Research map / Image generation / Autoregressive and latent generation
Mask Image Watermarking
Read the paperCheck your idea against 108,967 papers
AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.
Proposes MaskWM, a mask-guided encoder-decoder watermarking framework (MaskWM-D masks only at decoding; MaskWM-ED also at encoding) that supports global and local watermark embedding, extraction and localization.
Problem
Global image watermarking methods fail to extract watermarks from small or tampered local regions, cannot localize watermarked areas, and cannot embed watermarks locally; existing local methods like WAM are costly and limited to 32 bits.
Approach
Introduce a mask into the decoding stage (and optionally the encoding stage) during training, with mask prediction via a U2-Net head, so the decoder localizes watermarked regions and extracts bits only from them; the encoder can also be conditioned on the mask to embed locally, with JND modulation for visual quality.
Key results
- MaskWM-ED reaches PSNR 39.52, SSIM 0.9828, and 1.0000 no-distortion bit accuracy, with geometric-distortion accuracy 1.0000 versus WAM's 0.8979 (32 bits).
- Local extraction stays near 100% accuracy with only 5% of the image watermarked, per the paper's introduction.
- Training takes about 20 hours on a single A6000, reported as roughly 1/15 of WAM's TFLOPs (7.74e14 vs 1.13e16).
Measured effects reported in the paper
| What was changed | Where | Measured | Effect |
|---|---|---|---|
| Use MaskWM instead of WAM for geometric-distortion extraction | Global watermarking, 32-bit messages · MS-COCO 2014 val, geometric distortions | Bit Accuracy: 0.8979 -> 0.9998 (MaskWM-D); 0.8979 -> 1.0000 (MaskWM-ED) | Helped |
| Use MaskWM-D rather than global baselines for local extraction | Local watermark extraction · MS-COCO 2014 val, small watermarked areas | Bit Accuracy | Helped |
| Embed the mask during encoding (MaskWM-ED rather than MaskWM-D) | MaskWM · Local watermark extraction, small watermarked areas | Bit Accuracy | Helped |
| Embed the mask during encoding (MaskWM-ED rather than MaskWM-D) | MaskWM · Watermark localization, small regions | IoU | Helped |
| Use predicted or ground-truth local masks instead of a full-image mask before extraction (ablation) | MaskWM decoder · Local watermark extraction, small regions | Bit Accuracy | Helped |
| Add JND modulation instead of using the Base pixel-space MSE approach (ablation) | MaskWM-D · Visual quality and local extraction/localization | Local extraction and localization performance | No clear effect |
| Add GAN loss (ablation) | MaskWM-D · Local watermark extraction and localization | Performance | Hurt |
| Add LPIPS feature-space loss (ablation) | MaskWM-D · Local watermark extraction and localization | Performance | Hurt |
| Fine-tune with VAE-based distortions (ablation) | MaskWM · VAE adaptive attacks | Bit Accuracy | Helped |
| Fine-tune with VAE-based distortions (ablation) | MaskWM · Other distortions | Robustness | Hurt |
| Increase the number of embedded watermarks | MaskWM-ED · Multi-watermark embedding under geometric distortions | Extraction accuracy | Hurt |
| Train MaskWM-ED with single-watermark supervision and evaluate multiple watermarks | MaskWM-ED · Multi-watermark embedding | Extraction accuracy and localization | Helped |
Surprising findings
- Under geometric distortions, multi-watermark extraction accuracy of MaskWM-ED degrades as the number of watermarks grows, because rotation shrinks corner watermark regions.
- GAN and LPIPS losses reduced visible artifacts only at the cost of local extraction and localization performance, whereas JND modulation preserved performance.
Limitations
- Visible artifacts remain in some images, especially in smooth background regions.
- Multi-watermark extraction under geometric distortion degrades as watermark count increases.
- Performance under geometric transforms at 128 bits lags WAM in some ranges.
Experimental setup
Datasets: MS-COCO 2014 train MS-COCO 2014 val LaMa-style masks COCO object masks
Benchmarks: MS-COCO 2014 validation (global, 1k images) MS-COCO 2014 validation local set (9,600 pairs) multi-watermark set (400 images per config)
Metrics: PSNR SSIM bit accuracy IoU
Baselines: StegaStamp SepMark TrustMark EditGuard Robust-Wide VINE WAM
Builds on: WAM TrustMark LaMa mask generation U-Net U2-Net
Closest papers by meaning
- WMarkGPT: Watermarked Image Understanding via Multimodal Large Language Models (ICML 2025 · similarity 0.87)
- END^2: Robust Dual-Decoder Watermarking Framework Against Non-Differentiable Distortions (AAAI 2025 · similarity 0.87)
- ArcMark: Distortion-Free Multi-Byte LLM Watermark via Optimal Transport (NeurIPS 2026 · similarity 0.86)
- Lightweight-Mark: Rethinking Deep Learning-Based Watermarking (ICML 2025 · similarity 0.86)
- Watermark Anything With Localized Messages (ICLR 2025 · similarity 0.86)
- Decoder Gradient Shield: Provable and High-Fidelity Prevention of Gradient-Based Box-Free Watermark Removal (CVPR 2025 · similarity 0.86)
Writing a paper in this area? scime draft is a free LaTeX editor with AI included, real-time co-authors and a check of your references and venue rules before you submit. It also imports OpenAI Prism projects.