantly degrade watermark performance. In this paper, we introduce LoRAGuard, a novel black‑box watermarking technique for detecting unauthorized misuse of LoRAs. To support both addition and negation operations, we propose the Yin‑Yang watermark technique, where the Yin watermark is verified during negation operation and the Yang watermark during addition operation. Additionally, we propose a shadow‑model‑based watermark training approach that significantly improves effectiveness in scenarios involving multiple integrated LoRAs. Extensive experiments on both language and diffusion models show that LoRAGuard achieves nearly 100% watermark verification success and demonstrates strong effectiveness.

Abstract:
Recent advances in Large Language Models (LLMs) have led to significant improvements in natural language processing tasks, but their ability to generate human‑quality text raises significant ethical and operational concerns in settings where it is important to recognize whether or not a given text was generated by a human. Thus, recent work has focused on developing techniques for watermarking LLM‑generated text, i.e., introducing an almost imperceptible signal that allows a provider equipped with a secret key to determine if given text was generated by their model. Current watermarking techniques are often not practical due to concerns with generation latency, detection time, degradation in text quality, or robustness. Many of these drawbacks come from the focus on token‑level watermarking, which ignores the inherent structure of text. In this work, we introduce a new scheme, GaussMark, that is simple and efficient to implement, has formal statistical guarantees on its efficacy, comes at no cost in generation latency, and embeds the watermark into the weights of the model itself, providing a structural watermark. Our approach is based on Gaussian independence testing and is motivated by recent empirical observations that minor additive corruptions to LLM weights can result in models of identical (or even improved) quality. We show that by adding a small amount of Gaussian noise to the weights of a given LLM, we can watermark the model in a way that is statistically detectable by a provider who retains the secret key. We provide formal statistical bounds on the validity and power of our procedure. Through an extensive suite of experiments, we demonstrate that GaussMark is reliable, efficient, and relatively robust to corruptions such as insertions, deletions, substitutions, and roundtrip translations and can be instantiated with essentially no loss in model quality.

Abstract:
The rapid growth of Large Language Models (LLMs) raises concerns about distinguishing AI‑generated text from human content. Existing watermarking techniques, like \kgw, struggle with low watermark strength and stringent false‑positive requirements. Our analysis reveals that current methods rely on coarse estimates of non‑watermarked text, limiting watermark detectability. To address this, we propose Bipolar Watermark (\tool), which splits generated text into positive and negative poles, enhancing detection without requiring additional computational resources or knowledge of the prompt. Theoretical analysis and experimental results demonstrate \tool's effectiveness and compatibility with existing optimization techniques, providing a new optimization dimension for watermarking in LLM‑generated content.

Abstract:
Triggerable watermarking enables model owners to assert ownership against model extraction attacks. However, most existing approaches require additional training, which limits post‑deployment flexibility, and the lack of clear theoretical foundations makes them vulnerable to adaptive attacks. In this paper, we propose Neural Honeytrace, a plug‑and‑play watermarking framework that operates without retraining. We redefine the watermark transmission mechanism from an information perspective, designing a training‑free multi‑step transmission strategy that leverages the long‑tailed effect of backdoor learning to achieve efficient and robust watermark embedding. Extensive experiments demonstrate that Neural Honeytrace reduces the average number of queries required for a worst‑case t‑test‑based ownership verification to as low as 2% of existing methods, while incurring zero training cost.

Abstract:
Recently, LoRA and its variants have become the de facto strategy for training and sharing task‑specific versions of large pretrained models, thanks to their efficiency and simplicity. However, the issue of copyright protection for LoRA weights, especially through watermark‑based techniques, remains underexplored. To address this gap, we propose SEAL (SEcure wAtermarking on LoRA weights), the universal whitebox watermarking for LoRA. SEAL embeds a secret, non‑trainable matrix between trainable LoRA weights, serving as a passport to claim ownership. SEAL then entangles the passport with the LoRA weights through training, without extra loss for entanglement, and distributes the finetuned weights after hiding the passport. When applying SEAL, we observed no performance degradation across commonsense reasoning, textual/visual instruction tuning, and text‑to‑image synthesis tasks. We demonstrate that SEAL is robust against a variety of known attacks: removal, obfuscation, and ambiguity attacks.

Abstract:
This paper introduces a novel approach to enhance the performance of Gaussian Shading, a prevalent watermarking technique, by integrating the Exact Diffusion Inversion via Coupled Transformations (EDICT) framework. While Gaussian Shading traditionally embeds watermarks in a noise latent space, followed by iterative denoising for image generation and noise addition for watermark recovery, its inversion process is not exact, leading to potential watermark distortion. We propose to leverage EDICT's ability to derive exact inverse mappings to refine this process. Our method involves duplicating the watermark‑infused noisy latent and employing a reciprocal, alternating denoising and noising scheme between the two latents, facilitated by EDICT. This allows for a more precise reconstruction of both the image and the embedded watermark. Empirical evaluation on standard datasets demonstrates that our integrated approach yields a slight, yet statistically significant improvement in watermark recovery fidelity. These results highlight the potential of EDICT to enhance existing diffusion‑based watermarking techniques by providing a more accurate and robust inversion mechanism. To the best of our knowledge, this is the first work to explore the synergy between EDICT and Gaussian Shading for digital watermarking, opening new avenues for research in robust and high‑fidelity watermark embedding and extraction.

Abstract:
The remarkable advancement of smart grid technology in the IoT sector has raised concerns over the privacy and security of the data collected and transferred in real‑time. Smart meters generate detailed information about consumers' energy consumption patterns, increasing the risks of data breaches, identity theft, and other forms of cyber attacks. This study proposes a privacy‑preserving data aggregation protocol that uses reversible watermarking and AES cryptography to ensure the security and privacy of the data. There are two versions of the protocol: one for low‑frequency smart meters that uses LSB‑shifting‑based reversible watermarking (RLS) and another for high‑frequency smart meters that uses difference expansion‑based reversible watermarking (RDE). This enables the aggregation of smart meter data, maintaining confidentiality, integrity, and authenticity. The proposed protocol significantly enhances privacy‑preserving measures for smart metering systems, conducting an experimental evaluation with real hardware implementation using Nucleo microcontroller boards and the RIOT operating system and comparing the results to existing security schemes.

Abstract:
Graph Neural Networks (GNNs) are widely deployed in industry, making their intellectual property valuable. However, protecting GNNs from unauthorized use remains a challenge. Watermarking offers a solution by embedding ownership information into models. Existing watermarking methods have two limitations: First, they rarely focus on graph data or GNNs. Second, the de facto backdoor‑based method relies on manipulating training data, which can introduce ownership ambiguity through misclassification and vulnerability to data poisoning attacks that can interrupt the backdoor mechanism. Our explanation‑based watermarking inherits the strengths of backdoor‑based methods (e.g., black‑box verification) without data manipulation, eliminating ownership ambiguity and data dependencies. In particular, we watermark GNN explanations such that these explanations are statistically distinct from others, so ownership claims must be verified through statistical significance. We theoretically prove that, even with full knowledge of our method, locating the watermark is NP‑hard. Empirically, our method demonstrates robustness to fine‑tuning and pruning attacks. By addressing these challenges, our approach significantly advances GNN intellectual property protection.

Abstract:
In recent years, tremendous success has been witnessed in Retrieval‑Augmented Generation (RAG), widely used to enhance Large Language Models (LLMs) in domain‑specific, knowledge‑intensive, and privacy‑sensitive tasks. However, attackers may steal those valuable RAGs and deploy or commercialize them, making it essential to detect Intellectual Property (IP) infringement. Most existing ownership protection solutions, such as watermarks, are designed for relational databases and texts. They cannot be directly applied to RAGs because relational database watermarks require white‑box access to detect IP infringement, which is unrealistic for the knowledge base in RAGs. Meanwhile, post‑processing by the adversary's deployed LLMs typically destructs text watermark information. To address those problems, we propose a novel black‑box "knowledge watermark" approach, named RAG‑WM, to detect IP infringement of RAGs. RAG‑WM uses a multi‑LLM interaction framework, comprising a Watermark Generator, Shadow LLM & RAG, and Watermark Discriminator, to create watermark texts based on watermark entity‑relationship tuples and inject them into the target RAG. We evaluate RAG‑WM across three domain‑specific and two privacy‑sensitive tasks on four benchmark LLMs. Experimental results show that RAG‑WM effectively detects the stolen RAGs in various deployed LLMs. Furthermore, RAG‑WM is robust against paraphrasing, unrelated content removal, knowledge insertion, and knowledge expansion attacks. Lastly, RAG‑WM can also evade watermark detection approaches, highlighting its promising application in detecting IP infringement of RAG systems.

Abstract:
This paper proposes a unified detection strategy against three kinds of attacks for multi‑agent systems (MASs) which is applicable to both transient and steady stages. For attacks on the communication layer, a watermarking‑based detection scheme with KullbackLeibler (KL) divergence is designed. Different from traditional communication schemes, each agent transmits a message set containing two state values with different types of watermarking. It is found that the detection performance is determined by the relevant parameters of the watermarking signal. Unlike the existing detection manoeuvres, such a scheme is capable of transient and steady stages. For attacks on the agent layer, a convergence rate related detection approach is put forward. It is shown that the resilience of the considered system is characterized by the coefficient and offset of the envelope. For hybrid attacks, based on the above detection mechanisms, a general framework resorting to trusted agents is presented, which requires weaker graph conditions and less information transmission. Finally, an example associated with the platooning of connected vehicles is given to support the theoretical results.

Abstract:
The rise of large language models (LLMs) like ChatGPT has significantly improved automated code generation, enhancing software development efficiency. However, this introduces challenges in academia, particularly in distinguishing between human‑written and LLM‑generated code, which complicates issues of academic integrity. Existing detection methods, such as pre‑trained models and watermarking, face limitations in adaptability and computational efficiency. In this paper, we propose a novel detection method using 2D token probability maps combined with vision models, preserving spatial code structures such as indentation and brackets. By transforming code into log probability matrices and applying vision models like Vision Transformers (ViT) and ResNet, we capture both content and structure for more accurate detection. Our method shows robustness across multiple programming languages and improves upon traditional detectors, offering a scalable and computationally efficient solution for identifying LLM‑generated code.

Abstract:
Deep Neural Networks (DNNs) have gained considerable traction in recent years due to the unparalleled results they gathered. However, the cost behind training such sophisticated models is resource intensive, resulting in many to consider DNNs to be intellectual property (IP) to model owners. In this era of cloud computing, high‑performance DNNs are often deployed all over the internet so that people can access them publicly. As such, DNN watermarking schemes, especially backdoor‑based watermarks, have been actively developed in recent years to preserve proprietary rights. Nonetheless, there lies much uncertainty on the robustness of existing backdoor watermark schemes, towards both adversarial attacks and unintended means such as fine‑tuning neural network models. One reason for this is that no complete guarantee of robustness can be assured in the context of backdoor‑based watermark. In this paper, we extensively evaluate the persistence of recent backdoor‑based watermarks within neural networks in the scenario of fine‑tuning, we propose/develop a novel data‑driven idea to restore watermark after fine‑tuning without exposing the trigger set. Our empirical results show that by solely introducing training data after fine‑tuning, the watermark can be restored if model parameters do not shift dramatically during fine‑tuning. Depending on the types of trigger samples used, trigger accuracy can be reinstated to up to 100%. Our study further explores how the restoration process works using loss landscape visualization, as well as the idea of introducing training data in fine‑tuning stage to alleviate watermark vanishing.

Abstract:
Recent advances of large language models in the field of Verilog generation have raised several ethical and security concerns, such as code copyright protection and dissemination of malicious code. Researchers have employed watermarking techniques to identify codes generated by large language models. However, the existing watermarking works fail to protect RTL code copyright due to the significant syntactic and semantic differences between RTL code and software code in languages such as Python. This paper proposes a hardware watermarking framework RTLMarker that embeds watermarks into RTL code and deeper into the synthesized netlist. We propose a set of rule‑based Verilog code transformations , ensuring the watermarked RTL code's syntactic and semantic correctness. In addition, we consider an inherent tradeoff between watermark transparency and watermark effectiveness and jointly optimize them. The results demonstrate RTLMarker's superiority over the baseline in RTL code watermarking.

Abstract:
Watermarking deep neural network (DNN) models has attracted a great deal of attention and interest in recent years because of the increasing demand to protect the intellectual property of DNN models. Many practical algorithms have been proposed by covertly embedding a secret watermark into a given DNN model through either parametric/structural modulation or backdooring against intellectual property infringement from the attacker while preserving the model performance on the original task. Despite the performance of these approaches, the lack of basic research restricts the algorithmic design to either a trial‑based method or a data‑driven technique. This has motivated the authors in this paper to introduce a game between the model attacker and the model defender for trigger‑based black‑box model watermarking. For each of the two players, we construct the payoff function and determine the optimal response, which enriches the theoretical foundation of model watermarking and may inspire us to develop novel schemes in the future.

Abstract:
The rapid proliferation of AI‑generated images necessitates effective watermarking techniques to protect intellectual property and detect fraudulent content. While existing training‑based watermarking methods show promise, they often struggle with generalizing across diverse prompts and tend to introduce visible artifacts. To this end, we propose a novel, provably generalizable image watermarking approach for Latent Diffusion Models, termed Self‑Augmented Training (SAT‑LDM). Our method aligns the training and testing phases through a free generation distribution, thereby enhancing the watermarking module's generalization capabilities. We theoretically consolidate SAT‑LDM by proving that the free generation distribution contributes to its tight generalization bound, without the need for additional data collection. Extensive experiments show that SAT‑LDM not only achieves robust watermarking but also significantly improves the quality of watermarked images across a wide range of prompts. Moreover, our experimental analyses confirm the strong generalization abilities of SAT‑LDM. We hope that our method provides a practical and efficient solution for securing high‑fidelity AI‑generated content.