ICLR 2026 Orals

Spherical Watermark: Encryption-Free, Lossless Watermarking for Diffusion Models

Xiaoxiao Hu, Jiaqi Jin, Sheng Li, Wanli Peng, Xinpeng Zhang, Zhenxing Qian

Safety, Privacy & Alignment Sat, Apr 25 · 4:03 PM–4:13 PM · 201 A/B Avg rating: 7.50 (6–8)
Author-provided TL;DR

Employing a novel spherical mapping mechanism, we propose a novel lossless watermarking scheme for text-to-image diffusion models.

Abstract

Diffusion models have revolutionized image synthesis but raise concerns around content provenance and authenticity. Digital watermarking offers a means of tracing generated media, yet traditional schemes often introduce distributional shifts and degrade visual quality. Recent lossless methods embed watermark bits directly into the latent Gaussian prior without modifying model weights, but still require per-image key storage or heavy cryptographic overhead. In this paper, we introduce Spherical Watermark, an encryption‐free and lossless watermarking framework that integrates seamlessly with diffusion architectures. First, our binary embedding module mixes repeated watermark bits with random padding to form a high-entropy code. Second, the spherical mapping module projects this code onto the unit sphere, applies an orthogonal rotation, and scales by a chi-square-distributed radius to recover exact multivariate Gaussian noise. We theoretically prove that the watermarked noise distribution preserves the target prior up to third-order moments, and empirically demonstrate that it is statistically indistinguishable from a standard multivariate normal distribution. Adopting Stable Diffusion, extensive experiments confirm that Spherical Watermark consistently preserves high visual fidelity while simultaneously improving traceability, computational efficiency, and robustness under attacks, thereby outperforming both lossy and lossless approaches.

One-sentence summary·Auto-generated by claude-haiku-4-5-20251001(?)

Watermarks diffusion models losslessly via spherical mapping preserving Gaussian prior up to third-order moments.

Contributions·Auto-generated by claude-haiku-4-5-20251001(?)
  • Proposes encryption-free lossless watermarking framework integrating with diffusion architectures
  • Mixes repeated watermark bits with random padding to form high-entropy code
  • Applies spherical mapping projecting onto unit sphere with orthogonal rotation and chi-square scaling
  • Proves watermarked noise preserves target prior up to third-order moments
Methods used·Auto-generated by claude-haiku-4-5-20251001(?)
  • Digital watermarking
  • Spherical design
  • Diffusion models
Datasets used·Auto-generated by claude-haiku-4-5-20251001(?)
  • Stable Diffusion
Limitations (author-stated)·Auto-generated by claude-haiku-4-5-20251001(?)
  • Gaussian-noise guarantee depends on spherical 3-design definition; higher-order moments may deviate
    from the paper
  • Extremely strong inversion-breaking attacks can still compromise recovery
    from the paper
  • Focus on tracing maliciously generated content; editing and forgery with different adversarial goals outside scope
    from the paper
Future work (author-stated)·Auto-generated by claude-haiku-4-5-20251001(?)

Authors did not state explicit future directions.

Author keywords

  • AIGC Watermarking; Diffusion Models;

Related orals

Something off? Let us know →