As generative image systems produce increasingly realistic content at scale, verifying authorship and origin has become a critical challenge. A research team has developed Latent Seal, a watermarking framework that embeds high-capacity image watermarks directly into the generation process of latent diffusion models (LDMs), rather than appending them after image creation. This approach aims to support copyright verification and identify AI-generated content (AIGC) while preserving image quality.
Traditional post-processing watermarks are simple to deploy but remain separate from the model and can be easily removed. In-generation techniques integrate protection more deeply, yet many suffer from limited information capacity or fail under common distortions like compression, cropping, rotation, and color adjustments. The central challenge is to embed provenance information durably enough for real-world online circulation without visibly degrading image quality.
Researchers from Macao Polytechnic University, Guangdong University of Technology, Jinan University, and the Institute of Automation, Chinese Academy of Sciences, reported their findings in Machine Intelligence Research on June 17, 2026 (DOI:10.1007/s11633-025-1620-y). Their study introduces Latent Seal, an encoder-decoder framework designed primarily for closed-source latent diffusion services. It embeds a customized image watermark during content generation, then checks suspicious images by extracting and comparing the recovered mark with the provider's original reference, enabling both generative-content detection and copyright verification.
The team built Latent Seal around Stable Diffusion 2.1 and assembled 74,247 generated images and their latent representations from prompts drawn from DiffusionDB and JourneyDB. Of these, 69,247 images were used for training and 5,000 for testing. The system freezes the original denoising network, clones and fine-tunes the variational autoencoder (VAE) decoder, and inserts a latent-space watermark encoder into an intermediate decoding block. A separate decoder learns two outcomes: recover the target watermark from protected images and return a blank output for unprotected images, reducing false detection.
During training, an attack layer simulated ten common distortions, including brightness, contrast, and saturation changes, blur, noise, compression, flips, cropping, and rotation. In benchmark tests, watermarked images reached a peak signal-to-noise ratio of 44.29 decibels and a structural similarity index of 0.9933, while recovered watermarks achieved 39.19 decibels, 0.9971 structural similarity, and 0.9992 normalized cross-correlation. Latent Seal also retained the strongest extraction quality across every tested attack and added only 7.33 milliseconds during embedding and 2.26 milliseconds during extraction. Tests on Stable Diffusion XL and Stable Diffusion 3.5 further showed consistent performance across models and image resolutions.
The authors said Latent Seal was designed to make provenance protection part of image creation rather than an optional step added afterward. "The aim is to preserve the visual quality users expect while giving model providers a practical way to verify origin after images have been edited or shared," they said. "Our results suggest that strong watermark recovery and low visual impact can be achieved together. The next step is to improve recovery for visually complex watermarks and make the framework adaptable to new watermark designs without retraining the full system each time."
Latent Seal could support provenance checks for commercial image generators, social-media investigations, copyright disputes, content moderation, and digital-asset management, particularly where providers control the underlying model. Its ability to carry a full-color image offers more identifying capacity than simple binary signatures, while its resistance to routine edits could help marks survive ordinary online sharing. However, the current system must be retrained for each new watermark, and recovery becomes modestly less accurate as watermark textures and colors grow more complex. The researchers therefore propose frequency-domain feature fusion and a lightweight adapter for arbitrary watermarks. In practice, the method would work best alongside disclosure policies, metadata standards, and other content-authentication tools rather than as a stand-alone guarantee.
