ECCV 2026

BiSLW: Bi-Spectral Latent Watermarking for Generative Diffusion Models

PDPM Indian Institute of Information Technology, Jabalpur, India

23bec023@iiitdmj.ac.in

BiSLW embeds a shared watermark identity across complementary semantic and textural frequency bands of diffusion latents, improving robustness to regeneration and common distortions while preserving high visual fidelity.

BiSLW architecture showing the full pipeline: prompt and random noise enter a Latent Diffusion Model, the generated latent z₀ undergoes channel-wise DCT decomposition into low-frequency semantic and high-frequency textural bands, a shared watermark message w is embedded into both via spectral encoders E_L and E_H, the bands are recombined via spectral recombination and inverse DCT, and the watermarked latent z̃₀ is decoded by the VAE into the final watermarked image.

BiSLW decomposes diffusion latents into low-frequency semantic and high-frequency textural components, embeds the same watermark identity into both, and recombines them before VAE decoding.

Overview

Diffusion models have made synthetic imagery increasingly realistic, creating a growing need for reliable provenance and attribution mechanisms. Invisible watermarking offers one approach, but existing methods often operate after image generation, treat latent representations primarily as spatial feature maps, or rely on fixed frequency-domain patterns. These signals can weaken when generated images undergo compression, geometric transformations, or diffusion-based regeneration.

BiSLW introduces a trainable bi-spectral latent watermarking framework that explicitly uses the internal frequency structure of diffusion latents. A channel-wise Discrete Cosine Transform separates the latent representation into complementary low-frequency and high-frequency components. The low-frequency band captures coarse semantic structure, while the high-frequency band represents finer textural information.

A shared watermark message is independently embedded into both spectral regions using lightweight learned networks. Dual spectral decoders recover the identity from both pathways, while a cross-band consistency objective encourages the two representations to encode the same watermark. This creates structured redundancy across complementary generative modes.

Key Contributions

Bi-Spectral Latent Watermarking

BiSLW jointly embeds a watermark across low-frequency semantic and high-frequency textural components of diffusion latents using learned spectral encoders and decoders.

Cross-Band Identity Binding

A consistency objective aligns watermark representations recovered from both spectral pathways, creating redundancy across complementary latent structures.

Robustness with Minimal Overhead

BiSLW improves robustness to common distortions and diffusion regeneration while preserving high perceptual fidelity and introducing approximately 1 ms of embedding overhead.

One Identity, Two Spectral Anchors

BiSLW is motivated by the frequency hierarchy of diffusion latents. Low-frequency coefficients encode broad semantic structure, while higher-frequency coefficients capture local texture and detail. Instead of storing the watermark in only one representational mode, BiSLW anchors the same identity in both.

Spectral decomposition of diffusion latents: a stacked feature maps tensor (H×W×C) is transformed via DCT into a frequency domain representation. The low-frequency region (global semantics) and high-frequency region (texture details) are both connected to the shared watermark message w via separate injection pathways. — The DCT frequency domain of diffusion latents contains a low-frequency region encoding global semantics and a high-frequency region capturing texture details. BiSLW injects the same watermark into both via independent spectral pathways.

LOW FREQUENCY

Global semantics · stronger distortion survival

HIGH FREQUENCY

Fine texture · complementary identity signal

The two bands act as complementary anchors: if an attack disrupts one spectral region more strongly, the second pathway retains additional identity evidence.

Framework

BiSLW embeds watermark information directly into the latent representation produced by the reverse diffusion process, before VAE decoding.

Spectral Decomposition

The generated latent z₀ is transformed using a channel-wise two-dimensional Discrete Cosine Transform. Channel-wise z-score normalization compensates for the large magnitude difference between DC and higher-frequency AC coefficients before the spectrum is partitioned.

The spectral mask radius r separates the representation into low-frequency and high-frequency regions. The decomposition is lossless because the two components reconstruct the complete frequency representation.

Z_freq  =  DCT(z₀)

Z_low   =  Z_freq ⊙ M

Z_high  =  Z_freq ⊙ (1 − M)

Selected operating point: r = 0.25

Bi-Spectral Embedding

The watermark message is injected independently into both bands using lightweight perturbation networks ΔL and ΔH.

Z̃_low   =  Z_low  +  αL · ΔL(Z_low,  w)

Z̃_high  =  Z_high +  αH · ΔH(Z_high, w)

The modified spectral components are recombined and transformed back into latent space using the inverse DCT. The resulting latent is then decoded by the frozen VAE.

αL = 0.8

Stronger low-frequency embedding — low-frequency perturbations survive common distortions more reliably.

αH = 0.3

Lighter high-frequency signal provides complementary redundancy without unnecessarily affecting fine visual detail.

Watermark Extraction

A potentially distorted image is encoded back into latent space and decomposed using the same spectral transformation. Dedicated low- and high-frequency decoders independently estimate the watermark.

ŵ_L  =  D_L(Z'_low)

ŵ_H  =  D_H(Z'_high)

ŵ   =  ½ (ŵ_L + ŵ_H)

Simple averaging is used to fuse the two estimates, providing a parameter-free consensus between the semantic and textural pathways.

Cross-Band Consistency

Independent spectral embedding creates the possibility that the two pathways encode inconsistent identities. BiSLW addresses this using a cross-band consistency loss that encourages both decoders to recover aligned watermark representations.

ℒ_cons  =  ‖ ŵ_L − ŵ_H ‖²₂

This encourages identity information to remain consistent across both spectral regions.

BiSLW training framework showing three phases: Phase 1 (Spectral Watermark Embedding) where the generated latent z₀ undergoes channel-wise DCT decomposition into low-frequency and high-frequency bands, each processed by spectral encoders E_L and E_H conditioned on watermark message w, then recombined via spectral recombination and inverse DCT into watermarked latent z̃₀ decoded by VAE; Phase 2 (Extraction and Robustness) where a watermarked image is attacked then re-encoded by VAE, decomposed by DCT, and processed by dual-band decoders D_L and D_H to produce final estimate ŵ; Phase 3 (Training Losses) showing watermark recovery loss, cross-band consistency loss, latent fidelity loss, and robustness loss. — BiSLW training framework showing the embedding pipeline (Phase 1), extraction under attack (Phase 2), and the four training objectives (Phase 3).

Lightweight by Design

The embedding modules ΔL and ΔH are lightweight convolutional encoder–decoder networks with residual connections. Each contains three convolutional blocks using 3×3 kernels and ReLU activations, with fewer than 2M parameters per module.

Watermark conditioning is implemented through Feature-wise Linear Modulation (FiLM). The binary watermark message is projected to per-channel scaling and bias parameters, allowing a single network to adapt its perturbation pattern to different watermark identities.

The extraction networks DL and DH use three convolutional blocks followed by global average pooling and a fully connected layer that predicts the watermark vector.

Training Configuration

Training epochs40

OptimizerAdamW

Learning rate6 × 10⁻⁵

Batch size8

λw (watermark)1.0

λcons (consistency)0.5

λz (fidelity)2.0

λrob (robustness)1.0

Mask radius r0.25

αL (low-freq strength)0.8

αH (high-freq strength)0.3

HardwareSingle NVIDIA A100

The diffusion backbone and VAE remain fully frozen. Only the four watermark embedding and extraction modules are optimized.

Dataset & Evaluation

BiSLW is trained using 100,000 images from MIRFLICKR-1M, a diverse collection of real-world photographs sourced from Flickr under Creative Commons licenses.

100,000

Training Images

MIRFLICKR-1M

256×256

Training Resolution

Training Epochs

48-bit

Extended Evaluation

Primary 32 & 48 bit

Evaluation Attacks

Robustness is evaluated against ten attack categories, including both common image distortions and diffusion-based regeneration:

Center cropRandom cropResize15° rotationGaussian blurContrast adjustmentBrightness adjustmentJPEG compressionCombined distortionsDiffusion regeneration

Results

BiSLW achieves a strong balance between perceptual fidelity, watermark robustness, generative quality, and computational efficiency.

37.40 dB

PSNR

32-bit · AI-generated

0.98

Combined Attack Acc.

AI-generated images

0.96

Regeneration Acc.

t* = 250

~1 ms

Embedding Overhead

In-generation variant

Comparison with Existing Methods

32-bit watermark · AI-generated images

* In-generation variant (1 ms embedding)

Method	PSNR ↑	SSIM ↑	Embed Time	Clean Acc. ↑	Combined Acc. ↑
DCT-DWT	39.47	0.97	139 ms	0.91	0.51
HiDDeN	32.59	0.95	17 ms	0.91	0.59
SSL	33.23	0.89	870 ms	1.00	0.85
RoSteALS	29.31	0.93	144 ms	1.00	0.50
RivaGAN	40.53	0.98	57 ms	0.99	0.93
Tree-Ring	33.64	0.90	46 ms	0.88	0.81
LaWa*	34.25	0.89	1 ms	1.00	0.97
BiSLW*	37.40	0.91	1 ms	1.00	0.98

BiSLW reaches 37.40 dB PSNR while maintaining 0.98 bit accuracy under the combined attack. Compared with LaWa, BiSLW improves perceptual quality by more than 3 dB while retaining strong robustness and the same approximately 1 ms in-generation embedding overhead. Note that RivaGAN reports higher PSNR (40.53 dB) but substantially lower combined-attack accuracy (0.93).

Robust Across Diverse Distortions

48-bit watermark · AI-generated images

Method	None	C-Crop	R-Crop	Resize	Rotation	Blur	Contrast	Brightness	JPEG	Combined
HiDDeN	0.91	0.91	0.91	0.82	0.79	0.76	0.75	0.74	0.53	0.59
SSL	1.00	0.74	0.72	0.99	0.99	1.00	0.96	0.95	0.99	0.85
Stable Signature	0.99	0.95	0.93	0.96	0.81	0.78	0.97	0.96	0.92	0.92
LaWa	1.00	0.95	0.91	0.99	0.96	0.99	1.00	1.00	1.00	0.97
BiSLW	1.00	0.96	0.90	0.98	0.97	0.99	1.00	1.00	1.00	0.98

BiSLW achieves the highest or joint-highest accuracy across the evaluated distortions and reaches 0.98 accuracy under the combined attack. JPEG, contrast, and brightness transformations retain perfect bit accuracy in this evaluation. LaWa performs slightly better than BiSLW on random crop (0.91 vs 0.90) and resize (0.99 vs 0.98) individually — the strength of BiSLW lies in the overall robustness–fidelity trade-off rather than dominance on every individual distortion.

Preserving the Generative Distribution

Comparison of generation quality and distribution fidelity

Method	FID ↓	CLIP ↑	PSNR ↑	KL Shift ↓	Latent Shift ↓	Regen. 250 ↑	Regen. 500 ↑
Vanilla SD	8.7	0.312	—	—	—	—	—
LaWa*	9.8	0.307	34.25	0.021	0.014	0.94	0.89
Tree-Ring	9.9	0.302	33.64	0.024	0.018	0.88	0.81
BiSLW*	9.0	0.311	37.40	0.018	0.011	0.96	0.92

BiSLW's FID of 9.0 remains close to vanilla Stable Diffusion at 8.7, while its CLIP similarity reaches 0.311. The comparatively small KL and latent shifts indicate that watermark embedding preserves the underlying latent distribution.

Surviving Diffusion Regeneration

Diffusion regeneration is particularly challenging because the image is re-encoded, perturbed with noise, and denoised again, potentially destroying embedded information. BiSLW degrades gradually as regeneration strength increases, outperforming representative watermarking baselines across the evaluated regeneration timesteps.

Line plot showing bit accuracy (%) versus regeneration timestep (50–500) for four methods: LaWa (purple dashed), HiDDeN (red dash-dot), Stable Signature (green dotted), and BiSLW Ours (blue solid). BiSLW consistently outperforms the baselines across all timesteps, remaining above 96% through timestep 250 and reaching approximately 92% at timestep 500. HiDDeN degrades most sharply, falling to below 60% at timestep 500. — Bit accuracy as regeneration strength increases. BiSLW remains above 96% through t* = 250 and reaches 92% at t* = 500, outperforming LaWa, Stable Signature, and HiDDeN across all evaluated timesteps.

The result supports the use of complementary semantic and textural anchors rather than relying on a single latent representation. Low-frequency components are more resilient to the diffusion re-noising process, while high-frequency components contribute complementary evidence where the semantic signal is partially disrupted.

Invisible to the Eye, Recoverable After Attack

Across representative scenes, BiSLW preserves high visual fidelity. Residual maps amplified by ×10 reveal the embedded perturbation, while the corresponding watermarked generations remain visually consistent with the originals.

Original Generation

BiSLW Generation

Residual ×10

PSNR (dB) / SSIM

Original

BiSLW

Residual map amplified ×10 revealing the embedded watermark perturbation — Sample 1 — cityscape aerial view with golden hour lighting

Residual ×10

40.24 / 0.98

Original

BiSLW

Residual map amplified ×10 revealing the embedded watermark perturbation — Sample 2

Residual ×10

38.35 / 0.96

Original

BiSLW

Residual map amplified ×10 revealing the embedded watermark perturbation — Sample 3

Residual ×10

39.11 / 0.96

Original

BiSLW

Residual map amplified ×10 revealing the embedded watermark perturbation — Sample 4

Residual ×10

36.74 / 0.93

Analysis & Ablations

Beyond aggregate accuracy, the experiments examine why the bi-spectral design works and how its key parameters influence the quality–robustness trade-off.

Why Use Both Frequency Bands?

Embedding Strategy	PSNR ↑	SSIM ↑	Combined Attack Acc. ↑
Low-frequency only	38.96	0.92	0.88
High-frequency only	37.12	0.89	0.90
BiSLW (Low + High)	37.71	0.89	0.93

Low-frequency-only embedding provides the highest image quality but weaker combined-attack robustness. High-frequency-only embedding improves robustness slightly but reduces perceptual quality. Combining both bands reaches the strongest combined-attack accuracy, supporting the central hypothesis that semantic and textural pathways provide complementary identity information.

Finding the Spectral Split

Radius r	PSNR ↑	SSIM ↑	Combined Acc. ↑
0.15	36.94	0.87	0.89
0.20	37.33	0.88	0.91
0.25	37.71	0.89	0.93
0.30	37.60	0.89	0.92
0.35	37.42	0.88	0.90

Highlighted: selected r = 0.25

Line plot showing watermark accuracy versus mask radius. The curve peaks at r=0.25 with 93% accuracy, decreasing on both sides toward 89% at r=0.15 and 90% at r=0.35. — Bit accuracy vs. mask radius. Accuracy peaks at r=0.25.

The spectral mask controls how much of the DCT representation belongs to the semantic low-frequency pathway versus the textural high-frequency pathway. Combined-attack accuracy peaks at r=0.25.

An overly narrow low-frequency region provides insufficient semantic coverage, while an overly broad region reduces the capacity available to the high-frequency pathway. The intermediate split provides the best measured balance.

These two ablations capture the main design choices: a balanced low/high spectral split and a mask radius of r = 0.25. The remaining supplementary curves are omitted here to keep the page focused on the core method and headline results.

BibTeX

View the citation entry on GitHub

@inproceedings{pandit2026bislw,
  title     = {BiSLW: Bi-Spectral Latent Watermarking for Generative Diffusion Models},
  author    = {Pandit, Aryan},
  booktitle = {European Conference on Computer Vision (ECCV)},
  year      = {2026}
}

Please update with the final proceedings metadata once available. Do not fabricate DOI, volume, pages, or publisher metadata until the final publication record is issued.