Research map / Architectures and efficiency / RNNs and normalization
Lightweight-Mark: Rethinking Deep Learning-Based Watermarking
Read the paperCheck your idea against 108,967 papers
AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.
Proposes a 0.016M-parameter lightweight deep watermarking model trained with a decoding-oriented surrogate loss (DO) and a detachable projection head (PH), plus a five-module encoder/decoder framework.
Problem
Lightweight deep learning watermarking models lose robustness and invisibility, partly because common decoding surrogate losses (MSE, BCE) spend model capacity on decoding-irrelevant optimization directions.
Approach
Decomposes MSE/BCE decoding losses into deflation, inflation and regularization terms; keeps only deflation-aligned penalties with a "safe distance" (DO loss) and adds a training-only projection head that is discarded at inference (PH), so a tiny network reaches state-of-the-art robustness and invisibility.
Key results
- Proposed lightweight model uses 0.016M total parameters (0.22 GFLOPs) versus 0.45M for HiDDeN, 0.75M for FIN, 20.80M for MBRS and 36.01M for CIN.
- DO loss reaches 99.36% average accuracy under combined noise at 41.70 dB PSNR, outperforming FIN (99.28%, 41.58 dB) and MBRS (99.25%, 40.72 dB).
- Under DiffPure attack at t=0.1, DO achieves 74.22% accuracy versus 67.68% for the MSE-trained model.
Measured effects reported in the paper
| What was changed | Where | Measured | Effect |
|---|---|---|---|
| Replace MSE loss with decoding-oriented surrogate loss | Lightweight watermarking model · Combined noise | average accuracy: 97.66 -> 99.36 | Helped |
| Replace MSE loss with decoding-oriented surrogate loss | Lightweight watermarking model · Combined noise | PSNR (dB): 39.31 -> 41.70 | Helped |
| Add a detachable projection head during training and discard it at inference | Lightweight watermarking model · Combined noise | average accuracy: 97.66 -> 99.28 | Helped |
| Add a detachable projection head during training and discard it at inference | Lightweight watermarking model · Combined noise | PSNR (dB): 39.31 -> 41.67 | Helped |
| Train with Ldeflation alone instead of the full MSE loss (ablation) | Lightweight watermarking model · Combined noise | average accuracy: 97.66 -> 97.97 | Helped |
| Train with Lregularization alone (ablation) | Lightweight watermarking model · Combined noise | average accuracy: 50.02 | Hurt |
| Train with Linflation alone (ablation) | Lightweight watermarking model · Combined noise | average accuracy: 49.78 | Hurt |
| Use decoding-oriented surrogate loss instead of Ldeflation alone (ablation) | Lightweight watermarking model · Combined noise | average accuracy: 97.97 -> 99.36 | Helped |
| Use detachable projection head instead of MSE loss | Lightweight watermarking model · DiffPure attack, t=0.1 | accuracy (%): 67.68 -> 69.24 | Helped |
| Use decoding-oriented surrogate loss instead of MSE loss | Lightweight watermarking model · DiffPure attack, t=0.1 | accuracy (%): 67.68 -> 74.22 | Helped |
Surprising findings
- Training with only the deflation term of MSE outperforms the full MSE loss, indicating the extra MSE terms waste capacity.
- Knowledge distillation from larger teachers degrades the student relative to the teacher, and the proposed DO/PH methods beat KD (FIN).
Limitations
- DO loss training with the deflation-only variant is reported as unstable, sometimes collapsing and needing manual weight adjustment.
- Diffusion-based purification attacks at higher denoising steps substantially degrade accuracy (74.22% at t=0.1), and the model is not robust to them at high t.
- Knowledge distillation from larger teachers loses performance as the capacity gap grows.
Experimental setup
Benchmarks: PSNR under combined noise (Dropout, JPEG, GN, S&P, GB, MB) PRGAI attack DiffPure attack
Metrics: PSNR bit accuracy parameter count FLOPs
Baselines: HiDDeN MBRS CIN FIN KD (HiDDeN) KD (MBRS) KD (CIN) KD (FIN)
Builds on: HiDDeN MBRS CIN FIN knowledge distillation
Closest papers by meaning
- END^2: Robust Dual-Decoder Watermarking Framework Against Non-Differentiable Distortions (AAAI 2025 · similarity 0.89)
- Decoder Gradient Shield: Provable and High-Fidelity Prevention of Gradient-Based Box-Free Watermark Removal (CVPR 2025 · similarity 0.89)
- SleeperMark: Towards Robust Watermark against Fine-Tuning Text-to-image Diffusion Models (CVPR 2025 · similarity 0.89)
- Learning to Watermark: A Selective Watermarking Framework for Large Language Models via Multi-Objective Optimization (NeurIPS 2025 · similarity 0.89)
- Transferable Black-Box One-Shot Forging of Watermarks via Image Preference Models (NeurIPS 2025 · similarity 0.88)
- WMarkGPT: Watermarked Image Understanding via Multimodal Large Language Models (ICML 2025 · similarity 0.88)
Writing a paper in this area? scime draft is a free LaTeX editor with AI included, real-time co-authors and a check of your references and venue rules before you submit. It also imports OpenAI Prism projects.