PaperlayerView exact revision on arXiv

Source-linked AI summary

What Limits Robustness in Deep Image Watermarking: An Analysis of Mechanisms and Their Scaling Across Capacities

Marta Bistroń, Zbigniew Piotrowski

arXiv:2609.01050v1cs.CR

TL;DR

Deep image watermarking lacks a clear account of whether rising payload capacity itself limits robustness or exposes limits caused by other mechanisms. This paper systematizes distortion classes and robustness strategies, then measures three mechanisms across capacity. It finds that the limits follow distortion class rather than capacity alone, and that harder extraction-side training cannot remove mechanisms arising before extraction.

  • Problem

    Reliable recovery under content transformations remains an open problem, and the paper asks whether capacity itself limits robustness or only makes other limits visible.

  • Method

    The paper organizes distortions by payload capacity and robustness strategies by differentiability, then evaluates three limiting mechanisms in spatial-block-grid schemes with separately trained extraction.

  • Results

    The measured limits follow distortion class rather than capacity itself, while codec-targeted extraction training degrades reading and does not remove mechanisms arising before extraction.

  • Takeaways & Limitations

    The conclusions apply to classes of designs using spatial payload indexing, separately trained extraction, or post-training scaling of embedding strength, and the protocol makes generalization claims checkable.

  • Takeaways & Limitations

    Measurements use a single 256 by 256 resolution, one embedding-architecture family, and codecs in one default configuration; absolute codec figures may change under other settings.

Abstract

from arXiv · show

Robustness remains the principal open problem in deep image watermarking, and what limits it becomes sharper as payload grows. This paper asks whether capacity is itself the limit or only makes other limits visible, and answers in two parts. The first organizes the distortions a watermark must survive and the strategies developed to resist them, ordering each by the axis that governs it: payload capacity for the distortions, differentiability for the strategies. The second identifies and measures three mechanisms that limit robustness in schemes mapping the payload onto a spatial block grid with extraction trained separately from a frozen embedder: desynchronization of the payload grid, the resistance of codec-induced distortion to training, and the narrowing of the usable embedding-strength window. Payloads from 64 to 16384 bits are measured, well beyond the range those strategies address. Training the extraction stage against a codec proves not merely ineffective but harmful, degrading the reading at the operating points used in training. The limits follow the class of distortion rather than capacity itself, and none is removed by further training on the extraction side, because all three arise before extraction. An evaluation protocol making claims of generalization verifiable is also contributed. The conclusions are properties of a class of designs rather than of one implementation.

I. INTRODUCTION

Deep image watermarking must recover embedded information after routine processing and increasingly hostile transformations. The paper organizes distortion classes and robustness strategies, then examines how their limits scale with payload capacity.

  • Reliable recovery under content transformations remains the principal open problem in digital watermarking.
  • Higher capacity reduces the image area carrying each payload element, narrowing the extraction margin.
  • The paper organizes distortions by payload capacity and robustness strategies by differentiability.
  • Watermark distortions arise from unavoidable processing as well as deliberate attacks, creating distinct threat models.
  • Signal-processing attacks alter pixel intensities while preserving spatial structure, including compression, filtering, and noise.
  • Lossy compression and low-pass filtering suppress low-amplitude high-frequency content, forcing robustness gains toward greater embedding strength.

B. GEOMETRIC ATTACKS

Geometric attacks primarily displace the spatial reference used for extraction rather than weakening watermark amplitude. Their difficulty is therefore governed by synchronization and payload block geometry.

  • Geometric attacks modify spatial structure through cropping, resizing, rotation, scaling, and translation.
  • Reliable recovery under geometric distortion becomes a synchronization problem because the watermark reference is displaced.
  • Cropping and resizing are especially important because image editing, reposting, and display adaptation commonly introduce them.
  • Zero-bit structured-pattern schemes report strong geometric resistance, but their construction bounds payload capacity.
  • Hybrid video codecs combine prediction, transforms, quantization, entropy coding, and reconstruction filters, making their distortion difficult to reproduce during training.
  • JPEG and hybrid video codecs share transform-block quantization and high-frequency loss, despite differing in block size, transforms, and prediction.

D. ATTACKS BASED ON ARTIFICIAL INTELLIGENCE

AI-based attacks regenerate or modify image content while preserving perceptual quality, threatening the carrier itself rather than merely its amplitude or spatial alignment. The paper contrasts this class with conventional distortion-focused robustness strategies.

  • AI-based attacks include diffusion editing, inpainting, content regeneration, style transfer, watermark removal, and adversarial perturbations.
  • A regenerated image is a different carrier that preserves original semantics, so signal-processing robustness is not the appropriate notion.
  • Regeneration severity increases with the quality of the underlying generative prior, unlike distortions bounded by a fixed operation.
  • The payload-grid design makes capacity govern three distortion classes, while the fourth class is affected differently.
  • The classical watermarking trade-off involves payload, imperceptibility, and robustness, with carried signal determined by amplitude multiplied by area.
  • Robustness strategies progress from simulated attacks and learned distortion models to decoupled training and invariant-representation learning.

B. LEARNED DISTORTION MODELS AND CODEC

Learned distortion models improve fidelity over simple attack simulation but retain a differentiable surrogate for encoder updates. Decoupled training instead freezes the embedder and fine-tunes extraction on real distortions.

  • Learned distortion models: Noise-layer training improves robustness by simulating expected distortions with differentiable approximations during end-to-end optimization.
  • Learned distortion models: Actual compression channels make training more realistic but increase complexity and require access to the target processing chain.
  • Learned distortion models: MBRS randomly selects real compression, simulated compression, or an identity path across mini-batches.
  • Learned distortion models: In MBRS, only the simulated path supplies gradients to the encoder, so fidelity is traded for differentiability.
  • Decoupled training: Decoupled training jointly optimizes encoder and decoder first, then freezes the encoder and fine-tunes the decoder on distorted images.
  • Decoupled training: Removing the distortion from the encoder’s gradient path allows real JPEG, video codecs, and other analytically inexpressible operations during decoder training.
  • Decoupled training: Decoupling can yield a locally optimal solution because the frozen encoder never adapts spatial embedding to the distortion.
  • Decoupled training: Video Seal and StyleMark use decoupling as a second phase after joint training rather than as a replacement for it.

D. INVARIANT-DOMAIN LEARNING

Invariant-domain learning seeks robustness by making representations stable across distortions, then decodes the message either directly or through reconstructed images. It differs from fixed-pattern invariance by learning invariance without a geometry-imposed payload bound, but remains preliminary and subject to generalization limits.

  • Invariant-domain learning: Triplet-based training pulls representations of a stego image and its distorted version together while separating unrelated images.The anchor is the stego image, the positive is its distorted version, and the negative is unrelated content.
  • Extraction strategies: Figure 4 contrasts direct message decoding from the invariant representation with decoding it through an image-domain reconstruction and conventional extractor.
  • Invariant-domain learning: Learned invariance is not constrained by the geometry of a fixed pattern, whereas constructed invariance offers bounded payload capacity without training.The two approaches are complementary and fail in different ways.
  • Training strategy: Invariant-domain learning decouples representation-level training from the embedding stage and can choose distortions for potential generalization beyond observed transformations.
  • Scope: The approach is the youngest robustness category, and its results are preliminary enough to require caution when assessing its maturity.
  • Differentiability criterion: Robustness strategies differ in whether distortion models must be differentiable, determining which degradation channels can enter training.

IV. EVALUATION PROTOCOL

The evaluation isolates payload capacity and block geometry while holding the model and training procedure fixed, then measures transparency and robustness at reproducible operating points. It also separates the frozen embedder from the extractor to study decoupled robustness training.

  • Design class: The studied class uses a spatial block-grid payload, a convolutional embedder, and an extractor robustness stage separated from a frozen embedder.
  • Payload mapping: Capacity changes block area while architecture, training data, and training procedure remain identical across four variants.On 256 by 256 covers, the blocks are 32, 16, 8 and 2 pixels per side for the examined capacities.
  • Training setup: All variants are trained only for clean-image embedding and recovery, without robustness objectives or simulated attacks.
  • Payload mapping: A 4096-bit control carries four bits per block in grey level on the same 8-pixel grid as the 1024-bit variant, separating capacity from block size.
  • Operating points: Transparency falls by three decibels across a 256-fold payload increase, measured using PSNR, SSIM and LPIPS on clean watermarked images.
  • Attack suite: The protocol uses thirty-two explicitly parameterized attack points, enabling exact reproduction and comparison with anchored literature operating points.

B. ATTACKS AND THEIR OPERATING POINTS

The protocol makes robustness claims testable by distinguishing held-out distortions from parameter extrapolation within trained classes and by reporting measured rather than nominal severity. Because the variants use no distortion during training, all attack results measure genuine generalization.

  • Operating points: Compression uses real JPEG, H.264 and H.265 encoders because no protocol operation lies on a gradient path and requires a differentiable substitute.
  • Training status: A two-valued train/test split can falsely call parameter changes within one distortion class generalization, so the claim and evidence may not match.
  • Training status: Each attack is labeled as excluded from training, within the trained parameter range, or outside that range within a seen class.The third category exposes a distinction hidden by binary reporting.
  • Training status: All thirty-two attacks are genuinely held out for the Section V variants, which were trained without any distortion.Their reported error rates therefore measure generalization to unseen distortions.
  • Measured severity: Measured severity accompanies each error rate because nominal settings vary with implementation, image content and codec rate control.

D. REPRODUCIBILITY AND TEST SETS

For spatially indexed payloads, geometric displacement breaks writing–reading correspondence rather than merely weakening signal strength, and this limit worsens as blocks shrink. Controlled comparisons show that block geometry, not payload count alone, governs the scaling, while extractor training cannot repair pre-extraction misalignment.

  • Reproducibility: The experiments use paired, reproducible attacks on BSDS300 and COCO, whose error rates differ by only 0.0046 on average and 0.032 at most.
  • Desynchronization: A grid-displacing attack can be more damaging than a much stronger grid-preserving attack; across thirty-one attacks, severity and damage have rank correlation −0.06.Matched pairs differ by factors exceeding four thousand and twenty-two despite nearly equal measured severity.
  • Desynchronization: Removing one fifth of the image produces error rates 0.0896, 0.0956, 0.0973 and 0.1016 across capacities, matching the expected 0.10 without spillover.
  • Scaling with block size: Rotation error rises from 0.221 to 0.500 and crop error from 0.183 to 0.499 as block size shrinks from 32 to 2 pixels.At 2-pixel blocks, a rotation tolerated at 32 pixels becomes indistinguishable from guessing.
  • Capacity versus geometry: At constant 8-pixel block size, quadrupling payload changes rotation from 0.4907 to 0.4979 and crop from 0.4609 to 0.4883, whereas shrinking blocks drives rotation from 0.221 to 0.491.
  • Limitations: The constant-block comparison is limited by a weaker 4096-bit baseline and saturation near chance, but supports block geometry as the governing quantity.The 4096-bit control reaches 0.0278 on clean images versus 0.0001 to 0.0006 for the other variants.
  • Extractor training: Geometric fine-tuning improves a 5-degree rotation error only from 0.0212 to 0.0184 and fails to confer tolerance even within the training range.At 30 degrees, all three extractors read at chance.
  • Cross-class trade-offs: Photometric fine-tuning harms mild geometric attacks, with regressions of 0.135 for rescaling to 0.9 and 0.015 for a crop retaining four fifths.It also raises contrast-doubling error from 0.0777 to 0.0940 and transfers only partly to blur.

B. COMPRESSION AS A TRAINING TARGET

The experiment tests whether separately training extraction against compression improves robustness when the watermark encoder is frozen. Compression training instead harms codec performance even at the most favorable, lowest-capacity setting.

  • Training setup: Separate extraction training permits a real codec to be included directly, unlike single-stage designs requiring a differentiable substitute.The distortion enters the extraction stage rather than lying on the encoder’s gradient path.
  • Training setup: The comparison uses four extractors reading identical images from one frozen encoder, with three fine-tuned under matched settings but different distortion profiles.All fine-tuned extractors share a photometric core; the experiment isolates the effect of compression training.
  • Scope and implication: The failure occurs at 64 bits, the most favorable capacity with the widest blocks and reading margins; compression damage rises from 0.3503 at 64 bits to 0.4913 at 16384 bits.Because the hypothesis fails in the least damaging regime, the passage states that harder regimes also fail.
  • Compression results: 86 percent: codec-trained extraction raises the error rate from 0.1091 to 0.2033 at rate factor 16 versus the unseen-codec base extractor.The codec-trained extractor loses at all three tested rate factors, while the JPEG-trained extractor reaches 0.3953 at quality 75.
  • Compression results: Two orders of magnitude: photometric fine-tuning improves Gaussian-blur error from 0.0164 to 0.0001, showing the extractor can learn relevant robustness.On unseen salt-and-pepper noise, the same extractor improves from 0.4047 to 0.0751, a fivefold reduction through generalization.
  • Compression results: Compression training is harmful beyond codec evaluation: codec and JPEG extractors reach salt-and-pepper errors of 0.4798 and 0.4465, worse than the base extractor.The result turns failure to learn compression into a measurable cost on another attack class.
  • Scope and implication: Robustness to codecs must therefore be acquired in embedding rather than extraction, bringing back the need for a differentiable codec model.The measured trade-off also connects codec survival with visibility allocation rather than transparency optimization alone.

C. THE USABLE EMBEDDING-STRENGTH WINDOW

The usable embedding-strength window is bounded below by readability and above by visibility and pixel clipping, and it narrows sharply as payload capacity increases.

  • Window mechanism: Embedding strength has a usable window because weak signals become unreadable, while strong signals become visible and eventually clip at valid pixel bounds.Strength can be scaled after training without retraining or changing the extractor.
  • Window mechanism: The error rate rises on both sides of the trained embedding-strength value, so failure results from excessive as well as insufficient embedding.This non-monotonic response distinguishes the mechanism from a simple threshold.
  • Capacity scaling: At factors 0.75, 1.25, and 1.5, the same displacement from the trained value costs one to two orders of magnitude more at 16384 bits than at 64 bits.At extreme factors 0.5 and 2.0, the payload is unreadable at every capacity.
  • Capacity scaling: Using an error-rate threshold of 0.001, usable settings fall from three at 64 bits to one at 16384 bits.The highest-capacity payload has only the trained setting below the threshold; the count depends on the threshold and six-point grid.
  • Trade-off: At 64 bits, increasing the factor from 1.0 to 1.5 costs 3.5 dB while reducing JPEG quality-90 error from 0.1113 to 0.0803.The same change also reduces error under JPEG quality 75 and H.264 constant rate factor 23.
  • Trade-off: A four-bit-per-block control has no usable window under the same criterion, reading at 0.0278 on clean images even at its trained value.The comparison indicates that smaller blocks and more bits per block consume the same reading margin.

VI. DISCUSSION AND DESIGN IMPLICATIONS

The discussion separates robustness limits by mechanism rather than treating capacity as their fundamental cause: geometry disrupts correspondence, codecs remove signal, and scaling reduces amplitude freedom.

  • VI. DISCUSSION AND DESIGN IMPLICATIONS: Quadrupling payload at constant block size leaves rotation error almost unchanged, whereas quartering the block moves it from 0.221 to 0.491.This identifies block geometry, rather than payload size alone, as the governing quantity for geometric robustness.
  • VI. DISCUSSION AND DESIGN IMPLICATIONS: JPEG quality 75 already produces 0.2879 error at the lowest capacity, showing that the compression limit is not created by high payloads.Capacity narrows margins, but the distortion class determines whether the scheme survives.
  • VI. DISCUSSION AND DESIGN IMPLICATIONS: The three mechanisms damage different components: geometric attacks displace the reading reference, compression removes signal, and strength scaling loses amplitude freedom.They therefore scale differently with capacity and require different responses.
  • VI. DISCUSSION AND DESIGN IMPLICATIONS: All three mechanisms arise before extraction, because the incoming representation already contains a displaced grid, quantized-away signal, or unavailable amplitude.Further extraction-side training cannot recover information absent at its input.
  • VI. DISCUSSION AND DESIGN IMPLICATIONS: Grid desynchronization applies to spatially indexed payloads, the codec limit to separately trained extraction from a frozen embedder, and window narrowing to post-training strength scaling.These are class-level scopes rather than claims about one network architecture.
  • VI. DISCUSSION AND DESIGN IMPLICATIONS: The classical payload–imperceptibility–robustness trade-off narrows into a trade-off between capacity and geometric invariance once amplitude budget and training decomposition are separated.The embedding-strength window directly measures the remaining amplitude trade-off.

B. IMPLICATIONS FOR DESIGN

The three robustness limits arise at different stages of spatially indexed, separately trained watermarking systems, and increasing extraction-side training does not remove them. Their design implications target synchronization, the embedder, and the operating point rather than extraction alone.

  • Design implications: Grid desynchronization requires synchronization mechanisms, because geometric displacement is bounded by block size rather than signal strength.The relevant specification is the tolerance available at each block size.
  • Design implications: Codec-induced distortion points back to the embedder, because decoupling does not eliminate the need for a differentiable distortion model.The requirement returns on the other side of the frozen embedder–extractor boundary.
  • Design implications: The usable embedding-strength window narrows with capacity and closes at the upper end, eliminating the transparency–robustness trade-off available at lower capacities.At closure, the strength is no longer a deployment-adjustable design parameter.
  • Scope and evaluation: The measurements use 256 by 256 images, pixel-valued block sizes, one embedding-architecture family, and codecs in one default configuration.Absolute codec figures may change with rate control and presets, while identical settings preserve comparisons among the four extractors.
  • Scope of the limits: The three mechanisms are not removed by harder extraction training because they arise before extraction, in the representation supplied to it.The boundary follows distortion class rather than capacity, including at the lowest capacity.
  • Scope and evaluation: The conclusions apply to design classes defined by spatial payload indexing, separated extraction training, or post-training embedding-strength scaling, rather than one architecture.The evaluation protocol records attack parameters, measured severity, training status, and published operating points to make generalization claims checkable.

APPENDIX

The appendix describes Table 11's attack-suite evaluation and explains how its compression-class result is aggregated across single-bit variants.

  • Table 11: Table 11 reports bit error rate for five base variants across the full attack suite on COCO val2017, using 1,000 images per point.Embedding strength is fixed at its trained value.
  • Table 11: The severity column is mean PSNR between each watermarked image and its attacked version, averaged over the five variants.The five variants differ by at most 0.68 dB on any attack.
  • Table 11: Attacks are grouped by Table 4 distortion class and ordered within each class by their effect at 64 bits.
  • Compression results: 0.3503, 0.4252, 0.4752 and 0.4913 are the compression-class means across the four single-bit variants.The class mean averages eight compression rows; BSDS300 results are omitted because the section reports the mean absolute difference between test sets instead.
Loading 2609.01050v1…