We begin our taxonomy with a separation of AI watermarking methods into either one of two categories – Post-hoc Watermarking or Generation-time Watermarking. Next, the Generation-time Watermarking method is further divided into either one of two approaches – Out-of-Model Generation-time Watermarking or In-Model Generation-time Watermarking. Then, we organize by modality – Image, Audio, or Text – our specific references in chronological order by publication date.

Note that this taxonomy is primarily focused on the years from 2023 and forward. This is because ChatGPT was publicly released at the end of 2022, and then by early 2023, in a major series of events leading to increased awareness of the potential, and risks, of advanced AI models, ChatGPT was jailbroken using prompt engineering techniques.

Post-hoc Watermarking

Post-hoc Image Watermarking

Tu Bui, Shruti Agarwal, and John Collomosse. TrustMark: Universal watermarking for arbitrary resolution images. arXiv:2311.18297, 2023. – https://arxiv.org/abs/2311.18297

Tu Bui, Shruti Agarwal, Ning Yu, and John Collomosse. RoSteALS: Robust steganography using autoencoder latent space. arXiv: 2304.03400, 2023. – https://arxiv.org/abs/2304.03400

Jiangtao Huang, Ting Luo, Li Li, Gaobo Yang, Haiyong Xu, and Chin-Chen Chang. ARWGAN: Attention-guided robust image watermarking model based on GAN. Referenced from ResearchGate. IEEE Transactions on Instrumentation and Measurement, 72:1–17, 2023. – https://www.researchgate.net/publication/371707904_ARWGAN_Attention-guided_Robust_Image_Watermarking_Model_Based_on_GAN

Gautier Evennou, Vivien Chappelier, Ewa Kijak, and Teddy Furon. SWIFT: Semantic watermarking for image forgery thwarting. arXiv:2407.18995, 2024. – https://arxiv.org/abs/2407.18995

Minzhou Pan, Yi Zeng, Xue Lin, Ning Yu, Cho-Jui Hsieh, Peter Henderson, and Ruoxi Jia. JIGMARK: A black-box approach for enhancing image watermarks against diffusion model edits. arXiv:2406.03720, 2024. – https://arxiv.org/abs/2406.03720

Post-hoc Audio Watermarking

Xinghua Qu, Xiang Yin, Pengfei Wei, Lu Lu, and Zejun Ma. AudioQR: Deep neural audio watermarks for QR code. IJCAI, 2023. – https://www.ijcai.org/proceedings/2023/687

Yanzhen Ren, Hongcheng Zhu, Liming Zhai, Zongkun Sun, Rubing Shen, and Lina Wang. Who is speaking actually? robust and versatile speaker traceability for voice conversion. arXiv:2305.05152, 2023. – https://arxiv.org/abs/2305.05152

Guangyu Chen, Yu Wu, Shujie Liu, Tao Liu, Xiaoyong Du, and Furu Wei. WavMark: Watermarking for audio generation. arXiv:2308.12770, 2023. – https://arxiv.org/abs/2308.12770

Patrick O’Reilly, Zeyu Jin, Jiaqi Su, and Bryan Pardo. MaskMark: Robust neural watermarking for real and synthetic speech. Referenced from Northwestern University, in ICASSP 2024-2024 IEEE International Conference on Acoustics, Speech and Signal Processing (ICASSP), pp. 4650–4654. IEEE, 2024. – https://www.scholars.northwestern.edu/en/publications/maskmark-robust-neural-watermarking-for-real-and-synthetic-speech

Robin San Roman, Pierre Fernandez, Hady Elsahar, Alexandre D´efossez, Teddy Furon, and Tuan Tran. Proactive detection of voice cloning with localized watermarking. arXiv: 2401.17264, 2024. – https://arxiv.org/abs/2401.17264

Post-hoc Text Watermarking

Honai Ueoka, Yugo Murawaki, and Sadao Kurohashi. Frustratingly easy edit-based linguistic steganography with a masked language model. arXiv:2104.09833, 2021. – https://arxiv.org/abs/2104.09833

Out-of-Model Generation-time Watermarking

Out-of-Model Generation-time ImageWatermarking

Yuxin Wen, John Kirchenbauer, Jonas Geiping, and Tom Goldstein. Tree-ring watermarks: Fingerprints for diffusion images that are invisible and robust. arXiv:2305.20030, 2023. – https://arxiv.org/abs/2305.20030

Seongmin Hong, Kyeonghyun Lee, Suh Yoon Jeon, Hyewon Bae, and Se Young Chun. On exact inversion of DPM-solvers. arXiv: 2311.18387, 2023. – https://arxiv.org/abs/2311.18387

Hai Ci, Yiren Song, Pei Yang, Jinheng Xie, and Mike Zheng Shou. WMAdapter: Adding watermark control to latent diffusion models. arXiv:2406.08337, 2024. – https://arxiv.org/abs/2406.08337

Hai Ci, Pei Yang, Yiren Song, and Mike Zheng Shou. RingID: Rethinking tree-ring watermarking for enhanced multi-key identification. arXiv:2404.14055, 2024. – https://arxiv.org/abs/2404.14055

Liangqi Lei, Keke Gai, Jing Yu, and Liehuang Zhu. DiffuseTrace: A transparent and flexible watermarking scheme for latent diffusion model. arXiv:2405.02696, 2024. – https://arxiv.org/abs/2405.02696

Ahmad Rezaei, Mohammad Akbari, Saeed Ranjbar Alvar, Arezou Fatemi, and Yong Zhang. Lawa: Using latent space for in-generation image watermarking. arXiv:2408.05868, 2024. – https://arxiv.org/abs/2408.05868

Out-of-Model Generation-time Audio Watermarking

Junzuo Zhou, Jiangyan Yi, Tao Wang, Jianhua Tao, Ye Bai, Chu Yuan Zhang, Yong Ren, and Zhengqi Wen. Traceablespeech: Towards proactively traceable text-to-speech with watermarking. arXiv:2406.04840, 2024. – https://arxiv.org/abs/2406.04840

Out-of-Model Generation-time TextWatermarking

John Kirchenbauer, Jonas Geiping, Yuxin Wen, Jonathan Katz, Ian Miers, and Tom Goldstein. A watermark for large language models. arXiv:2301.10226, 2023. – https://arxiv.org/abs/2301.10226

Pierre Fernandez, Antoine Chaffin, Karim Tit, Vivien Chappelier, and Teddy Furon. Three bricks to consolidate watermarks for large language models. arXiv: 2308.00113, 2023. – https://arxiv.org/abs/2308.00113

KiYoon Yoo, Wonhyuk Ahn, Jiho Jang, and Nojun Kwak. Robust multi-bit natural language watermarking through invariant features. arXiv:2305.01904, 2023. – https://arxiv.org/abs/2305.01904

KiYoon Yoo, Wonhyuk Ahn, and Nojun Kwak. Advancing beyond identification: Multi-bit watermark for language models. arXiv:2308.00221, 2023. – https://arxiv.org/abs/2308.00221

Miranda Christ, Sam Gunn, and Or Zamir. Undetectable watermarks for language models. Cryptology ePrint Archive, 2023. – https://eprint.iacr.org/2023/763

Rohith Kuditipudi, John Thickstun, Tatsunori Hashimoto, and Percy Liang. Robust distortion-free watermarks for language models. arXiv:2307.15593, 2023. – https://arxiv.org/abs/2307.15593

Baihe Huang, Banghua Zhu, Hanlin Zhu, Jason D. Lee, Jiantao Jiao, and Michael I. Jordan. Towards optimal statistical watermarking, 2023. – https://arxiv.org/abs/2312.07930

Taehyun Lee, Seokhee Hong, Jaewoo Ahn, Ilgee Hong, Hwaran Lee, Sangdoo Yun, Jamin Shin, and Gunhee Kim. Who wrote this code? watermarking for code generation. arXiv:2305.15060, 2023. – https://arxiv.org/abs/2305.15060

Aiwei Liu, Leyi Pan, Xuming Hu, Shiao Meng, and Lijie Wen. A semantic invariant robust watermark for large language models. arXiv:2310.06356, 2023. – https://arxiv.org/abs/2310.06356

Abe Bohan Hou, Jingyu Zhang, Tianxing He, Yichen Wang, Yung-Sung Chuang, Hongwei Wang, Lingfeng Shen, Benjamin Van Durme, Daniel Khashabi, and Yulia Tsvetkov. SemStamp: A semantic watermark with paraphrastic robustness for text generation. arXiv:2310.03991, 2023. – https://arxiv.org/abs/2310.03991

Yu Fu, Deyi Xiong, and Yue Dong. Watermarking conditional text generation for AI detection: Unveiling challenges and a semantic-aware watermark remedy. arXiv: 2307.13808, 2023. – https://arxiv.org/abs/2307.13808

Julien Piet, Chawin Sitawarin, Vivian Fang, Norman Mu, and David Wagner. Mark my words: Analyzing and evaluating language model watermarks. arXiv:2312.00273, 2023. – https://arxiv.org/abs/2312.00273

Yepeng Liu and Yuheng Bu. arXiv:2401.13927, 2024. – https://arxiv.org/abs/2401.13927

Wenjie Qu, Dong Yin, Zixin He, Wei Zou, Tianyang Tao, Jinyuan Jia, and Jiaheng Zhang. Provably robust multi-bit watermarking for AI-generated text. arXiv:2401.16820, 2024. – https://arxiv.org/abs/2401.16820

Abe Bohan Hou, Jingyu Zhang, Yichen Wang, Daniel Khashabi, and Tianxing He. k-SemStamp: A clustering-based semantic watermark for detection of machine-generated text. arXiv:2402.11399, 2024. – https://arxiv.org/abs/2402.11399

Eva Giboulot and Teddy Furon. WaterMax: breaking the LLM watermark detectability-robustness-quality trade-off. arXiv:2403.04808, 2024. – https://arxiv.org/abs/2403.04808

Leyi Pan, Aiwei Liu, Zhiwei He, Zitian Gao, Xuandong Zhao, Yijian Lu, Binglin Zhou, Shuliang Liu, Xuming Hu, Lijie Wen, et al. MarkLLM: An open-source toolkit for LLM watermarking. arXiv:2405.10051, 2024. – https://arxiv.org/abs/2405.10051

In-Model Generation-time Watermarking

In-Model Generation-time ImageWatermarking

Yunqing Zhao, Tianyu Pang, Chao Du, Xiao Yang, Ngai-Man Cheung, and Min Lin. A recipe for watermarking diffusion models. arXiv:2303.10137, 2023. – https://arxiv.org/abs/2303.10137

Pierre Fernandez, Guillaume Couairon, Herve Jegou, Matthijs Douze, and Teddy Furon. The stable signature: Rooting watermarks in latent diffusion models. arXiv: 2303.15435, 2023. – https://arxiv.org/abs/2303.15435

Jianwei Fei, Zhihua Xia, Benedetta Tondi, and Mauro Barni. Robust retraining-free gan fingerprinting via personalized normalization. arXiv: 2311.05478, 2023. – https://arxiv.org/abs/2311.05478

Changhoon Kim, Kyle Min, Maitreya Patel, Sheng Cheng, and Yezhou Yang. WOUAF: Weight modulation for user attribution and fingerprinting in text-to-image diffusion models. arXiv: 2306.04744, 2023. – https://arxiv.org/abs/2306.04744

Weitao Feng, Wenbo Zhou, Jiyan He, Jie Zhang, Tianyi Wei, Guanlin Li, Tianwei Zhang, Weiming Zhang, and Nenghai Yu. AquaLoRA: Toward white-box protection for customized stable diffusion models via watermark LoRA. arXiv:2405.11135, 2024. – https://arxiv.org/abs/2405.11135

Jianwei Fei, Zhihua Xia, Benedetta Tondi, and Mauro Barni. Wide flat minimum watermarking for robust ownership verification of gans. IEEE Transactions on Information Forensics and Security, 2024. – https://ieeexplore.ieee.org/document/10636196

In-Model Generation-time AudioWatermarking

Lauri Juvela and Xin Wang. Collaborative watermarking for adversarial speech synthesis. arXiv:2309.15224, 2023. – https://arxiv.org/abs/2309.15224

Robin San Roman, Pierre Fernandez, Antoine Deleforge, Yossi Adi, and Romain Serizel. Latent watermarking of audio generative models. arxiv:2409.02915, 2024. – https://arxiv.org/abs/2409.02915

In-Model Generation-time Text Watermarking

Chenchen Gu, Xiang Lisa Li, Percy Liang, and Tatsunori Hashimoto. On the learnability of watermarks for language models. arXiv:2312.04469, 2023. – https://arxiv.org/abs/2312.04469

Xiaojun Xu, Yuanshun Yao, and Yang Liu. Learning to watermark llm-generated text via reinforcement learning. arXiv:2403.10553, 2024. – https://arxiv.org/abs/2403.10553

Thanks for reading!