Source-linked AI summary
Towards Blind Watermarking: Combining Invertible and Non-invertible Mechanisms
Rui Ma, Mengxi Guo, Yi Hou, Fan Yang, Yuan Li, Huizhu Jia, Xiaodong Xie
TL;DR
Blind watermarking needs both high imperceptibility and robustness to strong noise attacks. CIN combines invertible modules for symmetric, imperceptible embedding and extraction with non-invertible modules for noise-adaptive recovery, and reports strong performance under noise-free and combined attacks.
Problem
Blind watermarking remains challenging because high imperceptibility and robustness against strong noise attacks must be achieved together.
Method
CIN combines an INN-based invertible component using DEM and FSM with NIAM and NSM for asymmetric extraction under strong compression noise.
Results
The framework reports 67.66 dB PSNR with BER below 10^-4 in the Identity case, and mean PSNR 39.28 dB with accuracy 99.64% under combined noises.
Takeaways & Limitations
Experiments on COCO and DIV2K show that CIN performs better in imperceptibility and robustness.
Takeaways & Limitations
The watermark is a binary sequence of length L randomly sampled from {0, 1}^L and embedded into an RGB image.
Abstract
from arXiv · showhide
Blind watermarking provides powerful evidence for copyright protection, image authentication, and tampering identification. However, it remains a challenge to design a watermarking model with high imperceptibility and robustness against strong noise attacks. To resolve this issue, we present a framework Combining the Invertible and Non-invertible (CIN) mechanisms. The CIN is composed of the invertible part to achieve high imperceptibility and the non-invertible part to strengthen the robustness against strong noise attacks. For the invertible part, we develop a diffusion and extraction module (DEM) and a fusion and split module (FSM) to embed and extract watermarks symmetrically in an invertible way. For the non-invertible part, we introduce a non-invertible attention-based module (NIAM) and the noise-specific selection module (NSM) to solve the asymmetric extraction under a strong noise attack. Extensive experiments demonstrate that our framework outperforms the current state-of-the-art methods of imperceptibility and robustness significantly. Our framework can achieve an average of 99.99% accuracy and 67.66 dB PSNR under noise-free conditions, while 96.64% and 39.28 dB combined strong noise attacks. The code will be available in https://github.com/rmpku/CIN.
1 INTRODUCTION
Blind watermarking must balance imperceptibility with robustness to strong, including non-differentiable, noise. CIN combines invertible and non-invertible mechanisms to address these challenges through symmetric embedding/extraction and noise-adaptive decoding.
- 1 INTRODUCTION: The end-to-end framework relies on adversarial training with a differential noise layer, while bottlenecks and noisy feature removal can sacrifice imperceptibility for robustness.These limitations motivate combining invertible and non-invertible mechanisms.
- 1 INTRODUCTION: CIN combines invertible and non-invertible mechanisms to improve watermark imperceptibility and robustness against strong noise attacks.The framework uses an invertible part for imperceptibility and a non-invertible part for strong-noise robustness.
- 1 INTRODUCTION: The invertible module shares parameters between embedding and extraction, enabling inverse extraction while using an input-image-based prior to stabilize training and reduce reversibility errors.Its full posterior probability supports accurate watermark restoration, and extraction is obtained from the learned forward process.
- 1 INTRODUCTION: NIAM and NSM address asymmetric extraction under lossy compression by adapting decoding to differentiable and non-differentiable noise conditions.Differentiable noise updates the encoder through backpropagation, whereas non-differentiable noise updates only NIAM.
- 1 INTRODUCTION: The framework introduces DEM and FSM for more efficient and robust watermark embedding and extraction.These modules belong to CIN’s invertible component.
2 RELATED WORK
Deep-learning watermarking developed from encoder-decoder and adversarial approaches, while invertible neural networks emerged as normalizing-flow models for high-dimensional density modeling. Related work spans robustness improvements, compression-aware training, and applications of invertible architectures to image processing.
- 2.1 Watermarking: Deep-learning watermarking followed traditional transform-domain methods, with autoencoder CNNs and HiDDeN establishing data-driven and end-to-end blind watermarking.Subsequent methods include residual networks, adversarial training, and other learned pipelines.
- 2.1 Watermarking: Watermarking methods increasingly target robustness through adversarial training, noise-aware decoder training, and simulated or real JPEG compression.These approaches address black-box noise and compression attacks.
- 2.2 Invertible Neural Network: Invertible neural networks originated as normalizing-flow frameworks for modeling complex high-dimensional densities and later incorporated convolutional and invertible 1×1 layers.Real NVP and invertible 1×1 convolutions became frequently used structures in image tasks.
- 2.2 Invertible Neural Network: Invertible architectures have been extended with attention and masked convolutions and applied to image and video super-resolution.Their flexibility and effectiveness motivate use beyond density estimation.
3 METHOD
CIN combines invertible and non-invertible components to embed watermarks with high imperceptibility while improving robustness to complex noise. Its architecture uses DEM, IM, FSM, NIAM, NSM, noise training, and multi-part losses.
- Diffusion and Extraction Module: DEM replicates and expands the binary watermark through fully connected branches, reshaping, transpose convolution, concatenation, and Haar transformation to match image dimensions.During extraction, the inverse DEM is used and average pooling replaces the embedding-time copy operation.
- Invertible Module: The invertible module uses an affine coupling layer whose forward and backward bijection implement watermark embedding and extraction with shared parameters.The image and watermark are the two inputs, and the coupling functions use exponential scaling, arbitrary transformations, and Hadamard products.
- Fusion and Split Module: FSM discards the image portion of the invertible output, scales the mapped watermark by strength factor S, and adds it to the input image to form the watermarked image.This fusion strategy differs from averaging corresponding output channels and is designed to trade off imperceptibility and robustness.
- Overall Architecture: CIN combines an invertible module for watermark embedding and extraction with an additional decoder that improves robustness against complex or lossy-compression noise.The invertible branch provides the main symmetric mapping, while the non-invertible branch addresses asymmetric extraction under difficult attacks.
- Noise Pool: The noise pool trains CIN with differentiable and non-differentiable compression and common image distortions, updating both branches for differentiable attacks but only NIAM for non-differentiable noise.NSM uses a CNN-based discriminator to select between the invertible and NIAM watermark outputs for JPEG versus other attacks.
- Training Objective: CIN optimizes L2 losses for the watermarked image, restored watermark, and restored image, weighted by separate coefficients in the total objective.The restored-image constraint applies when the identity noise layer is used.
4 EXPERIMENTS
Experiments evaluate CIN across datasets, noise conditions, baselines, and ablations, showing strong imperceptibility and robustness. The framework generally outperforms competing methods and benefits from combining invertible and non-invertible modules.
- Robustness and Imperceptibility: 99.64% accuracy and 39.28 dB PSNR are achieved under combined noise, while specific-noise testing reaches 99.78% accuracy and 54.76 dB average PSNR.In the identity case, PSNR reaches 67.66 dB with BER below 10^-4.
- Comparison with State of the Art: CIN achieves higher PSNR and the best robustness than the compared methods under combined noise on COCO.The comparison uses message length 30 and adjusts PSNR to 38.51 dB by a strength factor.
- Comparison with State of the Art: Across 12 noise types, CIN achieves optimal robustness and substantially higher PSNR than other methods at watermark length 30.The evaluation compares models trained and tested under the same watermark length.
- Comparison with State of the Art: At watermark length 30, CIN improves PSNR over the reference method and lowers BER; at length 64, it is more robust to cropping than MBRS.The study reports excellent robustness and imperceptibility relative to MBRS.
- JPEG Robustness: Compared with MBRS, CIN has higher PSNR and SSIM at lower BER, including significantly lower BER under JPEG quality factor Q=10.CIN also has noticeably higher SSIM at strength factor 1.4.
- Ablation Study: Ablations show that adding DEM and FSM improves watermark accuracy by 7.2% and PSNR by 2.38%, while NIAM and NSM add a further 16.9% accuracy against real JPEG.The invertible-only model has 77.49% accuracy against real JPEG and cannot flexibly adjust watermark intensity.
5 CONCLUSIONS
The paper concludes that CIN jointly uses invertible and non-invertible mechanisms to improve watermark imperceptibility and robustness. Experiments on COCO and DIV2K report better performance on both dimensions.
- Conclusion: CIN learns a joint embedding–extraction representation that improves imperceptibility against traditional noise.The framework combines an invertible mechanism with modules designed for robustness to non-differentiable lossy compression noise.
- Conclusion: CIN uses NIAM for non-additive quantization noise, DEM for robust watermark embedding and extraction, and NSM to select suitable decoders.These components address different parts of the combined watermarking problem.
- Conclusion: Experiments on COCO and DIV2K show better imperceptibility and robustness than the compared methods.