FiLM-CAM: Keyed Feature Modulation for Conditional-Access Watermarking

Yash Kulthe; Vishal Asnani; Shruti Agarwal; Andrew Gilbert; John Collomosse

cs.CVOct 21, 2026

FiLM-CAM: Keyed Feature Modulation for Conditional-Access Watermarking

Authors: Yash Kulthe, Vishal Asnani, Shruti Agarwal, Andrew Gilbert, John Collomosse

Organizations: DECaDE, University of Surrey, UK · Adobe Research

Abstract

We propose FiLM-CAM; a conditional-access image watermarking approach that enforces authorized encoding, decoding, and removal through keyed feature modulation. A secret key conditions a Feature-wise Linear Modulation (FiLM) mechanism that transforms the internal representation of the watermark signal before embedding, thereby coupling the payload to the key at the feature, rather than pixel level. The same key must be presented to condition the decoder to correctly recover the payload embedded in an image. To enforce conditional access, we train the system to maximize the performance gap between authorized and unauthorized use, ensuring reliable extraction under the correct key while inducing failure under incorrect keys. In addition, we design our encoder to estimate the watermark residual invariant to the presence of pre-existing watermarks. This design enables conditional watermark removal via simple re-encoding and subtraction of the residual using iterative refinement, contingent on knowledge of the secret key. We evaluate FiLM-CAM across multiple watermarking encoder-decoder backbones, demonstrating that keyed feature modulation serves as an effective, architecture-agnostic conditional access module (CAM) for image watermarking.

Figures & tables

Figure 1: Architecture of FiLM-CAM. Stage 1 : The Embedder generates watermark residuals, which are added to the cover image, producing a watermarked image. The Extractor recovers the watermark from the image if it receives the correct key; if an incorrect key is provided, the extractor outputs an all-zero bit message. Stage 2 : The Embedder network is trained to output residuals when given a watermarked image, such that it can be used to remove the watermark. Conditional Access Module (CAM) : A binary key $k$ is mapped to an embedding $e_{k}=\phi(k)$ and transformed via $\psi$ to produce feature-wise parameters $(\gamma_{k},\beta_{k})$ . These conditions are the intermediate feature maps via FiLM modulation $F_{\text{cond}}=\gamma_{k}\odot F+\beta_{k}$ , enabling key-dependent watermark embedding, decoding, and removal.

		COCO				DIV2K				SA-1B
Method	Payload	Bit Acc.	PSNR	SSIM	LPIPS	Bit Acc.	PSNR	SSIM	LPIPS	Bit Acc.	PSNR	SSIM	LPIPS
TrustMark-Q [ 11 ]	100	0.99	41.9	0.9910	0.0017	0.99	40.9	0.9939	0.0026	0.99	41.3	0.9946	0.0028
InvisMark [ 43 ]	100	0.99	48.0	0.9974	0.0011	0.99	46.5	0.9964	0.0025	0.99	46.2	0.9961	0.0027
PixelSeal [ 38 ]	256	0.99	45.8	0.9948	0.0020	0.99	46.0	0.9959	0.0011	0.99	46.5	0.9966	0.0012
RoSteALS [ 12 ]	100	0.99	30.0	0.9462	0.0475	0.98	28.2	0.9484	0.0527	0.99	28.6	0.9537	0.0521
SSL [ 22 ]	100	0.99	40.0	0.9788	0.0351	0.99	40.0	0.9733	0.0611	0.99	40.0	0.9770	0.0350

Table 1: Comparison with SOTA neural image watermarking across three evaluation datasets. We report bit accuracy (correct key

\uparrow

, wrong key

\downarrow

), PSNR (

\uparrow

), SSIM (

\uparrow

), and LPIPS (

\downarrow

Method COCO BER

\uparrow

SSL 50 Key-based FNNS 29 FiLM-CAM 47 DIV2K BER

\uparrow

SSL 50 Key-based FNNS 23 FiLM-CAM 46

Table 2: (Left) Bit error rate (BER, %, higher is better) for conditional watermark decoding on COCO and DIV2K under wrong-key. (Right) Comparison of FiLM-CAM and SSL under varying key correctness (%). FiLM-CAM maintains near-random extraction accuracy (

\sim

50-60% bit accuracy) up to approximately 80% key correctness and increases sharply only when the query key closely matches the true key. SSL accuracy grows more gradually as key correctness increases. Removal PSNR of FiLM-CAM improves as key correctness increases.

	COCO			DIV2K			SA-1B			Inference
Method	PSNR $\uparrow$	Acc.	Gain $\uparrow$	PSNR $\uparrow$	Acc.	Gain $\uparrow$	PSNR $\uparrow$	Acc.	Gain $\uparrow$	time (ms)
TrustMark-RM(Q) [ 11 ]	41.7	0.66	-0.2	40.8	0.74	-0.2	41.08	0.72	-0.2	35.9
CtrlRegen+ [ 29 ]	21.1	0.50	-27.1	20.0	0.51	-26.7	20.0	0.50	-26.6	1976
Diffusion Attack [ 46 ]	21.0	0.50	-27.2	22.4	0.51	-24.3	22.0	0.50	-24.6	255.63
VAE-Bmshj2018 [ 8 ]	30.0	0.50	-18.2	25.3	0.51	-21.4	25.5	0.50	-21.1	4.00
VAE-Cheng2020 [ 14 ]	31.4	0.50	-16.8	26.4	0.51	-20.3	26.6	0.50	-20.0	14.46

Table 3: Comparison of watermark removal performance across COCO, DIV2K, and SA-1B. We report removal PSNR (

\uparrow

), post-removal bit accuracy (

\downarrow

toward 0.50 indicating random guessing), PSNR gain over the watermarked image (

\uparrow

), and inference time in milliseconds (

\downarrow

). For baselines and FiLM-CAM with the correct key, lower post-removal accuracy is better (0.50 = random guessing, i.e. watermark erased). For FiLM-CAM with the wrong key, higher accuracy is desirable, since the watermark should survive an unauthorized removal attempt. Accuracy column is therefore not marked with an arrow.

Figure 2: Re-Watermarking. (Left) Repeated re-watermarking (blue) progressively degrades decoding accuracy, whereas the watermark–remove–reapply cycle (red) maintains near-original accuracy across iterations. (Right) Naïve repeated re-watermarking leads to substantial quality degradation (blue), while the watermark–remove–reapply cycle preserves significantly higher reconstruction quality.

Panel of Figure 3 — Figure 3: Explore the influence of strength and iteration count. (Left) Trade-off between robustness and imperceptibility due to strength $\alpha$ . As $\alpha$ increases extractor bit accuracy (green, right axis) increases with $\alpha$ , whereas post-removal bit accuracy (red, right axis) remains close to random i.e., the remover effectively removes the watermark. (Right) Removal PSNR as a function of refinement iterations for correct and wrong keys.

Method	Bit Acc. $\uparrow$	WM PSNR (dB) $\uparrow$	Rem. PSNR (dB) $\uparrow$	Post-Rem. Acc. $\downarrow$
FiLM-CAM w/o FiLM	0.85	36.9	47.3	0.62
FiLM-CAM w/o gain	0.99	36.0	44.0	0.51
FiLM-CAM w/o logit space (additive)	0.98	47.0	54.1	0.55
FiLM-CAM	0.99	46.7	55.4	0.54

Table 4: Ablation on DIV2K reporting bit accuracy (

\uparrow

), watermarked quality (WM PSNR

\uparrow

), removal quality (Rem. PSNR

\uparrow

), and removal accuracy (Post-Rem. Acc.

\downarrow

Encoder	Decoder	Ext. Acc. $\uparrow$	WM PSNR $\uparrow$	Rem. PSNR $\uparrow$	Post-Rem. Acc. $\downarrow$
MUNIT [ 11 ]	ResNet-50 [ 24 ]	0.97	41.3	54.0	0.67
FiLM-CAM Encoder	ResNet-50 [ 24 ]	0.96	37.5	43.1	0.67
FiLM-CAM Encoder	ConvNeXt-Tiny [ 30 ]	0.99	38.6	49.8	0.65
FiLM-CAM Encoder	ConvNeXtV2-Base [ 42 ]	0.98	38.2	50.5	0.60
FiLM-CAM Encoder	ConvNeXt-Base [ 30 ]	0.99	46.7	55.4	0.54

Table 5: Ablation of encoder–decoder backbone choices for FiLM-CAM on DIV2K.

Appendix figures & tables17 assets

Supplementary material from the paper’s appendix.

Appendix

Type	Transform	Low-severity setting / range
Fixed	Horizontal flip	Applied with probability $0.5$
Fixed	Resize-to-224 crop	Output size $224\times 224$
Optional	JPEG compression	JPEG quality sampled in $[70,100]$ (ramped)
Optional	Brightness	Factor sampled in $[0.9,1.1]$ (ramped)
Optional	Contrast	Factor sampled in $[0.9,1.1]$ (ramped)
Optional	Colour jiggle	Brightness $\pm 0.05$ , contrast $\pm 0.05$ ,

Appendix

Table 6: Training-time noise layer used in FiLM-CAM, as implemented in our augmentation code. Two optional transforms are sampled uniformly at each forward pass ( n_optional=2 ), with per-transform application probability p=0.5 . In addition, fixed transforms are applied every time as listed below. The augmentation strength is ramped during training via a schedule over ramp=1000 steps.

Attack	TrustMark-Q	InvisMark	PixelSeal	RoSteALS	SSL	MBRS	FiLM-CAM
Crop	60.8	75.1	83.2	50.4	74.1	50.0	83.2
Flip	99.9	100.0	99.6	48.7	99.9	50.0	100.0
Sharpness	99.8	100.0	99.5	98.9	99.7	100.0	100.0
Motion Blur	99.8	100.0	99.6	98.7	84.5	82.2	96.9
Gaussian Noise	99.6	81.5	95.5	95.2	62.7	82.3	90.2
Colour Jiggle	99.7	100.0	99.4	98.8	99.6	99.8	99.0

Appendix

Table 7: Robustness comparison on DIV2K under common image perturbations. We report watermark extraction bit accuracy (%, higher is better) for each attack.

Family	Attack	[email protected]%FPR $\uparrow$	Bit Acc. (%) $\uparrow$	AUC $\uparrow$	Attacked PSNR (dB)
Clean	None	1.000	99.66	1.000	40.56
Distortion (single)	Random crop	0.995	94.1	1.000	12.86
	Erase	0.997	93.0	1.000	15.66
	Brightness	0.981	94.7	0.996	15.19
	Contrast	0.997	95.5	1.000	21.64
	Noise	0.999	95.0	1.000	26.53

Appendix

Table 8: WAVES benchmark results for FiLM-CAM (noise-trained), with the correct key.

Dataset	Metric	FiLM-CAM (Clean)		FiLM-CAM (Noise-trained)
Dataset	Metric	Correct Key	Wrong Key	Correct Key	Wrong Key
COCO	Embed. Acc.	0.99	0.53	0.99	0.55
	Embed. PSNR	48.2	–	40.2	–
	Rem. Acc. ( $\sim$ 0.5)	0.53	0.58	0.57	0.81
	Rem. PSNR	59.9	56.2	57.9	48.0
DIV2K	Embed. Acc.	0.99	0.54	0.99	0.55

Appendix

Table 9: Conditional behaviour of FiLM-CAM across COCO, DIV2K, and SA-1B, comparing the model trained under clean conditions and the model trained with the noise layer. We report watermark extraction bit accuracy (Acc., higher is better), watermarked-image PSNR (dB, higher is better), post-removal bit accuracy (Rem. Acc., where 0.5 indicates random guessing), and removal PSNR (Rem. PSNR, dB, higher is better).

Decoder	Bit Acc. (held-out)
FiLM-CAM extractor, correct key	0.99
FiLM-CAM extractor, random key	0.54
Surrogate decoder (no key)	0.52

Appendix

Table 10: Key-free decoding with a surrogate decoder, on held-out covers.

$\lambda$	Bit Acc. (%)	PSNR (dB)
0.5	98.87	40.57
1.0	97.59	40.71
2.0	90.48	40.14
3.0	80.71	38.76
5.0	67.97	35.49
8.0	58.55	31.58

Appendix

Table 11: Collusion attack: subtracting the averaged same-key watermark at scale

\lambda

Embedder
Input	$x\in\mathbb{R}^{3\times 256\times 256},\;m\in\{0,1\}^{100},\;k\in\{0,1\}^{100}$
Secret projection	Linear, reshape, upsample: $m\rightarrow\mathbb{R}^{3\times 16\times 16}\rightarrow\mathbb{R}^{3\times 256\times 256}$
Concatenation	$\mathrm{Concat}(x,\mathrm{Secret2Image}(m))\rightarrow\mathbb{R}^{6\times 256\times 256}$
Initial block	ResNetBlock $\rightarrow\mathbb{R}^{32\times 256\times 256}$
Down block 1	DBlock $\rightarrow\mathbb{R}^{64\times 128\times 128}$
Down block 2	DBlock $\rightarrow\mathbb{R}^{128\times 64\times 64}$

Appendix

Table 12: High-level architecture of the FiLM-CAM watermark embedder.

Extractor
Input	$x^{\mathrm{w}}\in\mathbb{R}^{3\times H\times W},\;k\in\{0,1\}^{100}$
Resize	Bilinear interpolation $\rightarrow\mathbb{R}^{3\times 224\times 224}$
Image encoder	ConvNeXt-Base features $\rightarrow\mathbb{R}^{1024\times 7\times 7}$
Global pooling	Adaptive average pooling $\rightarrow\mathbb{R}^{1024\times 1\times 1}$
Normalization	BatchNorm2D $\rightarrow\mathbb{R}^{1024\times 1\times 1}$
Flatten	$\rightarrow\mathbb{R}^{1024}$

Appendix

Table 13: High-level architecture of the FiLM-CAM watermark extractor.

Figure 4: Qualitative results of embedding and removal with FiLM-CAM. From left to right, we show the cover image, the watermarked image, the embedding residual ( $5\times$ amplified for visibility), the reconstructed cover after removal, and the removal residual ( $5\times$ amplified).

FiLM emb. dim.	Embed. PSNR $\uparrow$	Bit Acc. (Correct) $\uparrow$	Bit Acc. (Wrong) ( $\sim$ 0.5 )
100	46.6	0.98	0.55
200	46.8	0.96	0.52
64 (default)	46.7	0.99	0.54

Appendix

Table 14: Ablation of the FiLM key-embedding dimension. We vary the dimensionality of the key embedding used to generate FiLM parameters, while keeping the rest of FiLM-CAM fixed. We report watermarked-image PSNR (dB, higher is better), extraction bit accuracy with the correct key (higher is better), and extraction bit accuracy with a wrong key (where values near 0.5 indicate random guessing). The default setting is 64 dimensions.

Figure 5: Effect of Different Keys on the Watermark Residuals

Key	Message	Removal PSNR (dB) $\uparrow$	PSNR gain (dB) $\uparrow$	Post-Rem. Bit Acc.
Correct	Correct	55.66	15.58	0.57
Correct	Random	48.31	8.23	0.78
Random	Correct	46.37	6.29	0.83
Random	Random	45.27	5.19	0.81

Appendix

Table 15: Effect of the key and message supplied at removal time. Post-removal bit accuracy near 0.50 indicates successful removal.

Dataset	Fixed Secret + Random Key	Random Secret + Random Key
COCO	0.58	0.81
DIV2K	0.59	0.82
SA-1B	0.59	0.81

Appendix

Table 16: Post-removal bit accuracy under unauthorized removal settings (FiLM-CAM (Clean)). We compare removal with an incorrect key and fixed secret against removal with both random secret and random key. Higher is better: high accuracy indicates that the embedded watermark remains decodable after an invalid removal attempt, demonstrating resistance to unauthorized removal.

	COCO			DIV2K			SA-1B
Method	PSNR $\uparrow$	SSIM $\uparrow$	LPIPS $\downarrow$	PSNR $\uparrow$	SSIM $\uparrow$	LPIPS $\downarrow$	PSNR $\uparrow$	SSIM $\uparrow$	LPIPS $\downarrow$
TrustMark-RM (Q)	41.7	0.9900	0.0023	40.8	0.9936	0.0034	41.1	0.9940	0.0037
CtrlRegen+	21.1	0.6418	0.1819	20.0	0.5744	0.1992	20.4	0.6122	0.1884
Diffusion Attack	21.0	0.5619	0.1816	22.4	0.6250	0.1513	22.0	0.6192	0.1575
VAE-Bmshj2018	30.0	0.8399	0.2096	30.85	0.8961	0.1089	29.56	0.8661	0.1679
VAE-Cheng2020	31.4	0.8661	0.1625	30.85	0.8961	0.1089	31.18	0.8990	0.1079

Appendix

Table 17: Image quality of restored (watermark-removed) outputs across COCO, DIV2K, and SA-1B. PSNR (dB) and SSIM are higher-is-better; LPIPS is lower-is-better. All metrics are computed against the original unwatermarked image.

Figure 6: Side-by-side comparison of watermarked images from FiLM-CAM and baseline methods.

Setting	Embed PSNR (dB)	Decoded Bit Acc.	Removal PSNR (dB)	Post-Removal Bit Acc.
Correct key	44.96	0.99	63.22	0.60
Wrong key	–	0.52	55.61	0.94

Appendix

Table 18: FiLM-CAM (clean) fine-tuned with the remover in place of the noise layer, on COCO (1K images).

Method	PSNR $\mathrm{wm}_{1}$ (dB)	PSNR $\mathrm{wm}_{2}$ (dB)	$w_{1}$ @ $\mathrm{wm}_{1}$	$w_{1}$ @ $\mathrm{wm}_{2}$
PixelSeal [ 38 ]	45.90	42.94	0.99	0.50
TrustMark [ 11 ]	41.94	39.12	0.99	0.50
InvisMark [ 43 ]	48.36	44.72	0.99	0.54
FiLM-CAM (ours)	48.57	43.29	0.99	0.53

Appendix

Table 19: Overwrite attack on COCO (1K images).

w_{1}

\mathrm{wm}_{i}

: bit accuracy of the original watermark

w_{1}

decoded from

\mathrm{wm}_{i}

Watermark Removal

Watermark removal studies how to erase or evade embedded signals in text, images, and audio while preserving useful content.

See all 40 papers

Optimizing and Securing the Modern Watermarking Channel for Images
Sep 28, 2026Enoal Gesny, Eva GiboulotRobust Watermarking Multi-Bit Watermarking
Inria, Rennes, France
Hide&Seek: Remove Image Watermarks with Negligible Cost via Pixel-wise Reconstruction
Mar 1, 2026Huajie Chen, Tianqing Zhu, Hailin Yang +7Watermark Removal AI-Generated Image Watermarking
City University of Macau · CISPA Helmholtz Center for Information Security · Guangzhou University
LiBRA: Detection-Aware Image Watermark Removal via Bidirectional Latent Optimization
Oct 2, 2026Saibo Ye, Huajie Chen, Xin Guo +5Watermark Removal AI-Generated Image Watermarking
Faculty of Data Science, City University of Macau, Macao SAR, China · Corresponding Author · School of Information and Communications Engineering, Xi’an Jiaotong University, Xi’an 710049, China +2

Sep 28, 2026J/K move · Enter open · S save

Optimizing and Securing the Modern Watermarking Channel for Images

Enoal Gesny, Eva Giboulot

Inria, Rennes, France

Robust Watermarking Multi-Bit Watermarking

Open paper AskPDF arXiv

To comply with recent regulations requiring traceable generated content, modern watermarking has adopted multi-bit post-hoc watermarking schemes. These modern designs rest on an encoder-decoder pair implemented as deep neural networks. These models are usually treated as pure black-boxes trained end-to-end, with the noise of the watermarking channel modeled through a fixed set of geometric and valuemetric transforms applied to watermarked images. We argue that this purely empirical approach leads to unquestioned design flaws and a lack of theoretical performance guarantees. This work proposes a general theoretical model of modern post-hoc watermarking schemes grounded in a statistical analysis of the outputs of the encoder/decoder pair. We show that these deep neural networks implicitly define a watermarking channel modeled as parallel AWGN channels, with messages transmitted using BPSK modulation. This imposes a binary alphabet, greatly limiting the capacity of these watermarking systems. Another fatal flaw is their lack of a secret key, making them intrinsically insecure. We make this notion of watermarking security precise for post-hoc schemes by linking it to the possibility of estimating the secret key under a given statistical model of the decoder's output. By putting together the results from this theoretical analysis, we introduce SNW: a novel post-hoc watermarking system that significantly outperforms existing state-of-the-art baselines in terms of capacity while also providing strong security guarantees. Notably, it does not depend on a fixed codebook or binary alphabet, allowing it to reach a rate close to Shannon capacity through the use of capacity-achieving error-correcting codes.

Abstract

Watermark Removal

Explore similar work

Optimizing and Securing the Modern Watermarking Channel for Images

Hide&Seek: Remove Image Watermarks with Negligible Cost via Pixel-wise Reconstruction

LiBRA: Detection-Aware Image Watermark Removal via Bidirectional Latent Optimization