Source-linked AI summary
Distortion Agnostic Deep Watermarking
Xiyang Luo, Ruohan Zhan, Huiwen Chang, Feng Yang, Peyman Milanfar
TL;DR
Deep watermarking must remain imperceptible and robust when test-time distortions are unknown, non-differentiable, or absent from training. The paper avoids explicit distortion modeling by combining CNN-based adversarial training with channel coding. It reports comparable performance on known distortions and better generalization to unknown distortions.
Problem
Explicitly modeling training distortions can cause poor generalization, while practical watermarking must handle unknown and potentially non-differentiable distortions.
Method
The framework combines differentiable adversarial training with CNN-generated perturbations and channel coding that adds redundancy to the encoded message.
Results
The model achieves comparable performance on distortions seen during training and better generalization to unseen distortions than explicit-distortion models.
Takeaways & Limitations
Robust watermarking can be trained without explicitly modeling the image distortions applied at test time.
Takeaways & Limitations
The channel-coding component approximates unknown watermarking errors with a binary symmetric channel whose independent random bit-flip assumption is not strictly satisfied.
Abstract
from arXiv · showhide
Watermarking is the process of embedding information into an image that can survive under distortions, while requiring the encoded image to have little or no perceptual difference from the original image. Recently, deep learning-based methods achieved impressive results in both visual quality and message payload under a wide variety of image distortions. However, these methods all require differentiable models for the image distortions at training time, and may generalize poorly to unknown distortions. This is undesirable since the types of distortions applied to watermarked images are usually unknown and non-differentiable. In this paper, we propose a new framework for distortion-agnostic watermarking, where the image distortion is not explicitly modeled during training. Instead, the robustness of our system comes from two sources: adversarial training and channel coding. Compared to training on a fixed set of distortions and noise levels, our method achieves comparable or better results on distortions available during training, and better performance on unknown distortions.
1. Introduction
Deep watermarking must preserve visual imperceptibility while reliably carrying messages through diverse image distortions. The paper proposes distortion-agnostic robustness using adversarial training and channel coding, with comparable known-distortion performance and better generalization to unknown distortions.
- Motivation: Deep watermarking balances imperceptibility with message robustness under distortions such as cropping, blurring, and JPEG compression.A good encoded image remains nearly identical to its original while preserving the embedded payload.
- Problem: Training on specific distortions can overfit and generalize poorly to other distortion types.Combining distortions requires tuning their types and magnitudes, while performance may still degrade on distant test distortions.
- Approach: The proposed framework avoids prior knowledge of test distortions by combining CNN-generated adversarial perturbations with channel coding.Channel coding injects redundancy into the encoded message, while adversarial training supplies distortion-agnostic robustness.
- Results: Comparable performance is achieved on known distortions, with better generalization to unknown distortions than explicit-distortion training.The comparison concerns models trained with explicit image distortions and evaluates both known and held-out distortion types.
2. Related Work
Prior work established deep end-to-end watermarking, adaptive attacks, adversarial training, and channel coding, but the proposed method differs by generating attacks with a trained CNN rather than a fixed distortion pool.
- Watermarking: Deep learning extended image watermarking to end-to-end systems, while later work broadened applications to video, audio, and complex image distortions.HiDDeN was an early deep learning framework, and other methods introduced residual connections or modeled richer distortions.
- Adversarial training: Prior attack-based watermarking methods used iterative attacks, fixed random distortion combinations, or adaptively selected distortion types and strengths.The cited methods differ in whether their attacks adapt to the watermarking model and whether training remains end-to-end differentiable.
- Distinction: The proposed method generates attacks from a trained CNN instead of a fixed pool of common distortions.This preserves end-to-end differentiability and produces a richer set of image manipulations than the compared approach.
- Channel coding: Channel coding detects and corrects transmission errors, with classical codes and learning-based solutions approaching noisy-channel limits.In this paper, channel coding supplies redundancy to improve watermark robustness.
3. Proposed Method
The framework avoids explicitly modeling unknown image distortions by combining CNN-based adversarial training with channel coding. Adversarial examples diversify distortions, while redundant messages add error-correction robustness to the watermarking pipeline.
- Adversarial training: The method replaces fixed distortion models with adversarial examples generated by a CNN trained to maximize message loss.The CNN-generated distortions can form diverse, complex combinations and co-adapt with watermarking training.
- Channel coding: Channel coding replaces the input message with a longer redundant binary message that supports recovery after channel distortion.The channel encoder maps X of length D to X′ of length N > D before watermark embedding; the decoder recovers X from the corrupted code.
- Adversarial training: The adversarial objective minimizes message loss under CNN-generated perturbations constrained by an image-distance budget.The relaxed min-max formulation restricts perturbations to outputs of Gadv, while the L2 norm constrains their deviation from the encoded image.
- Channel coding: The channel model uses BSC noise as an approximation and NECST to handle varying distortion strengths without requiring a noise estimate at decoding.BSC independently flips bits with probability p, and NECST is trained with uniformly sampled noise strengths.
- Training: The channel coding model is trained separately from the watermarking model to prevent co-adaptation and overfitting across image distortions.Watermarking training alternates attack-network and encoder-decoder updates, while image quality uses L2 and GAN losses.
- Training: The overall watermarking loss combines image, message, and adversarial terms, with alternating optimization of the attack and watermarking networks.Algorithm 1 updates Gadv, Fenc, and Fdec using Adam during alternating training.
4. Experiments
Experiments compare the proposed model with HiDDeN baselines on known and unknown distortions, bit accuracy, and encoded-image quality. The model matches or exceeds combined-distortion performance in several settings while improving robustness to unknown distortions and reducing artifacts in flat regions.
- Experimental setup: The experiments compare the proposed model with HiDDeN identity and combined-distortion baselines using bit accuracy and PSNR on MS COCO images.The combined baseline uses JPEG, dropout, crop, and Gaussian blur distortions.
- Known distortions: Specialized models show poor cross-distortion generalization, whereas the combined and adversarially trained models remain robust to distortions used during combined-model training.The specialized models exhibit a diagonal accuracy pattern across distortion types.
- Known distortions: On crop and dropout, the proposed model reaches comparable performance; it outperforms the combined model on JPEG but underperforms on Gaussian blur.Across small distortion strengths, its accuracy is nearly identical to the combined model, and it exceeds the identity model across all tested noise levels and distortion types.
- Visual quality: The proposed model is less prone to small artifacts in flat image regions than the compared model.The qualitative comparison is presented in Figure 11.
- Unknown distortions: On additional unknown distortions, the proposed model performs better overall, especially for color change, with lower variance in bit accuracy across distortions.The identity and combined models become closer on these unknown distortions, indicating that combined training does not eliminate generalization issues.
- Ablation study: Adversarial training supplies most of the robustness, while channel coding further increases accuracy when combined with a robust watermarking model.Channel coding alone does not provide enough robustness without a robust watermarking model.
- Attack-network analysis: Increasing attack-network complexity decreases adversarial-example bit accuracy and slightly degrades final results; capped networks perform poorly on JPEG and Gaussian blur.Residual networks perform similarly to regular convolutional networks, while FGSM performs poorly across distortions because the image networks overfit to that distortion.
5. Conclusion
The paper concludes that distortion-agnostic watermarking can avoid explicit distortion modeling during training by combining adversarial training with channel coding. Empirical evaluations report comparable performance on seen distortions and better generalization to unseen distortions.
- Conclusion: The proposed watermarking method does not explicitly model image distortions during training and uses adversarial training plus channel coding for robustness.These are identified as the method’s two core components.
- Conclusion: Empirical evaluations show comparable performance to the combined-distortion model on seen distortions and better generalization to unseen distortions.The paper states that future work will seek greater robustness and deeper connections between watermarking and adversarial attacks.
6. Appendix
The appendix lists training hyperparameters, architecture details, channel-model settings, and qualitative examples for the proposed and baseline watermarking systems.
- Training details: The appendix lists the hyperparameters used for training the watermarking model.The supplied appendix text includes settings for loss weights and training iterations.
- Architecture: The proposed model uses a message size of 120 instead of 30 because of the added channel-coding layer, while retaining the HiDDeN network architecture.The architecture begins with four 3 × 3 Conv-BN-ReLU blocks and spatially repeats the input message.
- Training details: The proposed and combined models warm-start from a pretrained HiDDeN identity model, stop at 250k iterations, and use ADAM with learning rate 1e-3.These settings are reported for both models.
- Channel model: The channel model uses two fully connected layers with 512 units each and trains with BSC noise sampled uniformly from [0, 0.3].The channel model is described separately from the watermarking network.
- Qualitative examples: Figures 10 and 11 show encoded-image samples from HiDDeN and the proposed model, while Figure 12 shows adversarial examples generated by the attack network.These figures provide qualitative examples rather than quantitative measurements.