ResGuard: Enhancing Robustness Against Known Original Attacks in Deep Watermarking

Hanyi Wang; Han Fang; Yupeng Qiu; Shilin Wang; Ee-Chien Chang

cs.CVApr 4, 2026

ResGuard: Enhancing Robustness Against Known Original Attacks in Deep Watermarking

Authors: Hanyi Wang, Han Fang, Yupeng Qiu, Shilin Wang, Ee-Chien Chang

Organizations: Shanghai Jiao Tong University China · University of Science and Technology of China China · National University of Singapore Singapore

Abstract

Deep learning-based image watermarking commonly adopts an "Encoder-Noise Layer-Decoder" (END) architecture to improve robustness against random channel distortions, yet it often overlooks intentional manipulations introduced by adversaries with additional knowledge. In this paper, we revisit this paradigm and expose a critical yet underexplored vulnerability: the Known Original Attack (KOA), where an adversary has access to multiple original-watermarked image pairs, enabling various targeted suppression strategies. We show that even a simple residual-based removal approach, namely estimating an embedding residual from known pairs and subtracting it from unseen watermarked images, can almost completely remove the watermark while preserving visual quality. This vulnerability stems from the insufficient image dependency of residuals produced by END frameworks, which makes them transferable across images. To address this, we propose ResGuard, a plug-and-play module that enhances KOA robustness by enforcing image-dependent embedding. Its core lies in a residual specificity enhancement loss, which encourages residuals to be tightly coupled with their host images and thus improves image dependency. Furthermore, an auxiliary KOA noise layer injects residual-style perturbations during training, allowing the decoder to remain reliable under stronger embedding inconsistencies. Integrated into existing frameworks, ResGuard boosts KOA robustness, improving average watermark extraction accuracy from 59.87% to 99.81%.

Figures & tables

Figure 1. Illustration of an example of the Known Original Attack (KOA) evaluated with RoSteALS ( Bui et al., 2023b ) , showing that even a single residual extracted from one host–watermarked pair can suppress watermark decoding across other images.

Figure 2. Framework of the proposed ResGuard. It consists of five main components: the encoder $E$ , the combined noise layer, the KOA noise layer, the residual specificity enhancement module, and the decoder $D$ . The model is trained end-to-end using two basic losses: $\mathcal{L}_{img}$ enforces visual similarity between the host and watermarked images, and $\mathcal{L}_{mes}$ ensures accurate message extraction under both common distortions and KOA attacks. Additionally, $\mathcal{L}_{RSE}$ promotes image-specific residual patterns and suppresses cross-image transferability, enhancing robustness against KOA.

Methods	Venue	Image size	message length	Optimizer	Learning rate
HiDDeN	ECCV 2018	$128\times 128$	30	Adam	$10^{-3}$
MBRS	ACM MM 2021	$256\times 256$	256	Adam	$10^{-3}$
CIN	ACM MM 2022	$128\times 128$	30	Adam	$10^{-4}$
RosteALS	CVPRW 2023	$256\times 256$	100	AdamW	$8\times 10^{-5}$
InvisMark	WACV 2025	$256\times 256$	100	AdamW	$10^{-4}$

Table 1. Training configurations for each baseline method. We follow the original implementation settings to ensure fair comparisons across methods.

Figure 3. Bitwise extraction accuracy under KOA across five baseline methods. Each curve shows performance variation with the number of available host–watermarked pairs

N

. Models equipped with ResGuard maintain consistently high accuracy, demonstrating strong robustness against KOA.

Methods	Extraction Accuracy		KOA Robustness
Methods	Cln. $\Uparrow$	Dis. $\Uparrow$	Bit Acc. $\Uparrow$
HiDDeN	1.0000	1.0000	0.5217
HiDDeN-ResGuard	1.0000	1.0000	0.9957
MBRS	1.0000	1.0000	0.5927
MBRS-ResGuard	1.0000	1.0000	0.9988
CIN	1.0000	0.9997	0.6147

Table 2. Comparison results of KOA robustness. “Cln” indicates results on clean images, while “Dis” represents results under channel distortions.

Methods	Watermarking Performance									KOA Robustness
	Image Quality			Extraction Accuracy						Bit Acc. $\Uparrow$
	PSNR $\Uparrow$	SSIM $\Uparrow$	LPIPS $\Downarrow$	Cln. $\Uparrow$	Dis. $\Uparrow$
	PSNR $\Uparrow$	SSIM $\Uparrow$	LPIPS $\Downarrow$	Cln. $\Uparrow$	JPEG	GN	S&P	GB	MB
MBRS	39.62	0.9361	0.0214	1.0000	0.9969	0.9967	0.9941	0.9978	0.9939	0.5713
MBRS-ResGuard	39.43	0.9287	0.0297	1.0000	0.9984	0.9988	0.9927	0.9974	0.9983	0.9982

Table 3. Evaluation results under diverse channel distortions using MBRS. “Cln” indicates results on clean images without distortions, while “JPEG”, “GN”, “S&P”, “GB”, and “MB” correspond to JPEG compression, Gaussian noise, salt-and-pepper noise, Gaussian blur, and median blur, respectively.

Figure 4. (a) JPEG, $QF$ =25; (b) Gaussian noise, $\mu=0,\sigma=0.05$ ; (c) Salt-and-pepper noise, $p=0.05$ ; (d) Gaussian blur, $r=4$ ; (e) Median filter, $k=7$ .

Figure 5. Comparison of inter-image residual similarity before and after applying ResGuard across five watermarking methods. Solid markers denote original models, while hollow markers represent ResGuard-enhanced counterparts. A lower similarity indicates more image-specific residuals.

Figure 6. Qualitative comparison of residual patterns before and after applying ResGuard across five watermarking methods. For each method, we visualize the original image, the residual produced by the baseline model (w/o ResGuard), and the residual produced by the ResGuard-enhanced model (w/ ResGuard). All residuals are scaled by a factor of 10 for visualization.

Figure 7. Visual results of original and ResGuard-enhanced models. For each baseline, we show the host image (top), watermarked image, KOA-attacked image, and the residual (bottom, ×10 magnified). Each column pair contrasts the original model (left) and its ResGuard-enhanced variant (right).

Methods	SSIM $\Uparrow$	PSNR $\Uparrow$	LPIPS $\Downarrow$
HiDDeN	36.40	0.9474	0.0048
HiDDeN-ResGuard	36.42	0.9412	0.0045
MBRS	40.42	0.9466	0.0123
MBRS-ResGuard	40.46	0.9438	0.0115
CIN	41.29	0.9615	0.0008
CIN-ResGuard	41.39	0.9587	0.0007

Table 4. Visual quality of watermarked images. PSNR, SSIM, and LPIPS are reported for original and ResGuard-enhanced models.

Methods	SSIM $\Uparrow$	PSNR $\Uparrow$	LPIPS $\Downarrow$
HiDDeN	36.85	0.9331	0.0065
HiDDeN-ResGuard	36.35	0.9265	0.0062
MBRS	40.43	0.9369	0.0167
MBRS-ResGuard	40.45	0.9393	0.0171
CIN	41.33	0.9526	0.0009
CIN-ResGuard	41.40	0.9532	0.0009

Table 5. Visual quality of images after KOA. PSNR, SSIM, and LPIPS are reported for original and ResGuard-enhanced models.

Methods	Mechanisms	Watermarking Performance					KOA Robustness
		Image Quality			Extraction Accuracy		Bit Acc. $\Uparrow$
		PSNR $\Uparrow$	SSIM $\Uparrow$	LPIPS $\Downarrow$	Cln. $\Uparrow$	Dis. $\Uparrow$	Bit Acc. $\Uparrow$
HiDDeN	Base	36.4045	0.9474	0.0048	1.0000	1.0000	0.5217
	RSE	36.8094	0.9102	0.0039	1.0000	1.0000	0.9513
	KNL	36.3545	0.9121	0.0050	1.0000	1.0000	0.9601
	ResGuard	36.4233	0.9472	0.0045	1.0000	1.0000	0.9957

Table 6. Ablation study on the effectiveness of the residual specificity enhancement loss and the residual transferability suppression loss. “Cln” indicates results on clean images, while “Dis” represents results under channel distortions.

Figure 8. Bitwise extraction accuracy under KOA across five baseline methods. Each curve shows performance variation with the number of available host–watermarked pairs

N

. Models equipped with ResGuard maintain consistently high accuracy, demonstrating strong robustness against KOA.

Methods	Extraction Accuracy		KOA Robustness
Methods	Cln. $\Uparrow$	Dis. $\Uparrow$	Bit Acc. $\Uparrow$
HiDDeN	1.0000	1.0000	0.7333
HiDDeN-ResGuard	1.0000	1.0000	1.0000
MBRS	1.0000	1.0000	0.7447
MBRS-ResGuard	1.0000	1.0000	1.0000
CIN	1.0000	0.9997	0.7313

Table 7. Comparison results of KOA robustness. “Cln” indicates results on clean images, while “Dis” represents results under channel distortions.

Robust Watermarking

Robust watermarking embeds or verifies ownership and provenance signals that survive editing, compression, model changes, and deliberate removal.

See all 202 papers

Decoupling Defense Strategies for Robust Image Watermarking
Feb 23, 2026Jiahui Chen, Zehang Deng, Zeyu Zhang +3Robust Watermarking Adversarial Robustness
Tsinghua University · Swinburne University of Technology · The Australian National University +2
Residual Transferability in Neural Image Watermarking
Sep 26, 2026Ziping Dong, Qi Li, Xinchao WangRobust Watermarking
National University of Singapore
LiBRA: Detection-Aware Image Watermark Removal via Bidirectional Latent Optimization
Oct 2, 2026Saibo Ye, Huajie Chen, Xin Guo +5Watermark Removal AI-Generated Image Watermarking
Faculty of Data Science, City University of Macau, Macao SAR, China · Corresponding Author · School of Information and Communications Engineering, Xi’an Jiaotong University, Xi’an 710049, China +2

Feb 23, 2026J/K move · Enter open · S save

Decoupling Defense Strategies for Robust Image Watermarking

Jiahui Chen, Zehang Deng, Zeyu Zhang, Chaoyang Li+2

Tsinghua University · Swinburne University of Technology · The Australian National University+2

Robust Watermarking Adversarial Robustness Adversarial Training

Open paper AskPDF arXiv

Deep learning-based image watermarking, while robust against conventional distortions, remains vulnerable to advanced adversarial and regeneration attacks. Conventional countermeasures, which jointly optimize the encoder and decoder via a noise layer, face 2 inevitable challenges: (1) decrease of clean accuracy due to decoder adversarial training and (2) limited robustness due to simultaneous training of all three advanced attacks. To overcome these issues, we propose AdvMark, a novel two-stage fine-tuning framework that decouples the defense strategies. In stage 1, we address adversarial vulnerability via a tailored adversarial training paradigm that primarily fine-tunes the encoder while only conditionally updating the decoder. This approach learns to move the image into a non-attackable region, rather than modifying the decision boundary, thus preserving clean accuracy. In stage 2, we tackle distortion and regeneration attacks via direct image optimization. To preserve the adversarial robustness gained in stage 1, we formulate a principled, constrained image loss with theoretical guarantees, which balances the deviation from cover and previous encoded images. We also propose a quality-aware early-stop to further guarantee the lower bound of visual quality. Extensive experiments demonstrate AdvMark outperforms with the highest image quality and comprehensive robustness, i.e. up to 29%, 33% and 46% accuracy improvement for distortion, regeneration and adversarial attacks, respectively.

Abstract

Robust Watermarking

Explore similar work

Decoupling Defense Strategies for Robust Image Watermarking

Residual Transferability in Neural Image Watermarking

LiBRA: Detection-Aware Image Watermark Removal via Bidirectional Latent Optimization