SLICE: Semantic Latent Injection via Compartmentalized Embedding for Image Watermarking¶

Conference: CVPR 2026 arXiv: 2603.12749 Code: Unavailable Area: Image Generation Keywords: Diffusion model watermarking, semantic watermarking, tamper localization, image provenance, privacy & security

TL;DR¶

SLICE is a semantic watermarking framework that decomposes image semantics into four factors—subject, environment, action, and detail—and binds each factor to a distinct spatial partition of the initial Gaussian noise. This enables a three-state verification mechanism that not only detects watermark presence but also localizes semantic tampering. Against the strongest CSI attack, SLICE achieves an attack success rate (ASR) of only 19%, compared to 81% for SEAL.

Background & Motivation¶

Background: Diffusion model watermarking has evolved from post-processing (HiNet) → model fine-tuning (Stable Signature) → training-free noise-space injection (Tree-Ring, Gaussian Shading). SEAL further introduced semantic awareness, making detection dependent on image content rather than fixed global patterns.

Limitations of Prior Work: Existing semantic watermarking methods (e.g., SEAL) rely on a single global semantic binding. The CSI attack demonstrates that adversaries can perform locally coherent semantic edits (e.g., modifying only the subject) to circumvent global watermark verification, achieving an ASR as high as 81%. Content-agnostic watermarks (Tree-Ring, etc.) collapse almost entirely under generative forgery attacks (100% ASR).

Key Challenge: Image semantics are not a monolithic whole but are composed of partially independent semantic factors. Global binding cannot distinguish cases where "the overall semantics appear consistent but a specific local factor has been maliciously altered."

Goal: (1) How to bind watermarks to fine-grained semantic factors rather than global semantics? (2) How to enable not only tamper detection but also tamper localization? (3) How to provide formal theoretical security guarantees?

Key Insight: Exploit the spatial decomposability of the diffusion model's latent space—different spatial regions can independently carry watermark signals for distinct semantics.

Core Idea: Decouple image semantics into four factors and bind each independently to a separate spatial partition of the noise latent space, so that a local semantic edit causes verification failure only in the corresponding partition, enabling tamper localization.

Method¶

Overall Architecture¶

SLICE consists of two phases: generation and detection. In the generation phase, a VLM extracts a four-dimensional semantic description → a keyed hash maps each semantic factor to a spatial partition of the noise latent space → the diffusion model generates the watermarked image from this noise. In the detection phase, semantics are re-extracted from the suspect image → a reference noise is reconstructed → DDIM inversion retrieves the actual noise → partition-wise comparison is performed → a three-state verdict is produced.

Key Designs¶

Spatially-Partitioned Semantic Injection:
- Function: Partition the latent grid into four non-overlapping regions, each bound to one semantic factor.
- Mechanism: The semantic factor set is \(\mathcal{K} = \{sub, env, act, det\}\). A VLM with meta-prompt \(\mathcal{P}_{meta}\) extracts a four-dimensional description \(\mathcal{S} = \{s_k\}\) from the image. For each spatial position \(p \in \mathcal{R}_k\), a text encoder and keyed hash generate the noise value \(\mathbf{z}_T(p) = H(E(s_k), p, \sigma)\).
- Design Motivation: A local semantic edit disrupts noise matching only in the corresponding partition, leaving others intact. This fundamentally addresses the insensitivity of global semantic binding to local tampering.
Three-State Detection Mechanism:
- Function: Distinguish among three states—"intact," "locally tampered," and "unwatermarked."
- Mechanism: Per-position distance is defined as \(d(p) = \|\mathbf{z}_{inv}(p) - \hat{\mathbf{z}}_T(p)\|_2\), from which regional match rates \(m_k\) and a global match rate \(m_g\) are computed. State I (intact): \(m_g \geq \tau_g\) and all \(m_k \geq \tau_k\); State II (locally tampered): \(m_g \geq \tau_g\) but some \(m_k < \tau_k\)—failing partitions directly indicate which semantic factors were altered; State III (unwatermarked): \(m_g < \tau_g\).
- Design Motivation: Traditional binary decisions (watermark present/absent) cannot diagnose the type of tampering; the three-state verdict provides richer provenance information.
Theoretical Security Guarantees:
- Function: Formally prove the robustness of tamper localization and the exponential decay of false acceptance rates.
- Mechanism: Theorem 4.3 proves, under bounded DDIM inversion error and a semantic separation assumption, that untampered factors maintain high match rates \(m_k \geq 1 - \beta_k - \gamma_k\), while tampered factors exhibit significantly lower match rates. Theorem 4.4 proves that the false acceptance probability for unwatermarked images decays exponentially with the number of latent positions.
- Design Motivation: Providing mathematical guarantees beyond empirical validation enhances the credibility of the scheme.

Loss & Training¶

SLICE is entirely training-free. Image generation uses Stable Diffusion V2; semantic extraction uses Qwen3-VL with Chinese prompts (experiments show that Chinese prompts achieve the highest semantic extraction stability on Qwen, with cosine similarity approaching 1.0).

Key Experimental Results¶

Main Results (ASR% ↓, lower is better)¶

Method	LFA	RPM	CSI
Gaussian Shading	100	100	100
Tree-Ring	93.81	100	100
WIND	100	100	100
SEAL	0	7	81
SLICE	0	5	19

Robustness to Common Perturbations¶

Transform	Clean	Rotate	JPEG	Blur	Noise	Brightness
Accuracy	1.000	1.000	0.990	0.988	0.993	0.941

Key Findings¶

Against the strongest CSI attack, ASR is reduced from 81% (SEAL) to 19% (SLICE), a more than 4× improvement.
Content-agnostic watermarks offer no defense against generative forgery (ASR ≈ 100%); SLICE fully resolves this vulnerability.
CLIP score decreases minimally (33.034 → 32.789), indicating negligible impact on image quality from watermark injection.
Chinese prompts achieve the highest semantic stability on Qwen3-VL, with cosine similarity approaching 1.0 across all four dimensions.

Highlights & Insights¶

Compartmentalized Semantic Design: Replacing "monolithic global binding" with "compartmentalized binding" is the fundamental solution to local tampering—each semantic factor is confined to its own partition, with no cross-interference.
Three-State Verification: Surpassing the conventional binary watermark decision, the three-state mechanism provides tamper localization capability, which has significant practical value for content provenance tracking and copyright dispute resolution.
Dual Guarantee—Theory and Experiment: Beyond empirical results, the framework is supported by an exponential decay theorem for false acceptance rates and a formal robustness proof for tamper localization.

Limitations & Future Work¶

Semantic extraction relies on the stability of the VLM (Qwen3-VL); different VLMs or version upgrades may affect consistency.
The number of partitions is fixed at four, which may lack flexibility for images with more complex semantic structures.
Cumulative error from DDIM inversion may increase under high noise step counts or complex architectures.

vs. SEAL: SEAL uses single global semantic binding; SLICE uses four-factor compartmentalized binding. Under CSI attack, ASR drops from 81% to 19%.
vs. Tree-Ring / Gaussian Shading: Content-agnostic watermarks offer no defense against generative forgery (100% ASR); SLICE resolves this entirely through semantic awareness.
Semantic Watermarking → Content Trustworthiness: SLICE's three-state verdict opens a new direction toward "trustworthy AI-generated content."

Rating¶

Novelty: ⭐⭐⭐⭐⭐ Compartmentalized semantic watermarking is a fundamentally new approach; three-state verification is unprecedented in the watermarking literature.
Experimental Thoroughness: ⭐⭐⭐⭐ Covers diverse attacks and perturbations, supported by theoretical analysis.
Writing Quality: ⭐⭐⭐⭐⭐ Theoretical derivations are rigorous; visualization cases are intuitive.
Value: ⭐⭐⭐⭐⭐ Significant contribution to AI content provenance and trustworthy generation.