Hiding a QR Code in the Continuous Flow Field: Dynamic Watermarks for Generative Models

Forum topic · 小凯 · 2026-05-18

Summary

A forum post discusses a third approach to watermarking generative models: instead of modifying outputs (fragile under post-processing) or weights (removable by fine-tuning), Wang embeds a watermark into the continuous dynamics of flow matching models. During training, a key-dependent perturbation is added to the velocity field. The design ensures the perturbation preserves the output distribution, so watermarked and unwatermarked models are statistically indistinguishable, while a black-box detector can recover the perturbation pattern to decode watermark information. This turns the watermark from a static imprint into a behavioral fingerprint of the generation process itself, making removal require destroying the model's dynamics rather than cleaning outputs or tuning weights. Experiments on MNIST and CIFAR-10 across architectures show three results: reliable watermark recovery, no drop in generation quality, and random-chance decoding without the key. Open questions raised include the number of black-box queries needed for recovery, robustness at higher-dimensional velocity fields for high-resolution images or video, and whether distillation or transfer learning can copy the behavior and evade the watermark.

Watermarking generative models typically takes one of two routes: modify the output (add imperceptible signals to generated images) or modify the weights (embed an identifier in model parameters). Both have weaknesses — output watermarks can be destroyed by post-processing, and weight watermarks can be washed out by fine-tuning. In this paper, Wang proposes a third approach: embed the watermark directly into the continuous dynamics of the generation process — the velocity field of a flow matching model.

How it works

Flow matching models learn a continuous path from noise to data. During training, the model is taught a velocity field: at every point, which direction to move to eventually reach the target distribution. Wang adds a key-dependent perturbation to this velocity field during training. The perturbation is designed so that the final generated distribution is unchanged — meaning watermarked and unwatermarked models produce statistically indistinguishable outputs. At detection time, recovering this perturbation pattern from black-box queries allows decoding the watermark information.

This effectively transforms the watermark from a *static imprint* into a *dynamic behavioral fingerprint*. Removing it would require breaking the dynamics of the model's data generation itself, rather than just cleaning the output layer or fine-tuning weights.

Experimental findings

Tests on MNIST and CIFAR-10 across different architectures support three points:

Watermark information can be reliably recovered
Generation quality shows no degradation
Without the key, decoding accuracy equals random guessing

Open questions

How many black-box samples are needed to recover the information?
For high-resolution images or video generation, the velocity field has higher dimensionality — does watermark robustness still hold?
If an attacker copies the model's generative behavior via distillation or transfer learning (without direct access to the velocity field), does the dynamic watermark remain effective?

---

References

1. Wang, S. (2026). *Dynamics-Level Watermarking of Flow Matching Models with Random Codes*. arXiv:2605.16239 [cs.LG].

2. Lipman, Y., et al. (2023). *Flow Matching for Generative Modeling*. ICLR.

3. Koh, J. Y., et al. (2025). *Watermarking in the Age of Generative AI*. Communications of the ACM.