ADD for Multi-Bit Image Watermarking

An Luo; Jie Ding

stat.MLApr 13, 2026

ADD for Multi-Bit Image Watermarking

Authors: An Luo, Jie Ding

Organizations: School of Statistics, University of Minnesota

Abstract

As generative models enable rapid creation of high-fidelity images, societal concerns about misinformation and authenticity have intensified. A promising remedy is multi-bit image watermarking, which embeds a multi-bit message into an image so that a verifier can later detect whether the image is generated by someone and further identify the source by decoding the embedded message. Existing approaches often fall short in capacity, resilience to common image distortions, and theoretical justification. To address these limitations, we propose ADD (Add, Dot, Decode), a multi-bit image watermarking method with two stages: learning a watermark to be linearly combined with the multi-bit message and added to the image, and decoding through inner products between the watermarked image and the learned watermark. On the standard MS-COCO benchmark, we demonstrate that for the challenging task of 48-bit watermarking, ADD achieves 100% decoding accuracy, with performance dropping by at most 2% under a wide range of image distortions, substantially smaller than the 14% average drop of state-of-the-art methods. In addition, ADD achieves substantial computational gains, with 2-fold faster embedding and 7.4-fold faster decoding than the fastest existing method. We further provide a theoretical analysis explaining why the learned watermark and the corresponding decoding rule are effective.

Figures & tables

Figure 1: An overview of multi-bit image watermarking. An image, which may be generated by AI models or created as digital artwork such as paintings or photographs, can be embedded with a multi-bit message. Such messages may encode information such as a timestamp, IP address, signature, or private key. The resulting watermarked image is then distributed over the Internet and may undergo distortions (e.g., compression or rotation). Given a possibly distorted image, the goal is to detect whether the image is watermarked and further decode the embedded multi-bit message to recover the information.

Figure 2: Overview of ADD for multi-bit image watermarking. Given an image $\bm{x}\in\mathcal{X}$ , a $K$ -bit message $\bm{m}\in\{\pm 1\}^{K}$ is embedded by $\tilde{\bm{x}}=\bm{x}+\sum_{k=1}^{K}m_{k}\bm{w}_{k}$ . After distribution, the watermarked image may be distorted by an distortion operator $A$ , yielding the observed image $\tilde{\bm{x}}^{\prime}_{i}=A(\tilde{\bm{x}})$ . Detection is performed to decide whether $\tilde{\bm{x}}^{\prime}$ is watermarked by ADD and if detected, decoding is performed to recover $\bm{m}$ . Specifically, detection and decoding are based on the inner products $\Gamma_{k}=\left\langle\bm{w}_{k},\tilde{\bm{x}}^{\prime}\right\rangle$ , collected as $I=\left(\Gamma_{1},\ldots,\Gamma_{K}\right)^{\top}$ : detect with $S=\sum_{k=1}^{K}\left|\Gamma_{k}\right|$ , and decode with $\hat{m}_{k}=\operatorname{sign}\left(\Gamma_{k}\right)$ . As indicated in the dashed region, when an optional dictionary of embedded messages $\mathcal{D}\subset\{\pm 1\}^{K}$ is available, detection and decoding can be improved with $S_{\mathcal{D}}=\max_{\bm{m}\in\mathcal{D}}\langle\bm{m},I\rangle$ and $\hat{\bm{m}}=\arg\max_{\bm{m}\in\mathcal{D}}\langle\bm{m},I\rangle$ . The watermark $\bm{w}_{1:K}$ is trained from the top objective $\mathcal{L}_{n}$ as proposed in ( 5 ).

\mathcal{L}_{\mathrm{batch}}\ \leftarrow\ \frac{1}{|\mathcal{I}|}\sum_{i\in\mathcal{I}}\sum_{k=1}^{K}V\!\big(m_{i,k}\,\langle\bm{w}_{i,k},\tilde{\bm{x}}^{\prime}_{i}\rangle\big)\;+\;\beta\cdot\frac{1}{|\mathcal{I}|}\frac{1}{D}\sum_{i\in\mathcal{I}}\sum_{k=1}^{K}\|\bm{w}_{i,k}\|^{2}.

Algorithm 1 Training (learn watermark for

K

bits)

Method	PSNR	None	Gaussian Blur	JPEG	Brightness	Contrast	Gaussian Noise	Rotation	Crop	Random Erase	Average
DwtDct	$\mathbf{37.22}\pm 0.08$	89.2	50.8	50.5	46.7	54.1	50.0	51.3	69.5	76.6	59.8
HiDDeN	$32.88\pm 0.05$	99.7	57.6	91.2	98.2	99.6	50.5	49.2	98.5	98.1	82.5
SSL	$33.09\pm 0.00$	100.0	93.8	88.4	88.6	91.8	54.7	96.6	80.7	69.9	84.9
ADD (Ours)	$32.36\pm 0.06$	100.0	98.1	98.6	99.6	99.9	98.8	99.8	99.9	99.9	99.4

Table 1: Watermark decoding results. All methods are evaluated on the same

1000

randomly sampled image–message pairs from the MS-COCO test split. PSNR (dB, higher is better) is reported as mean

\pm

standard error. Bit accuracy (%, higher is better) is reported in under each distortion setting. The Average column reports the mean bit accuracy across all distortion settings.

Figure 3: Qualitative comparison of image quality across watermarking methods. All methods are evaluated on the same image, with PSNR values reported. Our method is visually close to the original image, as the rest of the methods do. A visual comparison of the magnified pixel-wise differences is in Section G of the supplementary material.

Method	PSNR	None	Gaussian Blur	JPEG	Brightness	Contrast	Gaussian Noise	Rotation	Crop	Random Erase	Average
DwtDct	37.05	88.0	49.8	50.0	50.5	52.7	49.8	49.8	54.9	69.0	57.2
HiDDeN	32.82	100.0	48.4	97.6	99.2	99.9	50.0	49.5	99.9	99.3	82.6
SSL	33.09	100.0	99.6	95.9	92.1	95.8	50.4	99.9	81.4	55.3	85.6
ADD (w/o $\mathcal{D}$ )		100.0	94.5	95.0	99.5	100.0	100.0	100.0	100.0	100.0	98.8
ADD (w/ $\mathcal{D}$ )	32.27	100.0	98.5	98.3	99.7	100.0	100.0	100.0	100.0	100.0	99.6

Table 2: Watermark detection results. All methods are evaluated on the same

10{,}000

randomly sampled image–message pairs from the MS-COCO test split. PSNR (dB, higher is better) is reported as mean. AUROC (%, higher is better) is reported under each distortion setting. The Average column reports the mean AUROC across all distortion settings. DwtDct/HiDDeN/SSL use dictionary-based detection with dictionary

\mathcal{D}

(

d_{\min}=6

) consisting of all

10{,}000

embedded 48-bit messages (threshold

\gamma\in\{0,\ldots,48\}

on best-match score). ADD (w/o

\mathcal{D}

) uses the dictionary-agnostic statistic

S

(threshold sweep on

S

). ADD (w/

\mathcal{D}

) uses the dictionary-dependent statistic

S_{\mathcal{D}}

(threshold sweep on

S_{\mathcal{D}}

Method	Embedding (ms/img)	Decoding (ms/img)
DwtDct	$8.37\pm 0.01$	$5.41\pm 0.01$
HiDDeN	$1.54\pm 0.01$	$1.41\pm 0.01$
SSL	$546.50\pm 2.37$	$6.50\pm 0.00$
ADD (Ours)	$\mathbf{0.76\pm 0.01}$	$\mathbf{0.19\pm 0.00}$

Table 3: Runtime comparison of watermark embedding and decoding. We report average time per image (ms/image)

\pm

standard error for the watermark embedding step (embedding a multi-bit watermark

\bm{m}

into an image) and the decoding step (recovering the embedded bits

\hat{\bm{m}}

from the watermarked image). All methods were evaluated on the same 1,000 images from the MS-COCO test split using a single NVIDIA A100 GPU. Standard errors are computed across processing batches (batch size 64), treating each batch’s per-image time as one observation.

Test domain	PSNR (dB)	Avg Bit Accuracy	Avg AUROC
MS-COCO (in-domain)	$32.36\pm 0.06$	$99.37\%$	$0.9927$
ImageNet	$32.21\pm 0.07$	$99.33\%$	$0.9893$
CIFAR-10	$36.16\pm 0.08$	$99.37\%$	$0.9987$
CIFAR-100	$35.75\pm 0.09$	$99.27\%$	$0.9978$

Table 4: Cross-dataset generalization. Our watermark is trained on MS-COCO only and evaluated on multiple test domains, each with 1000 images. We report PSNR (mean

\pm

standard error), average bit accuracy, and average AUROC. Bit accuracy and AUROC are averaged over the performance under each distortion setting. See detailed per-distortion result in Section I of the supplementary material.

Panel of Figure 4 — Figure 4: Empirical trade-offs from $\beta$ and $n$ . Trade-off between PSNR and average bit accuracy from (a) different $\beta$ values and (b) different training sample sizes $n$ . In (a), $n=2000$ and $\beta\in\{1,10,100,500,1000,5000,10000\}$ . In (b), $\beta=1000$ and $n\in\{10,15,20,50,100,500,1000,2000\}$ . The dashed red lines indicate acceptable thresholds chosen to reflect practical deployment requirements: PSNR $=32$ dB in (a) and average bit accuracy $=0.99$ in (b). The rest of the training setup is the same.

Explore similar work

Apr 12, 2026

UniMark: Unified Adaptive Multi-bit Watermarking for Autoregressive Image Generators

Invisible watermarking for autoregressive (AR) image generation has recently gained attention as a means of protecting image ownership and tracing AI-generated content. However, existing approaches suffer from three key limitations: (1) they embed only zero-bit watermarks for binary verification, lacking the ability to convey multi-bit messages; (2) they rely on static codebook partitioning strategies that are vulnerable to security attacks once the partition is exposed; and (3) they are designed for specific AR architectures, failing to generalize across diverse AR paradigms. We propose \method{}, a training-free, unified watermarking framework for autoregressive image generators that addresses all three limitations. \method{} introduces three core components: Adaptive Semantic Grouping (ASG), which dynamically partitions codebook entries based on semantic similarity and a secret key, ensuring both image quality preservation and security; Block-wise Multi-bit Encoding (BME), which divides the token sequence into blocks and encodes different bits across blocks with error-correcting codes for reliable message transmission; and a Unified Token-Replacement Interface (UTRI) that abstracts the watermark embedding process to support both next-token prediction (e.g., LlamaGen) and next-scale prediction (e.g., VAR) paradigms. We provide theoretical analysis on detection error rates and embedding capacity. Extensive experiments on three AR models demonstrate that \method{} achieves state-of-the-art performance in image quality (FID), watermark detection accuracy, and multi-bit message extraction, while maintaining robustness against cropping, JPEG compression, Gaussian noise, blur, color jitter, and random erasing attacks.

Yigit Yilmaz, Elena Petrova, Mehmet Kaya +2

Bandırma Onyedi Eylül University

Robust Watermarking Autoregressive Image Generation

Ask PDF

Oct 2, 2026

LiBRA: Detection-Aware Image Watermark Removal via Bidirectional Latent Optimization

Digital watermarking supports source attribution for AI-generated images, but its reliability depends on resistance to removal attacks. Some attacks attempt to remove watermarks by forcing the decoded watermark to differ from the original. However, this can produce an inverted watermark that remains detectable, causing removal to fail, while further attempts to alter the watermark may unnecessarily degrade image quality. To address these limitations, we present LiBRA (Latent In-band Bidirectional Removal Attack), which aims to make watermarks undetectable while preserving image quality. Instead of continually pushing the watermark toward inversion, LiBRA adjusts the image to conceal the watermark without encouraging further changes that could degrade image quality. Some attacks keep pushing decoded bits away from the original watermark, even when further changes preserve detectability and damage image quality. With access to the watermark key and decoder, LiBRA makes bounded changes in a public autoencoder's latent space. Unlike inversion-driven objectives that cannot correct excessive inversion, LiBRA guides average decoding confidence toward random guessing from either direction. This helps avoid an inverted but detectable watermark. Leaving individual bits flexible allows image-quality constraints to favor less damaging changes, while an optional frequency-guided mask limits their location. We verify removal using an exact two-sided binomial test rather than assuming the confidence target guarantees success.

Saibo Ye, Huajie Chen, Xin Guo +5

Faculty of Data Science, City University of Macau, Macao SAR, China · Corresponding Author · School of Information and Communications Engineering, Xi’an Jiaotong University, Xi’an 710049, China +2

Watermark Removal Latent Space Optimization

Ask PDF

Apr 9, 2026

Optimal Multi-bit Generative Watermarking Schemes Under Worst-Case False-Alarm Constraints

This paper considers the problem of multi-bit generative watermarking for large language models under a worst-case false-alarm constraint. Prior work established a lower bound on the achievable miss-detection probability in the finite-token regime and proposed a scheme claimed to achieve this bound. We show, however, that the proposed scheme is in fact suboptimal. We then develop two new encoding-decoding constructions that attain the previously established lower bound, thereby completely characterizing the optimal multi-bit watermarking performance. Our approach formulates the watermark design problem as a linear program and derives the structural conditions under which optimality can be achieved. In addition, we identify the failure mechanism of the previous construction and compare the tradeoffs between the two proposed schemes.

Yu-Shin Huang, Chao Tian, Krishna Narayanan

Text Watermarking LLM Watermarking Information-Theoretic Lower Bounds

Ask PDF