1
2
Embed each image with a semantic encoder
3
Divide the semantic space into 2M regions using LSH (semantic codes)
4
Score each region with a secret key
5
Distortion-Free Semantic Watermarks
for Black-Box Generative Models
Tel Aviv University
TL;DR A distortion-free, sampling-based watermarking method for generative models that requires only black-box access to any generator and any semantic encoder.
Generation
Detection
1
Take an image
2
Embed it and find its semantic region
3
Score its region with the same secret key and compare it to a threshold
An example with the prompt, model and hyperplanes from Generation.
About the method
Black-box
The method only requests samples and encodes them, so it works with a closed generation API. To our knowledge it is the first distortion-free semantic watermark that treats both the generator and the encoder as black boxes.
Distortion-free
For any prompt, averaging over random secret keys gives exactly the same distribution of images as sampling the generator directly.
Survives edits
Cropping, resizing, and compression change pixels but not what an image depicts. The encoder is trained to describe an image and its edited versions alike, so edited images stay in the same semantic region and keep the watermark.
Citation
@misc{yossef2026distortionfree,
title = {Distortion-Free Semantic Watermarks for Black-Box Generative Models},
author = {Yossef, Aviv and Patashnik, Or and Zamir, Or},
year = {2026},
note = {Preprint}
}