Source-linked AI summary
ReDMark: Framework for Residual Diffusion Watermarking on Deep Networks
Mahdi Ahmadi, Alireza Norouzi, S. M. Reza Soroushmehr, Nader Karimi, Kayvan Najarian, Shadrokh Samavi, Ali Emami
TL;DR
Watermarking must balance robustness against image attacks with imperceptibility, while prior CNN approaches provide limited end-to-end solutions. ReDMark learns blind embedding and extraction with residual FCNs, differentiable attack simulation, and spatial diffusion; the paper reports improved robustness and imperceptibility versus recent state-of-the-art methods.
Problem
Watermarked images remain vulnerable to processing, compression, transmission noise, and intentional attacks, while robustness and imperceptibility remain key challenges.
Method
ReDMark uses two residual Fully Convolutional Neural Networks trained end-to-end for blind embedding and extraction, with differentiable attack simulation and tunable parameters.
Results
ReDMark is reported to surpass recent state-of-the-art methods in robustness and imperceptibility.
Takeaways & Limitations
The framework diffuses watermark data across a relatively wide image area and supports tuning the robustness–imperceptibility trade-off.
Takeaways & Limitations
The proof-of-concept uses a fixed transformation layer rather than training the transform layers to discover a new transform domain.
Abstract
from arXiv · showhide
Due to the rapid growth of machine learning tools and specifically deep networks in various computer vision and image processing areas, application of Convolutional Neural Networks for watermarking have recently emerged. In this paper, we propose a deep end-to-end diffusion watermarking framework (ReDMark) which can be adapted for any desired transform space. The framework is composed of two Fully Convolutional Neural Networks with the residual structure for embedding and extraction. The whole deep network is trained end-to-end to conduct a blind secure watermarking. The framework is customizable for the level of robustness vs. imperceptibility. It is also adjustable for the trade-off between capacity and robustness. The proposed framework simulates various attacks as a differentiable network layer to facilitate end-to-end training. For JPEG attack, a differentiable approximation is utilized, which drastically improves the watermarking robustness to this attack. Another important characteristic of the proposed framework, which leads to improved security and robustness, is its capability to diffuse watermark information among a relatively wide area of the image. Comparative results versus recent state-of-the-art researches highlight the superiority of the proposed framework in terms of imperceptibility and robustness.
1. Introduction
ReDMark is an end-to-end blind watermarking framework designed to improve robustness and imperceptibility through learned diffusion, differentiable attack simulation, and tunable embedding strength.
- Motivation: Watermarking remains challenged by attacks, compression, transmission noise, and the trade-off between robustness and imperceptibility.These challenges affect watermarked images containing hidden data.
- Proposed framework: ReDMark uses two residual Fully Convolutional Neural Networks for embedding and extraction within an end-to-end blind watermarking system.A differentiable attack layer is included to simulate well-known attacks during training.
- Adaptive watermarking: The framework learns embedding patterns in different transform domains and adapts them to the required attacks instead of relying only on fixed transform-domain methods.Only the constructed network can embed and extract using the discovered patterns, supporting secure hiding.
- Diffusion: Diffusing watermark data across several image blocks improves robustness when meaningful image regions are corrupted or removed.The framework distributes information over a relatively wide area rather than concentrating it in a single block.
- Controllability: A strength factor controls the trade-off between watermark robustness and imperceptibility according to application requirements.The strength factor is enabled by the residual structure of the embedding network.
- Contributions: The authors identify differentiable JPEG approximation and diffusion watermarking as major contributions to attack robustness.The contribution list also includes a residual framework specialized for several attacks.
2. Related Work
Prior watermarking research spans spatial and transform domains, machine-learning-assisted procedures, and recent CNN-based end-to-end systems with different limitations.
- Transform-domain methods: Traditional watermarking embeds data by modifying pixels or selected coefficients in domains such as DCT, wavelet, Hadamard, and Contourlet.Other reported approaches use mixtures of transforms, reversible transforms, or specialized transform domains.
- Machine-learning assistance: Earlier machine-learning methods typically assist specific watermarking stages, including parameter optimization, coefficient prediction, or attack estimation.One blind method uses SVM to identify the least-distorted DCT spectral zone for extraction.
- CNN-based watermarking: CNN watermarking research includes auto-encoder feature-map methods and networks trained for embedding and extraction under attacks.These methods preceded the more relevant end-to-end HiDDeN framework.
- CNN-based watermarking: A reported limitation of one CNN approach is that it hides a one-bit watermark in a single image block.HiDDeN instead provides end-to-end training with a noise layer for attack simulation and targets color-image data hiding.
3. Proposed Watermarking Framework
ReDMark is an adaptive, end-to-end blind watermarking framework using residual FCNs for embedding and extraction, with differentiable attack simulation. Its transform-space flexibility, strength control, and diffusion across adjacent blocks target tunable robustness, imperceptibility, capacity, and security.
- Framework Overview: ReDMark uses two residual Fully Convolutional Networks trained end-to-end for blind watermarking in a desired transform space.The framework includes embedding and extraction networks and a differentiable attack module.
- Embedding Module: The embedding pipeline reshapes image blocks, applies reversible linear transforms, and computes a residual watermark mask before adding it to the cover image with strength factor α.The watermark mask is computed in the transform domain, inverse-transformed spatially, and added to the original image.
- Embedding Module: Transform layers may use a desired or learned linear transform, although the framework uses fixed transformations for proof of concept.The embedding and extraction transforms are constrained to be equivalent inverse transforms when trained.
- Embedding Module: Circular convolutions expand receptive fields so watermark information is diffused across adjacent blocks rather than confined to individual blocks.Each block receives a superposition of symbols from its own and neighboring blocks, supporting diffusion watermarking.
- Attack Layer: The differentiable attack layer keeps attacks inside end-to-end training, including noise, cropping, filtering, and an approximate JPEG process.Training with an attack guides the network toward patterns robust to that attack, while multiple attacks can be selected across iterations.
- Network Training and Evaluation Metrics: The training objective combines SSIM-based image-quality loss with binary-cross-entropy extraction loss through a weighted loss ratio.The two terms represent imperceptibility or watermark-image quality and watermark extraction rate or robustness.
4. Experimental Results
The experiments evaluate ReDMark’s configurations, training data, attack robustness, imperceptibility, and comparison with prior watermarking systems. Results examine how attack-specific training, strength control, and diffusion affect performance.
- Experimental setup: The study trains GT-Net, JT-Net, and MT-Net under Gaussian noise, JPEG, and multiple attacks, respectively.MT-Net uses salt-and-pepper noise, Gaussian noise, JPEG, and mean smoothing.
- Network configurations: The networks embed 4 × 4 watermark patterns into 32×32 training patches using 8 × 8 blocks and DCT-domain transform layers.The implementation uses fully convolutional embedding and extraction modules with circular convolutional layers and ELU activations.
- Experimental setup: Training combines CIFAR10 and Pascal VOC images converted or cropped into grayscale cover-image patches.CIFAR10 contributes 32×32 RGB images, while Pascal images provide randomly extracted 32×32 patches.
- Robustness evaluation: Robustness testing uses three levels per attack, including grid cropping that suppresses random 8 × 8 blocks throughout the image.The evaluation embeds 1024-bit watermarks in 512×512 grayscale images with four-times redundancy.
- Robustness and imperceptibility: Increasing the strength factor lowers BER for a fixed attack and network, while also reducing PSNR and SSIM.Stronger symbols improve robustness but incur the expected imperceptibility cost.
- Comparison with prior work: At matched SSIM, ReDMark outperforms Random Matching Pursuit in JPEG robustness, while retaining better PSNR.ReDMark’s BER is compared using 1024-bit watermarks on 512×512 Granada images.
- Diffusion analysis: Diffusion patterns show circular convolution scattering watermark bits across the image and avoiding the DC coefficient.GT-Net concentrates on high frequencies, JT-Net on low frequencies, and MT-Net distributes energy across low and middle frequencies.
5. Conclusion
The conclusion presents ReDMark as an adaptive, blind diffusion-watermarking framework whose learned transforms, differentiable attacks, and broad data sharing support robustness and imperceptibility.
- Framework: ReDMark uses residual Fully Convolutional Neural Networks to learn blind watermark embedding and extraction end-to-end.The framework can operate in a desired transform domain and uses tunable parameters for robustness versus imperceptibility.
- Training and attacks: Differentiable attack layers, including a JPEG approximation, facilitate end-to-end training and improve robustness to JPEG attack.Three network instances are trained under different attack strategies.
- Diffusion: Diffusing watermark data across a broad image area improves security and robustness against attacks that corrupt or remove image regions.The paper illustrates diffusion patterns and introduces attacks to test this characteristic.
- Evaluation: Comparisons with recent state-of-the-art methods report superior imperceptibility and robustness for ReDMark.
Appendix A.1. Expansion of equation (1) for DCT transform:
The appendix expands the two-dimensional DCT transform by reshaping image matrices into vectors and expressing transformed elements through a change of variables.
- DCT transform: The DCT appendix begins by defining the two-dimensional transform of an M×N image matrix.
- Vector formulation: After reshaping f and fT into vectors of length MN, it derives the θth transformed element by changing variables.
- Vector formulation: The resulting expression is then related to the kth element f(k) of the vectorized input.
Appendix A.2. Expansion of equation (1) for Hadamard transform:
The appendix defines the Hadamard transform for an N×N image block using left and right multiplication by the Hadamard matrix.
- Hadamard transform: For an N×N block f, the Hadamard transform is defined as fT = HfH, where H is the N×N Hadamard matrix.