[SPL 2026] Nonintrusive Watermarking for CycleGAN

Generative adversarial networks (GANs) are a set of powerful generative models, among which CycleGAN, featuring the unique cycle consistency loss, has gained special popularity. However, this unique structure and the cycle consistency loss make watermarking CycleGAN particularly challenging, rendering existing deep neural network (DNN) watermarking methods, whether model-agnostic or GAN-specific, inapplicable. Meanwhile, existing DNN watermarking methods are intrusive in nature, requiring directly or indirectly modification of model parameters for watermark embedding, which raises fidelity concerns. To solve the above problems, we propose the first nonintrusive and robust watermarking method for CycleGAN. We empirically show that without modifying the CycleGAN model, a user-defined watermark image can still be extracted from model outputs using a dedicated watermark decoder. Extensive experimental results verify that while achieving the socalled absolute fidelity, the proposed method is robust to various attacks, from image post-processing to model stealing.