Researchers published a method for watermarking autoregressive image generation models at the token level on October 23, 2025. The approach adapts watermarking techniques from language models for image generation and addresses a central problem: the lack of reverse-cycle consistency (RCC), in which token sequences are altered through retokenization and the watermark is lost.
Technical Solution Through Tokenizer Finetuning
The method combines two main techniques to increase robustness: custom tokenizer-detokenizer finetuning to improve reverse-cycle consistency and a watermark synchronization layer as a complementary component. Finetuning was performed with Adam optimizer at a learning rate of 10⁻⁴, multiplied by factor 0.9 per epoch, over 101 epochs. Training took 22 hours on 16 V100 GPUs for the Taming model, 2.5 hours on 8 H200 GPUs for Chameleon, and 0.5 hours for RAR-XL.
Progressive Augmentations Against Image Editing
The method uses progressive augmentations in three difficulty levels. The first level (𝒜₁) includes JPEG compression with qualities from 90 to 70, Gaussian blur with kernel sizes 1 and 3, Gaussian noise with standard deviations from 0.005 to 0.02, brightness increases by factors 1.0 to 1.2, rotations of ±1°, and cropping with 80 to 90 percent of image area retained. The third level (𝒜₃) increases intensity to JPEG qualities from 40 to 20, blur kernel sizes up to 9, and noise standard deviations up to 0.1.
For non-differentiable JPEG compression, researchers implemented a straight-through estimator. Training was performed with a batch size of 64 total and a regularization parameter λ=1.
Extended Applications and Theoretical Foundations
Recent developments show an expansion of watermarking beyond image and text generation. A 2025 published work addresses watermarking of LLM-based time series forecasting. A framework for anytime-valid statistical watermarking published on February 19, 2026 achieved a reduction in average token budget for detection of 13 to 15 percent compared to state-of-the-art baselines.
A research paper published on July 14, 2026 extended watermark functionality beyond binary authentication: watermarks can now attribute users, extract hidden payloads, or localize surviving parts after image editing. An approach to watermarking in the latent space of generative models published on January 22, 2026 enables distilling watermarkers directly into the generative model or the latent decoder.
All described methods enable theoretically grounded p-values for reliable and robust watermark detection. Benchmarking studies from October 24, 2024 evaluated watermark robustness against image regeneration, global editing, local editing, and image-to-video generation. A method published on December 1, 2025 combines appearance adapter with layout branch to preserve semantic consistency, edge topology, and local spatial relationships during watermark removal.