We propose FiLM-CAM; a conditional-access image watermarking approach that enforces authorized encoding, decoding, and removal through keyed feature modulation. A secret key conditions a Feature-wise Linear Modulation (FiLM) mechanism that transforms the internal representation of the watermark signal before embedding, thereby coupling the payload to the key at the feature, rather than pixel level. The same key must be presented to condition the decoder to correctly recover the payload embedded in an image. To enforce conditional access, we train the system to maximize the performance gap between authorized and unauthorized use, ensuring reliable extraction under the correct key while inducing failure under incorrect keys. In addition, we design our encoder to estimate the watermark residual invariant to the presence of pre-existing watermarks. This design enables conditional watermark removal via simple re-encoding and subtraction of the residual using iterative refinement, contingent on knowledge of the secret key. We evaluate FiLM-CAM across multiple watermarking encoder-decoder backbones, demonstrating that keyed feature modulation serves as an effective, architecture-agnostic conditional access module (CAM) for image watermarking.
Figures & tables
Figure 1: Architecture of FiLM-CAM. Stage 1 : The Embedder generates watermark residuals, which are added to the cover image, producing a watermarked image. The Extractor recovers the watermark from the image if it receives the correct key; if an incorrect key is provided, the extractor outputs an all-zero bit message. Stage 2 : The Embedder network is trained to output residuals when given a watermarked image, such that it can be used to remove the watermark. Conditional Access Module (CAM) : A binary key k is mapped to an embedding ek=ϕ(k) and transformed via ψ to produce feature-wise parameters (γk,βk) . These conditions are the intermediate feature maps via FiLM modulation Fcond=γk⊙F+βk , enabling key-dependent watermark embedding, decoding, and removal.
COCO
DIV2K
SA-1B
Method
Payload
Bit Acc.
PSNR
SSIM
LPIPS
Bit Acc.
PSNR
SSIM
LPIPS
Bit Acc.
PSNR
SSIM
LPIPS
TrustMark-Q [ 11 ]
100
0.99
41.9
0.9910
0.0017
0.99
40.9
0.9939
0.0026
0.99
41.3
0.9946
0.0028
InvisMark [ 43 ]
100
0.99
48.0
0.9974
0.0011
0.99
46.5
0.9964
0.0025
0.99
46.2
0.9961
0.0027
PixelSeal [ 38 ]
256
0.99
45.8
0.9948
0.0020
0.99
46.0
0.9959
0.0011
0.99
46.5
0.9966
0.0012
RoSteALS [ 12 ]
100
0.99
30.0
0.9462
0.0475
0.98
28.2
0.9484
0.0527
0.99
28.6
0.9537
0.0521
SSL [ 22 ]
100
0.99
40.0
0.9788
0.0351
0.99
40.0
0.9733
0.0611
0.99
40.0
0.9770
0.0350
Table 1: Comparison with SOTA neural image watermarking across three evaluation datasets. We report bit accuracy (correct key ↑ , wrong key ↓ ), PSNR ( ↑ ), SSIM ( ↑ ), and LPIPS ( ↓ ).
Table 2: (Left) Bit error rate (BER, %, higher is better) for conditional watermark decoding on COCO and DIV2K under wrong-key. (Right) Comparison of FiLM-CAM and SSL under varying key correctness (%). FiLM-CAM maintains near-random extraction accuracy ( ∼ 50-60% bit accuracy) up to approximately 80% key correctness and increases sharply only when the query key closely matches the true key. SSL accuracy grows more gradually as key correctness increases. Removal PSNR of FiLM-CAM improves as key correctness increases.
COCO
DIV2K
SA-1B
Inference
Method
PSNR ↑
Acc.
Gain ↑
PSNR ↑
Acc.
Gain ↑
PSNR ↑
Acc.
Gain ↑
time (ms)
TrustMark-RM(Q) [ 11 ]
41.7
0.66
-0.2
40.8
0.74
-0.2
41.08
0.72
-0.2
35.9
CtrlRegen+ [ 29 ]
21.1
0.50
-27.1
20.0
0.51
-26.7
20.0
0.50
-26.6
1976
Diffusion Attack [ 46 ]
21.0
0.50
-27.2
22.4
0.51
-24.3
22.0
0.50
-24.6
255.63
VAE-Bmshj2018 [ 8 ]
30.0
0.50
-18.2
25.3
0.51
-21.4
25.5
0.50
-21.1
4.00
VAE-Cheng2020 [ 14 ]
31.4
0.50
-16.8
26.4
0.51
-20.3
26.6
0.50
-20.0
14.46
Table 3: Comparison of watermark removal performance across COCO, DIV2K, and SA-1B. We report removal PSNR ( ↑ ), post-removal bit accuracy ( ↓ toward 0.50 indicating random guessing), PSNR gain over the watermarked image ( ↑ ), and inference time in milliseconds ( ↓ ). For baselines and FiLM-CAM with the correct key, lower post-removal accuracy is better (0.50 = random guessing, i.e. watermark erased). For FiLM-CAM with the wrong key, higher accuracy is desirable, since the watermark should survive an unauthorized removal attempt. Accuracy column is therefore not marked with an arrow.
Figure 2: Re-Watermarking. (Left) Repeated re-watermarking (blue) progressively degrades decoding accuracy, whereas the watermark–remove–reapply cycle (red) maintains near-original accuracy across iterations. (Right) Naïve repeated re-watermarking leads to substantial quality degradation (blue), while the watermark–remove–reapply cycle preserves significantly higher reconstruction quality.
Figure 3: Explore the influence of strength and iteration count. (Left) Trade-off between robustness and imperceptibility due to strength α . As α increases extractor bit accuracy (green, right axis) increases with α , whereas post-removal bit accuracy (red, right axis) remains close to random i.e., the remover effectively removes the watermark. (Right) Removal PSNR as a function of refinement iterations for correct and wrong keys.
Method
Bit Acc. ↑
WM PSNR (dB) ↑
Rem. PSNR (dB) ↑
Post-Rem. Acc. ↓
FiLM-CAM w/o FiLM
0.85
36.9
47.3
0.62
FiLM-CAM w/o gain
0.99
36.0
44.0
0.51
FiLM-CAM w/o logit space (additive)
0.98
47.0
54.1
0.55
FiLM-CAM
0.99
46.7
55.4
0.54
Table 4: Ablation on DIV2K reporting bit accuracy ( ↑ ), watermarked quality (WM PSNR ↑ ), removal quality (Rem. PSNR ↑ ), and removal accuracy (Post-Rem. Acc. ↓ ).
Encoder
Decoder
Ext. Acc. ↑
WM PSNR ↑
Rem. PSNR ↑
Post-Rem. Acc. ↓
MUNIT [ 11 ]
ResNet-50 [ 24 ]
0.97
41.3
54.0
0.67
FiLM-CAM Encoder
ResNet-50 [ 24 ]
0.96
37.5
43.1
0.67
FiLM-CAM Encoder
ConvNeXt-Tiny [ 30 ]
0.99
38.6
49.8
0.65
FiLM-CAM Encoder
ConvNeXtV2-Base [ 42 ]
0.98
38.2
50.5
0.60
FiLM-CAM Encoder
ConvNeXt-Base [ 30 ]
0.99
46.7
55.4
0.54
Table 5: Ablation of encoder–decoder backbone choices for FiLM-CAM on DIV2K.
Appendix figures & tables17 assets
Supplementary material from the paper’s appendix.
Appendix
Type
Transform
Low-severity setting / range
Fixed
Horizontal flip
Applied with probability 0.5
Fixed
Resize-to-224 crop
Output size 224×224
Optional
JPEG compression
JPEG quality sampled in [70,100] (ramped)
Optional
Brightness
Factor sampled in [0.9,1.1] (ramped)
Optional
Contrast
Factor sampled in [0.9,1.1] (ramped)
Optional
Colour jiggle
Brightness ±0.05 , contrast ±0.05 ,
Appendix
Table 6: Training-time noise layer used in FiLM-CAM, as implemented in our augmentation code. Two optional transforms are sampled uniformly at each forward pass ( n_optional=2 ), with per-transform application probability p=0.5 . In addition, fixed transforms are applied every time as listed below. The augmentation strength is ramped during training via a schedule over ramp=1000 steps.
Attack
TrustMark-Q
InvisMark
PixelSeal
RoSteALS
SSL
MBRS
FiLM-CAM
Crop
60.8
75.1
83.2
50.4
74.1
50.0
83.2
Flip
99.9
100.0
99.6
48.7
99.9
50.0
100.0
Sharpness
99.8
100.0
99.5
98.9
99.7
100.0
100.0
Motion Blur
99.8
100.0
99.6
98.7
84.5
82.2
96.9
Gaussian Noise
99.6
81.5
95.5
95.2
62.7
82.3
90.2
Colour Jiggle
99.7
100.0
99.4
98.8
99.6
99.8
99.0
Appendix
Table 7: Robustness comparison on DIV2K under common image perturbations. We report watermark extraction bit accuracy (%, higher is better) for each attack.
Table 8: WAVES benchmark results for FiLM-CAM (noise-trained), with the correct key.
Dataset
Metric
FiLM-CAM (Clean)
FiLM-CAM (Noise-trained)
Correct Key
Wrong Key
Correct Key
Wrong Key
COCO
Embed. Acc.
0.99
0.53
0.99
0.55
Embed. PSNR
48.2
–
40.2
–
Rem. Acc. ( ∼ 0.5)
0.53
0.58
0.57
0.81
Rem. PSNR
59.9
56.2
57.9
48.0
DIV2K
Embed. Acc.
0.99
0.54
0.99
0.55
Appendix
Table 9: Conditional behaviour of FiLM-CAM across COCO, DIV2K, and SA-1B, comparing the model trained under clean conditions and the model trained with the noise layer. We report watermark extraction bit accuracy (Acc., higher is better), watermarked-image PSNR (dB, higher is better), post-removal bit accuracy (Rem. Acc., where 0.5 indicates random guessing), and removal PSNR (Rem. PSNR, dB, higher is better).
Decoder
Bit Acc. (held-out)
FiLM-CAM extractor, correct key
0.99
FiLM-CAM extractor, random key
0.54
Surrogate decoder (no key)
0.52
Appendix
Table 10: Key-free decoding with a surrogate decoder, on held-out covers.
λ
Bit Acc. (%)
PSNR (dB)
0.5
98.87
40.57
1.0
97.59
40.71
2.0
90.48
40.14
3.0
80.71
38.76
5.0
67.97
35.49
8.0
58.55
31.58
Appendix
Table 11: Collusion attack: subtracting the averaged same-key watermark at scale λ .
Embedder
Input
x∈R3×256×256,m∈{0,1}100,k∈{0,1}100
Secret projection
Linear, reshape, upsample: m→R3×16×16→R3×256×256
Concatenation
Concat(x,Secret2Image(m))→R6×256×256
Initial block
ResNetBlock →R32×256×256
Down block 1
DBlock →R64×128×128
Down block 2
DBlock →R128×64×64
Appendix
Table 12: High-level architecture of the FiLM-CAM watermark embedder.
Extractor
Input
xw∈R3×H×W,k∈{0,1}100
Resize
Bilinear interpolation →R3×224×224
Image encoder
ConvNeXt-Base features →R1024×7×7
Global pooling
Adaptive average pooling →R1024×1×1
Normalization
BatchNorm2D →R1024×1×1
Flatten
→R1024
Appendix
Table 13: High-level architecture of the FiLM-CAM watermark extractor.
Figure 4: Qualitative results of embedding and removal with FiLM-CAM. From left to right, we show the cover image, the watermarked image, the embedding residual ( 5× amplified for visibility), the reconstructed cover after removal, and the removal residual ( 5× amplified).
FiLM emb. dim.
Embed. PSNR ↑
Bit Acc. (Correct) ↑
Bit Acc. (Wrong) ( ∼ 0.5 )
100
46.6
0.98
0.55
200
46.8
0.96
0.52
64 (default)
46.7
0.99
0.54
Appendix
Table 14: Ablation of the FiLM key-embedding dimension. We vary the dimensionality of the key embedding used to generate FiLM parameters, while keeping the rest of FiLM-CAM fixed. We report watermarked-image PSNR (dB, higher is better), extraction bit accuracy with the correct key (higher is better), and extraction bit accuracy with a wrong key (where values near 0.5 indicate random guessing). The default setting is 64 dimensions.
Figure 5: Effect of Different Keys on the Watermark Residuals
Key
Message
Removal PSNR (dB) ↑
PSNR gain (dB) ↑
Post-Rem. Bit Acc.
Correct
Correct
55.66
15.58
0.57
Correct
Random
48.31
8.23
0.78
Random
Correct
46.37
6.29
0.83
Random
Random
45.27
5.19
0.81
Appendix
Table 15: Effect of the key and message supplied at removal time. Post-removal bit accuracy near 0.50 indicates successful removal.
Dataset
Fixed Secret + Random Key
Random Secret + Random Key
COCO
0.58
0.81
DIV2K
0.59
0.82
SA-1B
0.59
0.81
Appendix
Table 16: Post-removal bit accuracy under unauthorized removal settings (FiLM-CAM (Clean)). We compare removal with an incorrect key and fixed secret against removal with both random secret and random key. Higher is better: high accuracy indicates that the embedded watermark remains decodable after an invalid removal attempt, demonstrating resistance to unauthorized removal.
COCO
DIV2K
SA-1B
Method
PSNR ↑
SSIM ↑
LPIPS ↓
PSNR ↑
SSIM ↑
LPIPS ↓
PSNR ↑
SSIM ↑
LPIPS ↓
TrustMark-RM (Q)
41.7
0.9900
0.0023
40.8
0.9936
0.0034
41.1
0.9940
0.0037
CtrlRegen+
21.1
0.6418
0.1819
20.0
0.5744
0.1992
20.4
0.6122
0.1884
Diffusion Attack
21.0
0.5619
0.1816
22.4
0.6250
0.1513
22.0
0.6192
0.1575
VAE-Bmshj2018
30.0
0.8399
0.2096
30.85
0.8961
0.1089
29.56
0.8661
0.1679
VAE-Cheng2020
31.4
0.8661
0.1625
30.85
0.8961
0.1089
31.18
0.8990
0.1079
Appendix
Table 17: Image quality of restored (watermark-removed) outputs across COCO, DIV2K, and SA-1B. PSNR (dB) and SSIM are higher-is-better; LPIPS is lower-is-better. All metrics are computed against the original unwatermarked image.
Figure 6: Side-by-side comparison of watermarked images from FiLM-CAM and baseline methods.
Setting
Embed PSNR (dB)
Decoded Bit Acc.
Removal PSNR (dB)
Post-Removal Bit Acc.
Correct key
44.96
0.99
63.22
0.60
Wrong key
–
0.52
55.61
0.94
Appendix
Table 18: FiLM-CAM (clean) fine-tuned with the remover in place of the noise layer, on COCO (1K images).
Method
PSNR wm1 (dB)
PSNR wm2 (dB)
w1 @ wm1
w1 @ wm2
PixelSeal [ 38 ]
45.90
42.94
0.99
0.50
TrustMark [ 11 ]
41.94
39.12
0.99
0.50
InvisMark [ 43 ]
48.36
44.72
0.99
0.54
FiLM-CAM (ours)
48.57
43.29
0.99
0.53
Appendix
Table 19: Overwrite attack on COCO (1K images). w1 @ wmi : bit accuracy of the original watermark w1 decoded from wmi .
To comply with recent regulations requiring traceable generated content, modern watermarking has adopted multi-bit post-hoc watermarking schemes. These modern designs rest on an encoder-decoder pair implemented as deep neural networks. These models are usually treated as pure black-boxes trained end-to-end, with the noise of the watermarking channel modeled through a fixed set of geometric and valuemetric transforms applied to watermarked images. We argue that this purely empirical approach leads to unquestioned design flaws and a lack of theoretical performance guarantees. This work proposes a general theoretical model of modern post-hoc watermarking schemes grounded in a statistical analysis of the outputs of the encoder/decoder pair. We show that these deep neural networks implicitly define a watermarking channel modeled as parallel AWGN channels, with messages transmitted using BPSK modulation. This imposes a binary alphabet, greatly limiting the capacity of these watermarking systems. Another fatal flaw is their lack of a secret key, making them intrinsically insecure. We make this notion of watermarking security precise for post-hoc schemes by linking it to the possibility of estimating the secret key under a given statistical model of the decoder's output. By putting together the results from this theoretical analysis, we introduce SNW: a novel post-hoc watermarking system that significantly outperforms existing state-of-the-art baselines in terms of capacity while also providing strong security guarantees. Notably, it does not depend on a fixed codebook or binary alphabet, allowing it to reach a rate close to Shannon capacity through the use of capacity-achieving error-correcting codes.
Watermarking has emerged as a key defense against the misuse of machine-generated images (MGIs). Yet the robustness of these protections remains underexplored. To reveal the limits of SOTA proactive image watermarking defenses, we propose HIDE&SEEK (HS), a suite of versatile and cost-effective attacks that reliably remove embedded watermarks while preserving high visual fidelity.
Huajie Chen, Tianqing Zhu, Hailin Yang +7
City University of Macau · CISPA Helmholtz Center for Information Security · Guangzhou University
Digital watermarking supports source attribution for AI-generated images, but its reliability depends on resistance to removal attacks. Some attacks attempt to remove watermarks by forcing the decoded watermark to differ from the original. However, this can produce an inverted watermark that remains detectable, causing removal to fail, while further attempts to alter the watermark may unnecessarily degrade image quality. To address these limitations, we present LiBRA (Latent In-band Bidirectional Removal Attack), which aims to make watermarks undetectable while preserving image quality. Instead of continually pushing the watermark toward inversion, LiBRA adjusts the image to conceal the watermark without encouraging further changes that could degrade image quality. Some attacks keep pushing decoded bits away from the original watermark, even when further changes preserve detectability and damage image quality. With access to the watermark key and decoder, LiBRA makes bounded changes in a public autoencoder's latent space. Unlike inversion-driven objectives that cannot correct excessive inversion, LiBRA guides average decoding confidence toward random guessing from either direction. This helps avoid an inverted but detectable watermark. Leaving individual bits flexible allows image-quality constraints to favor less damaging changes, while an optional frequency-guided mask limits their location. We verify removal using an exact two-sided binomial test rather than assuming the confidence target guarantees success.
Saibo Ye, Huajie Chen, Xin Guo +5
Faculty of Data Science, City University of Macau, Macao SAR, China · Corresponding Author · School of Information and Communications Engineering, Xi’an Jiaotong University, Xi’an 710049, China +2