PaperlayerView exact revision on arXiv

Source-linked AI summary

Optimizing and Securing the Modern Watermarking Channel for Images

Enoal Gesny, Eva Giboulot

arXiv:2609.34744v1cs.CRcs.CV

TL;DR

Modern post-hoc watermarking lacks secret keys and has implicit channel-design choices whose capacity and security need rigorous analysis. The paper models the channel and introduces SNW, reporting 2.5× higher capacity alongside theoretical security guarantees.

  • Problem

    Modern post-hoc watermarking's lack of secret keys and implicit design choices leave its security and capacity in need of rigorous analysis.

    Source: §1 · p. 2

  • Method

    The paper develops a framework for analyzing post-hoc systems and introduces SNW with a secret key in its embedding and decision mechanisms.

    Source: §1 · p. 2, §4.1 · p. 6

  • Results

    2.5× higher capacity is reported for SNW, which also offers theoretical security guarantees through a secret key.

    Source: §7 · p. 9

  • Takeaways & Limitations

    SNW's design can accommodate more powerful codebook constructions, including continuous alphabets and capacity-achieving codes as a natural extension.

    Source: §7 · p. 9

    The analysis focuses on watermarking security; adversarial robustness is outside the paper's scope.

    Source: §2.3 · p. 4

Abstract

from arXiv · show

To comply with recent regulations requiring traceable generated content, modern watermarking has adopted multi-bit post-hoc watermarking schemes. These modern designs rest on an encoder-decoder pair implemented as deep neural networks. These models are usually treated as pure black-boxes trained end-to-end, with the noise of the watermarking channel modeled through a fixed set of geometric and valuemetric transforms applied to watermarked images. We argue that this purely empirical approach leads to unquestioned design flaws and a lack of theoretical performance guarantees. This work proposes a general theoretical model of modern post-hoc watermarking schemes grounded in a statistical analysis of the outputs of the encoder/decoder pair. We show that these deep neural networks implicitly define a watermarking channel modeled as parallel AWGN channels, with messages transmitted using BPSK modulation. This imposes a binary alphabet, greatly limiting the capacity of these watermarking systems. Another fatal flaw is their lack of a secret key, making them intrinsically insecure. We make this notion of watermarking security precise for post-hoc schemes by linking it to the possibility of estimating the secret key under a given statistical model of the decoder's output. By putting together the results from this theoretical analysis, we introduce SNW: a novel post-hoc watermarking system that significantly outperforms existing state-of-the-art baselines in terms of capacity while also providing strong security guarantees. Notably, it does not depend on a fixed codebook or binary alphabet, allowing it to reach a rate close to Shannon capacity through the use of capacity-achieving error-correcting codes.

1 INTRODUCTION

The introduction argues that modern post-hoc watermarking needs more rigorous evaluation of its channel design, capacity, and security. It presents a theoretical analysis and SNW as a keyed alternative with higher capacity.

1 INTRODUCTION

  • Modern post-hoc systems use end-to-end encoder-decoder networks trained against image augmentations while preserving watermark imperceptibility.Classical schemes instead construct watermarking spaces using handcrafted transforms.Source: §1 · p. 2
  • The introduction frames geometric robustness as a classical trade-off, while modern schemes' claimed robustness does not resolve their security weaknesses.Classical schemes can struggle to resist all geometric transforms simultaneously; adding scaling and cropping during training can improve robustness to both in modern schemes.Source: §1 · p. 2
  • Modern schemes lack secret keys and rely on DNNs, leaving them vulnerable to spoofing and adversarial attacks.Prior work demonstrated that watermark signals can be erased, copied, or forged.Source: §1 · p. 2
  • The paper argues that capacity inefficiency stems from implicit architecture and training choices, not simply from model size.It says capacity can increase almost threefold without enlarging the encoder or decoder, changing architecture, or using more training compute.Source: §1 · p. 2
  • 656 bits with a binary alphabet versus 256 bits for current state-of-the-art, with the same DNN architecture and perfect security against PCA attacks.The introduction identifies these as SNW's maximum capacity and security result.Source: §1 · pp. 2–3

2 MULTI-BIT WATERMARKING SYSTEMS

The section formulates post-hoc watermarking as message attribution under a spoofing threat model, then defines the system components and distinguishes watermarking security from adversarial robustness. Its security analysis is scoped to spoofing rather than adversarial robustness.

2.1 PROBLEM FORMULATION

  • In the attribution scenario, users receive watermarked images linked to unique messages; the correct key should decode the user's message, while an absent watermark or incorrect key should yield a random message.The stated threat model gives the attacker the pipeline and at least one target image, but not the secret key or target codeword, and assumes noiseless decoding.Source: §2.1 · p. 3
  • The threat model focuses on spoofing under Kerckhoffs' principle; analyzing erasure attacks would require only slight changes, mainly using watermarked rather than unwatermarked images..Source: §2.1 · p. 3

2.2 MAIN DEFINITIONS

  • A message m is distinct from its codeword c, which is mapped to the message using an error-correcting code; the codeword may be binary or real-valued.The codeword length M′ must be at least the message length M.Source: §2.2 · p. 3
  • A post-hoc system comprises secret keys, keyed embedding and decision functions, and forward projections between pixel and watermarking spaces.The embedding maps a codeword into the watermarking space; the decision mechanism extracts it using the key.Source: §2.2 · p. 3

2.3 WATERMARKING SECURITY VS ADVERSARIAL ROBUSTNESS

  • Watermarking security concerns the embedding and decoding mechanisms, whereas adversarial robustness concerns the decoding projection; this paper focuses on the former.An L-secure system is one where N independent observations do not, on average, improve spoofing success beyond random chance.Source: §2.3 · p. 4

3 THE MODERN POST-HOC WATERMARKING CHANNEL

The encoder–decoder pair induces a watermarking channel modeled as parallel AWGN channels with BPSK signaling, limiting capacity to one bit per channel element. The analysis also identifies redundant latent dimensions and shows how a keyless system can be attacked by linear estimation.

3 THE MODERN POST-HOC WATERMARKING CHANNEL

  • A fixed steering vector is mixed with downsampling features; a CNN decoder produces a latent vector, and a linear head outputs the soft codeword before sign decoding.The embedding signal is perturbed by a transform before decoding.Source: §3 · p. 5
  • The latent covariance has M′ high-eigenvalue robust components, smaller brittle components, and zero-eigenvalue redundant dimensions; the linear head whitens and debiases the estimate.The soft-codeword is modeled as a multivariate Gaussian with diagonal covariance.Source: §3 · p. 5
  • The encoder–decoder pair induces M′ parallel AWGN channels with BPSK signaling, whose capacity is at most 1 bit per channel element.The model is grounded in the statistical outputs of the decoding projection and decision mechanism.Source: §3 · p. 5
  • BPSK is capacity-optimal for an AWGN channel with a binary alphabet, but limits transmission to 1 message bit per codeword bit.The theoretical capacity bound applies for positive signal power and nonnegative noise variance.Source: §3 · p. 5
  • Without a secret key, an attacker can watermark L+1 images with independent messages and solve for the linear head, enabling codeword recovery and spoofing.The attack uses the known messages and corresponding latent vectors to solve Wz + b = c.Source: §3 · p. 6

4 SNW : SECURE NEURAL WATERMARKING

SNW addresses keylessness, redundant watermark-space use, and binary capacity limits with a secret-key design and continuous-valued codewords. Its embedding and decoding mechanisms use a shared secret subspace, while training promotes alignment, isotropy, and image quality.

4 SNW : SECURE NEURAL WATERMARKING

  • SNW targets keylessness, redundant watermark-space use, and binary capacity limits with a secure design that supports a continuous alphabet.The design aims to maximize use of the watermark space.Source: §4 · p. 6

4.1 SECURE DECISION MECHANISM AND EMBEDDING FUNCTIONS (ek, d)

  • A semi-orthogonal secret matrix U is integrated into embedding and decoding, and real-valued codewords permit off-the-shelf capacity-achieving AWGN codes.The parameter α controls the capacity-security trade-off.Source: §4.1 · p. 6

4.2 LEARNING ISOTROPIC AND ROBUST NEURAL PROJECTIONS (fe, f †

  • The projections are jointly optimized for alignment, latent-space isotropy, and image quality; arbitrary vectors on the L−1 hypersphere are allowed.The quality objective combines a PSNR constraint on watermark power with an LPIPS perceptual metric.Source: §4.2 · pp. 6–7
  • Setting α = M′/L guarantees perfect security against PCA attacks while maintaining invariant bit accuracy across codeword dimensions; α = 1 is the maximum-robustness setting.Figure 2 also plots bit accuracy and Shannon capacity against projection alignment.Source: Figure 2 · p. 7

5 SNW THEORETICAL ANALYSIS

The analysis derives SNW’s binary-channel capacity under a perturbation model and characterizes security against PCA key estimation. It identifies a regime where maximum capacity and perfect PCA security coincide.

5.1 CAPACITY

  • Under the perturbation model, SNW’s binary capacity is Cρ = M′ (1 − h2(p(ρ))), where p(ρ) is the probability of correctly decoding a bit.The expression uses the standard Gaussian c.d.f. Φ to define p(ρ).Source: §5.1 · p. 7
  • At α=1, decoding robustness is maximized because all embedding energy goes to the watermark signal.The section also states that this setting gives perfect PCA security when α=1 and L=M′.Source: §5.1 · p. 7, §5.2 · p. 8

5.2 WATERMARKING SECURITY

  • Under the stated statistical model, PCA cannot estimate any secret-key dimension when the signal eigenvalue supports lie within the unwatermarked-image support.Source: §5.2 · p. 8
  • SNW requires N=ηL watermark observations to retrieve the watermark subspace; as ηL grows without bound, it is perfectly secure against PCA attacks.Source: §5.2 · p. 8
  • When codeword size matches watermark-space dimension (L=M′), α=1 gives both perfect PCA security and maximum capacity; smaller codewords require energy to be spent drowning the signal in noise.Source: §5.2 · p. 8

6 EXPERIMENTS

Experiments compare SNW with recent neural watermarking baselines on capacity, perceptual quality, and PCA security. SNW has higher empirical capacity, while quality remains similar in order of magnitude and its specified operating regime is perfectly secure against PCA key estimation.

6.1 EXPERIMENTAL SETTINGS

  • The binary-alphabet evaluation compares SNW with VideoSeal and PixelSeal (256-bit codewords) and TrustMark (100-bit codewords), using whitened outputs for a message-agnostic comparison.Source: §6.1 · p. 8
  • Evaluation uses 1000 MFlickr images disjoint from COCO training and tests valuemetric and geometric transforms.Source: §6.1 · p. 8

6.2 RESULTS

  • Around 2.5× the capacity of PIXELSEAL is achieved by SNW under classic transformations and recent blind erasure attacks.The evaluation covers 1000 images; Figures 3 and 4 show capacity comparisons for classic transformations and watermarking erasure attacks, respectively.Source: Figure 3 · p. 9, Figure 4 · p. 9, §6.2 · p. 9

6.1 EXPERIMENTAL SETTINGS

  • Capacity is reported as total Shannon capacity from empirical codeword bit accuracy, assuming independent bits ensured by whitening; quality is measured with LPIPS and security with η-security under PCA attack.The quality comparison fixes watermark power at 48 dB PSNR.Source: §6.1 · p. 9, Table 2 · p. 9

6.2 RESULTS

  • TrustMark achieves slightly lower perceptual distortion, at the cost of far lower capacity than the other evaluated schemes.Across methods, perceptual quality remains within the same order of magnitude.Source: §6.2 · p. 9
  • At α*=1 and M′=L, SNW is perfectly secure against PCA secret-key estimation; keyless systems are assigned η≈1 in the paper’s charitable analysis.Source: §6.2 · p. 9

7 CONCLUSION

The conclusion presents SNW as a theoretically grounded post-hoc watermarking design, reporting higher capacity and secret-key security. The accompanying material specifies its notation, formalizes error correction, and describes training objectives and architecture.

7 CONCLUSION

  • SNW addresses inefficient watermark-space use and lack of security, reporting 2.5× higher capacity with theoretical security guarantees through a secret key.Continuous alphabets with capacity-achieving codes are described as a natural extension that could reach far better capacities at almost no cost.Source: §7 · p. 9

A NOTATIONS

  • The notation distinguishes pixel, latent, and soft-codeword spaces, and permits either binary or continuous alphabets for A^M′.Source: A NOTATIONS · p. 12

B FORMAL DEFINITIONS

  • An error-corrected watermarking system maps messages to a codebook and replaces embedding and decision functions with codeword-level mechanisms.Source: B FORMAL DEFINITIONS · p. 13

C TRAINING DETAILS

  • The described training procedure is not claimed to be unique or optimal, and the model was trained on COCO 2017 train.Source: C TRAINING DETAILS · p. 13

C.1 ARCHITECTURE

  • SNW adopts PixelSeal’s architecture but removes its classification linear head; its embedder accepts a continuous random unit vector of dimension L=768.The passage says retaining the backbone helps compare capacity and security under an identical architecture.Source: §C.1 · p. 13

C.2 LOSSES

  • The training objectives include vector alignment, isotropy across representations, PSNR-bounded watermark power, LPIPS perceptual quality, and anti-spoofing.Source: §C.2 · p. 14

C.3 TRAINING PROCEDURE

Training proceeds in three stages: signal discovery, pooled-representation alignment, and anti-spoofing fine-tuning. The active losses change across stages to support these respective aims.

C.3 TRAINING PROCEDURE

  • The three-stage pipeline assigns different combinations of losses to each stage, as summarized in Table 3.Source: §C.3 · p. 15, Table 3 · p. 15
  • Stage 1 finds and extracts an isotropic watermark signal without transforms, using an alignment loss and a PSNR target scaled from 0 to 42 dB.Transforms are progressively added for robustness using PixelSeal’s set.Source: §C.3 · p. 15
  • Stage 2 transfers the signal to the pooled representation while improving perceptual quality and isotropy.It uses pooled alignment, LPIPS, JND attenuation, and isotropy losses.Source: §C.3 · p. 15
  • Stage 3 fine-tunes against residual transfer attacks so residual detectability depends on image content.Source: §C.3 · p. 15

D PROOFS

The proofs derive SNW’s bit-decoding probability and capacity under a specified perturbation model, then characterize when PCA can recover its watermark subspace and when covariance isotropy gives perfect PCA security.

D.1 PROPOSITION 2

  • Under the Equation 7 perturbation model, Proposition 4 derives the probability of correctly decoding a bit and the resulting Shannon capacity.The capacity is C_ρ = M′(1 − h2(p(ρ))).Source: §D.1 · p. 16

D.2 PROPOSITION 3

  • Proposition 5 states that PCA retrieval of the watermark subspace requires at least N = ηL watermark observations, while N → ∞ gives perfect security against PCA.The proof notes that a full-rank empirical covariance in R^L requires at least L independent observations.Source: §D.2 · pp. 17–18

D.3 PROPOSITION 3 (PERFECT SECURITY)

  • Proposition 6 identifies strict isotropy of the population covariance, with λ1 = λ2, as the condition for perfect security against PCA estimation.The two eigenvalues correspond to the watermark subspace and its complementary subspace.Source: §D.3 · p. 18

E WATERMARKING SECURITY AND ADVERSARIAL ROBUSTNESS

The section distinguishes watermarking security, which concerns access to the raw watermark channel, from adversarial robustness against perturbations of the decoding projection. It also discusses Lipschitz bounds and empirical estimates for projection functions.

E WATERMARKING SECURITY AND ADVERSARIAL ROBUSTNESS

  • Watermarking security concerns unauthorized removal, detection or estimation, writing, or modification of raw watermark bits, whereas adversarial attacks can target a specific decoding projection.The paper distinguishes full channel access through key estimation from attacks whose output is a perturbation for a specific operation.Source: E WATERMARKING SECURITY AND… · p. 19

E.1 ADVERSARIAL ROBUSTNESS AND LIPSCHITZ NETWORKS

  • A large Lipschitz constant can make the theoretical lower bound on pixel-space distortion vanish, allowing imperceptible noise to move latents across a decision boundary.The bound relates the pixel perturbation needed to induce a target latent displacement to the projection function’s Lipschitz constant.Source: §E.1 · p. 20

E.2 LIPSCHITZ ESTIMATION

  • Table 4 compares empirical projection-function Lipschitz estimates: classical transforms guarantee Lf = 1, while unconstrained neural projections have elevated constants.The estimates use 100 ImageNet images; the paper links elevated neural-network constants to vulnerability to adversarial watermark erasure.Source: Table 4 · p. 20, §E.2 · p. 20

F WHITENING

The section describes whitening detector outputs for fair method comparisons and examines residual transfer between hosts. It reports that fine-tuning SNW with an anti-spoofing loss suppresses transferability while preserving decoding capacities.

F WHITENING

  • Because deep watermarking detectors produce biased and correlated logits, the comparison whitens detector outputs using logits from natural MFlickr images.The procedure computes empirical bias and covariance, then defines a projection matrix and whitened detector output.Source: F WHITENING · pp. 20–21

G RESIDUAL TRANSFER ATTACKS

  • SNW and TrustMark are vulnerable to residual transfer, while PixelSeal and VideoSeal are robust; anti-spoofing fine-tuning suppresses SNW transferability while preserving decoding capacities.Table 5 reports bit accuracy against residual transfer attacks on 200 MFlickr 1024 × 1024 images.Source: G RESIDUAL TRANSFER ATTACKS · p. 21, Table 5 · p. 21

H.1 SNW GEOMETRIC ANALYSIS

The appendices examine SNW’s geometric behavior, performance against recent erasing attacks and classic image transformations, and qualitative watermarked-image examples. The supplied text reports that training increases robust components and that setting α = 1 prevents PCA or other second-order recovery of the secret key.

H.1 SNW GEOMETRIC ANALYSIS

  • As SNW training steps increase, the number of non-zero robust components grows, while cover and watermarked-content eigenvalues become indistinguishable.The authors state that with α = 1, the secret key cannot be recovered through PCA or another second-order attack.Source: §H.1 · p. 21, Figure 5 · p. 22

H.2 RECENT ERASING ATTACKS

  • Table 6 presents watermarking-system capacities against recent erasure attacks, with results computed over 200 MFlickr 1024 × 1024 images.The listed attacks are VAE Purification, DiffPure, and WM Forger.Source: Table 6 · p. 22, §H.2 · p. 22

H.3 DETAILED RESULTS

  • Table 7 reports capacities against an extensive set of classic image transformations using 1000 MFlickr 1024 × 1024 images.The supplied passages identify the benchmark scope but do not provide its comparison outcomes.Source: §H.3 · p. 22, Table 7 · p. 23

H.4 EXAMPLES

  • Figure 6 provides qualitative examples of images watermarked by different methods at a fixed watermark power of 48 dB PSNR.The examples include the associated residuals.Source: Figure 6 · p. 23, §H.4 · p. 23

Related papers

Loading 2609.34744v1…