**Gaussian Shading: Provable Performance-Lossless Image Watermarking for Diffusion Models** **Abstract:** Ethical concerns surrounding copyright protection and inappropriate content generation pose challenges for the practical implementation of diffusion models. Existing watermarking methods often compromise model performance or require additional training, which is undesirable. To address this issue, we propose Gaussian Shading, a diffusion model watermarking technique that is both performance-lossless and training-free. Our method embeds a watermark in latent representations following a standard Gaussian distribution, ensuring indistinguishability from non-watermarked images. This approach achieves lossless performance and robustness to lossy processing and erasure attempts. The watermark can be extracted using Denoising Diffusion Implicit Models (DDIM) inversion and inverse sampling. Experiments on multiple versions of Stable Diffusion demonstrate that Gaussian Shading outperforms existing methods in terms of robustness and performance preservation. **Introduction:** Diffusion models, such as Stable Diffusion, have revolutionized image generation, but they also raise concerns about copyright protection and content authenticity. Existing watermarking methods for diffusion models can be categorized into post-processing-based, fine-tuning-based, and latent-representation-based approaches. These methods often compromise model performance or require additional computational overhead. Gaussian Shading addresses these issues by embedding watermarks without altering the model's architecture or parameters, making it a plug-and-play solution. **Methods:** Gaussian Shading involves three main steps: watermark diffusion, randomization, and distribution-preserving sampling. The watermark is diffused throughout the latent representation, ensuring it is evenly distributed. Randomization ensures the watermark follows a uniform distribution, and distribution-preserving sampling guarantees the watermark's distribution matches that of non-watermarked images. The watermark can be extracted using DDIM inversion and inverse sampling. **Proof of Performance-Lossless:** We provide a theoretical proof that Gaussian Shading is performance-lossless under chosen watermark tests. This proof shows that the watermarked image is indistinguishable from the non-watermarked image in polynomial time, ensuring no degradation in model performance. **Experiments:** Experiments on Stable Diffusion models (V1.4, V2.0, V2.1) demonstrate the effectiveness of Gaussian Shading in both detection and traceability scenarios. The method outperforms baseline methods in terms of robustness and performance preservation. Ablation studies further validate the hyperparameter selection and the impact of various components on performance. **Limitations and Future Work:** While Gaussian Shading shows superior performance, it relies on specific sampling methods and requires proper key management. Future work will focus on improving inversion methods and expanding the range of sampling techniques to enhance robustness against forgery attacks.**Gaussian Shading: Provable Performance-Lossless Image Watermarking for Diffusion Models** **Abstract:** Ethical concerns surrounding copyright protection and inappropriate content generation pose challenges for the practical implementation of diffusion models. Existing watermarking methods often compromise model performance or require additional training, which is undesirable. To address this issue, we propose Gaussian Shading, a diffusion model watermarking technique that is both performance-lossless and training-free. Our method embeds a watermark in latent representations following a standard Gaussian distribution, ensuring indistinguishability from non-watermarked images. This approach achieves lossless performance and robustness to lossy processing and erasure attempts. The watermark can be extracted using Denoising Diffusion Implicit Models (DDIM) inversion and inverse sampling. Experiments on multiple versions of Stable Diffusion demonstrate that Gaussian Shading outperforms existing methods in terms of robustness and performance preservation. **Introduction:** Diffusion models, such as Stable Diffusion, have revolutionized image generation, but they also raise concerns about copyright protection and content authenticity. Existing watermarking methods for diffusion models can be categorized into post-processing-based, fine-tuning-based, and latent-representation-based approaches. These methods often compromise model performance or require additional computational overhead. Gaussian Shading addresses these issues by embedding watermarks without altering the model's architecture or parameters, making it a plug-and-play solution. **Methods:** Gaussian Shading involves three main steps: watermark diffusion, randomization, and distribution-preserving sampling. The watermark is diffused throughout the latent representation, ensuring it is evenly distributed. Randomization ensures the watermark follows a uniform distribution, and distribution-preserving sampling guarantees the watermark's distribution matches that of non-watermarked images. The watermark can be extracted using DDIM inversion and inverse sampling. **Proof of Performance-Lossless:** We provide a theoretical proof that Gaussian Shading is performance-lossless under chosen watermark tests. This proof shows that the watermarked image is indistinguishable from the non-watermarked image in polynomial time, ensuring no degradation in model performance. **Experiments:** Experiments on Stable Diffusion models (V1.4, V2.0, V2.1) demonstrate the effectiveness of Gaussian Shading in both detection and traceability scenarios. The method outperforms baseline methods in terms of robustness and performance preservation. Ablation studies further validate the hyperparameter selection and the impact of various components on performance. **Limitations and Future Work:** While Gaussian Shading shows superior performance, it relies on specific sampling methods and requires proper key management. Future work will focus on improving inversion methods and expanding the range of sampling techniques to enhance robustness against forgery attacks.