Generative image systems can now produce realistic, varied pictures at industrial scale, but the same capability makes authorship and origin harder to verify. Conventional post-processing watermarks are easy to deploy, yet they remain separate from the model and may be removed or bypassed. In-generation techniques integrate protection more deeply, but many still carry limited information or lose reliability after compression, cropping, rotation, color adjustment, or targeted removal. The central challenge is therefore to preserve image quality while making provenance information durable enough for real online circulation. Because of these challenges, deeper investigation is needed into watermarking methods that are integrated into the generation process, visually unobtrusive, and resilient to real-world manipulation.
Researchers from Macao Polytechnic University, Guangdong University of Technology, Jinan University, and the Institute of Automation, Chinese Academy of Sciences, reported (DOI： 10.1007/s11633-025-1620-y) the work in Machine Intelligence Research on June 17, 2026. Their study introduces Latent Seal, an encoder-decoder framework developed mainly for closed-source latent diffusion services. It embeds a customized image watermark while content is being generated, then checks suspicious images by extracting and comparing the recovered mark with the provider's original reference, enabling both generative-content detection and copyright verification.
The team built Latent Seal around Stable Diffusion 2.1 and assembled 74,247 generated images and their latent representations from prompts drawn from DiffusionDB and JourneyDB. Of these, 69,247 images were used for training and 5,000 for testing. The system freezes the original denoising network, clones and fine-tunes the variational autoencoder (VAE) decoder, and inserts a latent-space watermark encoder into an intermediate decoding block. A separate decoder learns two outcomes: recover the target watermark from protected images and return a blank output for unprotected images, reducing false detection.
During training, an attack layer simulated ten common distortions, including brightness, contrast and saturation changes, blur, noise, compression, flips, cropping, and rotation. In benchmark tests, watermarked images reached a peak signal-to-noise ratio of 44.29 decibels and a structural similarity index of 0.9933, while recovered watermarks achieved 39.19 decibels, 0.9971 structural similarity, and 0.9992 normalized cross-correlation. Latent Seal also retained the strongest extraction quality across every tested attack and added only 7.33 milliseconds during embedding and 2.26 milliseconds during extraction. Tests on Stable Diffusion XL and Stable Diffusion 3.5 further showed consistent performance across models and image resolutions.
The authors said Latent Seal was designed to make provenance protection part of image creation rather than an optional step added afterward. "The aim is to preserve the visual quality users expect while giving model providers a practical way to verify origin after images have been edited or shared,"they said. "Our results suggest that strong watermark recovery and low visual impact can be achieved together. The next step is to improve recovery for visually complex watermarks and make the framework adaptable to new watermark designs without retraining the full system each time.”
Latent Seal could support provenance checks for commercial image generators, social-media investigations, copyright disputes, content moderation, and digital-asset management, particularly where providers control the underlying model. Its ability to carry a full-color image offers more identifying capacity than simple binary signatures, while its resistance to routine edits could help marks survive ordinary online sharing. However, the current system must be retrained for each new watermark, and recovery becomes modestly less accurate as watermark textures and colors grow more complex. The researchers therefore propose frequency-domain feature fusion and a lightweight adapter for arbitrary watermarks. In practice, the method would work best alongside disclosure policies, metadata standards, and other content-authentication tools rather than as a stand-alone guarantee.
###
References
DOI
10.1007/s11633-025-1620-y
Original Source URL
https://doi.org/10.1007/s11633-025-1620-y
Funding information
This work was funded by the Science and Technology Development Fund of Macau Special Administrative Region (SAR), China (No. 0053/2025/RIB2), and the Macao Polytechnic University, China (No. RP/FCA-04/2024).
About Machine Intelligence Research
Machine Intelligence Research (original title: International Journal of Automation and Computing) is published by Springer and sponsored by the Institute of Automation, Chinese Academy of Sciences. The journal publishes high-quality papers on original theoretical and experimental research, targets special issues on emerging topics, and strives to bridge the gap between theoretical research and practical applications.