Organizations: Tsinghua University · Swinburne University of Technology · The Australian National University · Key Laboratory of Pervasive Computing, Ministry of Education · Corresponding Author
Deep learning-based image watermarking, while robust against conventional distortions, remains vulnerable to advanced adversarial and regeneration attacks. Conventional countermeasures, which jointly optimize the encoder and decoder via a noise layer, face 2 inevitable challenges: (1) decrease of clean accuracy due to decoder adversarial training and (2) limited robustness due to simultaneous training of all three advanced attacks. To overcome these issues, we propose AdvMark, a novel two-stage fine-tuning framework that decouples the defense strategies. In stage 1, we address adversarial vulnerability via a tailored adversarial training paradigm that primarily fine-tunes the encoder while only conditionally updating the decoder. This approach learns to move the image into a non-attackable region, rather than modifying the decision boundary, thus preserving clean accuracy. In stage 2, we tackle distortion and regeneration attacks via direct image optimization. To preserve the adversarial robustness gained in stage 1, we formulate a principled, constrained image loss with theoretical guarantees, which balances the deviation from cover and previous encoded images. We also propose a quality-aware early-stop to further guarantee the lower bound of visual quality. Extensive experiments demonstrate AdvMark outperforms with the highest image quality and comprehensive robustness, i.e. up to 29%, 33% and 46% accuracy improvement for distortion, regeneration and adversarial attacks, respectively.
Figures & tables
Figure 1: Four training paradigms. Adversarial training (2) degrades clean accuracy of y1 and exhibits limited improvement, while moving image (3+4) suffices in both terms.
Figure 2: The bit accuracy ↑ of against three representative distortion, regeneration and adversarial attacks. JAT and EAT denote joint and encoder-based adversarial training.
Figure 3: Overview of AdvMark. In stage 1 we mainly fine-tune the encoder with slight decoder training to tackle adversarial attack. In stage 2 we directly optimize the encoded image to address the rest two attacks while preserving adversarial robustness.
Figure 4: Illustration of stage 1. We constantly fine-tune the encoder to map the image (No. 1) towards the non-attackable center (No. n). The decoder is updated only when the final image fails to suffice (No. n of image 2).
Figure 5: Illustration of stage 2. 0→1 : initialize image 1 from encoder, which exhibits only adversarial robustness; 2: comprehensive robustness but low visual quality; 3: high quality yet vulnerable to A attack again; 4: similar to image 2; ⋆ : high quality and robustness.
Figure 6: The original xo , watermarked xw and residual images xr of different watermarking methods where xr=∣xw−xo∣×10 . We present below each watermarking method as PSNR ↑ /SSIM ↑ /LPIPS ↓ .
Defense
Image Size
n
MS-COCO
DiffusionDB
PSNR ↑
SSIM ↑
LPIPS ↓
PSNR ↑
SSIM ↑
LPIPS ↓
DwtDctSvd
256 × 256
30
35.8
0.98
0.03
36.8
0.98
0.05
HiDDeN
128 × 128
30
30.3
0.94
0.14
30.8
0.94
0.16
MBRS
128 × 128
30
32.1
0.95
0.09
31.8
0.94
0.14
Stable Signature
128 × 128
48
30.5
0.94
0.12
30.8
0.94
0.14
PIMoG
128 × 128
30
35.8
0.95
0.08
35.6
0.95
0.10
Table 1: Visual quality of watermarked images, n is the secret message length. Blue and Red denote the best and worst.
Table 2: Robust accuracy ↑ . 1,2,3,4,1∼4 represent JPEG, Gaussian noise, Gaussian blur, brightness and 4 attacks combined respectively. ∗ denotes unknown attacks not included in training. Geometric and advanced combined attacks are in Table 5 .
Figure 7: Attack performance of Black-S and Black-Q.
Figure 8: Example of Black-Q attack and accuracy optimization.
Table 3: Ablation of AdvMark. AdvMark w/ λi2=7 achieves better robustness but at the cost of more optimization overheads. AdvMark w/ different sizes and n still outperforms baselines.
Figure 9: PSNR ↑ and accuracy ↑ for different thresholds.
Figure 10: Bit accuracy ↑ of watermarking methods against distortion attacks with different testing parameters.
Table 4: Ablation study of baselines. We present watermarking PSNR ↑ and robustness accuracy ↑ . Baselines with stage 2 are enhanced, demonstrating our optimization effectiveness.
Table 5: Performance of geometric and advanced attacks. We present the robustness accuracy ↑ . Although MBRS achieves similar results as AdvMark, it fails to defend against regeneration and adversarial attack, as shown in Table 2 .
Deep learning-based image watermarking commonly adopts an "Encoder-Noise Layer-Decoder" (END) architecture to improve robustness against random channel distortions, yet it often overlooks intentional manipulations introduced by adversaries with additional knowledge. In this paper, we revisit this paradigm and expose a critical yet underexplored vulnerability: the Known Original Attack (KOA), where an adversary has access to multiple original-watermarked image pairs, enabling various targeted suppression strategies. We show that even a simple residual-based removal approach, namely estimating an embedding residual from known pairs and subtracting it from unseen watermarked images, can almost completely remove the watermark while preserving visual quality. This vulnerability stems from the insufficient image dependency of residuals produced by END frameworks, which makes them transferable across images. To address this, we propose ResGuard, a plug-and-play module that enhances KOA robustness by enforcing image-dependent embedding. Its core lies in a residual specificity enhancement loss, which encourages residuals to be tightly coupled with their host images and thus improves image dependency. Furthermore, an auxiliary KOA noise layer injects residual-style perturbations during training, allowing the decoder to remain reliable under stronger embedding inconsistencies. Integrated into existing frameworks, ResGuard boosts KOA robustness, improving average watermark extraction accuracy from 59.87% to 99.81%.
Hanyi Wang, Han Fang, Yupeng Qiu +2
Shanghai Jiao Tong University China · University of Science and Technology of China China · National University of Singapore Singapore
Digital watermarking supports source attribution for AI-generated images, but its reliability depends on resistance to removal attacks. Some attacks attempt to remove watermarks by forcing the decoded watermark to differ from the original. However, this can produce an inverted watermark that remains detectable, causing removal to fail, while further attempts to alter the watermark may unnecessarily degrade image quality. To address these limitations, we present LiBRA (Latent In-band Bidirectional Removal Attack), which aims to make watermarks undetectable while preserving image quality. Instead of continually pushing the watermark toward inversion, LiBRA adjusts the image to conceal the watermark without encouraging further changes that could degrade image quality. Some attacks keep pushing decoded bits away from the original watermark, even when further changes preserve detectability and damage image quality. With access to the watermark key and decoder, LiBRA makes bounded changes in a public autoencoder's latent space. Unlike inversion-driven objectives that cannot correct excessive inversion, LiBRA guides average decoding confidence toward random guessing from either direction. This helps avoid an inverted but detectable watermark. Leaving individual bits flexible allows image-quality constraints to favor less damaging changes, while an optional frequency-guided mask limits their location. We verify removal using an exact two-sided binomial test rather than assuming the confidence target guarantees success.
Saibo Ye, Huajie Chen, Xin Guo +5
Faculty of Data Science, City University of Macau, Macao SAR, China · Corresponding Author · School of Information and Communications Engineering, Xi’an Jiaotong University, Xi’an 710049, China +2
Invisible image watermarks are increasingly used for deepfake detection and provenance tracking, where they must survive not only incidental distortions but also deliberate removal. We revisit spread-spectrum embedding, a classical watermarking principle, inside a modern neural post-hoc watermarking architecture. Our starting point is a measurement: in existing encoder-decoder schemes each message bit occupies only a small fraction of the image, a shared contributing factor to their fragility, since removal then need only disturb the region a bit occupies. SpreadMark instead spreads each bit as a dense pseudo-random codeword over the whole image and recovers it by matched-filtering a learned cover-suppressed chip representation, with a parallel convolutional decoding path and sparsification-aware training. A conditional chip-space analysis shows that, under a codeword-independent perturbation model, dense spreading increases the budget required to disrupt matched-filter recovery. Evaluated on COCO and DIV2K against nine schemes, SpreadMark is the only evaluated method retaining high detection under both the regeneration and the latent-space sparsification settings we test, with competitive JPEG and additive-noise robustness. It keeps the embedded watermark imperceptible, maintaining high perceptual quality on both COCO and DIV2K.
Wei Song, Yuxin Cao, Zhenchang Xing +4
University of New South Wales, Australia · National University of Singapore, Singapore · CSIRO’s Data61, Australia