---
library_name: pytorch
pipeline_tag: image-classification
tags:
  - watermarking
  - diffusion
  - provenance
  - attribution
  - stable-diffusion
---

# DiffSign public watermark decoder (256-bit)

Public verification artifact for the anonymous **DiffSign** submission,
*Public Authorization and the Adaptive Attack Surface of Diffusion-Watermark
Attribution*.

This repository contains **only the public decoder** `D_psi`. The secret
encoder `E_phi` is server-private by design and is deliberately not published:
DiffSign's threat model assumes an adversary holds the full public
verification interface but cannot invoke the encoder.

## Artifact

| | |
|---|---|
| File | `diffsign_public_decoder_256bit.pth` |
| Size | 21,702,122 bytes |
| SHA-256 | `1cf105cd89de5aba6beefe5e48af2082de78de296e912557ab2d7905c2ab975c` |
| Tensors | 38 (5,422,300 parameters) |
| Output | logits `[batch, 256, 2]` |
| Raw LLRs | `logit(bit=1) - logit(bit=0)`, shape `[batch, 256]` |

Top-level fields: `format_version`, `artifact`, `decoder_state_dict`,
`decoder_config`, `preprocessing`, `llr_convention`. It contains no
`encoder_state_dict` and no optimizer, scheduler, or training state.

## Preprocessing

Pair the decoder with the public VAE from
[`stable-diffusion-v1-5/stable-diffusion-v1-5`](https://huggingface.co/stable-diffusion-v1-5/stable-diffusion-v1-5):

1. Convert to RGB and resize to 512x512.
2. Normalize pixels to `[-1, 1]`.
3. Take the VAE posterior mode and multiply by the latent scaling factor.
4. Evaluate `D_psi` once.
5. Return `logit(bit=1) - logit(bit=0)` as `float32[256]` raw LLRs.

Public verification is normative in `float32`. Half precision is permitted for
throughput but is not the reference configuration: it shifts raw LLRs by up to
`2e-2` and can flip a hard decision on a bit whose LLR is already near zero,
so two verifiers on different hardware may disagree.

## Usage

```python
from diffsign.physical import PublicWatermarkDecoder

decoder = PublicWatermarkDecoder.from_pretrained(
    "diffsign_public_decoder_256bit.pth",
    device="cuda",
)
raw_llrs = decoder.decode_raw_llrs(image)   # float32[256]
```

The raw LLRs are divided by the fixed calibration temperature `0.7144` and
decoded by a CRC-aided successive-cancellation list decoder (length-256
non-systematic polar code, list size 8) into a 112-bit payload, which resolves
through an audited transparency log to a signed receipt.

## Scope

Inference only. No training loop, dataset loader, attack implementation,
third-party baseline, benchmark harness, or bulk generation script.