Gaussian Shannon: High-Precision Diffusion Model Watermarking Based on Communication

Conference: CVPR 2026 arXiv: 2603.26167 Code: https://github.com/Rambo-Yi/Gaussian-Shannon Area: Image Generation / AI Security Keywords: Diffusion model watermarking, communication theory, error-correcting codes, bit-exact recovery, copyright protection

TL;DR

This paper models the watermark embedding and extraction process in diffusion models as communication over a noisy channel, and proposes the Gaussian Shannon framework. By cascading majority voting and LDPC error-correcting codes, the framework achieves bit-exact watermark recovery (rather than mere threshold-based detection), attaining state-of-the-art bit accuracy and detection rates across three Stable Diffusion versions and seven types of perturbation.

Background & Motivation

1. Background: High-quality images generated by diffusion models pose risks of copyright infringement and misinformation propagation. Watermarking is a critical line of defense for tracing and authenticating AI-generated content. Existing methods such as Tree-Ring, GaussianShading, and PRCW have achieved reasonably strong watermark detection.
2. Limitations of Prior Work: Existing methods rely on threshold matching for detection—they only determine whether a watermark is present, without precisely recovering each individual bit. When watermarks need to carry structured data (e.g., license information, creator identity, timestamps, usage permissions, cryptographic verification tokens), fuzzy matching schemes are fundamentally insufficient.
3. Key Challenge: The diffusion model's generation process inherently introduces prediction errors; additionally, images suffer from various attacks during distribution (JPEG compression, Gaussian noise, etc.), causing the initial noise recovered via DDIM Inversion to deviate from the noise used at embedding time. These deviations manifest as two distinct error modes: local bit flips (large-scale errors concentrated in local regions of the latent space) and global random perturbations (random errors scattered throughout the entire latent space).
4. Goal: How can lossless watermark recovery (100% bit accuracy) be achieved while maintaining robust detection?
5. Key Insight: The watermark embedding–extraction process is analogized to the transmission and reception of a message over a noisy channel in classical communication systems, leveraging error-correction and redundancy mechanisms from communication theory to ensure reliable transmission.
6. Core Idea: Cascaded majority voting (to combat local errors) and LDPC error-correcting codes (to combat global random noise) are used to achieve bit-exact watermark recovery in diffusion models.

Method

Overall Architecture

Embedding stage: Binary watermark \(\mathbf{w}\) → LDPC encoding to obtain codeword \(\mathbf{c}\) → redundancy expansion to \(\mathbf{c}_R\) (matching the latent space dimensionality) → pseudo-random modulation to generate signal \(\mathbf{s}\) (preserving the standard Gaussian distribution) → sampling initial noise \(\mathbf{z}_T\) according to \(\mathbf{s}\) → diffusion model denoising to produce the watermarked image. Extraction stage: Image → DDIM Inversion to recover \(\mathbf{z}_T\) → demodulation to obtain \(\mathbf{c}'_R\) → attempt direct LDPC decoding on each codeword replica → if unsuccessful, aggregate via majority voting and attempt LDPC decoding again → recover \(\mathbf{w}\).

Key Designs

1. Communication-Theoretic Watermarking Framework

   • Function: Reformulates the diffusion model watermarking problem as reliable communication over a noisy channel.
   • Mechanism: The diffusion model's sampling → DDIM Inversion pipeline is equivalent to the input → output process of a message over a noisy channel. The "channel noise" originates from two sources: neural network prediction error (intrinsic noise) and adversarial attacks during image distribution (extrinsic noise). The overall system constitutes a Binary Input AWGN Channel (BIAWGN). Based on Shannon's theorem, reliable transmission can be achieved through appropriate coding schemes as long as the channel capacity permits.
   • Design Motivation: Prior methods did not systematically analyze watermarking system reliability from a communication-theoretic perspective, making bit-level accuracy guarantees unattainable. Communication theory provides mature tools for analyzing and combating channel noise.

2. Redundancy Expansion + Pseudo-Random Modulation Embedding Scheme

   • Function: Embeds the encoded watermark into the initial noise without degrading generation quality.
   • Mechanism: The LDPC-encoded codeword \(\mathbf{c}\) (length \(n\)) is repeated \(R = P/n\) times (\(P\) being the latent space dimensionality) to obtain \(\mathbf{c}_R\). This is then pseudo-randomly modulated using key \(K\) to produce signal \(\mathbf{s}\). For each position \(j\), a sample \(\epsilon_j \sim \mathcal{N}(0,1)\) is drawn, and the initial noise is defined as \(z_T^j = (-1)^{1-s_j} \cdot |\epsilon_j|\). Since the positive and negative half-axes each account for 50%, \(z_T\) still follows the standard Gaussian distribution—generation quality is completely unaffected.
   • Design Motivation: Redundancy expansion provides multiple replicas required for majority voting; pseudo-random modulation ensures distributional consistency, avoiding the quality degradation caused by methods such as Tree-Ring that modify the noise distribution.

3. Cascaded Error-Correction: Majority Voting + LDPC Decoding

   • Function: Combats two distinct types of channel errors to achieve bit-exact recovery.
   • Mechanism: The extraction stage applies two-layer error correction. First layer: If a codeword replica directly satisfies the LDPC parity-check equations \(H \cdot c_r^T = 0 \pmod{2}\), its information bits are immediately taken as the watermark. Second layer: If no replica passes the parity check, majority voting is applied bit-wise across \(R\) replicas, \(\tilde{c}_i = \text{mode}\{c_{1i}, c_{2i}, ..., c_{ri}\}\), to obtain an aggregated codeword \(\tilde{c}\), which is then submitted to LDPC decoding again. The error rate of majority voting decays exponentially: \(P_{error}^{\text{maj}} \leq \exp(-m \cdot D(1/2 \| p))\); when the original error rate \(p < 0.5\), increasing the redundancy count \(m\) rapidly reduces the error rate. LDPC then handles the remaining random errors after the channel quality has been improved by voting. The two mechanisms are complementary—majority voting excels at handling locally concentrated errors, while LDPC excels at correcting dispersed random errors.
   • Design Motivation: A single error-correction mechanism cannot simultaneously handle both error modes. The visualization in Figure 4 clearly shows that local errors (large black regions in the latent space) require majority voting for compensation, while global random errors (scattered black dots) require LDPC for correction.

Loss & Training

This method requires no training or fine-tuning—it is entirely training-free. DDIM sampling with 50 steps and DDIM Inversion with 50 steps are used (empty prompt, guidance scale = 1). Default parameters: redundancy \(m = 16\), LDPC code rate \(R = 0.25\), channel SNR estimate 0 dB, watermark capacity 256 bits.

Key Experimental Results

Main Results (Average performance across three SD versions: TPR@10⁻⁶FPR / BitAcc / TPR@BitAcc.100%)

Method	TPR@FPR (w/o noise / w/ noise)	BitAcc (w/o noise / w/ noise)	TPR@100%Acc (w/o noise / w/ noise)
GaussianShading	1.000 / 0.999	0.9999 / 0.9703	0.989 / 0.389
PRCW (ICLR 2025)	1.000 / 0.845	1.0000 / 0.9176	1.000 / 0.836
Ours	1.000 / 1.000	1.0000 / 0.9928	1.000 / 0.966

Ablation Study

Noise Condition	Code rate 1/6	1/5	1/4	1/3	1/2
TPR@100% (w/o noise)	1.000	0.999	1.000	1.000	1.000
TPR@100% (w/ noise)	0.781	0.873	0.965	0.852	0.795

Noise Condition	Redundancy 16	8	4	2	1
TPR@100% (w/o noise)	1.000	1.000	1.000	1.000	0.929
TPR@100% (w/ noise)	0.965	0.739	0.592	0.314	0.187

Key Findings

• TPR@BitAcc.100% is the most critical metric: Under noisy conditions, GaussianShading achieves complete recovery of all 256 bits for only 38.9% of images; PRCW achieves 83.6%; the proposed method achieves 96.6%—a substantial gap in real-world copyright authentication scenarios.
• Code rate \(R = 1/4\) is the sweet spot: higher rates provide insufficient redundancy, while lower rates lead to structural defects in the LDPC parity-check matrix that cause decoding failures.
• The effect of redundancy is pronounced: at \(m = 16\), the majority voting rate is extremely low (0.028), indicating that most codewords can be decoded successfully by LDPC directly; at \(m = 1\) (no redundancy, voting impossible), TPR@100% drops to 18.7%.
• In terms of image quality (FID, CLIP Score), all semantic watermarking methods show virtually no difference, confirming that the proposed method is quality-free.
• Strong robustness is maintained under advanced attacks (VAE compression, diffusion regeneration, embedding attacks).

Highlights & Insights

• Deep integration of the communication-theoretic perspective: Rather than simply borrowing error-correcting codes, the paper systematically analyzes two error modes and their complementary correction strategies from a channel model perspective. The theoretical analysis and experimental validation are highly consistent. This cross-disciplinary methodology is instructive.
• Practical value of bit-exact recovery: Previous watermarks could only answer "Was this AI-generated?", whereas Gaussian Shannon can answer "Who owns the copyright to this image, and what are the terms of use?"—advancing from detection to information parsing.
• Zero-cost embedding: By preserving the noise distribution through pseudo-random modulation, generation quality incurs zero degradation and no fine-tuning is required—inheriting and advancing the approach of GaussianShading.

Limitations & Future Work

• The current implementation uses regular LDPC codes; structural defects cause performance degradation at code rates below 1/4. The authors note that irregular LDPC codes could alleviate this issue, but leave it as future work.
• The method depends on the accuracy of DDIM Inversion—different samplers (e.g., DPM-Solver, Euler) yield varying recovery precision, affecting channel quality.
• The 256-bit watermark capacity may be insufficient for structured data scenarios (e.g., embedding a complete JSON license).
• The channel SNR estimate is fixed at 0 dB; while experiments demonstrate this is a reasonable default, adaptive SNR estimation may perform better under extreme conditions.

Related Work & Insights

• vs. GaussianShading (CVPR 2024): Gaussian Shannon builds upon GaussianShading by adding a cascaded error-correction mechanism consisting of LDPC coding and majority voting. Although GaussianShading achieves high BitAcc (0.97), it cannot guarantee bit-exact recovery, and its TPR@100% is only 39%.
• vs. PRCW (ICLR 2025): PRCW also employs error-correcting codes but lacks a cascaded majority voting mechanism to handle local errors. Under noisy conditions, Gaussian Shannon's TPR@100% exceeds PRCW by 13 percentage points.
• vs. Tree-Ring: Tree-Ring embeds watermarks in the frequency domain, constraining sampling randomness, and cannot achieve bit-exact recovery.
• The broader implication of this work is that information theory and communication theory offer rich application potential in AI security—tools such as channel coding and rate-distortion theory can systematically improve the reliability of tasks including watermarking and provenance tracking.

Rating

• Novelty: ⭐⭐⭐⭐ The communication-theoretic perspective is creative and the cascaded error-correction design is well-motivated; however, the core idea (redundancy + error correction) is classical in the communications literature.
• Experimental Thoroughness: ⭐⭐⭐⭐⭐ Three SD versions × seven perturbation types × extensive ablations provide very comprehensive coverage; advanced attack experiments are also included.
• Writing Quality: ⭐⭐⭐⭐ The communication-theoretic analogy is explained clearly, and the error visualization in Figure 4 is highly intuitive.
• Value: ⭐⭐⭐⭐⭐ Bit-exact recovery is critical for practical deployment in copyright protection, filling an important gap.

Related Papers

• [CVPR 2026] SLICE: Semantic Latent Injection via Compartmentalized Embedding for Image Watermarking
• [CVPR 2026] Editing Away the Evidence: Diffusion-Based Image Manipulation and the Failure Modes of Robust Watermarking
• [CVPR 2026] Towards Robust Content Watermarking Against Removal and Forgery Attacks
• [CVPR 2026] SPDMark: Selective Parameter Displacement for Robust Video Watermarking
• [CVPR 2026] High-Fidelity Diffusion Face Swapping with ID-Constrained Facial Conditioning