Decoupling Defense Strategies for Robust Image Watermarking

Jiahui Chen; Zehang Deng; Zeyu Zhang; Chaoyang Li; Lianchen Jia; Lifeng Sun

cs.CVFeb 23, 2026

Decoupling Defense Strategies for Robust Image Watermarking

Authors: Jiahui Chen, Zehang Deng, Zeyu Zhang, Chaoyang Li, Lianchen Jia, Lifeng Sun

Organizations: Tsinghua University · Swinburne University of Technology · The Australian National University · Key Laboratory of Pervasive Computing, Ministry of Education ·

Abstract

Deep learning-based image watermarking, while robust against conventional distortions, remains vulnerable to advanced adversarial and regeneration attacks. Conventional countermeasures, which jointly optimize the encoder and decoder via a noise layer, face 2 inevitable challenges: (1) decrease of clean accuracy due to decoder adversarial training and (2) limited robustness due to simultaneous training of all three advanced attacks. To overcome these issues, we propose AdvMark, a novel two-stage fine-tuning framework that decouples the defense strategies. In stage 1, we address adversarial vulnerability via a tailored adversarial training paradigm that primarily fine-tunes the encoder while only conditionally updating the decoder. This approach learns to move the image into a non-attackable region, rather than modifying the decision boundary, thus preserving clean accuracy. In stage 2, we tackle distortion and regeneration attacks via direct image optimization. To preserve the adversarial robustness gained in stage 1, we formulate a principled, constrained image loss with theoretical guarantees, which balances the deviation from cover and previous encoded images. We also propose a quality-aware early-stop to further guarantee the lower bound of visual quality. Extensive experiments demonstrate AdvMark outperforms with the highest image quality and comprehensive robustness, i.e. up to 29%, 33% and 46% accuracy improvement for distortion, regeneration and adversarial attacks, respectively.

Figures & tables

Figure 1: Four training paradigms. Adversarial training (2) degrades clean accuracy of

y_{1}

and exhibits limited improvement, while moving image (3+4) suffices in both terms.

Figure 2: The bit accuracy

\uparrow

of against three representative distortion, regeneration and adversarial attacks. JAT and EAT denote joint and encoder-based adversarial training.

Figure 3: Overview of AdvMark. In stage 1 we mainly fine-tune the encoder with slight decoder training to tackle adversarial attack. In stage 2 we directly optimize the encoded image to address the rest two attacks while preserving adversarial robustness.

Figure 4: Illustration of stage 1. We constantly fine-tune the encoder to map the image (No. 1) towards the non-attackable center (No. n). The decoder is updated only when the final image fails to suffice (No. n of image 2).

Figure 5: Illustration of stage 2.

0\rightarrow 1

: initialize image 1 from encoder, which exhibits only adversarial robustness; 2: comprehensive robustness but low visual quality; 3: high quality yet vulnerable to A attack again; 4: similar to image 2;

\star

: high quality and robustness.

Figure 6: The original $x_{o}$ , watermarked $x_{w}$ and residual images $x_{r}$ of different watermarking methods where $x_{r}=|x_{w}-x_{o}|\times 10$ . We present below each watermarking method as PSNR $\uparrow$ /SSIM $\uparrow$ /LPIPS $\downarrow$ .

Defense	Image Size	n	MS-COCO			DiffusionDB
Defense	Image Size	n	PSNR $\uparrow$	SSIM $\uparrow$	LPIPS $\downarrow$	PSNR $\uparrow$	SSIM $\uparrow$	LPIPS $\downarrow$
DwtDctSvd	256 $\times$ 256	30	35.8	0.98	0.03	36.8	0.98	0.05
HiDDeN	128 $\times$ 128	30	30.3	0.94	0.14	30.8	0.94	0.16
MBRS	128 $\times$ 128	30	32.1	0.95	0.09	31.8	0.94	0.14
Stable Signature	128 $\times$ 128	48	30.5	0.94	0.12	30.8	0.94	0.14
PIMoG	128 $\times$ 128	30	35.8	0.95	0.08	35.6	0.95	0.10

Table 1: Visual quality of watermarked images, n is the secret message length. Blue and Red denote the best and worst.

Panel of Table 2 — Table 2: Robust accuracy $\uparrow$ . $1,2,3,4,1\sim 4$ represent JPEG, Gaussian noise, Gaussian blur, brightness and 4 attacks combined respectively. ∗ denotes unknown attacks not included in training. Geometric and advanced combined attacks are in Table 5 .

Panel of Figure 7 — Figure 7: Attack performance of Black-S and Black-Q.

Panel of Figure 8 — Figure 8: Example of Black-Q attack and accuracy optimization.

Panel of Table 3 — Table 3: Ablation of AdvMark. AdvMark w/ $\lambda_{i_{2}}=7$ achieves better robustness but at the cost of more optimization overheads. AdvMark w/ different sizes and n still outperforms baselines.

Panel of Figure 9 — Figure 9: PSNR $\uparrow$ and accuracy $\uparrow$ for different thresholds.

Panel of Figure 10 — Figure 10: Bit accuracy $\uparrow$ of watermarking methods against distortion attacks with different testing parameters.

Panel of Table 4 — Table 4: Ablation study of baselines. We present watermarking PSNR $\uparrow$ and robustness accuracy $\uparrow$ . Baselines with stage 2 are enhanced, demonstrating our optimization effectiveness.

Panel of Table 5 — Table 5: Performance of geometric and advanced attacks. We present the robustness accuracy $\uparrow$ . Although MBRS achieves similar results as AdvMark, it fails to defend against regeneration and adversarial attack, as shown in Table 2 .

Panel of Figure 11 — Figure 11: Overhead comparison.

Robust Watermarking

Robust watermarking embeds or verifies ownership and provenance signals that survive editing, compression, model changes, and deliberate removal.

See all 202 papers

ResGuard: Enhancing Robustness Against Known Original Attacks in Deep Watermarking
Apr 4, 2026Hanyi Wang, Han Fang, Yupeng Qiu +2Robust Watermarking Watermark Removal
Shanghai Jiao Tong University China · University of Science and Technology of China China · National University of Singapore Singapore
LiBRA: Detection-Aware Image Watermark Removal via Bidirectional Latent Optimization
Oct 2, 2026Saibo Ye, Huajie Chen, Xin Guo +5Watermark Removal AI-Generated Image Watermarking
Faculty of Data Science, City University of Macau, Macao SAR, China · Corresponding Author · School of Information and Communications Engineering, Xi’an Jiaotong University, Xi’an 710049, China +2
SpreadMark: Robust Image Watermarking via Spread-Spectrum Embedding
Aug 4, 2026Wei Song, Yuxin Cao, Zhenchang Xing +4Dataset Watermarking Robust Watermarking
University of New South Wales, Australia · National University of Singapore, Singapore · CSIRO’s Data61, Australia

Apr 4, 2026J/K move · Enter open · S save

ResGuard: Enhancing Robustness Against Known Original Attacks in Deep Watermarking

Hanyi Wang, Han Fang, Yupeng Qiu, Shilin Wang+1

Shanghai Jiao Tong University China · University of Science and Technology of China China · National University of Singapore Singapore

Robust Watermarking Watermark Removal

Open paper AskPDF arXiv

Deep learning-based image watermarking commonly adopts an "Encoder-Noise Layer-Decoder" (END) architecture to improve robustness against random channel distortions, yet it often overlooks intentional manipulations introduced by adversaries with additional knowledge. In this paper, we revisit this paradigm and expose a critical yet underexplored vulnerability: the Known Original Attack (KOA), where an adversary has access to multiple original-watermarked image pairs, enabling various targeted suppression strategies. We show that even a simple residual-based removal approach, namely estimating an embedding residual from known pairs and subtracting it from unseen watermarked images, can almost completely remove the watermark while preserving visual quality. This vulnerability stems from the insufficient image dependency of residuals produced by END frameworks, which makes them transferable across images. To address this, we propose ResGuard, a plug-and-play module that enhances KOA robustness by enforcing image-dependent embedding. Its core lies in a residual specificity enhancement loss, which encourages residuals to be tightly coupled with their host images and thus improves image dependency. Furthermore, an auxiliary KOA noise layer injects residual-style perturbations during training, allowing the decoder to remain reliable under stronger embedding inconsistencies. Integrated into existing frameworks, ResGuard boosts KOA robustness, improving average watermark extraction accuracy from 59.87% to 99.81%.

Abstract

Robust Watermarking

Explore similar work

ResGuard: Enhancing Robustness Against Known Original Attacks in Deep Watermarking

LiBRA: Detection-Aware Image Watermark Removal via Bidirectional Latent Optimization

SpreadMark: Robust Image Watermarking via Spread-Spectrum Embedding