Research map / Image generation / Autoregressive and latent generation
OmniGuard: Hybrid Manipulation Localization via Augmented Versatile Deep Image Watermarking
Read the paperCheck your idea against 108,967 papers
AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.
Proposes OmniGuard, a hybrid watermarking framework pairing proactive dual watermark embedding with a passive, degradation-aware Swin/ViT-based tamper mask extractor, plus an adaptive watermark transform and a VAE-based AIGC-edit simulation layer.
Problem
Versatile deep image watermarking must jointly provide high container-image fidelity, precise pixel-wise tamper localization, flexible localized watermark choice, and copyright extraction robustness under AIGC editing and common degradations; prior residual-subtraction methods trade fidelity against
Approach
Replace residual subtraction between fixed and recovered localized watermarks with a learned passive tamper extractor that takes the recovered watermark artifact map and the tampered image plus a learnable degradation query, decoupling encoder and decoder so the localized watermark can be chosen flexibly and made content-aware; add a VAE-based (SD 1.5) and partial-removal simulation layer to make
Key results
- Achieves PSNR 42.33 dB for container image with 100-bit copyright watermark, and 41.78 dB with localized watermark, 4.25 dB above EditGuard's 37.53 dB under the dual-watermark setting.
- Localization F1 of 0.947 under Stable Diffusion Inpaint degraded condition versus EditGuard's 0.740; average F1 gain under noisy conditions reported as about 20.7%.
- Copyright bit accuracy under Stable Diffusion Inpaint 0.989 and Gaussian noise 0.980 with training iteration time 0.16s vs 3.675s for Robust-Wide.
Measured effects reported in the paper
| What was changed | Where | Measured | Effect |
|---|---|---|---|
| replace EditGuard with OmniGuard | versatile watermark localization · Stable Diffusion Inpaint degraded | F1: 0.740 -> 0.947 | Helped |
| replace EditGuard with OmniGuard | versatile watermark localization · ControlNet Inpaint degraded | F1: 0.752 -> 0.952 | Helped |
| replace EditGuard with OmniGuard | versatile watermark localization · Splicing degraded | F1: 0.758 -> 0.895 | Helped |
| add OmniGuard's dual-watermark approach instead of EditGuard† | copyright watermark embedding · COCO test | PSNR (dB): 37.53 -> 41.78 | Helped |
| use OmniGuard instead of Robust-Wide | copyright watermark recovery · Instructp2p | Bit accuracy (%): 0.990 -> 0.981 | Hurt |
| use a fixed natural-image watermark instead of a fixed pure-image watermark (ablation) | OmniGuard localized watermark selection · COCO test | PSNR (dB): 39.64 -> 41.09 | Helped |
| use a fixed natural-image watermark instead of a fixed pure-image watermark (ablation) | OmniGuard localized watermark selection · COCO test | F1: 0.975 -> 0.957 | Hurt |
| use the original image as the localized watermark instead of a fixed natural image (ablation) | OmniGuard localized watermark selection · COCO test | PSNR (dB): 41.09 -> 40.28 | Hurt |
| use the original image as the localized watermark instead of a fixed natural image (ablation) | OmniGuard localized watermark selection · COCO test | F1: 0.957 -> 0.885 | Hurt |
| add adaptive watermark transform to a fixed natural-image watermark (ablation) | OmniGuard · COCO test | PSNR (dB): 41.09 -> 41.78 | Helped |
| remove tampered image input from the tamper extractor (ablation) | OmniGuard · COCO test | F1: 0.905 vs 0.961 | Hurt |
| remove degradation query from the tamper extractor (ablation) | OmniGuard · COCO test | F1: 0.935 vs 0.961 | Hurt |
Surprising findings
- Fixed pure-color localized watermark gives best localization but produces stripe-like artifacts that compromise imperceptibility.
- For global edits like InstructPix2Pix, the method tends to mark the entire image as tampered, which the authors say is consistent with its pixel-level focus.
Limitations
- Global semantic edits such as InstructPix2Pix cause the whole image to be flagged as tampered.
- Tamper extractor trained only on Stable Diffusion Inpaint tampering, with generalization claimed but not exhaustively shown.
Experimental setup
Datasets: MIRFlickr DIV2K COCO UltraEdit ImageNet-1k
Benchmarks: COCO UltraEdit
Metrics: F1-Score AUC PSNR SSIM bit accuracy
Baselines: MVSS-Net CAT-Net PSCC-Net HiFi-Net IML-ViT EditGuard PIMoG SepMark TrustMark Robust-Wide
Builds on: EditGuard Robust-Wide TrustMark IML-ViT Q-Former
Closest papers by meaning
- EditGuard: Versatile Image Watermarking for Tamper Localization and Copyright Protection (CVPR 2024 · similarity 0.89)
- StableGuard: Towards Unified Copyright Protection and Tamper Localization in Latent Diffusion Models (NeurIPS 2025 · similarity 0.87)
- FakeShield: Explainable Image Forgery Detection and Localization via Multi-modal Large Language Models (ICLR 2025 · similarity 0.86)
- Robust Watermarking Using Generative Priors Against Image Editing: From Benchmarking to Advances (ICLR 2025 · similarity 0.85)
- WMCopier: Forging Invisible Watermarks on Arbitrary Images (NeurIPS 2025 · similarity 0.84)
- Toward Real-world Text Image Forgery Localization: Structured and Interpretable Data Synthesis (NeurIPS 2025 · similarity 0.84)
Writing a paper in this area? scime draft is a free LaTeX editor with AI included, real-time co-authors and a check of your references and venue rules before you submit. It also imports OpenAI Prism projects.