A List Of AI Watermarking References And Resources

Posted on by Brian Colwell

The following is organized into three sections – Academic Papers, Industry & Research Organizations, and Government & Regulatory Resources.

Academic Papers

  1. Adi, Y., Baum, C., Cisse, M., Pinkas, B., & Keshet, J. (2018). Turning your weakness into a strength: Watermarking deep neural networks by backdooring. In Proceedings of the 27th USENIX Conference on Security Symposium, SEC’18, pp. 1615–1631.
  2. Atallah, M. J., Raskin, V., Crogan, M., Hempelmann, C., Kerschbaum, F., Mohamed, D., & Naik, S. (2001). Natural Language Watermarking: Design, Analysis, and a Proof-of-Concept Implementation. In Information Hiding, Lecture Notes in Computer Science, pp. 185–200.
  3. Atallah, M. J., Raskin, V., Hempelmann, C. F., Karahan, M., Sion, R., Topkara, U., & Triezenberg, K. E. (2003). Natural Language Watermarking and Tamperproofing. In Information Hiding, Lecture Notes in Computer Science, pp. 196–212.
  4. Bagad, S., Domb, Y., Marwah, A., Shlomovits, O., & Solberg, T. (2025). Provable Watermark Extraction. OpenReview. https://openreview.net/pdf?id=JyrjeQJ8VK
  5. Boenisch, F. (2021). A Systematic Review on Model Watermarking for Neural Networks. Frontiers in Big Data, 4.
  6. Bui, T., Agarwal, S., & Collomosse, J. (2023). TrustMark: Universal Watermarking for Arbitrary Resolution Images. arXiv preprint arXiv:2311.18297.
  7. Chakraborty, A., et al. (2022). DynaMarks: Defending Against Deep Learning Model Extraction Using Dynamic Watermarking. arXiv preprint arXiv:2207.13321.
  8. Chen, A., Xu, Z., Geiger, A., Yu, J., & Su, H. (2022). TensoRF: Tensorial Radiance Fields. In European conference on computer vision, pages 333–350.
  9. Chen, L., Wu, H., et al. (2025). DiffuseTrace: A Transparent and Flexible Watermarking Scheme for Latent Diffusion Model. arXiv:2405.02696.
  10. Choi, J., Kim, J., Yang, S., & Kim, S. J. (2025). Visual Fidelity vs. Robustness: Trade-Off Analysis of Image Adversarial Watermark Mitigated by SSIM Loss. ICLR 2025 Workshop on GenAI Watermarking.
  11. Cox, I. J., Miller, M. L., Bloom, J. A., Fridrich, J., & Kalker, T. (2002). Digital Watermarking and Steganography. Morgan Kaufmann.
  12. Crothers, E., Japkowicz, N., & Viktor, H. (2022). Machine Generated Text: A Comprehensive Survey of Threat Models and Detection Methods. arxiv:2210.07321[cs].
  13. Dai, F., & Cai, Z. (2019). Towards Near-imperceptible Steganographic Text. In Proceedings of the 57th Annual Meeting of the Association for Computational Linguistics, pp. 4303–4308.
  14. Diaa, A., Aremu, T., & Lukas, N. (2025). Optimizing Adaptive Attacks against Content Watermarks for Language Models. ICLR 2025 Workshop on GenAI Watermarking.
  15. Dziembowski, S., Ebrahimi, S., & Hassanizadeh, P. (2024). VIMz: Private proofs of image manipulation using folding-based zkSNARKs. Cryptology ePrint Archive, Paper 2024/1063.
  16. Fabra, L., Solanes, J.E., Muñoz, A., Martí-Testón, A., Alabau, A., & Gracia, L. (2024). Application of Neural Radiance Fields (NeRFs) for 3D Model Representation in the Industrial Metaverse. Applied Sciences, 14(5):1825.
  17. Feng, W., Zhang, L., & Chen, T. (2025). A novel blockchain-watermarking mechanism utilizing interplanetary file system and fast walsh hadamard transform. Scientific Reports, 2589004224020467.
  18. Feng, W., Zhou, W., He, J., Zhang, J., Wei, T., Li, G., Zhang, T., Zhang, W., & Yu, N. (2024). AquaLoRA: Toward white-box protection for customized stable diffusion models via watermark lora. In International Conference on Machine Learning (ICML).
  19. Fernandez, P., Couairon, G., Jégou, H., Douze, M., & Furon, T. (2023). The stable signature: Rooting watermarks in latent diffusion models. In Proceedings of the IEEE/CVF International Conference on Computer Vision, pages 22466–22477.
  20. Gloaguen, T., Jovanović, N., Staab, R., & Vechev, M. (2025). Discovering Spoofing Attempts on Language Model Watermarks. ICLR 2025 Workshop on GenAI Watermarking.
  21. Grinbaum, A., & Adomaitis, L. (2022). The Ethical Need for Watermarks in Machine-Generated Language. arxiv:2209.03118[cs].
  22. Huang, X., Li, R., Cheung, Y., Cheung, K.C., See, S., & Wan, R. (2024). Gaussianmarker: Uncertainty-aware copyright protection of 3d gaussian splatting. In Advances in Neural Information Processing Systems (NeurIPS).
  23. Jang, Y., Lee, D.I., Jang, M., Kim, J.W., Yang, F., & Kim, S. (2024). WateRF: Robust Watermarks in Radiance Fields for Protection of Copyrights. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pages 12087–12097.
  24. Jia, H., Choquette-Choo, C. A., Chandrasekaran, V., & Papernot, N. (2021). Entangled watermarks as a defense against model extraction. In 30th USENIX Security Symposium (USENIX Security 21), pp. 1937–1954.
  25. Jiang, L., Zhao, Y., & Li, Z. (2024). SmartMark: Software Watermarking Scheme for Smart Contracts. IEEE Symposium on Security and Privacy.
  26. Kaptchuk, G., Jois, T. M., Green, M., & Rubin, A. D. (2021). Meteor: Cryptographically secure steganography for realistic distributions.
  27. Kirchenbauer, J., Geiping, J., Goldblum, M., & Goldstein, T. (2023). A Watermark for Large Language Models. arXiv preprint arXiv:2301.10226.
  28. Kohrita, T., & Towa, P. (2023). Zeromorph: Zero-knowledge multilinear-evaluation proofs from homomorphic univariate commitments. Cryptology ePrint Archive, Paper 2023/917.
  29. Kulthe, S., Ahmed, F., Collomosse, J., & Bui, T. (2025). MultiNeRF: Multiple Watermark Embedding for Neural Radiance Fields. arXiv:2504.02517.
  30. Kumar, V., Patel, S., et al. (2025). AudioSeal: Robust and Efficient Audio Watermarking with Localized Detection. IEEE Transactions on Audio, Speech, and Language Processing.
  31. Lei, L., Gai, K., Yu, J., & Zhu, L. (2024). DiffuseTrace: A transparent and flexible watermarking scheme for latent diffusion model. arXiv preprint arXiv:2405.02696.
  32. Li, C., Li, S., Zhao, Y., Zhu, W., & Lin, Y. (2022). RT-NeRF: Real-Time On-Device Neural Radiance Fields Towards Immersive AR/VR Rendering. In Proceedings of the 41st IEEE/ACM International Conference on Computer-Aided Design, pages 1–9.
  33. Li, C., Liu, H., Fan, Z., Li, W., Liu, Y., Pan, P., & Yuan, Y. (2024). Gaussianstego: A generalizable stenography pipeline for generative 3d gaussians splatting. arXiv preprint arXiv:2407.01301.
  34. Li, X., Yang, B., Cheng, D., & Zeng, T. (2009). A generalization of LSB matching. IEEE Signal Process. Lett. 16, 69–72.
  35. Liu, J., Zhao, Z., Ji, H., et al. (2024). Digital Watermarking Technology for AI-Generated Images: A Survey. Mathematics 13(4):651.
  36. Lu, C., Liu, S., & Wang, J. (2024). Attacking and Defending Neural Watermarks in Generative Models. arXiv preprint arXiv:2402.00001.
  37. Luo, Z., Guo, Q., Cheung, K.C., See, S., & Wan, R. (2023). CopyRNeRF: Protecting the copyright of neural radiance fields. In Proceedings of the IEEE/CVF International Conference on Computer Vision, pages 22401–22411.
  38. Meral, H. M., Sankur, B., Sumru Ozsoy, A., Gungor, T., & Sevinc, E. (2009). Natural language watermarking via morphosyntactic alterations. Computer Speech & Language, 23(1):107–125.
  39. Mildenhall, B., Srinivasan, P.P., Tancik, M., Barron, J.T., Ramamoorthi, R., & Ng, R. (2021). NeRF: Representing Scenes as Neural Radiance Fields for View Synthesis. Communications of the ACM, 65(1):99–106.
  40. Min, R., Li, S., Chen, H., & Cheng, M. (2024). A watermark-conditioned diffusion model for ip protection. In European conference on computer vision (ECCV).
  41. Mirsky, Y., Demontis, A., Kotak, J., Shankar, R., Gelei, D., Yang, L., Zhang, X., Pintor, M., Lee, W., Elovici, Y., & Biggio, B. (2023). The Threat of Offensive AI to Organizations. Computers & Security, 124:103006.
  42. Pan, Y., Yang, C., Lin, Y., et al. (2025). Can LLM Watermarks Robustly Prevent Unauthorized Knowledge Distillation? ICLR 2025 Workshop on GenAI Watermarking.
  43. Petitcolas, F., Anderson, R., & Kuhn, M. (1999). Information hiding-a survey. Proceedings of the IEEE, 87(7):1062–1078.
  44. Petrov, A., Agarwal, S., Torr, P., Bibi, A., & Collomosse, J. (2025). On the Coexistence and Ensembling of Watermarks. Extracted from: https://arxiv.org/html/2501.17356v1
  45. Rouhani, B. D., Chen, H., & Koushanfar, F. (2019). Deepsigns: An end-to-end watermarking framework for ownership protection of deep neural networks. In Proceedings of International Conference on ASPLOS, pages 485–497.
  46. Sander, T., Fernandez, P., Mahloujifar, S., Durmus, A. O., & Guo, C. (2025). Detecting Benchmark Contamination Through Watermarking. ICLR 2025 Workshop on GenAI Watermarking.
  47. Schramowski, P., et al. (2023). Watermarking and Provenance in Generative AI. arXiv preprint arXiv:2306.07863.
  48. Sharma, N., & Kim, J. (2025). Intellectual Property Protection using Blockchain and Digital Watermarking. IEEE Conference on Blockchain and Digital Watermarking.
  49. Song, Q., Luo, Z., Cheung, K.C., See, S., & Wan, R. (2024). Protecting NeRFs’ Copyright via Plug-And-Play Watermarking Base Model. In European Conference on Computer Vision, pages 57–73.
  50. Springer, J., Wolpert, L., & Chen, Y. (2025). Visual Watermarking in the Era of Diffusion Models: Advances and Challenges. arXiv:2505.08197.
  51. Szyller, S., Atli, B. G., Marchal, S., & Asokan, N. (2021). DAWN: Dynamic adversarial watermarking of neural networks. In Proceedings of the 29th ACM International Conference on Multimedia, Chengdu, China, 20–24 October 2021; pp. 4417–4425.
  52. Tancik, M., Mildenhall, B., & Ng, R. (2020). StegaStamp: Invisible Hyperlinks in Physical Photographs. In Proc. CVPR, pages 2117–2126.
  53. Thietke, J., Müller, A., Lukovnikov, D., Fischer, A., & Quiring, E. (2025). Towards A Correct Usage of Cryptography in Semantic Watermarks for Diffusion Models. ICLR 2025 Workshop on GenAI Watermarking.
  54. Topkara, M., Riccardi, G., Hakkani-Tür, D., & Atallah, M. J. (2006). Natural language watermarking: Challenges in building a practical system.
  55. Wang, K., Li, J., et al. (2025). PromptCARE: Prompt Copyright Protection by Watermark Injection and Verification. Proceedings of ACM Multimedia 2025.
  56. Wen, Y., Kirchenbauer, J., Geiping, J., & Goldstein, T. (2024). Tree-rings watermarks: Invisible fingerprints for diffusion images. Advances in Neural Information Processing Systems, 36.
  57. Xu, X., Yao, Y., & Liu, Y. (2024). Learning to watermark LLM-generated text via reinforcement learning. arXiv preprint arXiv:2403.10553.
  58. Xu, X., et al. (2025). Robust Multi-bit Text Watermark with LLM-based Paraphrasers. ICLR 2025 Workshop on GenAI Watermarking.
  59. Yang, Z., Zeng, K., Chen, K., Fang, H., Zhang, W., & Yu, N. (2024). Gaussian shading: Provable performance-lossless image watermarking for diffusion models. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pages 12162–12171.
  60. Zhang, R., Hussain, S. S., Neekhara, P., & Koushanfar, F. (2024). REMARK-LLM: A robust and efficient watermarking framework for generative large language models. In 33rd USENIX Security Symposium, 1813-1830.
  61. Zhang, T., & Liu, Y. (2025). LVMark: Robust Watermark for Latent Video Diffusion Models. arXiv:2412.09122.
  62. Zhang, X., Meng, J., Li, R., Xu, Z., Zhang, Y., & Zhang, J. (2024). GS-Hider: Hiding Messages into 3D Gaussian Splatting. arXiv preprint arXiv:2405.15118.
  63. Zhao, Y., Pang, T., Du, C., Yang, X., Cheung, N.M., & Lin, M. (2023). A recipe for watermarking diffusion models. arXiv preprint arXiv:2303.10137.
  64. Zhu, J., Kaplan, R., Johnson, J., & Fei-Fei, L. (2018). HiDDeN: Hiding Data with Deep Networks. In Proc. ECCV, pages 657–672.
  65. Ziegler, Z., Deng, Y., & Rush, A. (2019). Neural Linguistic Steganography.

Industry & Research Organizations

  1. Access Now. (2023). Watermarking & generative AI: what, how, why (and why not). Retrieved from https://www.accessnow.org/watermarking-generative-ai-what-how-why-and-why-not/
  2. ACM Computing Surveys. (2024). A Survey of Text Watermarking in the Era of Large Language Models. Retrieved from https://dl.acm.org/doi/10.1145/3691626
  3. Brookings Institution. (2024). Detecting AI fingerprints: A guide to watermarking and beyond. Retrieved from https://www.brookings.edu/articles/detecting-ai-fingerprints-a-guide-to-watermarking-and-beyond/
  4. C2PA. (2024). Coalition for Content Provenance and Authenticity.
  5. DataCamp. (2025). AI Watermarking: How It Works, Applications, Challenges. Retrieved from https://www.datacamp.com/blog/ai-watermarking
  6. DataScientest. (2023). AI Watermarking: All you need to know. Retrieved from https://datascientest.com/en/ai-watermarking-all-you-need-to-know
  7. DeepMind. (2025). SynthID: Watermarking AI-generated text and video. Google DeepMind Technologies.
  8. EFF. (2024). AI Watermarking Won’t Curb Disinformation. Retrieved from https://www.eff.org/deeplinks/2024/01/ai-watermarking-wont-curb-disinformation
  9. Hugging Face. (2024). AI Watermarking 101: Tools and Techniques. Retrieved from https://huggingface.co/blog/watermarking
  10. ICLR Workshop. (2025). Workshop on GenAI Watermarking. International Conference on Learning Representations. Retrieved from https://iclr.cc/virtual/2025/workshop/23975 and https://openreview.net/pdf?id=euhFSyW2CA
  11. ITU. (2024). AI watermarking: A watershed for multimedia authenticity. Retrieved from https://www.itu.int/hub/2024/05/ai-watermarking-a-watershed-for-multimedia-authenticity/
  12. MIT Technology Review. (2024). It’s easy to tamper with watermarks from AI-generated text. Retrieved from https://www.technologyreview.com/2024/03/29/1090310/its-easy-to-tamper-with-watermarks-from-ai-generated-text/
  13. Nature. (2024). AI watermarking must be watertight to be effective. Retrieved from https://www.nature.com/articles/d41586-024-03418-x
  14. RAND. (2024). The Case for and Against AI Watermarking. Retrieved from https://www.rand.org/pubs/commentary/2024/01/the-case-for-and-against-ai-watermarking.html
  15. SoftwareMill. (2024). What is AI watermarking? Retrieved from https://softwaremill.com/what-is-ai-watermarking/
  16. TechTarget. (2024). What is AI watermarking and how does it work? Retrieved from https://www.techtarget.com/searchenterpriseai/definition/AI-watermarking
  17. WordLift. (2024). AI Content Protection: Understanding Watermarking Essentials. Retrieved from https://wordlift.io/blog/en/watermarking-for-ai-content/

Government & Regulatory Resources

  1. Data Innovation. (2024). The AI Act’s AI Watermarking Requirement Is a Misstep in the Quest for Transparency. Retrieved from https://datainnovation.org/2024/07/the-ai-acts-ai-watermarking-requirement-is-a-misstep-in-the-quest-for-transparency/
  2. Federal Times. (2024). The case for and against AI watermarking. Retrieved from https://www.federaltimes.com/opinions/2024/01/16/the-case-for-and-against-ai-watermarking/
  3. FedScoop. (2024). AI watermarking could be exploited by bad actors to spread misinformation. Retrieved from https://fedscoop.com/ai-watermarking-misinformation-election-bad-actors-congress/
  4. Forward Pathway. (2025). AI-Generated Content Detection: Watermarking Technology, Applications, and Ethical Challenges in AIGC Security. Retrieved from https://www.forwardpathway.us/ai-generated-content-detection-watermarking-technology-applications-and-ethical-challenges-in-aigc-security
  5. ResearchGate. (2023). LEGAL AND ETHICAL DIMENSIONS OF AI WATERMARKING IN PRIVACY-CENTRIC CONTEXTS. Retrieved from https://www.researchgate.net/publication/391279684_LEGAL_AND_ETHICAL_DIMENSIONS_OF_AI_WATERMARKING_IN_PRIVACY-_CENTRIC_CONTEXTS

Thanks for reading!