  Watermarking images is critical for tracking image provenance and claiming
ownership. With the advent of generative models, such as stable diffusion, able
to create fake but realistic images, watermarking has become particularly
important, e.g., to make generated images reliably identifiable. Unfortunately,
the very same stable diffusion technology can remove watermarks injected using
existing methods. To address this problem, we present a ZoDiac, which uses a
pre-trained stable diffusion model to inject a watermark into the trainable
latent space, resulting in watermarks that can be reliably detected in the
latent vector, even when attacked. We evaluate ZoDiac on three benchmarks,
MS-COCO, DiffusionDB, and WikiArt, and find that ZoDiac is robust against
state-of-the-art watermark attacks, with a watermark detection rate over 98%
and a false positive rate below 6.4%, outperforming state-of-the-art
watermarking methods. Our research demonstrates that stable diffusion is a
promising approach to robust watermarking, able to withstand even
stable-diffusion-based attacks.
