Content-provenance standards such as C2PA let a platform recover a stripped manifest through a soft binding: an invisible watermark read from the content, or a fingerprint looked up in a registry. We benchmarked both families under one protocol, restricted to openly available models whose licences we audited, on public media, with false-match rates calibrated on held-out negatives and source-level bootstrap intervals for performance estimates. For watermarking we evaluated 25 image, 7 audio and 7 video configurations from 12 methods on perceptual quality, robustness, false positives and cost; for fingerprinting, 35 methods on registries of up to 98,985 images, partial edits and adversarial attacks. PixelSeal gave the best balance for image and video watermarks and AudioSeal for audio, but the error-correcting detector of every TrustMark variant fired on 5.9 to 15.3% of unmarked images, so a verifier should test the expected payload. Among fingerprints, copy detectors trained on non-commercial data detected up to 75.5% of transformed images at a pair-level false-match rate of 10−7 and DINOv2, the best permissively licensed method, 65.0%; near-copies in a product catalogue dominated the false matches, and no detection improvement from geometric verification was observed under a matched calibration false-binding constraint in the evaluated image pipelines. On the same attacked copies the two families failed differently: the union of watermark and fingerprint successes covered 69% of image copies; fingerprints covered more audio queries, whereas expected-key watermark verification covered more video queries. Embedding a watermark moved the ISCC code of 62.0% of images past its match threshold, and platform-dependent colour conversion changed watermark bits between x86 and ARM hosts.
Figures & tables
Figure 1: Benchmark protocol. Each of the 25 image, 7 audio and 7 video configurations embeds a seeded payload into every item. Quality is measured on the marked item; robustness on the decoder output after each transformation; false positives on unmarked items under the untouched condition and three benign transformations; latency and cost on a fixed GPU and CPU host. A configuration qualifies for ranking only if its licence, gate robustness and false-positive evidence all pass.
Modality
Method
Bits
Code
Weights
Image
TrustMark B, C, P, Q [ 4 ]
100
MIT
MIT
Image
PixelSeal [ 6 ]
256
MIT
MIT
Image, video
Video Seal 1.0 [ 35 ]
256
MIT
MIT
Image, video
ChunkySeal [ 31 ]
1024
MIT
MIT
Image
WAM [ 30 ]
32
MIT
MIT a
Image
DWT-DCT, DWT-DCT-SVD [ 24 ]
64
MIT
n/a
Table 1: Methods, payload sizes and licences.
Figure 2: Benchmark protocol. 35 fingerprinting methods are applied to registered assets and distractors (registry) and to queries derived from registered assets (positives) or from never-registered media (negatives) under 79 transformations and six kinds of partial edit. Thresholds are fixed on half of the negatives and evaluated on the other half. The same queries also drive the localization, security and watermark-complementarity measurements.
Modality
Method
Class
Code licence
Weights / data
Bits
Time (ms)
Image
PDQ
Perceptual hash
BSD (ThreatExchange); pdqhash binding
n/a
256
31 CPU
PDQ (dihedral)
Perceptual hash
BSD (ThreatExchange); pdqhash binding
n/a
256
31 CPU
aHash
Perceptual hash
BSD-2-Clause (imagehash)
n/a
64.0
4.3 CPU
dHash
Perceptual hash
BSD-2-Clause (imagehash)
n/a
64.0
4.4 CPU
pHash
Perceptual hash
BSD-2-Clause (imagehash)
n/a
64.0
5.2 CPU
pHash-256
Perceptual hash
BSD-2-Clause (imagehash)
n/a
256
5.6 CPU
Table 2: Methods, licences, stored size and extraction time. Bits: stored bits per registered asset (float descriptors count 32 bits per dimension; time-based systems report the mean over the registered items). Time: per image (1024 px), per second of audio or per 5 s clip.
Configuration
Q
PSNR
SSIM
LPIPS
FLIP
CVVDP
JPEG 75 bit acc.
Blind
GPU
Cost
Comb.
(dB) ↑
↑
↓
↓
↑
pooled
worst set
FPR ↓
(ms/MP)
($/k MP)
↑
PixelSeal (0.15) ⋆
✓
48.3
0.9969
0.0012
0.024
9.93
0.988
0.980
n/a
9.13
0.0026
0.95
PixelSeal (0.2)
✓
45.9
0.9952
0.0020
0.030
9.88
0.998
0.996
n/a
9.13
0.0026
0.90
Video Seal (0.2) CS
✓
44.8
0.9953
0.0021
0.034
9.82
0.997
0.996
n/a
8.79
0.0025
0.90
PixelSeal (0.4)
✓
40.1
0.9863
0.0077
0.051
9.57
0.999
0.999
n/a
9.13
0.0026
0.79
Video Seal (0.4)
✓
38.9
0.9856
0.0082
0.058
9.39
1.000
0.999
n/a
8.79
0.0025
0.79
Table 3: Image watermarking on 85 images (24 Kodak, 25 DIV2K, 28 CLIC, 8 16-bit HDR). Means over images (FLIP: 60 images without DIV2K; CVVDP: 32 Kodak and HDR images); bit accuracy after JPEG at quality 75, pooled and on the worst content subset.
Figure 3: Image watermarking trade-offs. (a) Perceptual error (FLIP, lower is better) against bit accuracy after JPEG 75 on the worst content subset; lines join strength settings of one network, darker shades are stronger settings, and open markers are reference-only methods. The dashed line is the 0.95 gate. (b) GPU embedding time against FLIP. (c) Combined score of the qualifying configurations with equal weights (filled) and quality-weighted (open). The ringed configuration has the highest combined score. Values are in Table 3 .
Modality
Configuration
Bits
ECC
Bit acc.
≥k (gate)
Exact (gate)
Exact (mean)
Image
PixelSeal (0.15)
256
none
0.988
1.000
0.318
0.254
Image
PixelSeal (0.2)
256
none
0.998
1.000
0.765
0.590
Image
Video Seal (0.2)
256
none
0.997
1.000
0.659
0.506
Image
PixelSeal (0.4)
256
none
0.999
1.000
0.871
0.771
Image
Video Seal (0.4)
256
none
1.000
1.000
0.906
0.745
Image
WAM (1)
32
none
0.994
0.976
0.918
0.828
Table 4: Exact payload recovery. Bit acc.: share of payload bits recovered at the gate transformation (JPEG 75, MP3 128 kb/s, H.264 CRF 23). Exact: share of items whose decoded payload equals the embedded one, at the gate and averaged over all transformations. For TrustMark exact recovery is after BCH decoding; no other method has an error-correcting layer, so exact recovery requires every bit. ≥k : share of items whose decoded bits match the embedded payload in at least k of n positions, the expected-payload decision of Table 8 (– where no such k exists).
Figure 4: Image robustness: mean bit accuracy of every configuration (rows) after every transformation (columns), from 0.5 (chance, white) to 1 (dark blue). † Reference-only methods. The full values are in the aggregated results (Data and Code Availability).
Figure 5: Visual comparison on a 256 × 256 crop of Kodak image 5. Top: watermarked crop. Middle: residual (marked minus original) amplified 20 times around mid-grey. Bottom: FLIP error map (0 to 0.3). Strengths are those of Table 3 .
Configuration
Q
SNR
SI-SNR
PESQ
STOI
∣Δ LUFS ∣
MP3 128k bit acc.
Blind
GPU
Cost
Comb.
(dB) ↑
(dB) ↑
speech ↑
music
↑
↓
pooled
worst set
FPR ↓
(ms/s)
($/kh)
↑
AudioSeal base (1) CS⋆
✓
27.3
27.0
4.44
4.23
0.9967
0.013
0.997
0.979
0.000
4.90
4.9
0.98
AudioSeal streaming (0.5)
✓
32.9
32.7
4.55
4.56
0.9999
0.004
0.996
0.988
0.000
5.83
5.9
0.91
AudioSeal streaming (1)
✓
26.9
26.6
4.39
4.45
0.9998
0.018
0.997
0.989
0.000
5.83
5.9
0.90
AudioSeal streaming (1.1)
✓
26.0
25.8
4.36
4.43
0.9997
0.025
0.996
0.988
0.000
5.83
5.9
0.90
WavMark
✓
36.3
35.9
4.15
4.36
0.9932
0.008
1.000
1.000
0.000
33.5
34
0.37
Table 5: Audio watermarking on 138 inputs: 46 source clips (40 LibriSpeech utterances, 6 music excerpts), each rendered at 16, 44.1 and 48 kHz. Means over inputs. PESQ is a speech model: the primary PESQ is the mean over the 120 speech inputs, and music PESQ (18 inputs) is shown for reference only. Bit accuracy after MP3 at 128 kb/s.
Figure 6: Audio watermarking. (a) Wideband PESQ on the speech inputs against bit accuracy after MP3 at 128 kb/s on the worst subset (source and sample rate). (b) GPU embedding time against SI-SNR. (c) Combined score of qualifying configurations. (d) Mean bit accuracy after each transformation; Perth is omitted because it carries no payload. † Reference only. Values are in Table 5 .
MP3 128k bit acc.
AAC 64k bit acc.
All codecs bit acc.
All codecs exact
Configuration
Pub.
Al.
Un.
Pub.
Al.
Un.
Al.
Un.
Al.
Un.
AudioSeal base (1)
0.997
0.997
0.999
0.998
0.998
0.999
0.997
0.999
0.978
0.986
AudioSeal streaming (0.5)
0.996
0.996
1.000
0.996
0.995
0.998
0.996
0.999
0.983
0.990
AudioSeal streaming (1.1)
0.996
0.997
1.000
0.997
0.996
1.000
0.997
1.000
0.993
1.000
AudioSeal streaming (1)
0.997
0.997
1.000
0.995
0.995
1.000
0.997
1.000
0.993
1.000
WavMark
1.000
1.000
1.000
1.000
1.000
1.000
1.000
1.000
1.000
1.000
Table 6: Audio decoding after codec round trips with and without alignment to the original. Pub.: the published bit accuracy (Table 5 , aligned, benchmark host). Al./Un.: re-run on one host, decoded after cross-correlation alignment to the original (the benchmark protocol) or from the codec output cut to the original length with no offset search. All: the six MP3 and AAC settings pooled; exact: all payload bits correct.
Figure 7: Where the audio watermarks put their energy. Top row: spectrograms of the first 6 s of one speech clip (LibriSpeech, band-limited to 8 kHz by its source) and one music clip, both at 44.1 kHz. Other rows: spectrogram of the residual (marked minus original) for each model at the strength of Table 5 , on the same decibel scale relative to the original’s peak. SilentCipher is omitted because its reference environment was not available when these clips were re-embedded.
Configuration
Q
PSNR
SSIM
LPIPS
FLIP
VMAF
H.264 CRF 23 bit acc.
GPU
fps
Cost
Comb.
(dB) ↑
↑
↓
↓
↑
pooled
worst clip
(ms/MP)
1080p
($/k MP)
↑
PixelSeal (0.4) CS⋆
✓
40.1
0.9674
0.0130
0.054
86.0
0.999
0.992
15.4
31.3
0.0043
1.00
Video Seal (0.4)
✓
40.3
0.9886
0.0131
0.055
82.1
1.000
1.000
16.3
29.7
0.0045
0.96
Video Seal (0.7)
✓
35.5
0.9710
0.0361
0.083
66.6
0.997
0.992
16.3
29.7
0.0045
0.91
ChunkySeal (0.2)
–
44.5
0.9734
0.0151
0.048
96.4
0.891
0.652
23.7
20.4
0.0066
–
PixelSeal (0.2)
–
46.0
0.9869
0.0035
0.031
95.5
0.984
0.949
15.4
31.3
0.0043
–
Table 7: Video watermarking on six 2.5-s 1080p clips. Bit accuracy after H.264 at CRF 23, pooled and on the worst clip.
Figure 8: Video watermarking. (a) VMAF against bit accuracy after H.264 at CRF 23 on the worst clip. (b) Bit accuracy after H.264 at CRF 23 for each clip (points) and the mean over clips (bars); defaults fail on one clip each. (c) Combined score of qualifying configurations. (d) Mean bit accuracy after each transformation. Values are in Table 7 .
Figure 9: Video residuals on one 1080p frame of aspen after video-mode embedding (frame 12 of 24). Top: 320 × 320 crop of the watermarked frame. Middle: residual amplified 20 times around mid-grey. Bottom: FLIP error map (0 to 0.3).
Network
Theoretical
Own payload
Random payloads
Blind detector
Evidence
k/n
PFM
trials
sources
95% upper
trials
max
trials
sources
95% upper
Image
ChunkySeal
589/1024
8.3×10−7
0/340
0/85
0.042
0/17000
566
none
analytic
InvisMark †
74/100
8.3×10−7
0/340
0/85
0.042
0/17000
70
none
analytic
PixelSeal
167/256
6.2×10−7
0/340
0/85
0.042
0/17000
158
none
analytic
RivaGAN †
30/32
1.2×10−7
0/240
0/60
0.060
0/12000
26
none
analytic
Table 8: False positives on unmarked content. Theoretical: the per-key false-match probability PFM of an expected-payload test that requires k of n bits to match, if unmarked content decodes to independent fair bits. Own payload: false matches against the payload recorded for the item, the check a verifier makes. Random payloads: the same decodes compared with unrelated payloads, which tests agreement with payloads the content was never marked with, conditional on these decodes. Blind detector: false detections of the model’s own detector.
Figure 10: False positives on unmarked content. (a) Blind false-positive rate per network with the unmarked source as the unit (a source counts if the detector fired on any of its transforms or renderings) and exact two-sided 95% intervals; networks with no false detection are shown by their upper bound. The dashed line is the 10−3 target. (b) TrustMark’s blind false-positive rate per image subset, per image. (c) Number of bits in unmarked PixelSeal decodes that match an expected 256-bit payload, against the binomial distribution for independent fair bits and the decision threshold k .
Modality
Network
Configs
Any Q
GPU (ms/unit)
CPU (ms/unit)
GPU $
CPU $
Cheaper
Image
InvisMark †
1
no
8.73
–
0.0024
–
GPU
Image
Video Seal CS
3
yes
8.79
544
0.0025
0.026
GPU
Image
PixelSeal ⋆
5
yes
9.13
1104
0.0026
0.053
GPU
Image
WAM
2
yes
19.1
361
0.0053
0.017
GPU
Image
TrustMark-P
3
yes
45.1
273
0.013
0.013
GPU
Image
TrustMark-B
1
yes
55.7
278
0.016
0.013
CPU
Table 9: Embedding cost and speed per network. Unit: one megapixel (image, video) or one second of audio. Cost in USD per 1,000 units for image and video, and per 1,000 hours for audio, at on-demand prices (g5.xlarge 1.006/h,m6a.xlarge0.1728/h, us-east-1, effective 2026-09-01).
Figure 11: Estimated embedding cost per network on GPU (filled circles) and CPU (open squares), at on-demand prices. (a) Images, USD per 1,000 megapixels. (b) Audio, USD per 1,000 hours. (c) Video, USD per 1,000 megapixels of 1080p frames (GPU only). Networks are sorted by their cheaper option. Values are in Table 9 .
Decoded file
Same host
x86-64 vs arm64
Bit flips
Bit strings
YUV equal
RGB equal
max ∣Δℓ∣
max ∣Δℓ∣
distinct
aspen, strength 0.4, CRF 18
0.00096
0.459
0
1
yes
no
aspen, strength 0.4, CRF 22
0.00090
0.889
0
1
yes
no
aspen, strength 1.1, CRF 18
0.00068
0.346
2
2
yes
no
aspen, strength 1.1, CRF 22
0.00076
0.440
0
1
yes
no
controlled burn, strength 0.4, CRF 18
0.0016
0.306
0
1
yes
no
Table 10: Cross-device determinism of watermark decoding. Δℓ : difference in detector logits between decodes of the same file.
Figure 12: Largest difference in detector logits between decodes of the same file on one host (open circles; CPU with one and four threads, and CUDA or MPS) and across an x86-64 and an arm64 host (filled circles). Crosses mark files for which at least one raw bit changed across hosts. Labels give the clip, Video Seal strength and H.264 CRF.
Modality
A
B
Metric
n
median(A − B)
pHolm
Image
PixelSeal (0.15)
TrustMark-P (0.8)
FLIP
60
0.0019
0.062
Image
PixelSeal (0.15)
Video Seal (0.2)
FLIP
60
-0.0099
< 0.001
Image
PixelSeal (0.15)
TrustMark-Q (1.2)
FLIP
60
-0.0212
< 0.001
Audio
AudioSeal base (1)
AudioSeal streaming (0.5)
PESQ (speech)
40
-0.1072
< 0.001
Video
PixelSeal (0.4)
Video Seal (0.4)
VMAF
6
3.6629
0.062
Table 11: Planned paired comparisons (two-sided Wilcoxon signed-rank on per-source values, Holm-adjusted over the five tests). Audio inputs of one clip are averaged first, so n counts clips; audio PESQ is on speech.
Figure 13: Recall@1 of every image method under every transformation, on the ABO registry of 98,985 images. Rows are grouped by family (compression, scaling, cropping, geometry, photometric, overlay, chains). Method names are coloured by class; † marks reference-tier methods.
Method
R@1
μ AP
TPR q,1%
TPR p,10−7
Hard FB
DISC21 μ AP
PDQ
0.579
0.520
0.495
0.495 [0.48, 0.50]
0.000
0.295
PDQ (dihedral)
0.623
0.569
0.549
0.546 [0.54, 0.55]
0.000
0.367
aHash
0.503
0.189
0.000
0.000 [0.00, 0.00]
0.000
0.027
dHash
0.560
0.356
0.313
0.000 [0.00, 0.00]
0.000
0.195
pHash
0.563
0.469
0.373
0.373 [0.00, 0.38]
0.000
0.240
pHash-256
0.589
0.520
0.494
0.492 [0.48, 0.50]
0.001
0.302
Table 12: Image retrieval over all attacks (ABO; registry of registered originals and distractors). TPR counts a query only if its top-1 is the true asset and the score passes a threshold fixed on held-out calibration negatives: query-level FPR 1% at this registry size, or pair-level FPR 10−7 (95% interval from a bootstrap over sources, which redraws the calibration negatives and so the threshold). Hard: rate at which another photograph of a registered product binds to that product at the 1% threshold.
Figure 14: (a) Recall@1 against the share of each side kept by a centred crop. (b) Mean Recall@1 over each transformation family for eight representative methods.
Figure 15: (a) Detection at pair-level FPR 10−7 against stored size per asset. (b) Against extraction time per 1024-pixel image (learned methods on one A10G GPU in batches of 64, hashes on one CPU thread; measured on an idle host). (c) μ AP on ABO against μ AP on the DISC21 subset.
A
B
TPR A
TPR B
A − B [95% CI]
sources
pHolm
SSCD R50
DINOv2-S
0.712
0.612
0.100 [0.084, 0.115]
2,000
<10−3
DINOv2-S
DINOv2-S LSH-256
0.612
0.519
0.093 [0.066, 0.106]
2,000
<10−3
PDQ
ISCC Image-64
0.495
0.427
0.068 [0.058, 0.175]
2,000
<10−3
PDQ
PDQ (dihedral)
0.495
0.546
-0.051 [-0.055, -0.050]
2,000
<10−3
ISCC Image-64
ISCC Image-256
0.427
0.458
-0.032 [-0.136, -0.020]
2,000
<10−3
SSCD R50
ISC21 1st
0.712
0.755
-0.043 [-0.056, -0.029]
2,000
<10−3
Table 13: Planned paired comparisons on the same image queries at pair-level FPR 10−7 . The unit is the registered source with all its transformed queries: pHolm from a sign-flip test on per-source differences in detections (Holm-adjusted over the eight comparisons); the interval of the TPR difference is a bootstrap over sources that also redraws the calibration negatives.
Figure 16: (a) Score distributions: best score of a never-registered query (grey) and score of an attacked query to its true asset (colour), pooled over all transformations; dashed line: threshold at pair-level FPR 10−7 . (b) Rate at which another photograph of a registered product binds to that product at the 1% threshold.
Any (primary)
Two of three
None
Method
TPR q,1%
TPR p,10−7
TPR q,1%
TPR p,10−7
TPR q,1%
TPR p,10−7
PDQ
0.495
0.495
0.476
0.471
0.214
0.214
PDQ (dihedral)
0.549
0.546
0.523
0.523
0.223
0.223
pHash-256
0.494
0.492
0.476
0.472
0.000
0.000
ISCC Image-256
0.466
0.458
0.448
0.448
0.211
0.000
DINOv2-S
0.625
0.612
0.546
0.544
0.194
0.192
Table 14: Sensitivity of the image operating points to the treatment of catalogue duplicates. Any : the rule fixed in advance (a pair counts as a duplicate if PDQ, SSCD or DINOv2-B says so); two : two of the three must agree; none : no cleanup, so recoloured or re-mounted versions of a registered design count as false matches. R@1 changes by at most a few points; the calibrated TPR does not.
Method
Retrieval threshold
k
TPR
FB
FB rate
DINOv2-S
pair 10−7
–
0.612
180
0.0067
query 1%
9 (matched)
0.609 [0.60, 0.61]
124
0.0046
query 1%
12 ( k=12 )
0.604 [0.60, 0.61]
104
0.0039
query 1%
278 (zero cal.)
0.206 [0.20, 0.22]
0
0.0000
pair 10−4
266 (matched)
0.268 [0.25, 0.28]
146
0.0054
pair 10−4
12 ( k=12 )
0.793 [0.79, 0.80]
4,390
0.1637
Table 15: Second-stage verification of image matches. The top-1 candidate is accepted only if its retrieval score passes a threshold and SIFT+RANSAC finds at least k geometric inliers between the query and the stored original. Both thresholds are fixed on the calibration negatives: matched, the smallest k whose calibration false bindings do not exceed those of retrieval alone at pair-level 10−7 ; zero cal., the smallest k no calibration negative reaches; and the localization track’s k=12 . FB: false bindings among the 26,820 held-out never-registered queries. TPR interval: bootstrap over sources.
Figure 17: (a) Detection of attacked image queries against the pair-level false-positive rate at which the threshold is set. (b) Expected number of false matches per query as a function of registry size for fixed pair-level rates.
Figure 18: (a) Recall@1 of each audio method under each transformation (1,000 registered items, 6,350 in the index). (b) Detection against the pair-level false-positive rate; unresolved targets are omitted.
Method
R@1
μ AP
TPR q,1%
FPR q (test)
TPR p,10−6
Music 10 s exc.
Speech 10 s exc.
Pitch +2
Re-record
Chromaprint
0.805
0.817
0.704 [0.68, 0.72]
0.016 [0.00, 0.04]
0.688 [0.66, 0.71]
1.000
1.000
0.006
0.451
audfprint
0.851
0.851
0.660 [0.53, 0.74]
0.008 [0.00, 0.03]
0.599 [0.46, 0.72]
0.982
1.000
0.071
0.852
ISCC Audio-64
0.662
0.581
0.409 [0.21, 0.41]
0.017 [0.00, 0.03]
0.212 [0.00, 0.41]
0.247
0.657
0.004
0.183
ISCC Audio-256
0.749
0.658
0.454 [0.31, 0.51]
0.019 [0.00, 0.04]
0.321 [0.24, 0.47]
0.555
0.882
0.006
0.342
CLAP
0.707
0.446
0.386 [0.33, 0.45]
0.017 [0.01, 0.04]
0.328 [0.27, 0.41]
0.957
0.725
0.910
0.228
NMFP †
0.905
0.937
0.862 [0.82, 0.88]
0.018 [0.00, 0.04]
0.846 [0.79, 0.88]
1.000
1.000
0.057
1.000
Table 16: Audio retrieval over all attacks, and Recall@1 under selected attacks. TPR q,1% : detection at the threshold set for a 1% query-level false-match rate on the calibration negatives; FPR q (test): the rate that threshold actually gave on the held-out negatives. TPR p,10−6 : the strictest pair-level target that 4053 calibration queries against 6350 references resolve; stricter targets are not reported. Intervals: 95% bootstrap over sources.
Figure 19: (a) Recall@1 of each video method under each transformation (120 registered clips, 443 in the index). (b) Detection against the pair-level false-positive rate; unresolved targets are omitted.
Method
R@1
μ AP
TPR q,1%
FPR q (test)
TPR p,10−4
Crop 50%
PiP
Inserted
Screen rec.
vPDQ
0.628
0.617
0.577 [0.56, 0.59]
0.032 [0.00, 0.08]
0.609 [0.57, 0.62]
0.000
0.000
0.342
0.000
TMK+PDQF
0.778
0.723
0.631 [0.61, 0.66]
0.066 [0.00, 0.16]
0.635 [0.63, 0.70]
0.017
0.000
0.583
0.992
ISCC Video-64
0.731
0.700
0.620 [0.61, 0.65]
0.062 [0.00, 0.16]
0.634 [0.62, 0.66]
0.025
0.000
0.333
0.817
ISCC Video-256
0.801
0.749
0.652 [0.63, 0.67]
0.068 [0.00, 0.17]
0.664 [0.66, 0.69]
0.108
0.008
0.575
0.958
DINOv2-S frames
0.872
0.691
0.437 [0.41, 0.58]
0.062 [0.01, 0.15]
0.523 [0.45, 0.63]
0.592
0.125
0.525
0.817
DINOv2-S mean
0.947
0.831
0.547 [0.51, 0.73]
0.032 [0.00, 0.16]
0.653 [0.56, 0.77]
0.917
0.200
0.958
0.950
Table 17: Video retrieval over all attacks, and Recall@1 under selected attacks. TPR q,1% : detection at the threshold set for a 1% query-level false-match rate on the calibration negatives; FPR q (test): the rate that threshold actually gave on the held-out negatives. TPR p,10−4 : the strictest pair-level target that 500 calibration queries against 443 references resolve; stricter targets are not reported. Intervals: 95% bootstrap over sources.
SIFT + RANSAC
DISK + LightGlue
Map
AUC
F1
best F1
AUC
F1
best F1
Pixel difference
0.944
0.75
0.83
0.942
0.72
0.82
SSIM
0.927
0.57
0.74
0.924
0.59
0.71
LPIPS
0.975
0.64
0.79
0.973
0.61
0.78
DINOv2 patches
0.958
0.53
0.70
0.952
0.52
0.69
PDQ tiles
0.866
0.04
0.50
0.866
0.02
0.49
Table 18: Localization of partial edits against the registered original (oracle retrieval; evaluation half of the sources). F1 at the threshold fixed for a 1% pixel false-positive rate on unedited, post-processed originals; best F1 chooses the threshold per map with hindsight.
Figure 20: (a) Examples of each edit type: registered original, edited query, ground-truth region, and three difference maps after SIFT alignment. (b) Pixel F1 at the calibrated threshold against the edited area, per map. (c) Share of edited queries whose original is retrieved above the query-level 1% threshold, against edited area, for the eight representative methods of Fig. 14 .
Figure 21: Inverting stored fingerprints. (a) Registered images (top) and thumbnails reconstructed from their descriptors by a decoder trained on distractor descriptors; bottom rows: the keyed 256-bit projection decoded by an attacker with the right and with a wrong key. (b) Share of reconstructions that retrieve their own original among the 5,000 registered images (95% Clopper–Pearson intervals); dashed: chance.
Figure 22: Adversarial robustness on 100 registered ABO images per setting. (a) Evasion by white-box PGD (learned descriptors) and surrogate-gradient PGD (DCT hashes) against the L∞ budget, judged by the real extractor at pair-level FPR 10−7 . (b) Evasion by perturbations crafted on a DINOv2-S, SSCD-R50 and OpenCLIP ensemble at a budget of 8 grey levels, judged at the pair-level 10−6 threshold the attack ran against; n/a: the method has no reachable operating point. (c) Targeted forgery: share of unrelated images that become their target’s top match above the 10−6 threshold.
Figure 23: Share of binary image codes that differ between an x86/A10G host and an arm64/M5 Pro laptop on byte-identical inputs. Float descriptors differ only in rounding ( 1−cos≤2×10−4 ).
Watermark
Fingerprint
WM
FP
Both
Either
Drift
TrustMark-Q
DINOv2-S
0.62
0.61
0.55
0.69
0.06
DINOv2-S LSH-256
0.62
0.51
0.47
0.66
0.21
ISC21 1st †
0.62
0.76
0.60
0.78
0.09
ISCC Image-64
0.62
0.47
0.43
0.66
0.62
PDQ
0.62
0.49
0.47
0.64
0.00
SSCD R50 †
0.62
0.68
0.58
0.72
0.18
Table 19: Watermark and fingerprint on the same attacked copies of watermarked assets, pooled over transformations. WM: exact-key recovery for TrustMark and AudioSeal, but expected-key verification for Video Seal; the latter does not establish unique registry identification. FP: correct fingerprint identification at a threshold calibrated to pair-level FPR 10−7 for images or query-level FPR 1% for audio and video; achieved held-out rates are reported separately. Both and Either are the intersection and union of these success criteria, not measured cascade accuracy. Drift: share of watermarked assets whose own fingerprint falls below the threshold against the unmarked original.
Figure 24: Share of attacked copies satisfying only the watermark criterion (blue), only the fingerprint criterion (orange), or both (grey), per transformation. Watermark success means exact-key recovery for images and audio, and expected-key verification for video; the video panel does not measure unique registry identification. (a) Images: TrustMark-Q and DINOv2-S, with the fingerprint threshold calibrated to pair-level FPR 10−7 . (b) Audio: AudioSeal and Chromaprint. (c) Video: Video Seal and the ISCC Video-Code. Audio and video fingerprint thresholds are calibrated to query-level FPR 1%; achieved held-out rates are reported separately.
Appendix figures & tables2 assets
Supplementary material from the paper’s appendix.
Appendix
Modality
Configuration
n
Metric 1
Metric 2
Metric 3
Image
PixelSeal (0.1)
85
51.6 [51.1, 52.1]
0.0006 [0.0005, 0.0007]
0.0158 [0.0146, 0.0171] ( n =60)
Image
Video Seal (0.1)
85
50.5 [50.1, 51.0]
0.0006 [0.0006, 0.0007]
0.0184 [0.0170, 0.0199] ( n =60)
Image
PixelSeal (0.125)
85
49.8 [49.3, 50.2]
0.0009 [0.0008, 0.0010]
0.0200 [0.0186, 0.0214] ( n =60)
Image
InvisMark
85
50.1 [49.6, 50.6]
0.0017 [0.0015, 0.0019]
0.0219 [0.0202, 0.0237] ( n =60)
Image
PixelSeal (0.15)
85
48.3 [47.8, 48.7]
0.0012 [0.0011, 0.0014]
0.0238 [0.0223, 0.0253] ( n =60)
Image
TrustMark-P (0.8)
85
50.5 [50.3, 50.8]
0.0017 [0.0014, 0.0020]
0.0220 [0.0215, 0.0226] ( n =60)
Appendix
Table 20: Quality means with bootstrap 95% confidence intervals (10,000 resamples of sources). Columns: image PSNR (dB), LPIPS, FLIP; audio SI-SNR (dB), PESQ on speech, STOI; video PSNR (dB), LPIPS, VMAF.
Mod.
Method
R@1
TPR q,1%
FPR q,1% (test)
TPR p,10−7
n+ (sources)
n− (sources)
image
PDQ
0.579 [0.58, 0.58]
0.495 [0.49, 0.50]
0.010 [0.01, 0.02]
0.495 [0.48, 0.50]
72,000 (2,000)
26,820 (745)
image
PDQ (dihedral)
0.623 [0.62, 0.63]
0.549 [0.54, 0.55]
0.011 [0.00, 0.02]
0.546 [0.54, 0.55]
72,000 (2,000)
26,820 (745)
image
aHash
0.503 [0.50, 0.51]
0.000 [0.00, 0.00]
0.000 [0.00, 0.00]
0.000 [0.00, 0.00]
72,000 (2,000)
26,820 (745)
image
dHash
0.560 [0.56, 0.56]
0.313 [0.00, 0.32]
0.011 [0.00, 0.01]
0.000 [0.00, 0.00]
72,000 (2,000)
26,820 (745)
image
pHash
0.563 [0.56, 0.57]
0.373 [0.37, 0.38]
0.003 [0.00, 0.01]
0.373 [0.00, 0.38]
72,000 (2,000)
26,820 (745)
image
pHash-256
0.589 [0.59, 0.59]
0.494 [0.49, 0.50]
0.013 [0.01, 0.02]
0.492 [0.48, 0.50]
72,000 (2,000)
26,820 (745)
Appendix
Table 21: Pooled results with 95% intervals from a bootstrap over sources: registered sources are drawn with all their transformed queries, and calibration and held-out negative sources likewise, with the threshold recomputed in every replicate. FPR q : share of held-out never-registered queries whose best score passes the query-level 1% threshold (out-of-sample check of the calibration). TPR p,10−7 is not resolved by the audio and video calibration sets (–).
Cryptographic provenance standards such as C2PA and invisible watermarking are positioned as complementary defenses for content authentication, yet the two verification layers are technically independent: neither conditions on the output of the other. This work formalizes and empirically demonstrates the Integrity Clash, a condition in which a digital asset carries a cryptographically valid C2PA manifest asserting human authorship while its pixels simultaneously carry a watermark identifying it as AI-generated, with both signals passing their respective verification checks in isolation. We construct metadata washing workflows that produce these authenticated fakes through standard editing pipelines, requiring no cryptographic compromise, only the semantic omission of a single assertion field permitted by the current C2PA specification. To close this gap, we propose a cross-layer audit protocol that jointly evaluates provenance metadata and watermark detection status, achieving 100% classification accuracy across 3,500 test images spanning four conflict-matrix states and three realistic perturbation conditions. Our results demonstrate that the gap between these verification layers is unnecessary and technically straightforward to close.
Alexander Nemecek, Hengzhi He, Guang Cheng +1
Case Western Reserve University · University of California, Los Angeles
We present a method for training imperceptible visual watermarks to coexist with other such watermarks. Recent work has shown that independently trained image watermarking models can coexist with surprisingly limited interference, enabling watermark ensembling. However, this coexistence is a serendipitous property rather than an explicit optimization objective, leaving interference uncontrolled and potentially reducing decoding robustness or visual quality. We first show empirically that the same coexistence property extends to video watermarking. We then show that both image and video watermarks can be trained with a decoder-aware objective to improve coexistence. Our results suggest a practical path to signpost watermarks that indicate the presence of independently deployed provenance watermarking systems, supporting layered provenance signaling for content authenticity and rights.
Shruti Agarwal, Vishal Asnani, John Collomosse
Adobe Research, San Jose CA 95110, USA · University of Surrey, Guildford GU2 7XH, UK
Current watermark removal methods are evaluated on two axes: attack success rate and perceptual quality. We show this is insufficient. While state-of-the-art attacks successfully degrade the watermark signal without visible distortion, they leave distinct statistical artifacts that betray the removal attempt. We name this overlooked axis Watermark Removal Detection (WRD) and demonstrate that a modern classifier trained on these artifacts achieves state-of-the-art detection rates at 10−3 FPR across every removal method tested. No existing attack accounts for this forensic leakage. We benchmark leading watermarking schemes against standard removal pipelines under the extended evaluation triple of attack success, perceptual quality, and forensic detectability, and find that no current method balances all three. Our results establish forensic stealthiness as a necessary requirement for watermark removal.