AWPD: Frequency Shield Network for Agnostic Watermark Presence Detection

Xiang Ao; Yilin Du; Zidan Wang; Mengru Chen; Siyang Lu

cs.CVMar 6, 2026

AWPD: Frequency Shield Network for Agnostic Watermark Presence Detection

Authors: Xiang Ao, Yilin Du, Zidan Wang, Mengru Chen, Siyang Lu

Organizations: School of Software Engineering, Beijing Jiaotong University, Beijing, 100044, China · School of Traffic and Transportation, Beijing Jiaotong University, Beijing, 100044, China · Law School, Beijing Jiaotong University, Beijing, 100044, China · School of Computer and Information Technology, Beijing Jiaotong University, Beijing, 100044, China

Abstract

Invisible watermarks, as an essential technology for image copyright protection, have been widely deployed with the rapid development of social media and AIGC. However, existing invisible watermark detection heavily relies on prior knowledge of specific algorithms, leading to limited detection capabilities for ``unknown watermarks'' in open environments. To this end, we propose a novel task named Agnostic Watermark Presence Detection (AWPD), which aims to identify whether an image carries a copyright mark without requiring decoding information. We construct the UniFreq-100K dataset, comprising large-scale samples across various invisible watermark embedding algorithms. Furthermore, we propose the Frequency Shield Network (FSNet). This model deploys an Adaptive Spectral Perception Module (ASPM) in the shallow layers, utilizing learnable frequency gating to dynamically amplify high-frequency watermark signals while suppressing low-frequency semantics. In the deep layers, the network introduces Dynamic Multi-Spectral Attention (DMSA) combined with tri-stream extremum pooling to deeply mine watermark energy anomalies, forcing the model to precisely focus on sensitive frequency bands. Extensive experiments demonstrate that FSNet exhibits superior zero-shot detection capabilities on the AWPD task, outperforming existing baseline models. Code and datasets will be released upon acceptance.

Figures & tables

Figure 1: Overall distribution of the UniFreq-100K dataset. (a) Distribution across five image categories totaling 190K images. (b) Distribution across watermarking algorithms, including 96K unwatermarked and 94K watermarked images. Evaluated watermarking algorithms: LSB [ 31 ] , Patchwork [ 2 ] , DCT [ 6 ] , DWT [ 35 ] , HiDDeN [ 42 ] , StegaStamp [ 29 ] , Stable Sig. [ 8 ] , Tree-Ring [ 34 ] , and SynthID [ 10 ] . Detailed cross-distribution data (category

\times

algorithm) can be found in the Appendix.

Figure 2: Overview of the Frequency Shield Network (FSNet) architecture showing the Adaptive Spectral Perception Module (ASPM) and Dynamic Multi-Spectral Attention (DMSA).

	FSNet (Ours)		CNN		ResNet		ViT		Swin-T		DINOv2		ConvNeXt-V2
Method	Acc	F1	Acc	F1	Acc	F1	Acc	F1	Acc	F1	Acc	F1	Acc	F1
LSB	0.594	0.268	0.545	0.584	0.549	0.233	0.516	0.160	0.505	0.037	0.504	0.082	0.501	0.028
Patchwork	0.587	0.301	0.561	0.641	0.544	0.284	0.519	0.150	0.529	0.207	0.506	0.106	0.500	0.009
DWT	0.945	0.951	0.682	0.744	0.721	0.712	0.545	0.264	0.915	0.913	0.579	0.447	0.769	0.794
DCT	0.931	0.926	0.753	0.792	0.979	0.979	0.991	0.991	0.982	0.982	0.936	0.938	0.949	0.947
HiDDeN	0.985	0.989	0.829	0.843	0.977	0.977	0.950	0.948	0.964	0.965	0.882	0.886	0.889	0.891

Table 1: Comparison of different models on various watermarking and steganography methods (Accuracy and F1-score). Bold : best performance; Italic : second-best performance.

Method	Full FSNet		w/o Gate		w/o Fusion		w/o Branch		w/o Pooling		ResNet
Method	Acc	F1	Acc	F1	Acc	F1	Acc	F1	Acc	F1	Acc	F1
LSB	0.594	0.268	0.556	0.275	0.564	0.278	0.514	0.225	0.526	0.241	0.549	0.233
Patchwork	0.587	0.301	0.564	0.298	0.549	0.268	0.511	0.209	0.552	0.254	0.544	0.284
DWT	0.945	0.951	0.890	0.841	0.912	0.911	0.842	0.836	0.879	0.886	0.721	0.712
DCT	0.931	0.926	0.921	0.924	0.914	0.905	0.945	0.928	0.939	0.933	0.979	0.979
HiDDeN	0.985	0.989	0.945	0.932	0.972	0.951	0.941	0.954	0.968	0.951	0.977	0.977

Table 2: Ablation study results on FSNet components. We evaluate the impact of different modules including the Learnable Gate, Multi-dim Fusion, Multi-freq Branch, and Extremum Pooling.

Figure 3: Model performance on different dataset ratios (10% to 100%). The accuracy increases with dataset size but shows diminishing returns after 30-50%.

Figure 4: Performance comparison after completely removing similar watermark algorithms from the dataset. Base represents the performance without removal, and Amb. represents the performance after removal.

Appendix figures & tables4 assets

Supplementary material from the paper’s appendix.

Appendix

Algorithm	Real	2D/Art	AIGC	E-Post.	Scan.	Total
Unwatermarked	30	12	30	12	12	96
LSB	4	2	2	2	2	12
Patchwork	4	2	2	2	2	12
DCT	4	2	2	2	2	12
DWT	4	2	2	2	2	12
HiDDeN	4	2	2	2	2	12

Appendix

Table 3: Detailed cross-distribution of image categories and watermarking algorithms in the UniFreq-100K dataset (all values in thousands)

Panel of Figure 5 — Figure 5: Visualization of absolute residual extremum binarization triggered by four watermarking algorithms under a pure white background. From left to right: Dense periodic vertical stripes of LSB; extremely sparse impulse dot matrix of Patchwork; continuous and dense high-frequency grid perturbations of DCT and DWT.

Figure 6: Learnable frequency domain gating heatmap of ASPM after training convergence. The weights in the top-left low-frequency region are significantly suppressed, while the weights in the mid-to-high-frequency regions are adaptively amplified.

Figure 7: Comparison of channel attention weight distributions of the DMSA module under clean images and watermarked images. Watermarked images trigger significant activation peaks in specific frequency bands.

Frequency-Domain Feature Learning

Frequency-domain feature learning uses Fourier, wavelet, and related spectral representations to extract task-relevant patterns from data.

See all 193 papers

FDDWAN: A Frequency-Decoupled Diffusion Network for Watermarking Attack
Jul 30, 2026Chunpeng Wang, Yuxin Li, Xiaoyu Wang +3Watermark Removal
Qilu University of Technology (Shandong Academy of Sciences), Jinan, Shandong Province, China · Dalian Maritime University, Dalian, Liaoning Province, China · Dalian Polytechnic University, Dalian, Liaoning Province, China
SPFM-Net: Semantic-Prior-Guided Frequency-Constrained Mamba for Invisible Watermark Attack
Jul 30, 2026Chunpeng Wang, Yanan Shi, Zhiqiu Xia +3Watermark Removal
Qilu University of Technology (Shandong Academy of Sciences) · Dalian Maritime University · Dalian Polytechnic University
PGID: Progressive Guided Inversion and Denoising for Robust Watermark Detection
May 10, 2026Minh Quoc Duong, Chun Tong Lei, Chun Pong LauDiffusion Model Inversion Diffusion Model Watermarking
City University of Hong Kong

Jul 30, 2026J/K move · Enter open · S save

FDDWAN: A Frequency-Decoupled Diffusion Network for Watermarking Attack

Chunpeng Wang, Yuxin Li, Xiaoyu Wang, Jidong Yang+2

Qilu University of Technology (Shandong Academy of Sciences), Jinan, Shandong Province, China · Dalian Maritime University, Dalian, Liaoning Province, China · Dalian Polytechnic University, Dalian, Liaoning Province, China

Watermark Removal

Open paper AskPDF arXiv

Existing invisible watermark removal methods often struggle to accurately capture the watermark-bearing features, leading to an unfavorable trade-off between watermark suppression and perceptual fidelity. In this paper, we propose the Frequency-Decoupled Diffusion Watermark Attack Network (FDDWAN), a coarse-to-fine framework that performs watermark removal through wavelet-domain decomposition and residual diffusion refinement. In the initial stage, the Wavelet-based Frequency-domain Preliminary Attack Module (WFPAM) decomposes the watermarked image into low- and high-frequency subbands and applies frequency-specific attack strategies tailored to their respective contributions to watermark robustness and perceptual quality. In the next stage, the Frequency-domain Residual Diffusion Attack Module (FRDAM) separately models the residual distributions between the preliminarily attacked outputs and the corresponding watermark-free references during training. Rather than reconstructing the entire image, FRDAM selectively refines frequency-domain residuals, directing the diffusion process toward the remaining watermark related discrepancies while minimizing modifications to image content. Extensive experiments on CelebA and ImageNet across four representative watermarking schemes demonstrate that FDDWAN achieves a more favorable trade-off between watermark removal effectiveness and visual fidelity than conventional and learning-based attack methods.

Abstract

Frequency-Domain Feature Learning

Explore similar work

FDDWAN: A Frequency-Decoupled Diffusion Network for Watermarking Attack

SPFM-Net: Semantic-Prior-Guided Frequency-Constrained Mamba for Invisible Watermark Attack

PGID: Progressive Guided Inversion and Denoising for Robust Watermark Detection