TIACam: Text-Anchored Invariant Feature Learning with Auto-Augmentation for Camera-Robust Zero-Watermarking

Abdullah All Tanvir; Agnibh Dasgupta; Xin Zhong

eess.IVFeb 21, 2026

TIACam: Text-Anchored Invariant Feature Learning with Auto-Augmentation for Camera-Robust Zero-Watermarking

Authors: Abdullah All Tanvir, Agnibh Dasgupta, Xin Zhong

Organizations: Department of Computer Science, University of Nebraska Omaha

Abstract

Camera recapture introduces complex optical degradations, such as perspective warping, illumination shifts, and Moiré interference, that remain challenging for deep watermarking systems. We present TIACam, a text-anchored invariant feature learning framework with auto-augmentation for camera-robust zero-watermarking. The method integrates three key innovations: (1) a learnable auto-augmentor that discovers camera-like distortions through differentiable geometric, photometric, and Moiré operators; (2) a text-anchored invariant feature learner that enforces semantic consistency via cross-modal adversarial alignment between image and text; and (3) a zero-watermarking head that binds binary messages in the invariant feature space without modifying image pixels. This unified formulation jointly optimizes invariance, semantic alignment, and watermark recoverability. Extensive experiments on both synthetic and real-world camera captures demonstrate that TIACam achieves state-of-the-art feature stability and watermark extraction accuracy, establishing a principled bridge between multimodal invariance learning and physically robust zero-watermarking.

Figures & tables

Figure 1: Concept of the proposed TIACam.

Figure 2: Overview of the proposed TIACam. Given an input image $x$ and its positive anchor caption $T$ with a negative caption $\tilde{T}$ , a distorted image $\hat{x}=\mathcal{T}_{\text{aug}}(x)$ is generated using the learned auto-augmentor $\mathcal{T}_{\text{aug}}(\cdot)$ . All inputs are encoded by the CLIP encoders to obtain 768-D features, which are refined by the invariant feature extractor $f_{\theta}(\cdot)$ into 1024-D invariant representations. Paired samples $(f_{\theta}(x),g_{\tau}(T))$ , $(f_{\theta}(\hat{x}),g_{\tau}(T))$ , and $(f_{\theta}(\hat{x}),g_{\tau}(\tilde{T}))$ are used to train a discriminator $D_{\psi}(\cdot)$ that distinguishes real from fake associations, while $f_{\theta}$ is adversarially optimized both against $D_{\psi}$ for semantic alignment and against $\mathcal{T}_{\text{aug}}$ for robustness. For zero-watermarking, the invariant feature $f_{\theta}(x)$ is projected onto reference codes $C$ , and watermark bits are predicted as $\hat{W}=\sigma(f_{\theta}(x)^{\top}C)$ for reliable extraction.

Distortion	SimCLR	BYOL	Barlow	VICReg	VIbCReg	TIACam
Additive	0.82	0.88	0.79	0.83	0.89	0.97
Photometric	0.84	0.84	0.81	0.76	0.88	0.93
Perspective	0.87	0.85	0.87	0.83	0.88	0.95
JPEG	0.79	0.80	0.87	0.81	0.73	0.98
Moiré	0.85	0.83	0.84	0.89	0.87	0.97
Filtering	0.88	0.88	0.89	0.87	0.88	0.98

Table 1: Cosine similarity between features of original and distorted images.

Figure 3: From left to right: example image, its camera-distorted version, and an unrelated negative image.

Figure 4: Linear probe (Top 1 & 5 accuracy) on CIFAR-100, Imagenette, MSCOCO, and Caltech-256 under six camera distortions.

Figure 5: Examples of real-world distortions evaluated in this study. The first row shows screen-camera captures, where images are re-photographed from different monitors using different mobile cameras. The second row shows print-camera captures, obtained by printing images on paper and re-capturing them under varying lighting and viewpoints. The third row shows screenshots, representing user-generated distortions such as compositional clutter.

Method	Screen Camera		Print Camera		Screenshots
Method	30 bits	100 bits	30 bits	100 bits	30 bits	100 bits
HiDDeN	70.6%	68.8%	67.1%	65.7%	74.5%	70.6%
PIMoG	82.3%	80.1%	75.7%	72.3%	79.7%	78.6%
StegaStamp	93.8%	91.2%	92.2%	91.3%	93.7%	93.9%
TIACam	99.1%	98.2%	96.6%	95.1%	97.4%	95.2%

Table 2: Bit accuracy (BA, in %) comparison of HiDDeN, PIMoG, StegaStamp, and TIACam under three real-world distortion types: Screen Camera, Print Camera, and Screenshots, for 30-bit and 100-bit message lengths. Results averaged over three random seeds; variance below 0.3%.

Dataset	CLIP Only	CLIP + TIACam Feature
Visual Genome	0.78	0.92
Flickr	0.84	0.93
MSCOCO	0.76	0.89
ImageNet	0.82	0.93

Table 3: Ablation on TIACam feature extractor. Higher cosine similarity indicates stronger invariance under distortion.

Figure 6: Extreme case test of feature distinctiveness. Both images are generated with the same caption, “A photo of cat, person, and park bench” , yet their invariant features exhibit a cosine similarity of only 0.73.

Figure 1: Example of Visual Gnome Training Data used in TIACam.

Figure 2: Example of Flickr training data used in TIACam. The first row shows the images, the second row contains the corresponding captions, and the third row presents paraphrased versions of those captions.

Figure 3: Examples of auto-augmented images.

Distortion Type	Manual Augmentor (Fixed)	Auto-Augmentor (Ours)
Additive Noise	0.84	0.98
Photometric	0.86	0.96
Perspective	0.78	0.92
JPEG Compression	0.88	0.97
Moiré Pattern	0.76	0.89
Filtering	0.89	0.98

Table 1: Cosine similarity between original and distorted invariant features across six distortion types.

Distortion Type	Manual Augmentor (Fixed)	Auto-Augmentor (Ours)
Screen Camera	0.82	0.91
Print Camera	0.76	0.87
Screenshot	0.78	0.85

Table 2: Cosine similarity between original and distorted invariant features across Screen Camera, Print Camera, Screenshot

Model Variant	30-bit	100-bit	200-bit
Manual Augmentor (Fixed)	91.2	89.5	89.3
Auto-Augmentor (Ours)	98.7	96.4	96.1

Table 3: Bit accuracy (%) under randomly applied 6 distortions.

Method	Screen Camera		Print Camera		Screenshots
Method	30 bits	100 bits	30 bits	100 bits	30 bits	100 bits
Manual Augmentor	93.3%	92.6%	90.1%	87.4%	92.7%	87.9%
Auto Augmentor (Ours)	99.1%	98.4%	96.9%	95.3%	97.6%	96.5%

Table 4: Bit accuracy (%) of Manual Augmentor and Auto Augmentor under screen camera, print camera, and screenshot distortions (30-bit and 100-bit).

Distortion	ZBW [ 27 ]	WSSL [ 7 ]	TIACam
Identity	1.00	1.00	1.00
Rotation (25°)	0.27	1.00	1.00
Crop (0.5)	1.00	1.00	0.98
Crop (0.1)	0.02	0.98	1.00
Resize (0.7)	1.00	1.00	1.00
Blur (2.0)	0.25	1.00	1.00

Table 5: Bit accuracy (%) under digital distortions.

Distortion	DWSF [ 11 ]	MuST [ 28 ]	WOFA [ 21 ]	TIACam
Translation 10%	52.97	50.00	91.97	93.9
Translation 25%	49.87	49.98	93.25	92.1
Translation 50%	49.92	49.74	87.93	90.3
Rotation 15°	50.21	49.79	95.26	99.2
Rotation 30°	49.74	49.73	94.24	97.8
Rotation 45°	49.60	49.82	90.63	95.5

Table 6: Bit accuracy (%) under geometric distortions.

Method	Screen Camera		Print Camera		Screenshots
Method	30 bits	100 bits	30 bits	100 bits	30 bits	100 bits
DWSF	77.4%	71.8%	69.4%	65.1%	64.9%	62.8%
MuST	81.8%	80.6%	74.9%	72.3%	65.3%	64.1%
WOFA	86.7%	81.1%	71.4%	70.2%	67.7%	64.8%
TIACam	99.1%	98.2%	96.6%	95.1%	97.4%	95.2%

Table 7: Bit accuracy (%) of DWSF, WOFA, MuST, and TIACam under screen camera, print camera, and screenshot distortions (30-bit and 100-bit).

Dataset	Method	Additive		Photometric		Perspective		JPEG		Moiré		Filtering
Dataset	Method	Top-1	Top-5	Top-1	Top-5	Top-1	Top-5	Top-1	Top-5	Top-1	Top-5	Top-1	Top-5
CIFAR-100	SimCLR	72.1	83.3	71.0	79.1	70.5	86.7	62.4	76.5	70.2	81.9	71.3	86.8
	BYOL	75.5	89.2	73.4	88.1	72.6	87.3	61.7	78.0	74.0	86.2	73.9	87.1
	Barlow Twins	71.8	88.7	69.6	85.7	72.9	86.9	65.8	77.6	75.5	87.0	78.2	86.6
	VICReg	74.2	84.5	70.9	90.4	73.9	87.4	65.1	78.6	71.3	83.7	78.1	87.5
	VIbCReg	72.9	88.5	72.9	88.4	76.9	87.4	66.1	82.6	76.3	81.7	77.1	87.5

Table 8: Linear evaluation (Top-1 / Top-5 accuracy) on CIFAR-100, Imagenette, MSCOCO, and Caltech-256 under six distortion types.

Figure 4: Semantic disambiguation using controlled captions. Although the two images are visually similar, the model distinguishes them through small caption differences (e.g., “cat” vs. “dog”), yielding higher similarity for matching image–text pairs and lower similarity for mismatched ones.

Figure 5: Example failure case caused by severe occlusion. More than two-thirds of the image content is covered, removing or altering the semantic cues required by TIACam to recover the invariant representation. Because the watermark is bound to the image’s underlying semantic meaning, a distortion that destroys or changes that meaning essentially yields a new image, making successful extraction impossible.

Robust Watermarking

Robust watermarking embeds or verifies ownership and provenance signals that survive editing, compression, model changes, and deliberate removal.

See all 207 papers

Rel-Zero: Harnessing Patch-Pair Invariance for Robust Zero-Watermarking Against AI Editing
Mar 18, 2026Pengzhen Chen, Yanwei Liu, Xiaoyan Gu +3Robust Watermarking Digital Image Forensics
Institute of Information Engineering, Chinese Academy of Sciences · School of Cyber Security, University of Chinese Academy of Sciences · State Key Laboratory of Cyberspace Security Defense +1
FeatMark: Feature-level Watermark Protection against Mimicry Attacks with Diffusion Models
Sep 25, 2026Haoyang Li, Ruoxi Sun, Qingqing Ye +4AI-Generated Image Watermarking Diffusion Model Watermarking
The Hong Kong Polytechnic University · CSIRO’s Data61 · Macquarie University
WaterVIB: Learning Minimal Sufficient Watermark Representations via Variational Information Bottleneck
Feb 25, 2026Haoyuan He, Yu Zheng, Jie Zhou +1Robust Watermarking
Department of Automation, Tsinghua University.

Mar 18, 2026J/K move · Enter open · S save

Rel-Zero: Harnessing Patch-Pair Invariance for Robust Zero-Watermarking Against AI Editing

Pengzhen Chen, Yanwei Liu, Xiaoyan Gu, Xiaojun Chen+2

Institute of Information Engineering, Chinese Academy of Sciences · School of Cyber Security, University of Chinese Academy of Sciences · State Key Laboratory of Cyberspace Security Defense+1

Robust Watermarking Digital Image Forensics

Open paper AskPDF arXiv

Recent advancements in diffusion-based image editing pose a significant threat to the authenticity of digital visual content. Traditional embedding-based watermarking methods often introduce perceptible perturbations to maintain robustness, inevitably compromising visual fidelity. Meanwhile, existing zero-watermarking approaches, typically relying on global image features, struggle to withstand sophisticated manipulations. In this work, we uncover a key observation: while individual image patches undergo substantial alterations during AI-based editing, the relational distance between patch pairs remains relatively invariant. Leveraging this property, we propose Relational Zero-Watermarking (Rel-Zero), a novel framework that requires no modification to the original image but derives a unique zero-watermark from these editing-invariant patch relations. By grounding the watermark in intrinsic structural consistency rather than absolute appearance, Rel-Zero provides a non-invasive yet resilient mechanism for content authentication. Extensive experiments demonstrate that Rel-Zero achieves substantially improved robustness across diverse editing models and manipulations compared to prior zero-watermarking approaches.

Abstract

Robust Watermarking

Explore similar work

Rel-Zero: Harnessing Patch-Pair Invariance for Robust Zero-Watermarking Against AI Editing

FeatMark: Feature-level Watermark Protection against Mimicry Attacks with Diffusion Models

WaterVIB: Learning Minimal Sufficient Watermark Representations via Variational Information Bottleneck