Meta-FC: Meta-Learning with Feature Consistency for Robust and Generalizable Watermarking

Yuheng Li; Weitong Chen; Chengcheng Zhu; Jiale Zhang; Chunpeng Ge; Di Wu; Guodong Long

cs.CVFeb 25, 2026

Meta-FC: Meta-Learning with Feature Consistency for Robust and Generalizable Watermarking

Authors: Yuheng Li, Weitong Chen, Chengcheng Zhu, Jiale Zhang, Chunpeng Ge, Di Wu, Guodong Long

Organizations: Yangzhou University · Nanjing University · Shandong University · La Trobe University ·

Abstract

Deep learning-based watermarking has made remarkable progress in recent years. To achieve robustness against various distortions, current methods commonly adopt a training strategy where a single random distortion (SRD) is chosen as the noise layer in each training batch. However, the SRD strategy treats distortions independently within each batch, neglecting the inherent relationships among different types of distortions and causing optimization conflicts across batches. As a result, the robustness and generalizability of the watermarking model are limited. To address this issue, we propose a novel training strategy that enhances robustness and generalization via meta-learning with feature consistency (Meta-FC). Specifically, we randomly sample multiple distortions from the noise pool to construct a meta-training task, while holding out one distortion as a simulated ``unknown'' distortion for the meta-testing phase. Through meta-learning, the model is encouraged to identify and utilize neurons that exhibit stable activations across different types of distortions, mitigating the optimization conflicts caused by the random sampling of diverse distortions in each batch. To further promote the transformation of stable activations into distortion-invariant representations, we introduce a feature consistency loss that constrains the decoded features of the same image subjected to different distortions to remain consistent. Extensive experiments demonstrate that, compared to the SRD training strategy, Meta-FC improves the robustness and generalization of various watermarking models by an average of 1.59%, 4.71%, and 2.38% under high-intensity, combined, and unknown distortions.

Figures & tables

Figure 1: The difference of the training process between SRD and Meta-FC. (a) The SRD pipeline. (b) The Meta-FC pipeline. In the meta-training phase, the model learns to be robust against known distortions. In the meta-testing phase, the model is evaluated under a simulated “unknown” distortion. Note that no truly unknown distortions are involved during the entire training process.

Figure 2: The whole training process of our proposed Meta-FC. First, the main encoder and decoder are used to process images under meta-training distortions, yielding the meta-training loss $\mathcal{L}_{meta\text{-}train}$ (composed of $\mathcal{L}_{w,n}$ and $\mathcal{L}^{tra}_{msg}$ ) and producing temporary encoder and decoder parameters. Next, these temporary parameters are evaluated on the meta-testing distortions to calculate the meta-testing loss $\mathcal{L}_{meta\text{-}test}$ (composed of $\mathcal{L}^{tes}_{msg}$ ). Subsequently, the image loss $\mathcal{L}_{img}$ (composed of $\mathcal{L}^{tra}_{img}$ and $\mathcal{L}^{tes}_{img}$ ) is computed based on the watermarked images generated by the main and the temporary encoders. Finally, the main model parameters are updated by minimizing the total loss $\mathcal{L}_{total}$ , which consists of $\mathcal{L}_{meta\text{-}train}$ , $\mathcal{L}_{meta\text{-}test}$ , and $\mathcal{L}_{img}$ .

Figure 3: Result of the visual quality of SRD and our method under different models. The first row presents the cover image, followed by the watermarked images in the second row. The third row shows the watermarked images subjected to various distortions. The fourth row illustrates the residuals, which represent the difference between the watermarked and cover images and are magnified by a factor of 5 to enhance visibility. The final two rows report the PSNR(dB) and SSIM values of each model, respectively, where consistent visual quality is maintained across training methods for the same model.

Datasets	Models	Strategy	Identity	GB ( $\sigma=6$ )	SPN ( $\sigma=0.15$ )	Crop ( $p=0.7$ )	JPEG ( $\mathcal{Q}=30$ )	MB ( $w=7$ )	GN ( $\sigma=0.08$ )	Bright ( $f=4$ )	Dropout ( $p=0.7$ )	Avg.
DIV2K	StegaStamp	SRD	100	100	98.07	86.56	95.84	99.97	97.89	77.70	94.33	94.48
	StegaStamp	Meta-FC	100	100	99.07	90.00	97.42	99.99	98.25	80.84	94.56	95.57
	MBRS	SRD	100	99.02	97.46	91.94	83.95	90.82	93.98	94.25	99.76	94.58
	MBRS	Meta-FC	100	99.33	98.44	95.78	86.79	95.25	96.01	93.93	99.75	96.14
	FIN	SRD	99.97	96.25	97.27	81.16	99.04	90.15	93.89	88.73	83.29	92.19
	FIN	Meta-FC	100	97.16	98.27	83.15	99.89	90.18	95.70	89.32	85.58	93.25

Table 1: Comparison of ACC (%) under high-intensity distortions. To ensure a fair comparison, the embedding strength of each baseline model is adjusted for both SRD and Meta-FC, such that the resulting PSNR values remain consistent across methods.

Datasets	Models	Strategy	MB&JPEG	MB&SPN	MB&GN	GN&SPN	GN&JPEG	MB&SPN &GN	MB&JPEG &Crop	Avg.
DIV2K	StegaStamp	SRD	99.13	99.81	98.54	97.49	97.04	94.78	97.21	97.71
	StegaStamp	Meta-FC	99.78	99.81	99.01	98.50	98.26	95.52	97.89	98.40
	MBRS	SRD	71.47	90.24	72.09	94.11	75.98	65.98	69.81	77.10
	MBRS	Meta-FC	81.53	98.88	82.70	96.31	80.21	74.92	79.31	84.84
	FIN	SRD	95.98	91.23	80.13	93.38	93.25	75.59	92.56	88.87
	FIN	Meta-FC	97.01	92.32	80.06	95.70	95.54	76.69	95.38	90.38

Table 2: Comparison of ACC (%) under combined distortions. PSNR is kept consistent across training methods for each baseline, following the same setup as in the high-intensity distortion evaluation.

Datasets	Model	Strategy	JPEG ( $Q=50$ )	Bright ( $f=3$ )	Dropout ( $p=0.7$ )	Erasing ( $\sigma=0.6$ )	Contrast ( $f=4$ )	Saturation ( $f=3$ )	Cropout ( $p=0.7$ )	Crop ( $p=0.7$ )	Avg.
DIV2K	StegaStamp	SRD	99.89	77.53	82.75	78.63	77.05	61.60	81.17	84.11	80.34
	StegaStamp	Meta-FC	99.97	78.43	84.34	79.22	79.28	68.80	86.39	85.68	82.76
	MBRS	SRD	60.30	92.70	99.02	82.45	96.13	99.71	91.25	89.53	88.89
	MBRS	Meta-FC	73.65	92.66	99.74	85.35	96.41	99.98	91.54	91.18	91.31
	FIN	SRD	99.93	90.09	81.93	73.45	89.23	99.38	77.51	78.44	86.25
	FIN	Meta-FC	99.98	90.74	83.41	76.06	89.45	99.46	79.17	79.57	87.23

Table 3: Comparison of ACC (%) under unknown distortions.

Strategy	ACC(%) $\uparrow$
Strategy	High-intensity	Combined	Unknown
Mate-FC w/o meta-train & FC	94.34 ( $\downarrow$ 1.59)	87.94 ( $\downarrow$ 4.71)	88.55 ( $\downarrow$ 2.38)
Mate-FC w/o meta-test & FC	95.27 ( $\downarrow$ 0.66)	90.58 ( $\downarrow$ 2.07)	88.96 ( $\downarrow$ 1.97)
Mate-FC w/o FC	95.56 ( $\downarrow$ 0.37)	90.44 ( $\downarrow$ 2.21)	90.99 ( $\uparrow$ 0.06)
Meta-FC	95.93	92.65	90.93

Table 4: Ablation study on different parts in our proposed Meta-FC architecture.

Strategy	StegaStamp		MBRS		FIN		SepMark		DERO
Strategy	Time (h)	ACC (%)	Time (h)	ACC (%)	Time (h)	ACC (%)	Time (h)	ACC (%)	Time (h)	ACC (%)
SRD	1.81	94.67	2.07	85.93	1.68	90.80	1.99	89.19	1.77	95.05
Meta-FC	2.36	96.87	3.37	90.40	2.86	92.35	3.12	95.48	2.53	96.59

Table 5: Comparison of training time for SRD and Meta-FC.

Robust Watermarking

Robust watermarking embeds or verifies ownership and provenance signals that survive editing, compression, model changes, and deliberate removal.

See all 207 papers

SHIFT: Stochastic Hidden-Trajectory Deflection for Removing Diffusion-based Watermark
Mar 31, 2026Rui Bao, Zheng Gao, Xiaoyu Li +3Watermark Removal Diffusion Model Watermarking
University of New South Wales · Griffith University
ResGuard: Enhancing Robustness Against Known Original Attacks in Deep Watermarking
Apr 4, 2026Hanyi Wang, Han Fang, Yupeng Qiu +2Robust Watermarking Watermark Removal
Shanghai Jiao Tong University China · University of Science and Technology of China China · National University of Singapore Singapore
Decoupling Defense Strategies for Robust Image Watermarking
Feb 23, 2026Jiahui Chen, Zehang Deng, Zeyu Zhang +3Robust Watermarking Adversarial Robustness
Tsinghua University · Swinburne University of Technology · The Australian National University +2

Mar 31, 2026J/K move · Enter open · S save

SHIFT: Stochastic Hidden-Trajectory Deflection for Removing Diffusion-based Watermark

Rui Bao, Zheng Gao, Xiaoyu Li, Xiaoyan Feng+2

University of New South Wales · Griffith University

Watermark Removal Diffusion Model Watermarking Diffusion Models

Open paper AskPDF arXiv

Diffusion-based watermarking methods embed verifiable marks by manipulating the initial noise or the reverse diffusion trajectory. However, these methods share a critical assumption: verification can succeed only if the diffusion trajectory can be faithfully reconstructed. This reliance on trajectory recovery constitutes a fundamental and exploitable vulnerability. We propose

\underline{\mathbf{S}}

tochastic

\underline{\mathbf{Hi}}

dden-Trajectory De

\underline{\mathbf{f}}

lec

\underline{\mathbf{t}}

ion (

\mathbf{SHIFT}

), a training-free attack that exploits this common weakness across diverse watermarking paradigms. SHIFT leverages stochastic diffusion resampling to deflect the generative trajectory in latent space, making the reconstructed image statistically decoupled from the original watermark-embedded trajectory while preserving strong visual quality and semantic consistency. Extensive experiments on nine representative watermarking methods spanning noise-space, frequency-domain, and optimization-based paradigms show that SHIFT achieves 95%--100% attack success rates with nearly no loss in semantic quality, without requiring any watermark-specific knowledge or model retraining.

Abstract

Robust Watermarking

Explore similar work

SHIFT: Stochastic Hidden-Trajectory Deflection for Removing Diffusion-based Watermark

ResGuard: Enhancing Robustness Against Known Original Attacks in Deep Watermarking

Decoupling Defense Strategies for Robust Image Watermarking