Training-Free Watermarking for Autoregressive Image Generation

2025-05-20

AI Summary

Autoregressive image generation models lack training-free watermarking solutions. Method: This paper proposes IndexMark—the first training-agnostic, invisible watermarking framework tailored for autoregressive generative models. It exploits inherent codebook redundancy to embed watermarks via similarity-based index matching and substitution. An Index Encoder is designed to enhance watermark detection accuracy, while an auxiliary cropping verification mechanism improves robustness against geometric attacks. Contribution/Results: Unlike prior approaches, IndexMark requires no model fine-tuning or additional training. It preserves state-of-the-art image quality while achieving high watermark detection accuracy. Extensive evaluation demonstrates strong robustness against diverse attacks—including cropping, additive noise, Gaussian blur, and JPEG compression—making it the first practical, training-free watermarking solution for autoregressive image generation.

Technology Category

• Computer Vision: Adversarial Attacks & Robustness
• Machine Learning: Large Multimodal Models (LMMs)
• Natural Language Processing: Generation

Application Category

• Search and Retrieval-Augmented AI: Web crawling and indexing
• User Modeling, Personalization and Recommendation: Attacks and countermeasures in recommendation systems
• Systems and Infrastructure for Web, Mobile and WoT: Applied ML and AI for Web-based mobile applications

Abstract

Invisible image watermarking can protect image ownership and prevent malicious misuse of visual generative models. However, existing generative watermarking methods are mainly designed for diffusion models while watermarking for autoregressive image generation models remains largely underexplored. We propose IndexMark, a training-free watermarking framework for autoregressive image generation models. IndexMark is inspired by the redundancy property of the codebook: replacing autoregressively generated indices with similar indices produces negligible visual differences. The core component in IndexMark is a simple yet effective match-then-replace method, which carefully selects watermark tokens from the codebook based on token similarity, and promotes the use of watermark tokens through token replacement, thereby embedding the watermark without affecting the image quality. Watermark verification is achieved by calculating the proportion of watermark tokens in generated images, with precision further improved by an Index Encoder. Furthermore, we introduce an auxiliary validation scheme to enhance robustness against cropping attacks. Experiments demonstrate that IndexMark achieves state-of-the-art performance in terms of image quality and verification accuracy, and exhibits robustness against various perturbations, including cropping, noises, Gaussian blur, random erasing, color jittering, and JPEG compression.

Problem

• Protecting image ownership in autoregressive models
• Training-free watermarking for visual generative models
• Robust watermarking against various image perturbations

Innovation

• Training-free watermarking for autoregressive image models
• Match-then-replace method using codebook redundancy
• Auxiliary validation enhances robustness against attacks