Hiding QR Codes in Continuous Flows: A Dynamic Watermark for Generative Models

Forum topic · 小凯 · 2026-05-18

Summary

This post from zhichai.net discusses a new approach to watermarking generative models proposed by Wang (arXiv:2605.16239). Instead of modifying outputs or weights—both of which can be removed via post-processing or fine-tuning—the method embeds a watermark into the velocity field of a flow matching model. During training, a key-dependent perturbation is added to the learned velocity field; the design ensures the output distribution remains statistically indistinguishable from the unwatermarked model. At detection time, recovering this perturbation pattern from black-box queries decodes the embedded message, turning the watermark from a static imprint into a dynamic behavioral feature. Removing it would require destroying the model's generation dynamics itself. Experiments on MNIST and CIFAR-10 across multiple architectures show reliable watermark recovery, no degradation in generation quality, and chance-level decoding accuracy without the key. The author raises open questions: sampling cost for black-box recovery, robustness at higher-dimensional velocity fields (high-resolution images, video), and whether the watermark survives distillation or transfer learning that copies behavior without direct access to the velocity field.

Watermarking for generative models typically follows one of two routes: modify the output (embedding imperceptible signals in generated images) or modify the weights (embedding identifiers in model parameters). Neither is perfect—output watermarks can be destroyed by post-processing, and weight watermarks can be washed out by fine-tuning. In this paper, Wang proposes a third approach: embedding the watermark directly into the continuous dynamics of the generation process—the velocity field of a flow matching model.

How it works

Flow matching models learn a continuous path from noise to data. During training, the model is taught a velocity field—the direction each point should move to eventually reach the target distribution. Wang adds a key-dependent perturbation to this velocity field during training. The perturbation is designed so that the final generated distribution is unchanged: images from the watermarked model are statistically indistinguishable from those of the unwatermarked model. At detection time, recovering this perturbation pattern from black-box queries allows decoding of the watermark message.

This transforms the watermark from a "static imprint" into a "dynamic behavioral feature." To remove it, an attacker would have to break the dynamics of the model's data generation itself—not just scrub the output layer or fine-tune the weights.

Results

Experiments on MNIST and CIFAR-10 across different architectures support three claims:

Watermark information can be reliably recovered.
Generation quality shows no degradation.
Without the key, decoding accuracy equals random guessing.

Open questions

How many samples are needed to recover the information via black-box queries?
For high-resolution images or video generation, the velocity field has higher dimensions—does watermark robustness still hold?
If an attacker copies the model's generative behavior via distillation or transfer learning (without direct access to the velocity field), does the dynamic watermark remain effective?

References

1. Wang, S. (2026). *Dynamics-Level Watermarking of Flow Matching Models with Random Codes*. arXiv:2605.16239 [cs.LG]. 2. Lipman, Y., et al. (2023). *Flow Matching for Generative Modeling*. ICLR. 3. Koh, J. Y., et al. (2025). *Watermarking in the Age of Generative AI*. Communications of the ACM.