Watermarking Autoregressive Image Generation 🖼️💧

<p align="center"> <img src="https://dl.fbaipublicfiles.com/wmar/gimmick.gif" alt="Watermarking Demo" width="600"/> </p>

Official implementation of Watermarking Autoregressive Image Generation (NeurIPS 2025). This repository provides a framework for watermarking autoregressive image models, and includes the code to reproduce the main results from the paper. In wmar_audio we also provide the code accompanying our case study on Audio (see Section 5 in the paper).

[arXiv] [Colab]

📰 News

• September 19: Follow-up work! SyncSeal is an active watermark synchronization method that improves robustness against desynchronization attacks. To use it as a drop-in replacement for the original synchronization layer, download the TorchScript (wget https://dl.fbaipublicfiles.com/wmar/syncseal/paper/syncmodel.jit.pt -P checkpoints/) and forward the path to the SyncManager (--syncpath flag). A standalone SyncSeal code release is in the syncseal/ folder.
• September 18: Our paper has been accepted to NeurIPS 2025! 🎉

💿 Installation

1️⃣ Environment

First, clone the repository and enter the directory:

git clone https://github.com/facebookresearch/wmar
cd wmar

Then, set up a conda environment as follows:

conda create --name wmar python=3.12
conda activate wmar

Finally, install xformers (which will include Torch 2.7.0 CUDA 12.6) and other dependencies, and override the triton version (needed for compatibility with Chameleon).

pip install -U xformers --index-url https://download.pytorch.org/whl/cu126
pip install -r requirements.txt
pip install triton==3.1.0 

We next describe how to load all autoregressive models, finetuned tokenizer deltas, and other requirements. The simplest way to start is to execute notebooks/colab.ipynb (also hosted on Colab) which downloads only the necessary components from below. We assume that all checkpoints will be placed under checkpoints/.

2️⃣ Autoregressive Models

Instructions to download each of the three models evaluated in the paper are given below.

• Taming. You need to manually download the transfomer and VQGAN weights following the instructions from the official repo. In particular, download cin_transformer from https://app.koofr.net/links/90cbd5aa-ef70-4f5e-99bc-f12e5a89380e and VQGAN ImageNet (f=16), 16384 from https://heibox.uni-heidelberg.de/d/a7530b09fed84f80a887/ and set up the following folder structure under e.g., checkpoints/2021-04-03T19-39-50_cin_transformer:

  checkpoints/
      net2net.ckpt 
      vqgan.ckpt
  configs/
      net2net.yaml
      vqgan.yaml
  

  This directory should be also set as --modeldir when executing the code (see below). To adapt the model configs to the paths in our codebase execute:

  sed -i 's/ taming\./ deps.taming./g' checkpoints/2021-04-03T19-39-50_cin_transformer/configs/vqgan.yaml
  sed -i 's/ taming\./ deps.taming./g' checkpoints/2021-04-03T19-39-50_cin_transformer/configs/net2net.yaml
  

• Chameleon. Our runs can be reproduced with the open-source alternative Anole, following these instructions. In particular, in your checkpoints/ run:

  git lfs install
  git clone https://huggingface.co/GAIR/Anole-7b-v0.1
  

  And then set --modelpath flag when running the models to checkpoints/Anole-7b-v0.1. Before this, patch Anole to make it compatible with the Taming codebase (you need to also download Taming above for this step):

  python -c 'from wmar.utils.utils import patch_chameleon; patch_chameleon("checkpoints/Anole-7b-v0.1")'
  cp assets/chameleon_patched_config.yaml checkpoints/Anole-7b-v0.1/tokenizer/vqgan.yaml
  

• RAR. RAR-XL is downloaded automatically on the first run; set --modelpath to the directory where you want to save the tokenizer and model weights, e.g., checkpoints/rar.

3️⃣ Deltas of Finetuned Tokenizers

We provide links to weight deltas of the tokenizers finetuned for reverse-cycle-consistency (RCC) that we used in our evaluation in the paper: | Model | Finetuned | Finetuned+Augmentations | | --- | --- | --- | | Taming | Encoder / Decoder | Encoder / Decoder | | Chameleon/Anole | Encoder / Decoder | Encoder / Decoder | | RAR | Encoder / Decoder | Encoder / Decoder |

To use them, download the files and place them in e.g., checkpoints/finetunes/, setting --encoder_ft_ckpt and --decoder_ft_ckpt flags accordingly when running the code (see below). These deltas should be added to the original encoder/decoder weights, which is automatically handled by our loading functions.

Alternatively, you can:

• download them automatically by running:

  mkdir -p checkpoints/finetunes && cd checkpoints/finetunes && wget -nc https://dl.fbaipublicfiles.com/wmar/finetunes/taming_encoder_ft_noaug_delta.pth https://dl.fbaipublicfiles.com/wmar/finetunes/taming_decoder_ft_noaug_delta.pth https://dl.fbaipublicfiles.com/wmar/finetunes/taming_encoder_ft_delta.pth https://dl.fbaipublicfiles.com/wmar/finetunes/taming_decoder_ft_delta.pth https://dl.fbaipublicfiles.com/wmar/finetunes/chameleon7b_encoder_ft_noaug_delta.pth https://dl.fbaipublicfiles.com/wmar/finetunes/chameleon7b_decoder_ft_noaug_delta.pth https://dl.fbaipublicfiles.com/wmar/finetunes/chameleon7b_encoder_ft_delta.pth https://dl.fbaipublicfiles.com/wmar/finetunes/chameleon7b_decoder_ft_delta.pth https://dl.fbaipublicfiles.com/wmar/finetunes/rar_encoder_ft_noaug_delta.pth https://dl.fbaipublicfiles.com/wmar/finetunes/rar_decoder_ft_noaug_delta.pth https://dl.fbaipublicfiles.com/wmar/finetunes/rar_encoder_ft_delta.pth https://dl.fbaipublicfiles.com/wmar/finetunes/rar_decoder_ft_delta.pth && cd - 
  

• or use the finetune.py script to finetune the models yourself (see below).

4️⃣ Other Requirements

To use the original watermark synchronization layer, download WAM:

wget https://dl.fbaipublicfiles.com/watermark_anything/wam_mit.pth -P checkpoints/

To instead use the active synchronization method from our follow-up work SyncSeal, download the TorchScript:

wget https://dl.fbaipublicfiles.com/wmar/syncseal/paper/syncmodel.jit.pt -P checkpoints/

To evaluate watermark robustness, download the DiffPure model:

wget https://openaipublic.blob.core.windows.net/diffusion/jul-2021/256x256_diffusion_uncond.pt -P checkpoints/

🎮 Usage

1️⃣ Quickstart

The notebook colab.ipynb (open in Colab) is a good starting point. It downloads the necessary components to run watermarked generation with RAR (RAR, finetuned deltas, WAM) and illustrates the robustness of the watermark to transformations.

2️⃣ Large-scale generation and evaluation

We describe how to start a larger generation run and the follow-up evaluation and plotting that follows our experimental setup from the paper and reproduces our main results. We focus on the Taming model, aiming to reproduce Figures 5, 6 and Table 2 in the paper. Before starting make sure to follow the relevant parts of the setup above.

For each of the 4 variants evaluated in the paper (Base, FT, FT+Augs, FT+Augs+Sync), we generate 1000 watermarked images and apply all the transformations using generate.py. The 4 corresponding runs are documented in a readable form in configs/taming_generate.json. For Taming, we provide the corresponding 4 commands in configs/taming_generate.sh. For example, to run FT+Augs+Sync, execute:

python3 generate.py --seed 1 --model taming \
--decoder_ft_ckpt checkpoints/finetunes/taming_decoder_ft_delta.pth \
--encoder_ft_ckpt checkpoints/finetunes/taming_encoder_ft_delta.pth  \
--modelpath checkpoints/2021-04-03T19-39-50_cin_transformer/ \
--sync True --syncpath checkpoints/wam_mit.pth \
--wm_method gentime --wm_seed_strategy linear --wm_delta 2 --wm_gamma 0.25 \
--wm_context_size 1 --wm_split_strategy stratifiedrand \
--include_diffpure True --include_neural_compress True \
--top_p 0.92 --temperature 1.0 --top_k 250 --batch_size 5 \
--conditioning 1,9,232,340,568,656,703,814,937,975 \
--num_samples_per_conditioning 100 \
--chunk_id 0 --num_chunks 1 \
--outdir out/0617_taming_generate/_sync=True_decoder_ft_ckpt=2_encoder_ft_ckpt=2

Evaluation can be speed up by increasing the batch size,