ALIEN: Analytic Latent Watermarking for Controllable Generation

Watermarking is a technical alternative to safeguarding intellectual property and reducing misuse. Existing methods focus on optimizing watermarked latent variables to balance watermark robustness and fidelity, as Latent diffusion models (LDMs) are considered a powerful tool for generative tasks. However, reliance on computationally intensive heuristic optimization for iterative signal refinement results in high training overhead and local optima entrapment.To address these issues, we propose an \underline{A}na\underline{l}ytical Watermark\underline{i}ng Framework for Controllabl\underline{e} Generatio\underline{n} (ALIEN). We develop the first analytical derivation of the time-dependent modulation coefficient that guides the diffusion of watermark residuals to achieve controllable watermark embedding pattern.Experimental results show that ALIEN-Q outperforms the state-of-the-art by 33.1% across 5 quality metrics, and ALIEN-R demonstrates 14.0% improved robustness against generative variant and stability threats compared to the state-of-the-art across 15 distinct conditions. Code can be available at https://anonymous.4open.science/r/ALIEN/.

💡 Research Summary

**
The paper tackles the problem of embedding robust, imperceptible watermarks into images generated by latent diffusion models (LDMs). Existing watermarking approaches for diffusion models fall into three categories: (1) direct latent modification (e.g., Tree‑Ring, RingID), which suffers from semantic drift because the mapping from the initial latent to the final image is highly nonlinear; (2) constrained sampling methods (e.g., Gaussian‑Shading, GaussMarker, PRC) that limit the sampling space to cryptographically defined sub‑spaces, thereby reducing generative diversity; and (3) optimization‑based schemes (e.g., Zodiac, Robin) that iteratively adjust latent variables to balance fidelity and robustness, but incur large computational overhead and are prone to local minima. Moreover, most of these techniques rely on the reverse diffusion process for detection, making them ineffective when irreversible samplers such as DDIM or DPM‑Solver are used, which opens a simple attack vector for watermark removal.

To overcome these limitations, the authors propose ALIEN (Analytic Latent Watermarking for Controllable Generation). The core insight is that the diffusion process is governed by a Variance‑Preserving Stochastic Differential Equation (VP‑SDE). By analyzing the reverse‑time SDE, they derive an exact relationship between the score function ∇ₙ log pₜ(z) and the difference between the current latent zₜ and its denoised estimate ẑ₀: ∇ₙ log pₜ(z) = −(zₜ − √ᾱₜ · ẑ₀)/(1 − ᾱₜ). If a watermark residual δ_w is to be added to the final clean latent (ẑ₀ → ẑ₀ + δ_w), the corresponding change in the score function can be expressed analytically. This yields a closed‑form correction term ΔF_rev that must be added to the reverse‑drift component of the SDE. Practically, the correction reduces to a simple linear modulation of the noise prediction εₜ at each denoising step: εₜ ← εₜ − λ · √(ᾱₜ/(1 − ᾱₜ)) · δ_w, where λ controls watermark strength and the factor √(ᾱₜ/(1 − ᾱₜ)) follows directly from the SDE coefficients. By injecting this term only during a user‑specified interval