Research map / Adversarial robustness and security / Attacks on text and graphs
RAW: A Robust and Agile Plug-and-Play Watermark Framework for AI-Generated Images with Provable Guarantees
Read the paperCheck your idea against 108,967 papers
AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.
Proposes RAW, a plug-and-play image watermarking method that jointly trains learnable additive watermarks (frequency and spatial domains) with a CNN verifier, and certifies FPR under bounded perturbations via randomized smoothing and conformal thresholding.
Problem
Detecting whether AI-generated images carry an owner's watermark robustly and quickly, under image manipulations and watermark-removal attacks, with provable false-positive-rate guarantees.
Approach
Replace fixed binary-code encoder-decoder watermarks with learnable watermark patterns added to images in both FFT and spatial domains, jointly trained with a binary classifier; apply randomized smoothing and conformal prediction to certify FPR under l2-bounded perturbations.
Key results
- Average AUROC under nine manipulations/attacks rises to 0.918 on MS-COCO vs 0.817 for RivaGan (and 0.543 for DwtDct), and 0.901 on DBDiffusion.
- Watermark injection takes 0.0051 s per image on MS-COCO, roughly 30x faster than DwtDct-based methods.
- Empirical FPR under certified settings (gamma=0.001, sigma=0.05) closely tracks the target alpha, e.g., 0.0042 for alpha=0.005 and 0.043 for alpha=0.05.
Measured effects reported in the paper
| What was changed | Where | Measured | Effect |
|---|---|---|---|
| Use RAW instead of RivaGan | Image watermark detection · MS-COCO, nine manipulations/attacks | Average AUROC: 0.817 -> 0.918 | Helped |
| Use RAW instead of RivaGan | Image watermark detection · DBDiffusion, nine manipulations/attacks | Average AUROC: 0.818 -> 0.901 | Helped |
| Use RAW instead of RivaGan | Image watermark embedding · MS-COCO | Encoding Speed: 1.16 -> 0.0051 | Helped |
| Use RAW instead of RivaGan | Image watermark embedding · DBDiffusion | Encoding Speed: 1.87 -> 0.0078 | Helped |
| Use RAW instead of RivaGan | Image watermarking · MS-COCO | FID: 24.87 -> 24.75 | No clear effect |
| Use RAW instead of RivaGan | Image watermarking · DBDiffusion | FID: 4.82 -> 5.17 | Hurt |
| Use RAW instead of RivaGan | Image watermark detection · MS-COCO, no manipulations or attacks | AUROC: 0.99 -> 0.98 | Hurt |
| Use RAW instead of RivaGan | Image watermark detection · DBDiffusion, no manipulations or attacks | AUROC: 0.99 -> 0.98 | Hurt |
| Jointly train the watermark and verification model rather than fixing the watermark (ablation) | RAW · Test data | Test accuracy | Helped |
| Add spatial-domain watermarks alongside frequency-domain watermarks (ablation) | RAW · Gaussian-noise manipulation on test data | Test accuracy | Helped |
Surprising findings
- Clean AUROC of RAW (0.98) is slightly below RivaGan (0.99) on both datasets, so gains are concentrated under manipulations and attacks.
Limitations
- Certified guarantee only holds for l2-bounded perturbations with small gamma (0.001 used), and the attack must not be excessively adversarial.
- RAW's clean AUROC is slightly lower than RivaGan and its performance drops on some manipulations (e.g., rotation AUROC 0.824 on DBDiffusion vs 0.999 for some baselines under noise).
Experimental setup
Datasets: MS-COCO DBDiffusion
Benchmarks: MS-COCO DBDiffusion
Metrics: AUROC FID CLIP score encoding speed certified FPR
Baselines: DwtDct DwtDctSvd RivaGan
Builds on: randomized smoothing conformal prediction Tree-Ring watermark RivaGAN DwtDct
Closest papers by meaning
- Robustness of AI-Image Detectors: Fundamental Limits and Practical Attacks (ICLR 2024 · similarity 0.88)
- Transferable Black-Box One-Shot Forging of Watermarks via Image Preference Models (NeurIPS 2025 · similarity 0.88)
- Shallow Diffuse: Robust and Invisible Watermarking through Low-Dim Subspaces in Diffusion Models (NeurIPS 2025 · similarity 0.87)
- Lightweight-Mark: Rethinking Deep Learning-Based Watermarking (ICML 2025 · similarity 0.87)
- PGID: Progressive Guided Inversion and Denoising for Robust Watermark Detection (NeurIPS 2026 · similarity 0.87)
- An Undetectable Watermark for Generative Image Models (ICLR 2025 · similarity 0.87)
Writing a paper in this area? scime draft is a free LaTeX editor with AI included, real-time co-authors and a check of your references and venue rules before you submit. It also imports OpenAI Prism projects.