Optimizing and Securing the Modern Watermarking Channel for Images

Enoal Gesny; Eva Giboulot

cs.CRSep 28, 2026

Optimizing and Securing the Modern Watermarking Channel for Images

Authors: Enoal Gesny, Eva Giboulot

Organizations: Inria, Rennes, France

Abstract

To comply with recent regulations requiring traceable generated content, modern watermarking has adopted multi-bit post-hoc watermarking schemes. These modern designs rest on an encoder-decoder pair implemented as deep neural networks. These models are usually treated as pure black-boxes trained end-to-end, with the noise of the watermarking channel modeled through a fixed set of geometric and valuemetric transforms applied to watermarked images. We argue that this purely empirical approach leads to unquestioned design flaws and a lack of theoretical performance guarantees. This work proposes a general theoretical model of modern post-hoc watermarking schemes grounded in a statistical analysis of the outputs of the encoder/decoder pair. We show that these deep neural networks implicitly define a watermarking channel modeled as parallel AWGN channels, with messages transmitted using BPSK modulation. This imposes a binary alphabet, greatly limiting the capacity of these watermarking systems. Another fatal flaw is their lack of a secret key, making them intrinsically insecure. We make this notion of watermarking security precise for post-hoc schemes by linking it to the possibility of estimating the secret key under a given statistical model of the decoder's output. By putting together the results from this theoretical analysis, we introduce SNW: a novel post-hoc watermarking system that significantly outperforms existing state-of-the-art baselines in terms of capacity while also providing strong security guarantees. Notably, it does not depend on a fixed codebook or binary alphabet, allowing it to reach a rate close to Shannon capacity through the use of capacity-achieving error-correcting codes.

Figures & tables

Panel of Figure 1 — Figure 1: Empirical analysis of the decoding projection $f_{d}$ and decision mechanism $d$ of three SOTA post-hoc watermarking systems computed over 10k $1024\times 1024$ ImageNet Deng et al. (2009) images watermarked with random messages. (Left) Eigenvalues of the covariance $\Sigma_{\mathrm{Identity}}$ of the latent vector $f_{d}(\mathbf{x}_{\mathrm{wm}})$ (i.e. when $t$ is the identity). (Right) Global distribution of the soft-codeword values $\tilde{\mathbf{c}}$ and the corresponding theoretical AWGN model with $(\varrho,\sigma)$ computed empirically.

	Channel characteristic $\varrho\sigma^{-1}$ ( $\uparrow$ )					Capacity $C_{(}\varrho,\sigma)$ / Empirical Capacity
	Identity	JPEG 50	Contrast $\times 2$	Crop 0.6	Rot. 90 ∘	Identity	JPEG 50	Contrast $\times 2$	Crop 0.6	Rot. 90 ∘
PixelSeal	3.07	2.21	1.60	1.73	1.97	0.99 / 0.96	0.90 / 0.88	0.69 / 0.72	0.75 / 0.75	0.84 / 0.79
VideoSeal	2.03	1.64	1.03	0.71	1.17	0.85 / 0.85	0.71 / 0.75	0.38 / 0.47	0.21 / 0.21	0.74 / 0.75
TrustMark	3.11	2.67	1.26	0.26	0.20	0.99 / 0.98	0.96 / 0.95	0.52 / 0.58	0.03 / 0.00	0.02 / 0.00

Table 1: Channel characteristic

\varrho\sigma^{-1}

computed empirically over 10k

1024\times 1024

ImageNet images watermarked with random messages and the corresponding theoretical capacity in message bits per codeword bit.

Figure 2: Theoretical bit accuracy $p(\rho)$ (left) and Shannon capacity in bits (right) as a function of the projection cosine alignment $\rho$ . Setting $\alpha=\sqrt{M^{\prime}/L}$ guarantees perfect security against PCA attacks while maintaining an invariant bit accuracy across all codeword dimensions $M^{\prime}$ . Dotted lines represent the maximum robustness setting, when $\alpha=1$ . Security ratio $\eta$ required to estimate the secret subspace with a PCA attack as a function of $\alpha$ for different values of alignment $\rho$ and $M^{\prime}\in\{256,512\}$ .

Appendix figures & tables7 assets

Supplementary material from the paper’s appendix.

Appendix

Losses	Stage 1	Stage 2	Stage 3
$\mathcal{L}_{\text{align}}^{\text{all}}$	✓	✗	✗
$\mathcal{L}_{\text{align}}^{\text{pool}}$	✗	✓	✓
$\mathcal{L}_{\text{iso}}^{\text{same}}$	✓	✓	✓
$\mathcal{L}_{\text{iso}}^{\text{cross}}$	✗	✓	✓
$\mathcal{L}_{\text{iso}}^{\text{host}}$	✗	✓	✓
$\mathcal{L}_{\text{qual}}^{\text{PSNR}}$	✓	✓	✓

Appendix

Table 3: Active losses per training stage.

WM	Projection function	Lipschitz constant $L_{f}$
PixelSeal	ConvNeXT	1079
VideoSeal	ConvNeXT	595
TrustMark	ResNet	120
Broken-Arrows	DWT	1

Appendix

Table 4: Comparison of empirical estimates of the Lipschitz constant

L_{f}

of the projection function across schemes. Classical transforms guarantee distance preservation (

L_{f}=1

), whereas unconstrained neural projection functions exhibit large empirical Lipschitz constants, exposing them to low-distortion removal. The estimation is performed over 100 ImageNet images.

Method	Rate $R_{\sigma}$ / $R_{\sigma}\times M^{\prime}$
	Identity	Residual Transfer
PixelSeal	0.910 / 232.9	0.003 / 0.8
VideoSeal	0.848 / 217.2	0.002 / 0.6
Trustmark	0.506 / 50.6	0.059 / 5.9
SNW (w/o anti-spoofing)	0.883 / 678.0	0.113 / 86.5
SNW (w anti-spoofing)	0.888 / 682.2	0.000 / 0.2

Appendix

Table 5: Bit accuracy of the methods against residual transfer attacks. The results are computed over 200 MFlickr

1024\times 1024

images.

Figure 5: Eigenvalues of the covariance $\Sigma_{\mathrm{Identity}}$ of the latent vector $f_{d}(\mathbf{x}_{\mathrm{wm}})$ (i.e. when $t$ is the identity) for different checkpoint of SNW. The number in the legend correspond to the number of training step.

Method	Identity	VAE	Sana (2 steps)	Sana (4 steps)	Sana (8 steps)
PixelSeal	0.939 / 240.5	0.555 / 142.0	0.519 / 132.8	0.357 / 91.3	0.076 / 19.4
VideoSeal	0.884 / 226.2	0.576 / 147.6	0.557 / 142.6	0.392 / 100.4	0.084 / 21.5
TrustMark	0.632 / 63.2	0.453 / 45.3	0.415 / 41.5	0.184 / 18.4	0.023 / 2.3
SNW	0.892 / 684.7	0.495 / 380.3	0.479 / 368.1	0.388 / 298.3	0.145 / 111.5
Method	Sana (10 steps)	Sana (20 steps)	WM Forger 50 steps	WM Forger 100 steps
PixelSeal	0.025 / 6.4	0.003 / 0.8	0.533 / 136.3	0.280 / 71.8

Appendix

Table 6: Capacity of the watermarking systems against recent watermarking erasure attacks. The results are computed over 200 MFlickr

1024\times 1024

images.

Method	Rate $R_{\sigma}$ / $R_{\sigma}\times M^{\prime}$
Method	Identity	Brightness $+0.2$	Contrast $\times 2$	JPEG QF $=80$	JPEG QF $=50$
PixelSeal	0.939 / 240.5	0.899 / 230.1	0.709 / 181.6	0.928 / 237.5	0.876 / 224.4
VideoSeal	0.878 / 224.7	0.793 / 203.1	0.539 / 138.1	0.863 / 221.0	0.816 / 209.0
TrustMark	0.611 / 61.1	0.530 / 53.0	0.309 / 30.9	0.545 / 54.5	0.491 / 49.1
SNW	0.983 / 686.0	0.868 / 666.3	0.514 / 394.6	0.884 / 679.0	0.837 / 642.5
	Gaussian Blur $3\times 3$ , $\sigma=1$	Rotation $90^{\circ}$	Horizontal Flip	Hue 0.5	Saturation 1.5

Appendix

Table 7: Capacity of the watermarking systems against an extensive set of classic image transformations. The results are computed over 1000 MFlickr

1024\times 1024

images.

Figure 6: Example of an image watermarked with different methods and associated residuals for a fixed watermark power of 48 dB PSNR.

Explore similar work

Do Modern Post-Hoc Watermarking Methods Beat Broken-Arrows?
May 26, 2026Enoal Gesny, Eva GiboulotWatermarks Watermarking
Inria Rennes, France
Secure Seed-Based Multi-bit Watermarking for Diffusion Models from First Principles
May 7, 2026Enoal Gesny, Eva GiboulotWatermarking Multi-Bit Watermarking
Inria, Rennes, France
SpreadMark: Robust Image Watermarking via Spread-Spectrum Embedding
Aug 4, 2026Wei Song, Yuxin Cao, Zhenchang Xing +4Watermarks Deepfake Detection
University of New South Wales, Australia · National University of Singapore, Singapore · CSIRO’s Data61, Australia

May 26, 2026, cs.CRJ/K move · Enter open · S save

Do Modern Post-Hoc Watermarking Methods Beat Broken-Arrows?

Enoal Gesny, Eva Giboulot

Inria Rennes, France

Watermarks Watermarking Image Generation

Open paper AskPDF arXiv

With the rapid proliferation of generative models, such as diffusion models, digital watermarking has emerged as a crucial solution for identifying AI-generated images. Modern post-hoc watermarking schemes use neural networks to achieve an extremely low false-alarm rate while remaining robust to common image transformations. However, there is a lack of comparison between these modern methods and classic ones, particularly in real-world scenarios where robustness and security take precedence over achieving an extremely low false-alarm probability. In this paper, we propose a fair comparison of robustness and security between modern and classic post-hoc watermarking across various types of classic augmentations and recent sophisticated attacks. Our experiments show that, in a realistic scenario, classic watermarking outperforms modern techniques in terms of security while maintaining robustness.

Abstract

Explore similar work

Do Modern Post-Hoc Watermarking Methods Beat Broken-Arrows?

Secure Seed-Based Multi-bit Watermarking for Diffusion Models from First Principles

SpreadMark: Robust Image Watermarking via Spread-Spectrum Embedding