PaperlayerView exact revision on arXiv

Source-linked AI summary

FiLM-CAM: Keyed Feature Modulation for Conditional-Access Watermarking

Yash Kulthe, Vishal Asnani, Shruti Agarwal, Andrew Gilbert, John Collomosse

arXiv:2610.30347v1cs.CV

TL;DR

Organizations may need watermark access control without maintaining separate private decoders. FiLM-CAM uses a secret key to condition a shared encoder–decoder for watermark embedding, decoding, and residual-based removal; the paper reports competitive quality and accuracy while adding conditional access.

  • Problem

    Organizations may want to control watermark encoding and decoding, but separate private encoder–decoder models impose a deployment burden.

    Source: §1 · p. 1

  • Method

    FiLM-CAM uses keyed feature modulation in a shared encoder–decoder and reuses the embedder to estimate and subtract a key-conditioned watermark residual.

    Source: §1 · p. 2, §3 · p. 3, §3.3 · p. 4

  • Results

    FiLM-CAM performs competitively in quality and accuracy while adding conditional-access functionality.

    Source: §5 · p. 10

  • Takeaways & Limitations

    A shared watermarking backbone can support multiple private domains with key-dependent embedding, decoding, and removal.

    Source: §5 · p. 10

    Conditional access prevents key-free decoding and reconstructive removal, but not key-free destruction, which can disable detection without recovering the original cover image.

    Source: §5 · p. 10

Abstract

from arXiv · show

We propose FiLM-CAM; a conditional-access image watermarking approach that enforces authorized encoding, decoding, and removal through keyed feature modulation. A secret key conditions a Feature-wise Linear Modulation (FiLM) mechanism that transforms the internal representation of the watermark signal before embedding, thereby coupling the payload to the key at the feature, rather than pixel level. The same key must be presented to condition the decoder to correctly recover the payload embedded in an image. To enforce conditional access, we train the system to maximize the performance gap between authorized and unauthorized use, ensuring reliable extraction under the correct key while inducing failure under incorrect keys. In addition, we design our encoder to estimate the watermark residual invariant to the presence of pre-existing watermarks. This design enables conditional watermark removal via simple re-encoding and subtraction of the residual using iterative refinement, contingent on knowledge of the secret key. We evaluate FiLM-CAM across multiple watermarking encoder-decoder backbones, demonstrating that keyed feature modulation serves as an effective, architecture-agnostic conditional access module (CAM) for image watermarking.

1 Introduction

Watermarking can support provenance and integrity, but open access to encoding and decoding may enable spoofing, unauthorized removal, or monitoring. FiLM-CAM conditions a shared watermarking model on a secret key for embedding, decoding, and removal.

1 Introduction

  • A single access-controlled framework could avoid the deployment burden of maintaining separate private decoders for each organization.Organizations may want to control encoding and decoding to protect against spoofing, unauthorized removal, or monitoring.Source: §1 · p. 1
  • FiLM-CAM integrates the key into the encoder–decoder’s internal feature hierarchy through Feature-wise Linear Modulation.The key conditions intermediate representations rather than binding the secret solely to the watermark signal.Source: §1 · pp. 1–2
  • Correct-key conditioning gates watermark representation, embedding, and extraction, while unauthorized keys induce systematic failure.The approach uses a single shared backbone to support multiple private watermarking domains.Source: §1 · p. 2
  • The embedder predicts a key-conditioned residual invariant to watermark presence, enabling removal by residual subtraction and gain-controlled refinement.The introduction reports removal quality of approximately 54 dB PSNR when the correct key and message are provided.Source: §1 · p. 2

2 Related Work

Prior image-watermarking work spans classical signal processing and learned encoder–decoder systems, while key-based access control has often depended on shared seeds, key-defined patterns, or transformed payloads. FiLM-CAM instead conditions a post-hoc image watermarking network itself and incorporates removal into the encoder–decoder architecture.

2 Related Work

  • Classical methods embed in pixels or frequency domains, while learned encoder–decoder systems extend watermarking to geometric resilience, latent-space operation, and robustness techniques.The cited examples include LSB, DCT/DWT, DWT–DCT–SVD, and learned systems such as HiDDEN [47] and TrustMark.Source: §2 · p. 2
  • Prior key-based approaches use shared seeds, define the watermark pattern, or transform the payload, whereas FiLM-CAM conditions the watermarking network itself.The passage contrasts FiLM-CAM with Tree-Ring and LatentSeal [19].Source: §2 · pp. 2–3
  • Removal work includes signal-processing attacks, separate learned residual estimators, and adversarial reconstruction, while FiLM-CAM reuses its embedder for key-conditioned residual estimation and subtraction.The cited alternatives may degrade image quality or reconstruct an image that deviates from the original.Source: §2 · p. 3

3 Methodology

FiLM-CAM uses a secret key to condition watermark embedding, decoding, and removal through feature modulation. Its methodology combines key-conditioned residual estimation with transformed-space composition, iterative removal, and two-stage training.

3.1 Conditional Access Module (CAM)

  • The Conditional Access Module (CAM) makes embedding and extraction depend on a shared key embedding that modulates intermediate features; an incorrect key disrupts their alignment.The key is mapped to a continuous embedding shared by the embedder and extractor.Source: §3.1 · pp. 3–4

3.2 Watermark Embedder/Extractor

  • The embedder predicts a residual from the cover image, message, and key, while the extractor predicts the embedded message from the watermarked image and supplied key.The extractor applies key conditioning immediately before its final prediction layer.Source: §3.2 · p. 4

3.3 Watermark Composition

  • Watermark composition adds a gain-adjusted perturbation in transformed logit space and maps the result back to the image domain, rather than adding the residual directly to pixels.The image-dependent gain compensates for tanh saturation, and the paper reports improved removal fidelity over additive composition.Source: §3.3 · p. 4

3.4 Noise Layer

  • A training noise layer applies an affine transform and randomly sampled image distortions after composition to simulate perturbations.The sampled transforms include JPEG compression, blur, additive noise, and geometric distortions.Source: §3.4 · p. 4

3.5 Removal Architecture

  • Removal reuses the embedder to estimate a residual from the watermarked image, key, and message, then inverts the composition; a wrong key makes removal fail.The correct message improves residual estimation, and iterative refinement approximates the inverse when the clean cover image is unavailable.Source: §3.5 · pp. 4–5

3.6 Training Schedule

  • Training uses two stages: key-conditioned embedding first, then removal fine-tuning; correct-key removal matches the embedded perturbation while wrong-key residuals are attenuated.The schedule alternates between the stages in five-epoch cycles after 120 initial Stage 1 epochs.Source: §3.6 · pp. 5–6
  • Wrong-key training targets an invalid decoded codeword while retaining image-quality objectives, encouraging authorized decoding and failure under unauthorized keys.Each iteration uses a correct-key step followed by a wrong-key step for the same embedded sample.Source: §3.6 · pp. 5–6

4 Experiments and Discussion

Experiments evaluate watermark quality, conditional access, removal, repeated watermarking, and design choices. FiLM-CAM combines near-perfect correct-key extraction with high-fidelity authorized removal, while wrong-key removal leaves the watermark more recoverable.

4.1 Datasets, metrics and training details

  • Evaluation trains on 100K MIRFlickr-1M images and tests on COCO, DIV2K, and SA-1B; the standard configuration uses 100-bit payloads and 100-bit keys.Metrics include PSNR, SSIM, LPIPS, bit accuracy, and removal BER; keys are freshly sampled during training and test keys are unseen by construction.Source: §4.1 · pp. 6–7, §4 · p. 6

4.2 Comparison with the state-of-the-art

  • FiLM-CAM achieves ∼0.99 bit accuracy across COCO, DIV2K, and SA-1B at ∼46 dB PSNR, and wrong-key suppression approaches random decoding more strongly than FNNS.On DIV2K, the noise-trained robustness variant averages ∼0.96 bit accuracy across attacks, with embedding PSNR ∼40 versus ∼47 dB. FiLM-CAM stays near 50–60% accuracy through roughly 80% key correctness, reaching ∼95% near 98%.Source: §4.2 · pp. 7–8, Table 1 · p. 7, Table 2 · p. 8

4.3 Watermark Removal

  • ∼58 dB removal PSNR on COCO and ∼54 dB on DIV2K and SA-1B, with post-removal bit accuracy ∼0.57–0.58 under the correct key; wrong-key removal yields ∼47 dB and accuracy ∼0.78–0.81.Regeneration baselines reach near-random post-removal accuracy at ∼20–30 dB; TrustMark-RM preserves quality but does not fully suppress decoding. Noise-layer training enforces the removal asymmetry.Source: §4.3 · p. 8, Table 3 · p. 8

4.4 Re-Watermarking

  • Repeated embedding progressively degrades decoding accuracy and image quality, whereas embed–remove cycling maintains watermarked-image PSNR and accuracy while reconstructed-image PSNR declines gradually.Each authorized embedding-removal cycle adds a small reconstruction error that accumulates over cycles.Source: §4.4 · p. 9, Figure 2 · p. 9

4.5 Ablation studies

  • Increasing watermark strength α trades imperceptibility for robustness, while correct-key removal PSNR improves with refinement and wrong-key removal saturates lower.Diminishing returns beyond 20 iterations motivate 20 as a quality–computation trade-off; Figure 3 presents the strength and iteration comparisons.Source: §4.5 · p. 9, Figure 3 · p. 9
  • Replacing FiLM conditioning with direct key input lowers embedding accuracy from 0.99 to 0.85 and removal quality from 55.4 dB to 47.3 dB.The direct-key variant does not converge to high decoding accuracy.Source: §4.5 · pp. 9–10, Table 4 · p. 10
  • Without the gain factor, removal PSNR falls from 55.4 dB to 44.0 dB, and iterative refinement cannot progressively improve removal.Logit-space composition improves removal PSNR by 1.3 dB over additive composition (55.4 vs. 54.1 dB); on COCO, removal PSNR is 59.3 vs. 55.5 dB and post-removal accuracy is 0.52 vs. 0.56.Source: §4.5 · p. 10, Table 4 · p. 10
  • FiLM-CAMEncoder paired with a ConvNeXt-Base extractor performs strongest, while CAM remains effective across several encoder–decoder backbones.The backbone comparison is reported on DIV2K.Source: §4.5 · p. 10, Table 5 · p. 10

5 Conclusion

FiLM-CAM combines key-dependent embedding, decoding, and removal in one encoder–decoder, with competitive quality and accuracy. Its scope excludes key-free destruction, and future work could improve capacity, removal quality, and wrong-key payload preservation.

5 Conclusion

  • FiLM-CAM provides key-dependent watermark embedding, decoding, and removal within a single encoder–decoder architecture.Its logit-space formulation estimates an invariant residual with the embedder for removal.Source: §5 · p. 10
  • Key-free attacks can disable detection through re-embedding or strong diffusion regeneration, but do not recover the original cover image.The limitation is shared by learned watermarking methods generally.Source: §5 · p. 10
  • Future work could raise bit capacity, use encoding-time side information to improve removal quality, and better preserve the full payload after wrong-key removal.The current approach preserves a substantial portion, but not always all, of the watermark under unauthorized removal.Source: §5 · p. 10

A Robustness Results

Robustness training improves extraction under common image perturbations while retaining conditional-access behavior, with a modest clean-condition performance cost.

A Robustness Results

  • 96.0% mean extraction bit accuracy on DIV2K under a perturbation suite, with the robustness-trained model retaining conditional access.The noise layer samples geometric and photometric perturbations and compression artifacts; Table 7 compares extraction accuracy across attacks.Source: A Robustness Results · p. 14
  • The noise-trained variant improves perturbation robustness at the cost of a minor decrease in clean-condition scores.Across COCO, DIV2K, and SA-1B, it retains strong correct-key extraction, near-chance wrong-key decoding, and broadly consistent post-removal behavior.Source: A Robustness Results · p. 14

B WAVES Benchmark

On WAVES, the noise-trained model remains detectable under many distortions and attacks, but several regeneration and composite attacks reduce detection to chance while damaging image quality.

B WAVES Benchmark

  • TPR ≥0.98 under most single distortions, photometric composites, and all adversarial-embedding and surrogate-classifier attacks.Blur, rotation, JPEG, and VAE-based regeneration are weaker cases; diffusion regeneration, rinsing, and geometric or full composite distortions reduce detection to chance.Source: B WAVES Benchmark · p. 14
  • Diffusion-based attacks reduce detection to chance but leave attacked-image PSNR ≤18 dB, so they do not recover the cover image.The evaluation reports TPR at 0.1% FPR, bit accuracy, AUC, and attacked-image PSNR on WAVES.Source: B WAVES Benchmark · p. 14

C Threat Model and Key-Free Attacks

The threat model tests whether an adversary without the victim key can decode messages or remove watermarks while preserving image quality. FiLM-CAM is designed to prevent reliable decoding and reconstructive removal, but not key-free destruction.

C Threat Model and Key-Free Attacks

  • The adversary knows the architecture and weights, can query the victim-key embedding pipeline, and may hold other legitimate keys, but never observes the victim key.The two goals are decoding the hidden message and removing its watermark while preserving image quality.Source: C Threat Model and Key-Free Attacks · p. 14
  • FiLM-CAM is designed to prevent key-free decoding and reconstructive removal, but not destruction by overwriting or strong diffusion regeneration.Such destruction is common to learned watermarking methods and does not recover the cover image; surrogate-key recovery attacks are not evaluated.Source: C Threat Model and Key-Free Attacks · pp. 14–15
  • The keyless surrogate decoder fits training examples at 0.998 bit accuracy but reaches only 0.52 accuracy on held-out covers, at chance level.The evaluated attacker reuses a fixed dictionary of 100 messages on new covers.Source: C Threat Model and Key-Free Attacks · p. 15
  • For quality-preserving collusion attacks, bit accuracy remains ≥90% at λ ≤2 and PSNR ≈40 dB; accuracy approaches chance only below 30 dB with visible artifacts.Averaging residuals from same-key images therefore does not remove the watermark while preserving image quality.Source: C Threat Model and Key-Free Attacks · p. 16

D Embedder/Extractor Architecture Details

FiLM-CAM uses a lightweight U-Net embedder to predict a watermark residual and a keyed extractor to recover the message. FiLM key embeddings modulate bottleneck features during embedding and the pooled image descriptor during decoding.

Embedder/Extractor Architecture Details

  • The embedder maps the 100-bit secret to a spatial tensor, concatenates it with the cover image, and predicts a watermark residual with a lightweight U-Net.The secret is projected to 3 × 16 × 16 and upsampled to 3 × 256 × 256 before concatenation.Source: D Embedder/Extractor Architecture… · pp. 16–17
  • A three-layer MLP maps the 100-bit key to a 64-dimensional embedding that generates FiLM parameters for channel-wise modulation of the embedder bottleneck features.The bottleneck contains eight residual blocks operating at 32 × 32 resolution.Source: D Embedder/Extractor Architecture… · p. 17
  • The extractor combines ConvNeXt-Base image features with FiLM modulation conditioned on the access key to predict 100 secret logits.The pooled image descriptor is 1024-dimensional; correct decoding depends on the correct key, while incorrect keys degrade extraction.Source: D Embedder/Extractor Architecture… · p. 17

E FiLM Embedding Dimension

The FiLM key-embedding dimension has a mild trade-off across image quality and key-conditioned extraction. The authors select 64 dimensions for the highest correct-key extraction accuracy and best overall balance.

FiLM Embedding Dimension

  • 0.99 correct-key extraction accuracy is highest with the 64-dimensional embedding, which also yields 0.54 wrong-key accuracy, close to random guessing.The 100-dimensional setting gives 0.98 correct-key and 0.55 wrong-key accuracy; 200 dimensions gives 0.96 and 0.52, respectively, while slightly improving PSNR.Source: E FiLM Embedding Dimension · p. 17
  • Increasing the FiLM embedding dimension mildly trades off watermark fidelity, correct-key decoding, and wrong-key collapse, so 64 dimensions is the default for its overall balance.The 200-dimensional setting has the lowest wrong-key accuracy, but reduces correct-key accuracy.Source: E FiLM Embedding Dimension · p. 17

F Additional Key-Conditional Analysis

Changing only the access key changes the embedder’s residual pattern for the same cover and secret. Cross-key decoding falls to approximately random-guess accuracy, and wrong-key removal is less effective than correct-key removal.

Additional Key-Conditional Analysis

  • 98.0% and 100.0% bit accuracy with the respective correct keys fall to 49.0% with the other key, near the 50% random-guess level.The comparison uses watermarked images generated from the same cover and secret but with different keys.Source: F Additional Key-Conditional Analysis · p. 18
  • 0.0875 amplified-residual MAE between keys exceeds the 0.0727 MAE between their watermarked images, although the final images remain visually similar.The magnified residuals and residual-difference image show structured differences induced by changing only the key.Source: F Additional Key-Conditional Analysis · p. 18
  • Approximately 55 dB removal PSNR with the correct key contrasts with around 49 dB using wrong keys, whose residual patterns are broadly similar.Figure 5 visualizes removal residuals and their differences between correct-key and wrong-key cases.Source: F Additional Key-Conditional Analysis · p. 18
  • Figure 4 presents the cover, watermarked image, amplified embedding residual, reconstructed cover after removal, and amplified removal residual.Both residual visualizations are amplified 5× for visibility.Source: Figure 4 · p. 19

G Removal under Fully Unauthorized Queries

FiLM-CAM’s removal depends on the supplied key and secret: lacking both makes removal less effective than using an incorrect key alone. The paper also examines native-resolution efficiency, visual comparisons, removal without the noise layer, and unauthorized re-embedding.

G Removal under Fully Unauthorized Queries

  • Approximately 0.81 post-removal bit accuracy across COCO, DIV2K, and SA-1B with both a random secret and key contrasts with around 0.59 using an incorrect key and fixed secret.Higher post-removal bit accuracy indicates more watermark information remains; the table compares these two unauthorized settings.Source: G Removal under Fully Unauthorized… · pp. 19–20, Table 16 · p. 21
  • With the correct key, the correct message yields 55.66 dB removal PSNR and 0.57 post-removal bit accuracy, versus 48.31 dB and 0.78 with a random message.With a random key, post-removal bit accuracy remains 0.81–0.83 regardless of the supplied message, and the watermark persists.Source: G Removal under Fully Unauthorized… · p. 21, Table 15 · p. 21

H Practical Considerations for Removal

  • FiLM-CAM removal can run at native resolution and requires an embedder forward pass plus a small number of refinement steps, which the paper describes as efficient relative to iterative generative baselines.The main paper also reports removal inference time.Source: H Practical Considerations for Removal · p. 21

I Visual Comparison with Baselines

J Key-Gated Removal without the Noise Layer

  • On COCO, fine-tuning with the remover instead of the noise layer leaves wrong-key removal at 0.94 post-removal bit accuracy, versus 0.58 for the clean model, while correct-key removal reaches 0.60 at 63.22 dB.The authors report this as evidence that key-dependent residuals combined with a robustly trained extractor create an authorized-versus-unauthorized removal gap.Source: J Key-Gated Removal without the Noise… · p. 22, Table 18 · p. 22

K Overwriting by Unauthorized Re-Embedding

  • A single unauthorized re-embedding drives the original watermark near chance for FiLM-CAM and all baselines while PSNR remains above 39 dB; the image remains doubly watermarked rather than restored.The paper identifies overwriting as a key-free destruction attack that FiLM-CAM’s reconstructive-removal key gating does not prevent.Source: K Overwriting by Unauthorized… · p. 22, Table 19 · p. 23
Loading 2610.30347v1…