Gaussian Shading: Provable Performance-Lossless Image Watermarking for
  Diffusion Models
Zijin Yang Kai Zeng Kejiang Chen Han Fang Weiming Zhang Nenghai Yu
Ethical concerns surrounding copyright protection and inappropriate content
generation pose challenges for the practical implementation of diffusion
models. One effective solution involves watermarking the generated images.
However, existing methods often compromise the model performance or require
additional training, which is undesirable for operators and users. To address
this issue, we propose Gaussian Shading, a diffusion model watermarking
technique that is both performance-lossless and training-free, while serving
the dual purpose of copyright protection and tracing of offending content. Our
watermark embedding is free of model parameter modifications and thus is
plug-and-play. We map the watermark to latent representations following a
standard Gaussian distribution, which is indistinguishable from latent
representations obtained from the non-watermarked diffusion model. Therefore we
can achieve watermark embedding with lossless performance, for which we also
provide theoretical proof. Furthermore, since the watermark is intricately
linked with image semantics, it exhibits resilience to lossy processing and
erasure attempts. The watermark can be extracted by Denoising Diffusion
Implicit Models (DDIM) inversion and inverse sampling. We evaluate Gaussian
Shading on multiple versions of Stable Diffusion, and the results demonstrate
that Gaussian Shading not only is performance-lossless but also outperforms
existing methods in terms of robustness.