A research team has introduced Latent Seal, a watermarking framework that integrates high-capacity image watermarks during the generation process of latent diffusion models (LDMs), rather than appending them post-creation. This approach aims to bolster copyright protection and provenance verification for AI-generated content while maintaining visual fidelity.
The method employs a latent-space encoder that embeds a red-green-blue (RGB) watermark into the model's internal representation, paired with a decoder that extracts the mark from protected images. Tests demonstrate that the technique remains highly accurate under common edits and distortions, providing a practical solution for traceable generative-image systems.
Generative image systems can now produce realistic images at scale, but this capability complicates authorship verification. Conventional post-processing watermarks are easy to implement but can be removed or bypassed. In-generation methods integrate protection more deeply, yet many suffer from limited information capacity or reliability issues after compression, cropping, or other manipulations. The challenge is to preserve image quality while ensuring watermark durability in real-world scenarios.
Researchers from Macao Polytechnic University, Guangdong University of Technology, Jinan University, and the Institute of Automation, Chinese Academy of Sciences, reported their work in Machine Intelligence Research on June 17, 2026. The study introduces Latent Seal, an encoder-decoder framework designed primarily for closed-source latent diffusion services. It embeds a custom watermark during image generation and verifies origin by extracting and comparing the recovered mark with the provider's reference, enabling both content detection and copyright verification.
The team built Latent Seal around Stable Diffusion 2.1, using 74,247 generated images and latent representations from prompts in DiffusionDB and JourneyDB. Of these, 69,247 images were used for training and 5,000 for testing. The system freezes the original denoising network, clones and fine-tunes the variational autoencoder (VAE) decoder, and inserts a watermark encoder into an intermediate decoding block. A separate decoder learns to recover the watermark from protected images and return a blank output for unprotected ones, reducing false detection.
During training, an attack layer simulated ten common distortions, including brightness, contrast, saturation changes, blur, noise, compression, flips, cropping, and rotation. In benchmarks, watermarked images achieved a peak signal-to-noise ratio of 44.29 decibels and a structural similarity index of 0.9933, while recovered watermarks reached 39.19 decibels, 0.9971 structural similarity, and 0.9992 normalized cross-correlation. Latent Seal retained the strongest extraction quality across all tested attacks and added only 7.33 milliseconds for embedding and 2.26 milliseconds for extraction. Tests on Stable Diffusion XL and Stable Diffusion 3.5 showed consistent performance across models and resolutions.
The authors emphasized that Latent Seal is designed to make provenance protection an integral part of image creation. They stated, "The aim is to preserve the visual quality users expect while giving model providers a practical way to verify origin after images have been edited or shared. Our results suggest that strong watermark recovery and low visual impact can be achieved together. The next step is to improve recovery for visually complex watermarks and make the framework adaptable to new watermark designs without retraining the full system each time."
Latent Seal could support provenance checks for commercial image generators, social-media investigations, copyright disputes, content moderation, and digital-asset management, particularly where providers control the underlying model. Its ability to carry a full-color image offers more identifying capacity than binary signatures, and its resistance to routine edits helps marks survive online sharing. However, the current system requires retraining for each new watermark, and recovery accuracy decreases with more complex watermark textures. The researchers propose frequency-domain feature fusion and a lightweight adapter for arbitrary watermarks. In practice, the method works best alongside disclosure policies, metadata standards, and other content-authentication tools.
