Research map / Image generation / Autoregressive and latent generation
EditGuard: Versatile Image Watermarking for Tamper Localization and Copyright Protection
Read the paperCheck your idea against 108,967 papers
AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.
Proposes EditGuard, a dual-watermark framework that embeds a localization image watermark and a 64-bit copyright watermark via a united image-bit steganography network, enabling zero-shot tamper localization of AIGC edits without tampered training data.
Problem
Existing deep image watermarking only protects copyright and cannot localize realistic AIGC-based tampering, while passive tamper localization methods generalize poorly to unseen tampering types and need tampered training data.
Approach
Exploits the fragility and locality of image-into-image steganography: a hidden localization image watermark is damaged exactly where the container is tampered, so comparing decoded and pre-defined watermarks yields a mask. Combined with bit-into-image steganography for copyright, the whole system is trained only on self-recovery with no tampered data, plus a prompt-based posterior estimation modu
Key results
- On four classical localization benchmarks EditGuard reaches F1 0.954, 0.955, 0.911, 0.988, beating TruFor by 0.102, 0.116, 0.441, 0.065 F1 with ~99.9% bit accuracy.
- On AGE-Set-C, EditGuard keeps F1 and AUC above 0.95 across AIGC editing methods with bit accuracy above 99.8%, while passive baselines stay below 0.7 F1.
- Under clean conditions with 64-bit copyright watermark at 512x512, container PSNR is 37.77 dB; at 128x128 with 30 bits it is 36.93 dB, comparable to other pure watermarking methods.
Measured effects reported in the paper
| What was changed | Where | Measured | Effect |
|---|---|---|---|
| Use EditGuard instead of the strongest listed passive localization baseline | EditGuard · CAISAv1, Coverage, NIST16, and Columbia | F1-score: 0.852 -> 0.954; 0.735 -> 0.955; 0.470 -> 0.911; 0.923 -> 0.988 | Helped |
| Use EditGuard instead of the strongest listed passive localization baseline | EditGuard · Stable Diffusion Inpaint, ControlNet, SDXL, RePaint, Lama, and FaceSwap | F1-score: 0.547 -> 0.966; 0.542 -> 0.968; 0.633 -> 0.965; 0.681 -> 0.967; 0.483 -> 0.965; 0.781 -> 0.896 | Helped |
| Use EditGuard rather than the watermarking baselines | EditGuard · COCO test images, Stable Diffusion Inpaint tampering | NIQE: 7.095 -> 5.567 | Helped |
| Add the lightweight feature interaction module (LFIM) (ablation) | EditGuard · Stable Diffusion Inpaint, clean | IoU: 0.904 -> 0.936 | Helped |
| Add the transformer block (ablation) | EditGuard · Stable Diffusion Inpaint, clean | IoU: 0.927 -> 0.936 | Helped |
| Add prompt-based fusion (ablation) | EditGuard · Stable Diffusion Inpaint, random degradations | F1-score: 0.903 -> 0.938 | Helped |
| Use bi-level optimization rather than joint training of all components (ablation) | EditGuard · Stable Diffusion Inpaint, clean | bit accuracy: 49.17 -> 99.95 | Helped |
Surprising findings
- Sequential embedding of localization and copyright watermarks works, while parallel encoding does not, per the authors' supplementary experiments.
- Without bi-level optimization, joint training fails to converge and bit accuracy approaches random guessing (49.17%).
Limitations
- Robustness to heavier degradations and real-world transmission is limited; performance decreases under random degradations (F1 0.938 vs 0.966 clean).
- Requires watermarking images in advance, so it cannot localize tampering in unwatermarked images.
- Pixel-wise localization only; semantic-level outcomes are not provided.
Experimental setup
Datasets: COCO CelebA CAISAv1 Coverage NIST16 Columbia
Benchmarks: CAISAv1 Coverage NIST16 Columbia AGE-Set-C AGE-Set-F
Metrics: F1-score AUC IoU bit accuracy PSNR SSIM NIQE
Baselines: MVSS-Net OSN PSCC-Net TruFor HiFi-Net IML-ViT MBRS CIN PIMoG SepMark
Builds on: HiDDeN invertible neural networks / flow-based steganography SepMark CIN
Closest papers by meaning
- OmniGuard: Hybrid Manipulation Localization via Augmented Versatile Deep Image Watermarking (CVPR 2025 · similarity 0.89)
- StableGuard: Towards Unified Copyright Protection and Tamper Localization in Latent Diffusion Models (NeurIPS 2025 · similarity 0.88)
- FakeShield: Explainable Image Forgery Detection and Localization via Multi-modal Large Language Models (ICLR 2025 · similarity 0.86)
- Robust Watermarking Using Generative Priors Against Image Editing: From Benchmarking to Advances (ICLR 2025 · similarity 0.85)
- Transferable Black-Box One-Shot Forging of Watermarks via Image Preference Models (NeurIPS 2025 · similarity 0.85)
- WMCopier: Forging Invisible Watermarks on Arbitrary Images (NeurIPS 2025 · similarity 0.84)
Writing a paper in this area? scime draft is a free LaTeX editor with AI included, real-time co-authors and a check of your references and venue rules before you submit. It also imports OpenAI Prism projects.