Deep learning-based watermarking has made remarkable progress in recent years. To achieve robustness against various distortions, current methods commonly adopt a training strategy where a single random distortion (SRD) is chosen as the noise layer in each training batch. However, the SRD strategy treats distortions independently within each batch, neglecting the inherent relationships among different types of distortions and causing optimization conflicts across batches. As a result, the robustness and generalizability of the watermarking model are limited. To address this issue, we propose a novel training strategy that enhances robustness and generalization via meta-learning with feature consistency (Meta-FC). Specifically, we randomly sample multiple distortions from the noise pool to construct a meta-training task, while holding out one distortion as a simulated ``unknown'' distortion for the meta-testing phase. Through meta-learning, the model is encouraged to identify and utilize neurons that exhibit stable activations across different types of distortions, mitigating the optimization conflicts caused by the random sampling of diverse distortions in each batch. To further promote the transformation of stable activations into distortion-invariant representations, we introduce a feature consistency loss that constrains the decoded features of the same image subjected to different distortions to remain consistent. Extensive experiments demonstrate that, compared to the SRD training strategy, Meta-FC improves the robustness and generalization of various watermarking models by an average of 1.59%, 4.71%, and 2.38% under high-intensity, combined, and unknown distortions.
Figures & tables
Figure 1: The difference of the training process between SRD and Meta-FC. (a) The SRD pipeline. (b) The Meta-FC pipeline. In the meta-training phase, the model learns to be robust against known distortions. In the meta-testing phase, the model is evaluated under a simulated “unknown” distortion. Note that no truly unknown distortions are involved during the entire training process.
Figure 2: The whole training process of our proposed Meta-FC. First, the main encoder and decoder are used to process images under meta-training distortions, yielding the meta-training loss Lmeta-train (composed of Lw,n and Lmsgtra ) and producing temporary encoder and decoder parameters. Next, these temporary parameters are evaluated on the meta-testing distortions to calculate the meta-testing loss Lmeta-test (composed of Lmsgtes ). Subsequently, the image loss Limg (composed of Limgtra and Limgtes ) is computed based on the watermarked images generated by the main and the temporary encoders. Finally, the main model parameters are updated by minimizing the total loss Ltotal , which consists of Lmeta-train , Lmeta-test , and Limg .
Figure 3: Result of the visual quality of SRD and our method under different models. The first row presents the cover image, followed by the watermarked images in the second row. The third row shows the watermarked images subjected to various distortions. The fourth row illustrates the residuals, which represent the difference between the watermarked and cover images and are magnified by a factor of 5 to enhance visibility. The final two rows report the PSNR(dB) and SSIM values of each model, respectively, where consistent visual quality is maintained across training methods for the same model.
Datasets
Models
Strategy
Identity
GB ( σ=6 )
SPN ( σ=0.15 )
Crop ( p=0.7 )
JPEG ( Q=30 )
MB ( w=7 )
GN ( σ=0.08 )
Bright ( f=4 )
Dropout ( p=0.7 )
Avg.
DIV2K
StegaStamp
SRD
100
100
98.07
86.56
95.84
99.97
97.89
77.70
94.33
94.48
Meta-FC
100
100
99.07
90.00
97.42
99.99
98.25
80.84
94.56
95.57
MBRS
SRD
100
99.02
97.46
91.94
83.95
90.82
93.98
94.25
99.76
94.58
Meta-FC
100
99.33
98.44
95.78
86.79
95.25
96.01
93.93
99.75
96.14
FIN
SRD
99.97
96.25
97.27
81.16
99.04
90.15
93.89
88.73
83.29
92.19
Meta-FC
100
97.16
98.27
83.15
99.89
90.18
95.70
89.32
85.58
93.25
Table 1: Comparison of ACC (%) under high-intensity distortions. To ensure a fair comparison, the embedding strength of each baseline model is adjusted for both SRD and Meta-FC, such that the resulting PSNR values remain consistent across methods.
Datasets
Models
Strategy
MB&JPEG
MB&SPN
MB&GN
GN&SPN
GN&JPEG
MB&SPN &GN
MB&JPEG &Crop
Avg.
DIV2K
StegaStamp
SRD
99.13
99.81
98.54
97.49
97.04
94.78
97.21
97.71
Meta-FC
99.78
99.81
99.01
98.50
98.26
95.52
97.89
98.40
MBRS
SRD
71.47
90.24
72.09
94.11
75.98
65.98
69.81
77.10
Meta-FC
81.53
98.88
82.70
96.31
80.21
74.92
79.31
84.84
FIN
SRD
95.98
91.23
80.13
93.38
93.25
75.59
92.56
88.87
Meta-FC
97.01
92.32
80.06
95.70
95.54
76.69
95.38
90.38
Table 2: Comparison of ACC (%) under combined distortions. PSNR is kept consistent across training methods for each baseline, following the same setup as in the high-intensity distortion evaluation.
Datasets
Model
Strategy
JPEG ( Q=50 )
Bright ( f=3 )
Dropout ( p=0.7 )
Erasing ( σ=0.6 )
Contrast ( f=4 )
Saturation ( f=3 )
Cropout ( p=0.7 )
Crop ( p=0.7 )
Avg.
DIV2K
StegaStamp
SRD
99.89
77.53
82.75
78.63
77.05
61.60
81.17
84.11
80.34
Meta-FC
99.97
78.43
84.34
79.22
79.28
68.80
86.39
85.68
82.76
MBRS
SRD
60.30
92.70
99.02
82.45
96.13
99.71
91.25
89.53
88.89
Meta-FC
73.65
92.66
99.74
85.35
96.41
99.98
91.54
91.18
91.31
FIN
SRD
99.93
90.09
81.93
73.45
89.23
99.38
77.51
78.44
86.25
Meta-FC
99.98
90.74
83.41
76.06
89.45
99.46
79.17
79.57
87.23
Table 3: Comparison of ACC (%) under unknown distortions.
Strategy
ACC(%) ↑
High-intensity
Combined
Unknown
Mate-FC w/o meta-train & FC
94.34 ( ↓ 1.59)
87.94 ( ↓ 4.71)
88.55 ( ↓ 2.38)
Mate-FC w/o meta-test & FC
95.27 ( ↓ 0.66)
90.58 ( ↓ 2.07)
88.96 ( ↓ 1.97)
Mate-FC w/o FC
95.56 ( ↓ 0.37)
90.44 ( ↓ 2.21)
90.99 ( ↑ 0.06)
Meta-FC
95.93
92.65
90.93
Table 4: Ablation study on different parts in our proposed Meta-FC architecture.
Strategy
StegaStamp
MBRS
FIN
SepMark
DERO
Time (h)
ACC (%)
Time (h)
ACC (%)
Time (h)
ACC (%)
Time (h)
ACC (%)
Time (h)
ACC (%)
SRD
1.81
94.67
2.07
85.93
1.68
90.80
1.99
89.19
1.77
95.05
Meta-FC
2.36
96.87
3.37
90.40
2.86
92.35
3.12
95.48
2.53
96.59
Table 5: Comparison of training time for SRD and Meta-FC.
Diffusion-based watermarking methods embed verifiable marks by manipulating the initial noise or the reverse diffusion trajectory. However, these methods share a critical assumption: verification can succeed only if the diffusion trajectory can be faithfully reconstructed. This reliance on trajectory recovery constitutes a fundamental and exploitable vulnerability. We propose Stochastic Hidden-Trajectory Deflection (SHIFT), a training-free attack that exploits this common weakness across diverse watermarking paradigms. SHIFT leverages stochastic diffusion resampling to deflect the generative trajectory in latent space, making the reconstructed image statistically decoupled from the original watermark-embedded trajectory while preserving strong visual quality and semantic consistency. Extensive experiments on nine representative watermarking methods spanning noise-space, frequency-domain, and optimization-based paradigms show that SHIFT achieves 95%--100% attack success rates with nearly no loss in semantic quality, without requiring any watermark-specific knowledge or model retraining.
Rui Bao, Zheng Gao, Xiaoyu Li +3
University of New South Wales · Griffith University
Deep learning-based image watermarking commonly adopts an "Encoder-Noise Layer-Decoder" (END) architecture to improve robustness against random channel distortions, yet it often overlooks intentional manipulations introduced by adversaries with additional knowledge. In this paper, we revisit this paradigm and expose a critical yet underexplored vulnerability: the Known Original Attack (KOA), where an adversary has access to multiple original-watermarked image pairs, enabling various targeted suppression strategies. We show that even a simple residual-based removal approach, namely estimating an embedding residual from known pairs and subtracting it from unseen watermarked images, can almost completely remove the watermark while preserving visual quality. This vulnerability stems from the insufficient image dependency of residuals produced by END frameworks, which makes them transferable across images. To address this, we propose ResGuard, a plug-and-play module that enhances KOA robustness by enforcing image-dependent embedding. Its core lies in a residual specificity enhancement loss, which encourages residuals to be tightly coupled with their host images and thus improves image dependency. Furthermore, an auxiliary KOA noise layer injects residual-style perturbations during training, allowing the decoder to remain reliable under stronger embedding inconsistencies. Integrated into existing frameworks, ResGuard boosts KOA robustness, improving average watermark extraction accuracy from 59.87% to 99.81%.
Hanyi Wang, Han Fang, Yupeng Qiu +2
Shanghai Jiao Tong University China · University of Science and Technology of China China · National University of Singapore Singapore
Deep learning-based image watermarking, while robust against conventional distortions, remains vulnerable to advanced adversarial and regeneration attacks. Conventional countermeasures, which jointly optimize the encoder and decoder via a noise layer, face 2 inevitable challenges: (1) decrease of clean accuracy due to decoder adversarial training and (2) limited robustness due to simultaneous training of all three advanced attacks. To overcome these issues, we propose AdvMark, a novel two-stage fine-tuning framework that decouples the defense strategies. In stage 1, we address adversarial vulnerability via a tailored adversarial training paradigm that primarily fine-tunes the encoder while only conditionally updating the decoder. This approach learns to move the image into a non-attackable region, rather than modifying the decision boundary, thus preserving clean accuracy. In stage 2, we tackle distortion and regeneration attacks via direct image optimization. To preserve the adversarial robustness gained in stage 1, we formulate a principled, constrained image loss with theoretical guarantees, which balances the deviation from cover and previous encoded images. We also propose a quality-aware early-stop to further guarantee the lower bound of visual quality. Extensive experiments demonstrate AdvMark outperforms with the highest image quality and comprehensive robustness, i.e. up to 29%, 33% and 46% accuracy improvement for distortion, regeneration and adversarial attacks, respectively.
Jiahui Chen, Zehang Deng, Zeyu Zhang +3
Tsinghua University · Swinburne University of Technology · The Australian National University +2