{"about":{"site":"https://codewithpapers.app","non_affiliation":"Code with Papers and Syntology are not affiliated with, endorsed by, or sponsored by Papers with Code, Meta, or the pwc-archive mirror.","licence":"CC BY-SA 4.0","licence_url":"https://creativecommons.org/licenses/by-sa/4.0/legalcode","attribution":"https://codewithpapers.app/attribution","modified":"archive material modified by Syntology; see the attribution page"},"url":"/paper/tree-ring-watermarks-fingerprints-for","title":"Tree-Ring Watermarks: Fingerprints for Diffusion Images that are Invisible and Robust","arxiv_id":"2305.20030","date":"2023-05-31","proceeding":null,"authors":["Yuxin Wen","John Kirchenbauer","Jonas Geiping","Tom Goldstein"],"abstract":"Watermarking the outputs of generative models is a crucial technique for tracing copyright and preventing potential harm from AI-generated content. In this paper, we introduce a novel technique called Tree-Ring Watermarking that robustly fingerprints diffusion model outputs. Unlike existing methods that perform post-hoc modifications to images after sampling, Tree-Ring Watermarking subtly influences the entire sampling process, resulting in a model fingerprint that is invisible to humans. The watermark embeds a pattern into the initial noise vector used for sampling. These patterns are structured in Fourier space so that they are invariant to convolutions, crops, dilations, flips, and rotations. After image generation, the watermark signal is detected by inverting the diffusion process to retrieve the noise vector, which is then checked for the embedded signal. We demonstrate that this technique can be easily applied to arbitrary diffusion models, including text-conditioned Stable Diffusion, as a plug-in with negligible loss in FID. Our watermark is semantically hidden in the image space and is far more robust than watermarking alternatives that are currently deployed. Code is available at https://github.com/YuxinWenRick/tree-ring-watermark.","url_abs":"https://arxiv.org/abs/2305.20030v3","url_pdf":"https://arxiv.org/pdf/2305.20030v3.pdf","source":{"archive":"pwc-archive (Hugging Face), CC BY-SA 4.0","snapshot":"2025-07-28","licence_url":"https://creativecommons.org/licenses/by-sa/4.0/legalcode","row_kind":"abstracts"},"code_links":[{"paper_slug":"tree-ring-watermarks-fingerprints-for","repo_url":"https://github.com/YuxinWenRick/tree-ring-watermark","is_official":1,"mentioned_in_paper":1,"mentioned_in_github":1,"framework":"pytorch","reach":{"status":"ok","spdx":"MIT"}},{"paper_slug":"tree-ring-watermarks-fingerprints-for","repo_url":"https://github.com/deepvk/metr","is_official":0,"mentioned_in_paper":0,"mentioned_in_github":1,"framework":"pytorch","reach":null}],"tasks":[{"task_slug":"image-generation","task_name":"Image Generation"}],"methods":[{"method_slug":"diffusion","method_name":"Diffusion"}],"datasets_introduced":[],"methods_introduced":[],"results":[],"syntology":{"atlas_url":"https://app.syntology.ai/?focus=2305.20030","mcp":{"get_harvested_code_for_paper":{"arxiv_id":"2305.20030"}},"developers":"https://syntology.ai/developers","read_at":"2026-09-24T18:15:14+00:00","read_at_is":"when the build read Syntology's graph, not when any sample ran","claim":"Per-sample execution status on synthesized fixtures; not a correctness claim about the paper. Samples come from repositories linked to the paper, official or community; repo_kind says which.","repos":[{"provenance":"external:paperswithcode_snapshot_2025-07-28","url":"https://github.com/YuxinWenRick/tree-ring-watermark","reach":{"status":"ok","spdx":"MIT"}},{"provenance":"external:paperswithcode_snapshot_2025-07-28","url":"https://github.com/deepvk/metr","reach":null}],"summary":{"ran_draft_wrong":2,"ran":1,"ran_honours":1,"unverified":5},"by_repo_kind":{"official":{"samples":8,"ran":3,"repositories":1},"listed":{"samples":1,"ran":1,"repositories":1}},"repo_kind_vocabulary":{"official":"The archive marks this repository official for the paper","named_in_paper":"The archive records that the paper mentions this repository; it is not marked official","listed":"In the archive's code links for this paper, not marked official and not recorded as mentioned in the paper","found_in_text":"Syntology found this repository in the paper's own text; whether it is the authors' implementation is not asserted","community":"Not in the archive's code links for this paper; a community repository Syntology harvested"},"n_pointer_only_for_licence":0,"samples":[{"code_sha256_prefix":"cfd76fd0d89574a4","entry":"approx_standard_normal_cdf","repo":"YuxinWenRick/tree-ring-watermark","repo_kind":"official","path":"guided_diffusion/losses.py","file_url":"https://github.com/YuxinWenRick/tree-ring-watermark/blob/HEAD/guided_diffusion/losses.py","link_basis":"harvester_set","language":"python","status":"ran_draft_wrong","verification_level":1,"contract_check":"MISDECLARED","metamorphic_tier":"invariant","behaviour_fingerprint":true,"licence":"MIT","inline_ok":true,"mcp_get_code":{"code_sha256":"cfd76fd0d89574a4"}},{"code_sha256_prefix":"cd33283d615fb3d7","entry":"discretized_gaussian_log_likelihood","repo":"YuxinWenRick/tree-ring-watermark","repo_kind":"official","path":"guided_diffusion/losses.py","file_url":"https://github.com/YuxinWenRick/tree-ring-watermark/blob/HEAD/guided_diffusion/losses.py","link_basis":"harvester_set","language":"python","status":"ran_draft_wrong","verification_level":1,"contract_check":"MISDECLARED","metamorphic_tier":"invariant","behaviour_fingerprint":false,"licence":"MIT","inline_ok":true,"mcp_get_code":{"code_sha256":"cd33283d615fb3d7"}},{"code_sha256_prefix":"df9010a43659b4f5","entry":"import_from_stable_sig","repo":"deepvk/metr","repo_kind":"listed","path":"src/metr/finetune_ldm_decoder.py","file_url":"https://github.com/deepvk/metr/blob/HEAD/src/metr/finetune_ldm_decoder.py","link_basis":"first_harvest_node","language":"python","status":"ran","verification_level":1,"contract_check":null,"metamorphic_tier":"well_formed","behaviour_fingerprint":false,"licence":"Apache-2.0","inline_ok":true,"mcp_get_code":{"code_sha256":"df9010a43659b4f5"}},{"code_sha256_prefix":"cf2798b666b231ca","entry":"normal_kl","repo":"YuxinWenRick/tree-ring-watermark","repo_kind":"official","path":"guided_diffusion/losses.py","file_url":"https://github.com/YuxinWenRick/tree-ring-watermark/blob/HEAD/guided_diffusion/losses.py","link_basis":"harvester_set","language":"python","status":"ran_honours","verification_level":1,"contract_check":"HONOURS","metamorphic_tier":"invariant","behaviour_fingerprint":true,"licence":"MIT","inline_ok":true,"mcp_get_code":{"code_sha256":"cf2798b666b231ca"}},{"code_sha256_prefix":"b9d521d7021e46bb","entry":"backward_ddim","repo":"YuxinWenRick/tree-ring-watermark","repo_kind":"official","path":"inverse_stable_diffusion.py","file_url":"https://github.com/YuxinWenRick/tree-ring-watermark/blob/HEAD/inverse_stable_diffusion.py","link_basis":"plan_row","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"MIT","inline_ok":true,"mcp_get_code":{"code_sha256":"b9d521d7021e46bb"}},{"code_sha256_prefix":"7a4c2a17586b3e13","entry":"detect","repo":"YuxinWenRick/tree-ring-watermark","repo_kind":"official","path":"src/tree_ring_watermark/_detect.py","file_url":"https://github.com/YuxinWenRick/tree-ring-watermark/blob/HEAD/src/tree_ring_watermark/_detect.py","link_basis":"first_harvest_node","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"MIT","inline_ok":true,"mcp_get_code":{"code_sha256":"7a4c2a17586b3e13"}},{"code_sha256_prefix":"3b89ab9f937dccdd","entry":"forward_ddim","repo":"YuxinWenRick/tree-ring-watermark","repo_kind":"official","path":"inverse_stable_diffusion.py","file_url":"https://github.com/YuxinWenRick/tree-ring-watermark/blob/HEAD/inverse_stable_diffusion.py","link_basis":"plan_row","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"MIT","inline_ok":true,"mcp_get_code":{"code_sha256":"3b89ab9f937dccdd"}},{"code_sha256_prefix":"648e9cd35d6b74d0","entry":"get_noise","repo":"YuxinWenRick/tree-ring-watermark","repo_kind":"official","path":"src/tree_ring_watermark/_get_noise.py","file_url":"https://github.com/YuxinWenRick/tree-ring-watermark/blob/HEAD/src/tree_ring_watermark/_get_noise.py","link_basis":"first_harvest_node","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"MIT","inline_ok":true,"mcp_get_code":{"code_sha256":"648e9cd35d6b74d0"}},{"code_sha256_prefix":"3576785daaa257bd","entry":"load_keys","repo":"YuxinWenRick/tree-ring-watermark","repo_kind":"official","path":"src/tree_ring_watermark/_detect.py","file_url":"https://github.com/YuxinWenRick/tree-ring-watermark/blob/HEAD/src/tree_ring_watermark/_detect.py","link_basis":"first_harvest_node","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"MIT","inline_ok":true,"mcp_get_code":{"code_sha256":"3576785daaa257bd"}}]},"arxiv_metadata":null,"syntology_extracted_results":null}