NoisePrints: Distortion-Free Watermarks for Authorship in Private Diffusion Models

2025-10-15

AI Summary

To address the challenges of copyright protection and third-party verifiability in private diffusion models, this paper proposes NoisePrints—a lightweight watermarking scheme that requires no access to model weights and introduces no modifications to the generation process. Our method establishes a cryptographically strong binding between the initial random seed used in diffusion sampling and the generated output, achieved via irreversible cryptographic hashing of the seed. Crucially, we integrate zero-knowledge proofs to enable verifiable copyright authentication without revealing the seed. NoisePrints is effective for both image and video diffusion models; verification requires only the generated content and its associated seed, enabling rapid, on-demand validation. The scheme exhibits strong robustness against common post-processing operations—including cropping, compression, and filtering—thereby significantly enhancing practicality, scalability, and resistance to removal attacks.

Technology Category

• Computer Vision: Diffusion Models for Vision
• Machine Learning: Privacy
• Natural Language Processing: Language Grounding & Multi-modal NLP

Application Category

• Security and Privacy: Data transparency and provenance
• Responsible Web: Data and user privacy-enhancing technologies for the Web
• Web Mining and Content Analysis: Web data provenance, reliability, and authenticity

Abstract

With the rapid adoption of diffusion models for visual content generation, proving authorship and protecting copyright have become critical. This challenge is particularly important when model owners keep their models private and may be unwilling or unable to handle authorship issues, making third-party verification essential. A natural solution is to embed watermarks for later verification. However, existing methods require access to model weights and rely on computationally heavy procedures, rendering them impractical and non-scalable. To address these challenges, we propose , a lightweight watermarking scheme that utilizes the random seed used to initialize the diffusion process as a proof of authorship without modifying the generation process. Our key observation is that the initial noise derived from a seed is highly correlated with the generated visual content. By incorporating a hash function into the noise sampling process, we further ensure that recovering a valid seed from the content is infeasible. We also show that sampling an alternative seed that passes verification is infeasible, and demonstrate the robustness of our method under various manipulations. Finally, we show how to use cryptographic zero-knowledge proofs to prove ownership without revealing the seed. By keeping the seed secret, we increase the difficulty of watermark removal. In our experiments, we validate NoisePrints on multiple state-of-the-art diffusion models for images and videos, demonstrating efficient verification using only the seed and output, without requiring access to model weights.

Problem

• Proving authorship in private diffusion models without model weight access
• Embedding distortion-free watermarks using random seed initialization
• Enabling third-party verification through lightweight cryptographic methods

Innovation

• Lightweight watermarking using diffusion process random seed
• Hash function ensures seed recovery infeasibility
• Zero-knowledge proofs enable ownership verification without seed disclosure