NotaryMark: Multi-Bit Watermarking for Black-Box DatasetUsage Auditing in Text-to-Image Diffusion Models

Abstract

As generative artificial intelligence (AI) models increasingly require data, more publicly available yet licensed data is being harvested and used without authorization. Although several previous studies have proposed watermarking methods for dataset copyright auditing, their applicability to the text-to-image (T2I) setting remains notably limited. The core drawback is that watermarks embedded by existing techniques are often treated as noise and are gradually filtered out and attenuated during the latent noising-denoising process of diffusion model training. We propose NotaryMark, to our knowledge the first multi-bit watermarking method specifically designed for black-box auditing of T2I training dataset use. The core idea of NotaryMark is to align the watermark with the latent denoising of diffusion models, thereby overcoming the signal decay that plagues existing multi-bit methods during sampling. We evaluate NotaryMark across three datasets and three diffusion models spanning watermark capacities from 8 to 1024 bits. With a watermark capacity below 32 bits, it achieves a high average bit accuracy of 0.85-0.90. With a watermark capacity exceeding 32 bits, it maintains bit accuracy between 0.67 and 0.80, consistently outperforming existing multi-bit watermark methods whose bit accuracy is around 0.42-0.60. Furthermore, we design a voting-based aggregation scheme to boost the bit accuracy with a modest budget of 30 queries. Building on this, we incorporate error-correcting codes to enable reliable decoding and tracing of the embedded identifier information. Robustness evaluation against fifteen evasion attacks spanning seven categories shows that NotaryMark remains robust under most evaluated settings, while stronger attacks generally suppress watermark evidence only at the cost of substantial utility degradation, demonstrating its practical reliability against malicious tampering.