[SoK] AIGC Watermarking: Securing the Generative Supply Chain

TL;DR

As Generative AI (Gen-AI) transitions from a novelty to a critical infrastructure, the risks of misinformation and IP theft have skyrocketed. This paper provides the first formal supply-chain definition of AIGC watermarking—treating the generation process as a "flow" rather than a single event. It identifies Endogeneity (embedding during generation) as the future of digital provenance and dissects why current "pixel-deep" watermarks are failing against modern AI-driven attacks.

Problem & Motivation: The Identity Crisis of AI Content

Traditional watermarking (like the LSB method) was designed for a world where images were static. In the era of Stable Diffusion and GPT-4, content is dynamic.

• The Gap: Prior work treats watermarks as an "add-on." If you can re-generate the image or paraphrase the text, the watermark vanishes.
• The Insight: The authors argue that a watermark shouldn't just be on the content; it should be of the content. By viewing the AI generation as a rooted tree (from data source to final output), we can find optimal "attack surfaces" and "injection points" that make the watermark inseparable from the media itself.

Methodology: The "Flow-Like" Supply Chain

The core contribution is a mathematical formalization of the AIGC pipeline.

Instead of just modifying the final output ($y$), the authors define the process as a sequence of nodes $V_p$ (processing functions).

• Core Objective: $\min D_m(m,m^{\prime })+\lambda D_y(y,y^{\prime })$. This balances Message Consistency (can we read the watermark?) with Utility (does the image still look good?).
• Tactical Shift: The paper categorizes watermarks into Training-free (injecting noise into diffusion) vs. Training-dependent (fine-tuning the model to always produce "signature" patterns).

Modality Breakdown: Multi-Modal Armor

The paper provides a state-of-the-art comparison of how different media handle watermarks:

1. Text: Moving from homoglyph substitution to Logit-based modifications (altering token probability distributions).
2. Audio: Using "pre-watermarked" training data so the model natively speaks with a signature.
3. Cross-Modality: Approaches like V2A-Mark that align visual and audio features to detect deepfake tampering across both tracks simultaneously.

Experiments & Results: The Fragile Shield

The survey synthesizes results from various SOTA benchmarks, highlighting a grim reality: the "Cat-and-Mouse" game is leaning toward the attackers.

• SOTA Performance: Methods like Tree-Ring and Stable Signature show high robustness against standard rotations or crops.
• The Achilles Heel: Regeneration Attacks. Authors demonstrate that if an attacker uses a secondary AI model to "re-describe and re-generate" an image, almost all current watermarks (even invisible ones) are stripped away.
• Quantitative Win: Advanced tamper-detection frameworks like EditGuard can localize modified regions with 96% accuracy, a significant leap over traditional global hashing techniques.

Critical Analysis: A Milestone in AI Governance

The paper concludes by mapping the technical landscape to the Global Regulatory framework (EU AI Act, China’s CAC regulations).

Limitations:

• Computational Overhead: Endogenous watermarking often requires expensive model fine-tuning.
• Public Verifiability: Most robust marks currently require a "secret key," making it hard for a regular user on Twitter to verify a deepfake without the creator's help.

Future Outlook:

The shift is moving toward Semantic Watermarking. Instead of hiding bits in pixels, we must hide the identity in the meaning of the generated content. Until we solve the "Regeneration Attack" problem, our current digital signatures are merely "written in the sand."

Final Takeaway: To secure the future of Gen-AI, the watermark must be the DNA of the model, not just the paint on the canvas.