Neural image watermarks can be forged by extracting watermark-bearing residuals from released images and transferring them to unrelated content. While prior work has demonstrated this vulnerability, what makes these residuals transferable remains poorly understood. We formalize this vulnerability with residual transferability (RT), a metric that quantifies how well watermark evidence remains decodable after transfer across unrelated images. Through comparative analyses and controlled interventions, we find that common training-side variations do not account for the large RT differences across watermarking systems; instead, architectural design plays a central role. By contrasting high- and low-RT systems and validating their architectural differences through controlled interventions, we identify two mechanisms that strengthen the dependence of watermark evidence on the cover image, thereby suppressing the residual transferability. These findings provide concrete design guidance for developing more forgery-resistant watermarking architectures. Complementarily, for existing watermarking systems where architectural redesign is impractical, we introduce CoverLock, a plug-and-play strategy for existing watermarking systems that strengthens such image dependence without architectural redesign. Across representative watermarking systems exhibiting high residual transferability, CoverLock achieves a more favorable security--robustness trade-off than both traditional handcrafted defenses and learned classifier-based defenses.
Figures & tables
Method
Loss
Disc.
Noise
Arch.
Dataset
Resolution
Message Len.
RT
CIN ( Ma et al., 2022 )
MSE+MSE
✗
✓
INN
COCO
128
30
1.00
VINE ( Lu et al., 2025 )
BCE+MSE+LPIPS
✓
✓
CNN
OpenImages
512
100
0.99
MBRS ( Jia et al., 2021 )
MSE+MSE
✓
✓
CNN
ImageNet
128
256
0.98
HiDDeN ( Zhu et al., 2018 )
MSE+MSE
✓
✓
CNN
COCO
128
30
0.28
RivaGAN ( Zhang et al., 2019 )
BCE+Feature
✓
✓
CNN
Hollywood2
256
32
0.08
Table 1: Comparison of representative watermarking methods in terms of training configurations, architectural designs, and residual transferability. Lower RT indicates a lower risk of residual-based watermark forgery. The computation of RT@100 is detailed in Sec. 3.1 .
Figure 1: Behavioral signatures of high- and low-RT watermarking methods. Left: Average residual patterns computed from two different cover sets, each containing five images. Right: Relative feature variation induced by the cover image and the embedded message at the decoder’s final layer.
Figure 2: Left: RT under controlled architectural interventions with Broadcast–GAP (BG) and content-adaptive attention. Right: Training dynamics of high- and low-RT configurations.
Figure 3: Overview of CoverLock. CoverLock derives a distortion-stable, image-conditioned binary code from frozen DINOv2 features and uses it to wrap and unwrap the watermark payload.
GT@1 ↓
Yang et al. (2024a) ↓
WmForger ( Souček et al., 2026 ) ↓
Watermark
Dataset
ConvNeXt
MHDW
CoverLock
ConvNeXt
MHDW
CoverLock
ConvNeXt
MHDW
CoverLock
CIN
COCO
24.12 ± 3.7
0.01 ± 0.0
0.00 ± 0.0
36.16 ± 2.6
2.17 ± 0.6
0.00 ± 0.0
86.09 ± 2.0
0.00 ± 0.0
0.00 ± 0.0
ImageNet
29.36 ± 3.9
0.00 ± 0.0
0.03 ± 0.0
36.37 ± 1.7
3.19 ± 0.9
0.00 ± 0.0
86.93 ± 1.7
0.00 ± 0.0
0.00 ± 0.0
DIV2K
18.72 ± 4.6
0.00 ± 0.0
0.00 ± 0.0
29.94 ± 1.9
4.72 ± 0.6
0.11 ± 0.2
78.56 ± 2.1
0.00 ± 0.0
0.00 ± 0.0
MBRS
COCO
2.41 ± 1.4
11.37 ± 4.4
0.11 ± 0.0
2.37 ± 0.1
46.14 ± 2.4
0.00 ± 0.0
96.28 ± 0.1
4.76 ± 1.7
0.06 ± 0.0
ImageNet
1.01 ± 0.6
10.81 ± 5.0
0.82 ± 0.2
2.96 ± 0.6
49.57 ± 0.8
0.00 ± 0.0
91.78 ± 1.3
3.68 ± 1.6
0.17 ± 0.1
Table 2: Forgery attack success rate (ASR, %) across evaluation datasets. Results are reported as mean ± std over three random seeds.
Figure 4: Attacks and CoverLock analysis.
Watermark
Method
Noise
Brightness
Blur
JPEG
Contrast
Crop
Average
CIN
Vanilla
99.98
99.92
100.00
96.28
100.00
100.00
99.36
MHDW
76.49
91.08
79.83
82.19
91.74
83.20
84.09
CoverLock
93.35
97.13
95.58
91.52
97.45
92.55
94.60
MBRS
Vanilla
69.16
98.52
94.13
100.00
99.06
94.41
92.55
MHDW
59.92
88.57
83.81
90.30
89.43
76.32
81.39
CoverLock
66.43
96.16
91.62
96.65
96.75
88.82
89.40
Table 3: Bit accuracy (BitAcc, %) on COCO under Gaussian noise ( σ=0.05 ), brightness ( ×1.2 ), Gaussian blur ( σ=1.0 ), JPEG compression ( Q=70 ), contrast ( ×1.2 ), and center crop (80% area). Average is over the six distortions and bold indicates the best binding defense, excluding Vanilla.
Appendix figures & tables6 assets
Supplementary material from the paper’s appendix.
Appendix
Figure 5: Training dynamics of CoverLock. Training curves of the overall objective and its individual loss components across four CoverLock variants. While the components exhibit different optimization trajectories, they eventually reach stable regimes under joint optimization.
Figure 6: Comparison of single-image and averaged watermark residuals. From top to bottom, we show the watermarked image, the residual from a single image, and the residual averaged over five images carrying the same message for different watermarking methods.
Model
BitAcc ↑
PSNR (dB) ↑
RT@1 ↓
RT@10 ↓
RT@100 ↓
RT@1000 ↓
HiDDeN
0.924 ± 0.05
33.85 ± 1.87
0.374 ± 0.20
0.301 ± 0.16
0.275 ± 0.16
0.275 ± 0.16
CIN
1.000 ± 0.00
41.55 ± 0.90
1.000 ± 0.00
1.000 ± 0.00
1.000 ± 0.00
1.000 ± 0.00
MBRS
1.000 ± 0.00
41.61 ± 1.69
0.940 ± 0.08
0.955 ± 0.07
0.982 ± 0.04
0.982 ± 0.04
RivaGAN
0.919 ± 0.08
42.05 ± 0.16
0.081 ± 0.11
0.088 ± 0.11
0.082 ± 0.11
0.085 ± 0.11
VINE
1.000 ± 0.00
35.47 ± 2.83
0.964 ± 0.05
0.981 ± 0.04
0.986 ± 0.03
0.985 ± 0.04
Appendix
Table 4: Sensitivity of residual transferability to the number of source images. RT@ s is computed using the averaged residual from s source images.
Figure 7: Residual transferability (RT@100) under different training settings. We vary the training dataset, message length, loss weight, and robustness-oriented noise simulation while keeping the remaining settings fixed. Results report the mean RT score over three independently trained models with different random seeds, with error bars indicating one standard deviation.
Deep learning-based image watermarking commonly adopts an "Encoder-Noise Layer-Decoder" (END) architecture to improve robustness against random channel distortions, yet it often overlooks intentional manipulations introduced by adversaries with additional knowledge. In this paper, we revisit this paradigm and expose a critical yet underexplored vulnerability: the Known Original Attack (KOA), where an adversary has access to multiple original-watermarked image pairs, enabling various targeted suppression strategies. We show that even a simple residual-based removal approach, namely estimating an embedding residual from known pairs and subtracting it from unseen watermarked images, can almost completely remove the watermark while preserving visual quality. This vulnerability stems from the insufficient image dependency of residuals produced by END frameworks, which makes them transferable across images. To address this, we propose ResGuard, a plug-and-play module that enhances KOA robustness by enforcing image-dependent embedding. Its core lies in a residual specificity enhancement loss, which encourages residuals to be tightly coupled with their host images and thus improves image dependency. Furthermore, an auxiliary KOA noise layer injects residual-style perturbations during training, allowing the decoder to remain reliable under stronger embedding inconsistencies. Integrated into existing frameworks, ResGuard boosts KOA robustness, improving average watermark extraction accuracy from 59.87% to 99.81%.
Hanyi Wang, Han Fang, Yupeng Qiu +2
Shanghai Jiao Tong University China · University of Science and Technology of China China · National University of Singapore Singapore
Watermarking has emerged as a key defense against the misuse of machine-generated images (MGIs). Yet the robustness of these protections remains underexplored. To reveal the limits of SOTA proactive image watermarking defenses, we propose HIDE&SEEK (HS), a suite of versatile and cost-effective attacks that reliably remove embedded watermarks while preserving high visual fidelity.
Huajie Chen, Tianqing Zhu, Hailin Yang +7
City University of Macau · CISPA Helmholtz Center for Information Security · Guangzhou University
Invisible image watermarks are increasingly used for deepfake detection and provenance tracking, where they must survive not only incidental distortions but also deliberate removal. We revisit spread-spectrum embedding, a classical watermarking principle, inside a modern neural post-hoc watermarking architecture. Our starting point is a measurement: in existing encoder-decoder schemes each message bit occupies only a small fraction of the image, a shared contributing factor to their fragility, since removal then need only disturb the region a bit occupies. SpreadMark instead spreads each bit as a dense pseudo-random codeword over the whole image and recovers it by matched-filtering a learned cover-suppressed chip representation, with a parallel convolutional decoding path and sparsification-aware training. A conditional chip-space analysis shows that, under a codeword-independent perturbation model, dense spreading increases the budget required to disrupt matched-filter recovery. Evaluated on COCO and DIV2K against nine schemes, SpreadMark is the only evaluated method retaining high detection under both the regeneration and the latent-space sparsification settings we test, with competitive JPEG and additive-noise robustness. It keeps the embedded watermark imperceptible, maintaining high perceptual quality on both COCO and DIV2K.
Wei Song, Yuxin Cao, Zhenchang Xing +4
University of New South Wales, Australia · National University of Singapore, Singapore · CSIRO’s Data61, Australia