1

Proactive Schemes: A Unifying Lens for Downstream Watermarking Applications

Dr. Vishal Asnani · Adobe Research & Michigan State University

Session Overview

2

01

Proactive Schemes

What are Proactive Schemes

Perturbation Types

Applications

KEY PAPERS

Goodfellow et al. ICLR 2015

Asnani et al. CVPR 2022

IJCV Survey 2026

02

Vision Model

Defense

Deepfake Detection

Manipulation Localization

Disrupting Generation

KEY PAPERS

Asnani et al. CVPR 2022

CMUA-WM · AAAI 2022

03

LLM &

Attribution

Token Watermarking

Text Provenance

Proactive Attribution

KEY PAPERS

Kirchenbauer ICML 2023

ProMark CVPR 2024

CustomMark ICCV 2025

TokenTrace CVPR 2026

04

Diffusion · NN

Ownership · Privacy

Diffusion Model WM

Neural Net Ownership

Privacy Cloaking

KEY PAPERS

Stable Signature ICCV 2023

DeepSigns ASPLOS 2019

Fawkes USENIX 2020

Glaze USENIX 2023

05

3D Domain &

Conclusion

NeRF · Mesh · 3DGS

Watermarking

Open Challenges

KEY PAPERS

WateRF CVPR 2024

GS-Hider NeurIPS 2024

What Are Proactive Schemes?

2

Adversarial attacks harming the society¹

Using these perturbations for enhancing the performance?

X

“panda”

90% confidence

Advantages of proactive schemes:

​

1. Improved performance compared to passive schemes

​

• Better generalization performance

​

• Can work for multiple applications

Perturbation Types

2

Tags

Bit sequences

Texts

2D noises

Visual Prompts

Applications

2

In this section: Deepfake Detection & Localization · Disrupting Deepfake Generation

2

Proactive perturbations embedded in real images which enable detection and localization of deepfakes and tampering — shifting forensics from reactive detection to by-design verification.

Vision Models

Defense

v

LLM & Text

Watermarking

Attribution &

Copyright

Diffusion &

NN Ownership

Privacy

Protection

3D Domain

Watermarking

Applications

Applications: Vision Model Defense

2

Deepfake Detection

Embed learnable templates in real images to detect and localize tampering. Source attribution via artificial fingerprints.

Asnani et al. 2022¹/2023² · AdvMark (Wu et al., IJCAI 2024)⁴

Disrupting Deepfake Generation

Proactive perturbations degrade the quality of AI-generated fakes before they are created.

Anti-DreamBooth (Van Le et al., ICCV 2023)⁵ · CMUA-Watermark (Huang et al.)³ · DUAW (Ye et al., 2023)⁶

Tampering Detection & Recovery

Interlocking watermarks detect altered image blocks and enable pixel-level recovery.

Hsu & Tu, 2016⁷ · Haghighi et al., 2018⁸ · Cao et al., 2017⁹ · Lee & Lin, 2008¹⁰

Identity Protection

Dual-trace watermarks (sustainable + erasable) to verify authenticity and protect individuals.

FakeTracer (Sun et al., 2024)¹¹ · FaceGuard (Yang et al., 2021)¹² · FaceSigns (Neekhara et al., TOMM 2024)¹³

Deepfake Detection

2

Proactive Image Manipulation Detection · CVPR 2022 · Asnani et al.¹

Problem

Passive deepfake detectors fail on unseen manipulation types and cannot localize tampered regions.

Method

Embed a learnable 2D perturbation template into real images before distribution. At detection time, the presence and spatial pattern of the template reveals whether the image was tampered.

Key result

Significant improvement over passive detectors: +16% AP on CycleGAN, +32% on GauGAN, +10% average over 12 unseen GMs. Template imperceptible at strength m=30%.

How It Works

1

Real image encrypted

with learnable perturbation

↓

2

Image shared or published

to the internet

↓

3

Manipulation attempt

alters pixel patterns

↓

4

Detector reads perturbation

→ flags tampered images

Deepfake Localization

2

How It Works

↓

↓

↓

Disrupting Deepfake Generation

2

CMUA-Watermark · AAAI 2022 · Huang et al.³

Problem

Deepfake generation models are model-specific — one adversarial perturbation doesn't work across all generators.

Method

Cross-Model Universal Adversarial Watermark. Optimizes a single universal perturbation that disrupts multiple deepfake models simultaneously using a shared gradient.

Key result

One watermark effectively disrupts multiple face-attribute editing GANs (StarGAN, AttGAN, AGGAN, HiSD).

In this section: Embedding Secret Signals in Text · IP Protection for LLMs · Visual Prompt Tuning

5

Perturbations injected into the token distribution during text generation allow provenance tracking and ownership verification of LLM outputs.

Vision Models

Defense

LLM & Text

Watermarking

v

Attribution &

Copyright

Diffusion &

NN Ownership

Privacy

Protection

3D Domain

Watermarking

Applications

Applications: LLM Watermarking & Text Provenance

2

Token-Level (Kirchenbauer et al., ICML 2023)¹⁴

Partition vocabulary into green/red lists. Sample from green tokens at high-entropy positions. Detect via z-statistic.

Lexical Substitution (Yang et al., AAAI 2022)¹⁶

Replace words with semantically equivalent tokens using BERT. Preserves meaning while embedding a hidden template signal.

Sinusoidal / Hash-Based (Zhao et al., ICML 2023)¹⁷

Perturb probability vector with sinusoidal signal + hash. Tree-Ring (Wen et al., NeurIPS 2023)¹⁵: WM embedded in initial diffusion noise.

A Watermark for Large Language Models

2

A Watermark for Large Language Models · ICML 2023 · Kirchenbauer, Geiping, Wen et al.¹⁴

Problem

Impossible to distinguish AI-generated text from human text at scale without model access.

Method

At generation time, partition vocabulary into green/red lists using a hash of the previous token. Bias sampling toward green tokens when text entropy is high. Detect via z-statistic on green token count.

Key result

Detectable from ~128 tokens at false-positive rate 3×10⁻⁵; ~98% sensitivity in 200-token generations. No retraining needed; text quality minimally affected.

How It Works

1

Hash previous token

→ assign green/red list

↓

2

Sample preferentially

from green tokens

↓

3

Text looks natural

but carries hidden signal

↓

4

Detect: z-statistic on

green token frequency

In this section: Neural Network Ownership · Diffusion Model Protection · Artists Protection

8

Vision Models

Defense

LLM & Text

Watermarking

Attribution &

Copyright

v

Diffusion &

NN Ownership

Privacy

Protection

3D Domain

Watermarking

Applications

Perturbations embedded into training data or model weights enable causal attribution — identifying which concepts or datasets a generated image originates from.

Attribution: Artists, Style and Training data

2

ProMark (Asnani et al., CVPR 2024)¹⁹

Encrypt training concepts with bit templates → GenAI model attributes concepts to source artist at inference time.

CustomMark (Asnani et al., ICCVW 2025 — APAI Workshop)²⁰

Customizes a pre-trained diffusion model to embed concept-specific watermarks. Supports robust attribution of hundreds of concepts within a single image without retraining from scratch.

Radioactive Data (Sablayrolles et al., ICML 2020)²²

Class-dependent unit vectors in training data — any model subsequently trained on the protected dataset carries a statistically detectable signature, enabling dataset ownership verification.

TokenTrace (Zhang et al., CVPR 2026)²¹

Multi-concept attribution by simultaneously perturbing text prompt embeddings and initial latent noise — a query-based module then disentangles and independently verifies object and style concepts from a single generated image.

ProMark & CustomMark: Proactive Attribution

2

How It Works

1

Artist image encrypted

with bit-sequence template

↓

2

Encrypted data used

to train GenAI model

↓

3

At inference: model

attributes concept to artist

ProMark vs CustomMark

2

ProMark

CustomMark

TokenTrace

2

Perturbations rooted in diffusion model latents or network weights prove ownership of generative models and their outputs, resisting fine-tuning, pruning, and model extraction.

Applications

Vision Models

Defense

LLM & Text

Watermarking

Attribution &

Copyright

Diffusion &

NN Ownership

v

Privacy

Protection

3D Domain

Watermarking

In this section: Stable Signature · Gaussian Shading · DeepSigns · Passport Layers

Diffusion Model Protection

2

Post-hoc Watermarking

Stable Signature (Fernandez et al., ICCV 2023)²³: fine-tune latent decoder to embed invisible marks. Robust to JPEG, crop, brightness shift.

In-Generation Watermarking

Tree-Ring (Wen et al., NeurIPS 2023)¹⁵: WM in initial diffusion noise.

Fine-Tuning Protection

FreezeAsGuard (Huang et al., 2024)²⁷: selective tensor freeze.

FT-Shield (Cui et al., 2024)²⁵: bi-level opt. + MoE.

DiffuseTrace (Lei et al., 2024)²⁶: invisible latent marks.

DiffusionShield (Cui et al., 2024)²⁴

Embed unique messages into datasets for identification without any model retraining required.

Neural Network Ownership & Fingerprinting

2

DeepSigns (Darvish Rouhani et al., ASPLOS 2019)²⁸

Embeds ownership signal into probability density of activation maps. Resists pruning, fine-tuning, and watermark overwriting.

Passport Layers (Fan et al., NeurIPS 2019)²⁹

Adjusts scale/bias of conv layers with a secret passport. Wrong passport → completely distorted output. Unremovable without performance collapse.

DAWN (Szyller et al., ACM MM 2021)³⁰

Dynamic adversarial watermarking. Changes responses to specific query inputs. Deters model extraction by API querying.

FedIPR (Li et al., TPAMI 2023)³¹

Ownership verification in federated learning without exposing private data. Robust to client selection variance and differential privacy.

Tardos Codes / Traitor Tracing (Furon & Desoubeaux, WIFS 2014)³²

Probabilistic fingerprinting — identifies which user leaked content even if multiple users pool and collude.

Stable Signature

2

The Stable Signature · ICCV 2023 · Fernandez, Couairon, Jégou, Douze & Furon²³

Problem

Watermarks added post-generation are fragile — cropping, JPEG compression, or brightness changes destroy them.

Method

Fine-tune only the latent decoder of a diffusion model to embed an invisible watermark into every generated image. The rest of the model is frozen.

Key result

Robust to crop, JPEG, brightness/contrast, and Gaussian noise. Bit accuracy > 90% under typical attacks. Negligible impact on FID.

How It Works

1

Standard diffusion model

generates latent code

↓

2

Fine-tuned decoder

embeds invisible bit string

↓

3

Image published /

distributed online

↓

4

Extractor recovers bits

→ verifies provenance

In this section: Face Recognition Privacy · Dataset Protection

11

Vision Models

Defense

LLM & Text

Watermarking

Attribution &

Copyright

Diffusion &

NN Ownership

Privacy

Protection

v

3D Domain

Watermarking

Applications

Adversarial perturbations added to personal images cloak identity features, preventing unauthorized facial recognition models from learning or matching the individual.

Applications: Privacy-Preserving Perturbations

2

Fawkes (Shan et al., USENIX Security 2020)³³

Pixel-level cloaks make face images unrecognizable to deep learning models while appearing completely normal to humans.

LowKey (Cherepanova et al., ICLR 2021)³⁴

Stronger adversarial cloaking that breaks commercial facial recognition systems. Targets the most sensitive features in embedding space.

Glaze (Shan et al., USENIX Security 2023)³⁵

Applies barely perceptible "style cloaks" to artworks before they are shared online — when scraped and used as training data, the perturbations mislead diffusion models attempting to mimic the artist's style.

MDP / AugMDP (Li et al., ICASSP 2021)³⁶

Misalign images and labels to confuse unauthorized model training, without harming legitimate use of the data.

Fawkes Privacy Protection

2

How It Works

1

User applies Fawkes

cloak before uploading

↓

2

Photo looks identical

to human viewers

↓

3

Scraper collects photo

and trains on it

↓

4

Recognition system

fails — wrong identity

In this section: NeRF Models · 3D Meshes · 3D Gaussian Splatting

14

Vision Models

Defense

LLM & Text

Watermarking

Attribution &

Copyright

Diffusion &

NN Ownership

Privacy

Protection

3D Domain

Watermarking

v

Applications

Imperceptible perturbations embedded into NeRF representations and Gaussian Splatting scenes carry ownership signals that survive rendering, compression, and format conversion.

Applications: 3D Domain Watermarking

2

3D Meshes (Deep3DMark, Zhu et al., AAAI 2024)³⁸

Attention-based convolution embeds watermarks into mesh geometry. Robust to re-meshing, smoothing, and coordinate noise.

Point Clouds (Liu et al., 2019³⁹; Al-Khafaji & Abhayaratne, ICASSP 2019⁴⁰)

Root Mean Square Curvature (RMSC) values used for embedding. Spectral domain via Graph Fourier Transform.

NeRF Models (WateRF, Jang et al., CVPR 2024)³⁷

2D decoder + NeRF trained jointly with patch loss + discrete wavelet transform. High bit accuracy + rendering quality.

3D Gaussian Splatting (GS-Hider, Zhang et al., NeurIPS 2024)⁴¹

Coupled secured feature attribute with parallel decoders — separates rendered RGB scene from hidden message stream.

SDFs & 3DMMs (FuncMark, Zhu et al., AAAI 2025)⁴²

Binary templates in signed distance fields via spherical partitioning. Neural encoder-decoder for 3D morphable models.

WateRF: Watermarking NeRF

2

WateRF · CVPR 2024 · Jang, Lee, Jang, Kim, Yang & Kim³⁷

Problem

Neural Radiance Fields (NeRF) have no mechanism for ownership verification — anyone can render and redistribute 3D scenes.

How It Works

1

3D scene trained with

watermark-aware loss

↓

2

Scene distributed as

NeRF / 3DGS file

↓

3

Attacker renders from

any viewpoint

↓

4

Owner extracts bits

from rendered frames

GS-Hider: Hiding Messages into 3D Gaussian Splatting

2

Limitations of the Current Techniques

2

Capacity–Robustness–Fidelity Trade-off

No method simultaneously achieves high payload, strong robustness, and imperceptible distortion. Gains on one axis degrade the others.

Inconsistent Evaluation Benchmarks

Attack sets, metrics, and thresholds vary widely across papers. No agreed-upon watermarking benchmark analogous to ImageNet exists.

Privacy Cloaks Degrade Over Time

Fawkes-style cloaks are trained against specific model snapshots. As models are retrained, previously effective cloaks lose their protection.

NN Watermarks Fragile to Fine-Tuning

Weight-regularization watermarks (DeepSigns, Passport Layers) are often erased by a small number of fine-tuning steps with large learning rates.

3D Lacks Robustness Standardization

NeRF, mesh, and Gaussian Splatting papers test different attack types, preventing systematic comparison of embedding schemes across the 3D domain.

Perceptual Models Are Inadequate

PSNR and SSIM are poor proxies for visibility of watermarks. Budgets set via these metrics can still produce visually objectionable artifacts.

Open Challenges

2

Robustness Under Regeneration

Diffusion-based regeneration strips most post-hoc watermarks. Templates must survive SDEdit, super-resolution, and image-to-image at scale.

Adaptive & Informed Adversaries

Attackers with decoder access can surgically remove watermarks. Robustness evaluations rarely account for adversaries who know the embedding scheme.

Scalable Multi-Concept Attribution

Attributing one generated image to multiple training concepts simultaneously — each with independent ownership — remains unsolved.

Cross-Architecture Generalization

Templates optimized for one model often fail when the downstream architecture changes. Universal, architecture-agnostic templates are an open problem.

Statistical Guarantees at Scale

Rigorous false positive control at internet scale demands p-values far below what current theoretical frameworks can provide.

Deployment Overhead

Watermarking every generated image at production scale adds latency. Lightweight embedding with no perceptual cost is a practical bottleneck.

Conclusion

2

Unified Framework

Proactive schemes turn adversarial perturbations into purposeful signals — one optimization principle spanning vision, text, diffusion, 3D, and privacy.

Vision Model Defense

Learnable 2D templates enable proactive deepfake detection and cross-model disruption, consistently outperforming passive forensic baselines.

Text & LLM Provenance

Green-token watermarking (Kirchenbauer et al.)¹⁴ and Tree-Ring¹⁵ achieve robust, training-free attribution of LLM and diffusion model outputs.

Proactive Attribution

ProMark¹⁹, CustomMark²⁰, and TokenTrace²¹ establish causal, verifiable links between training data concepts and generated images at scale.

Privacy & Artist Protection

Fawkes³³ and Glaze³⁵ demonstrate that subtle perturbations protect personal identity and artistic style from unauthorized model training.

Open Challenges Remain

Robustness under regeneration, adaptive adversaries, scalable deployment, and rigorous false positive control are the field's active frontiers.

References

2

Vision Defense

[1] Asnani, Yin, Hassner, Liu, Liu. Proactive Image Manipulation Detection. CVPR 2022, pp. 15386–15395.

[2] Asnani, Yu, Bui, Liu, Agarwal. MaLP: Manipulation Localization Using a Proactive Scheme. CVPR 2023, pp. 12343–12352.

[3] Huang et al. CMUA-Watermark: A Cross-Model Universal Adversarial Watermark for Combating Deepfakes. AAAI 2022, pp. 989–997.

[4] Wu, Liao, Liu, Qin. Are Watermarks Bugs for Deepfake Detectors? Rethinking Proactive Forensics (AdvMark). IJCAI 2024.

[5] Van Le, Phung, Nguyen, Dao, Tran, Tran. Anti-DreamBooth: Protecting Users from Personalized Text-to-Image Synthesis. ICCV 2023.

[6] Ye, Huang, An, Wang. DUAW: Data-free Universal Adversarial Watermark against Stable Diffusion Customization. arXiv:2308.09889, 2023.

[7] Hsu, Tu. Image Tamper Detection and Recovery Using Adaptive Embedding Rules. Measurement 88, 2016, pp. 287–296.

[8] Haghighi, Taherinia, Harati. TRLG: Fragile Blind Quad Watermarking for Image Tamper Detection and Recovery. Information Sciences, 2018.

[9] Cao, An, Wang, Ye, Wang. Hierarchical Recovery for Tampered Images Based on Watermark Self-Embedding. Displays 46, 2017, pp. 52–60.

[10] Lee, Lin. Dual Watermark for Image Tamper Detection and Recovery. Pattern Recognition 41(11), 2008, pp. 3497–3506.

[11] Sun, Qi, Li, Lyu. FakeTracer: Catching Face-swap DeepFakes via Implanting Traces. IEEE TETC, 2024.

[12] Yang, Liang, He, Cao, Gong. FaceGuard: Proactive Deepfake Detection. arXiv:2109.05673, 2021.

[13] Neekhara, Hussain, Zhang, Huang, McAuley, Koushanfar. FaceSigns: Semi-Fragile Neural Watermarks for Media Authentication. ACM TOMM, 2024.

LLM & Generative

[14] Kirchenbauer, Geiping, Wen, Katz, Miers, Goldstein. A Watermark for Large Language Models. ICML 2023, pp. 17061–17084.

[15] Wen, Kirchenbauer, Geiping, Goldstein. Tree-Ring Watermarks: Fingerprints for Diffusion Images. NeurIPS 2023.

[16] Yang, Zhang, Chen, Zhang, Ma, Wang, Yu. Tracing Text Provenance via Context-Aware Lexical Substitution. AAAI 2022, pp. 11613–11621.

[17] Zhao, Wang, Li. Protecting Language Generation Models via Invisible Watermarking. ICML 2023, pp. 42187–42199.

[18] Yang, Zeng, Chen, Fang, Zhang, Yu. Gaussian Shading: Provable Performance-Lossless Image Watermarking. CVPR 2024, pp. 12162–12171.

Attribution & Copyright

[19] Asnani, Collomosse, Bui, Liu, Agarwal. ProMark: Proactive Diffusion Watermarking for Causal Attribution. CVPR 2024, pp. 10802–10811.

[20] Asnani, Collomosse, Liu, Agarwal. CustomMark: Customization of Diffusion Models for Proactive Attribution. ICCVW 2025 (APAI Workshop).

[21] Zhang, Agarwal, Collomosse, Xie, Asnani. TokenTrace: Multi-Concept Attribution through Watermarked Token Recovery. CVPR 2026.

[22] Sablayrolles, Douze, Schmid, Jégou. Radioactive Data: Tracing Through Training. ICML 2020, pp. 8326–8335.

References (continued)

2

Diffusion & NN Ownership

[23] Fernandez, Couairon, Jégou, Douze, Furon. The Stable Signature: Rooting Watermarks in Latent Diffusion Models. ICCV 2023, pp. 22466–22477.

[24] Cui, Ren, Xu, He, Liu, Sun, Xing, Tang. DiffusionShield: A Watermark for Data Copyright Protection against Generative Diffusion Models. arXiv:2306.04642, 2024.

[25] Cui, Ren, Lin, Xu, He, Xing, Lyu, Fan, Liu, Tang. FT-Shield: A Watermark Against Unauthorized Fine-tuning in Text-to-Image Diffusion Models. arXiv:2310.02401, 2024.

[26] Lei, Gai, Yu, et al. DiffuseTrace: A Transparent and Flexible Watermarking Scheme for Latent Diffusion Model. arXiv:2405.02696, 2024.

[27] Huang et al. FreezeAsGuard: Mitigating Illegal Adaptation of Diffusion Models via Selective Tensor Freezing. arXiv:2405.17472, 2024.

[28] Darvish Rouhani, Chen, Koushanfar. DeepSigns: An End-to-End Watermarking Framework for Ownership Protection. ASPLOS 2019, pp. 485–497.

[29] Fan, Ng, Chan. Rethinking Deep Neural Network Ownership Verification: Embedding Passports to Defeat Ambiguity Attacks. NeurIPS 2019, pp. 4714–4723.

[30] Szyller, Atli, Marchal, Asokan. DAWN: Dynamic Adversarial Watermarking of Neural Networks. ACM MM 2021, pp. 4417–4425.

[31] Li, Fan, Gu, Li, Yang. FedIPR: Ownership Verification for Federated Deep Neural Network Models. IEEE TPAMI 45(4), 2023, pp. 4521–4536.

[32] Furon, Desoubeaux. Tardos Codes for Real. IEEE WIFS 2014, pp. 24–29.

Privacy

[33] Shan, Wenger, Zhang, Li, Zheng, Zhao. Fawkes: Protecting Privacy against Unauthorized Deep Learning Models. USENIX Security 2020, pp. 1589–1604.

[34] Cherepanova, Goldblum, Foley, Duan, Dickerson, Taylor, Goldstein. LowKey: Leveraging Adversarial Attacks to Protect Social Media Users from Facial Recognition. ICLR 2021.

[35] Shan, Cryan, Wenger, Zheng, Hanocka, Zhao. Glaze: Protecting Artists from Style Mimicry by Text-to-Image Models. USENIX Security 2023, pp. 2187–2204.

[36] Li, Liu, Jiang, Xia. Visual Privacy Protection via Mapping Distortion (MDP/AugMDP). ICASSP 2021, pp. 3740–3744.

3D Domain

[37] Jang, Lee, Jang, Kim, Yang, Kim. WateRF: Robust Watermarks in Radiance Fields for Protection of Copyrights. CVPR 2024, pp. 12087–12097.

[38] Zhu, Ye, Luo, Wei. Rethinking Mesh Watermark: Towards Highly Robust and Adaptable Deep 3D Mesh Watermarking (Deep3DMark). AAAI 2024.

[39] Liu, Yang, Ma, He, Wang. A Novel Watermarking Algorithm for 3D Point-Cloud Models Based on Vertex Curvature. Int. J. Distrib. Sensor Networks, 2019.

[40] Al-Khafaji, Abhayaratne. Graph Spectral Domain Blind Watermarking. ICASSP 2019, pp. 2492–2496.

[41] Zhang, Liu, Lu, Yu, Bao. GS-Hider: Hiding Messages into 3D Gaussian Splatting. NeurIPS 2024.

[42] Zhu, Ye, Dong, Luo, Zhang, Wei. Mesh Watermark Removal Attack and Mitigation: A Novel Perspective of Function Space (FuncMark). AAAI 2025.

Background

[43] Goodfellow, Shlens, Szegedy. Explaining and Harnessing Adversarial Examples. ICLR 2015.