Source-linked AI summary
ADD for Multi-Bit Image Watermarking
An Luo, Jie Ding
TL;DR
Reliable multi-bit watermarking is needed to support image authenticity and provenance, but existing methods have limitations in resilience, capacity, and theoretical justification. ADD learns an additive watermark and decodes messages through inner products, while providing a geometric analysis of why this works. On MS-COCO, it achieves near-perfect decoding under common distortions, competitive visual quality, and faster embedding and decoding than competing methods.
Problem
Existing multi-bit image watermarking methods have limitations in resilience to distortions, capacity, and theoretical justification, constraining reliable authenticity and provenance verification.
Method
ADD learns an additive watermark weighted by the message and decodes the message using inner products with the stored watermark, supported by theoretical analysis.
Results
On MS-COCO, ADD achieves near-perfect decoding under common distortions while maintaining competitive visual quality and substantially faster embedding and decoding than competing methods.
Takeaways & Limitations
ADD combines high decoding reliability, competitive visual quality, computational efficiency, and a theoretical explanation in a multi-bit watermarking method.
Takeaways & Limitations
Classical and neural watermarking methods remain constrained by intensive distortions, low capacity, limited theory, or dependence on particular model architectures and post-hoc settings.
Abstract
from arXiv · showhide
As generative models enable rapid creation of high-fidelity images, societal concerns about misinformation and authenticity have intensified. A promising remedy is multi-bit image watermarking, which embeds a multi-bit message into an image so that a verifier can later detect whether the image is generated by someone and further identify the source by decoding the embedded message. Existing approaches often fall short in capacity, resilience to common image distortions, and theoretical justification. To address these limitations, we propose ADD (Add, Dot, Decode), a multi-bit image watermarking method with two stages: learning a watermark to be linearly combined with the multi-bit message and added to the image, and decoding through inner products between the watermarked image and the learned watermark. On the standard MS-COCO benchmark, we demonstrate that for the challenging task of 48-bit watermarking, ADD achieves 100\% decoding accuracy, with performance dropping by at most 2\% under a wide range of image distortions, substantially smaller than the 14\% average drop of state-of-the-art methods. In addition, ADD achieves substantial computational gains, with 2-fold faster embedding and 7.4-fold faster decoding than the fastest existing method. We further provide a theoretical analysis explaining why the learned watermark and the corresponding decoding rule are effective.
1 Introduction
Multi-bit watermarking supports image provenance by embedding richer messages, but existing methods face capacity, distortion-resilience, theoretical, and computational limitations. ADD addresses these gaps with additive message encoding, inner-product decoding, and a geometric theoretical analysis.
- Multi-bit watermarking carries richer provenance information than single-bit watermarking, including owner identifiers, fingerprints, timestamps, and IP addresses.
- Higher message capacity makes it harder to preserve watermark invisibility while reliably recovering messages after common image distortions.
- Existing methods remain limited by distortion resilience, capacity of no more than 32 bits, and limited theoretical guidance.
- ADD learns a watermark whose message-weighted linear combination is added to the image, then decodes bits through inner products with the learned watermark.
- Under a low-dimensional image-subspace and Gaussian-noise assumption, ADD learns mutually orthogonal bit components orthogonal to the image subspace.
- ADD derives likelihood-based detection and decoding rules with performance guarantees, and reports state-of-the-art resilience, image quality, and computational speed.The analysis also states that finite-sample learned watermarks asymptotically recover the geometric and performance properties of the population solution.
2 Problem Formulation of Watermarking
The paper formulates multi-bit watermarking as detecting whether an image is watermarked and recovering its embedded identifier, even after common distortions. A successful mechanism must balance visual quality, identifiability, and resilience.
- Applications: Multi-bit watermarking embeds an identifier that can support both watermark detection and source or user attribution.The paper describes provider, artist, and multi-entity settings in which decoded messages identify the issuing source or user.
- Verification: Verification comprises watermark detection followed by message decoding from the observed image, which may have undergone compression, cropping, or other distortions.Detection is posed as a hypothesis test between unwatermarked images and images watermarked by W, while decoding recovers the embedded bits.
- Design objectives: The watermarking mechanism should preserve image quality, distinguish watermarked from unwatermarked images, recover messages accurately, and resist common distortions.These are stated as the objectives of quality, identifiability, and resilience.
- Evaluation criterion: Bit accuracy is used as the decoding metric because it is standard, supports comparison with prior work, and is more informative than perfect-message recovery as K grows.Perfect decoding becomes increasingly stringent because one incorrect bit makes the entire message incorrect.
3 Add, Dot, Decode (ADD)
ADD learns watermarks that are linearly combined with message bits and added to images, then uses inner products for detection and bit decoding. Its training simulates distortions while balancing quality, identifiability, and resilience.
- 3.1 Overview: ADD first learns K watermark vectors and embeds a message by adding the message-weighted sum of those vectors to the image.The deployment rule is x̃ = x + Σ_k m_k w_k.
- 3.3 Deployment: ADD computes Γ_k = ⟨w_k, x⟩, aggregates |Γ_k| for detection, and uses sign(Γ_k) to decode each bit.When a message dictionary is available, maximum inner-product statistics can improve detection and decoding.
- 3.2 Training: Training jointly targets quality, identifiability, and resilience by using margin-based decoding losses, distortion simulation, and watermark-magnitude regularization.Random message bits and distortion operators are incorporated into the population objective, with β controlling regularization.
- 3.2 Training: For K > 1, ADD treats each bit as a separate binary classification problem because decoding applies sign(⟨w_k, x⟩) independently.The K = 1 construction motivates the multi-bit objective and decoder.
- 3.2 Training: The finite-sample objective uses training images and Monte Carlo samples of messages and distortions, while implementation learns watermark maps through a lower-dimensional parameterization.A frozen feature extractor feeds trainable maps; their dataset-level averaged outputs become fixed deployment watermarks.
- 3.3 Deployment: ADD freezes the trained watermark maps and averages their outputs across training images to construct fixed watermarks for deployment.Deployment then uses these learned fixed vectors for embedding, detection, and decoding.
4 Theoretical Analysis
The theoretical analysis models images near a low-dimensional subspace and shows that learned watermarks become orthogonal or nearly orthogonal to it. These geometric properties support principled hypothesis tests and inner-product decoding rules, with finite-sample behavior approaching the population analysis.
- 4.1 Theoretical setup: The analysis assumes image data follow a perturbed low-dimensional Gaussian model whose signal lies in a subspace U.The model defines U from a full-column-rank matrix and includes independent Gaussian perturbation with noise level σϵ.
- 4.1 Population objective: The learned population watermark exists under the stated assumptions and is orthogonal to the image subspace U, with mutually orthogonal components of equal positive norm.Theorem 1 establishes existence and the geometric properties of the population minimizer.
- 4.1 Objective conditions: The population objective has a unique but trivial zero minimizer when β > K · L, motivating the practical condition β < K · L.The same trivial-minimizer issue is reported for the finite-sample objective.
- 4.1 Finite-sample objective: Finite-sample minimizers exist and, with high probability, inherit the population watermark geometry up to errors controlled by εn(δ).The finite-sample results include near-orthogonality to U and mutual near-orthogonality under the stated uniform-convergence condition.
- 4.2 Detection and decoding: The decoder forms inner products Γk = ⟨wk, x⟩ and uses likelihood-based tests, including sign decoding or dictionary-constrained maximization.For a known message dictionary D, decoding selects arg maxm∈D ⟨m, Γ⟩.
- 4.2 Detection and decoding: For finite-sample watermarks, the detection statistics and bit accuracy converge to their oracle counterparts, while dictionary decoding can improve accuracy when the dictionary size is sufficiently controlled.The analysis states that |D| can grow exponentially in K when dmin ≍ K while still ensuring higher expected bit accuracy than decoding without D.
5 Experiments
Experiments evaluate ADD on MS-COCO for 48-bit watermarking across decoding, detection, computational efficiency, cross-dataset generalization, and hyperparameter trade-offs. ADD maintains strong decoding and image quality under distortions, improves runtime, generalizes without retraining, and exposes quality–accuracy trade-offs governed by β and n.
- 5.1 Competitive performance of ADD: ADD achieves the best bit accuracy under all distortion settings while preserving comparable PSNR and visual fidelity to competing methods.The qualitative comparison evaluates all methods on the same image and reports PSNR values.
- 5.1 Competitive performance of ADD: ADD achieves the strongest overall detection performance across distortions, both without a message dictionary and, more strongly, with one.The reported comparison uses average AUROC across distortions; competing methods require a dictionary for detection in this evaluation.
- 5.2 Computational advantage of ADD: 2× faster embedding and 7.4× faster decoding are achieved by ADD than by competing methods.Embedding uses linear watermark addition, while decoding uses inner products, unlike the more sophisticated computations or neural processing used by competing approaches.
- 5.3 Generalizability to other datasets: ≥99.27% bit accuracy and AUROC ≥0.9893 are maintained across multiple unseen datasets when the watermark is trained only on MS-COCO.The cross-dataset evaluation includes ImageNet, CIFAR-10, and CIFAR-100 without retraining; CIFAR PSNR is higher after up-sampling from 32 × 32 to 256 × 256.
6 Conclusion
ADD is a multi-bit watermarking method that combines additive embedding, inner-product decoding, and theoretical analysis. On MS-COCO, it achieves near-perfect decoding under common distortions, competitive visual quality, faster computation, and finite-sample guarantees, while identifying limitations for broader deployment.
- Method: ADD learns an additive watermark, embeds a K-bit message by linear combination, and detects or decodes it using inner products with the stored watermark.The method is designed around a simple embedding and decoding structure.
- Empirical results: On MS-COCO, ADD achieves near-perfect decoding under common distortions while maintaining competitive visual quality.The conclusion reports both robustness and visual-quality performance.
- Empirical results: ADD outperforms competing methods and offers substantially faster embedding and decoding because of its simple structure.The passage attributes the computational advantage to ADD's simple structure.
- Theory: Under a low-dimensional image-subspace model, the population objective yields watermarks orthogonal to the image subspace and mutually orthogonal.This geometric structure supports a generalized likelihood ratio test and a corresponding decoding rule.
- Theory: For finite-sample watermarks, false-positive rates, true-positive rates, and bit accuracy converge to their population counterparts as training-sample size grows.The convergence result covers the derived detection and decoding rules.
- Limitations and future work: Future work includes extending ADD to video, audio, and text and addressing the assumption that images use only one watermarking mechanism.Multiple mechanisms would require centralized allocation and verification of messages.
Use of Generative AI Tools
The authors used several generative AI tools during manuscript preparation for language improvement, figure design, coding assistance, and programming support. They state that these tools were used to improve clarity, assist programming, and support figure preparation, while the authors reviewed and edited all outputs.
- Tool use: The authors used ChatGPT-5.2 and AgentLab for language improvement and figure design, and Claude Opus 4.6 for coding assistance.
- Tool use: These tools supported writing clarity, programming, and figure preparation rather than serving as substitutes for the authors' review.
- Author responsibility: The authors reviewed and edited all outputs and take full responsibility for the manuscript's content.