Research map / Image generation / Autoregressive and latent generation
On the Coexistence and Ensembling of Watermarks
Read the paperCheck your idea against 108,967 papers
AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.
Studies whether deep and classical image watermarks can coexist when applied sequentially to the same image, and shows that ensembling them (with strength clipping and linear ECCs) increases capacity and enables new accuracy-quality trade-offs without retraining.
Problem
Multiple watermarks from different actors or for super-watermark decoder identification must be embedded in the same image, but it was unknown whether modern watermarking methods can coexist without overwriting each other; post-training modification of watermark capacity and trade-offs also requires
Approach
Shows empirically that most pairs of open-source image watermarks can be applied in series and both decoded with non-zero accuracy, then exploits this coexistence to build series/parallel watermark ensembles that add message capacity and, combined with PSNR-based strength clipping and linear error-correcting codes, yield new capacity-accuracy-robustness-quality trade-offs without retraining.
Key results
- No watermark method coexists with itself: the first secret drops to 0% accuracy on the diagonal, while the second watermark keeps high accuracy across most pairs.
- Ensembling TrustMark B with SSL (series, 100-bit secrets each) gives a 200-bit capacity ensemble; applying clipping and a [200,100,32] ECC yields 100 bits with up to 15 correctable bit flips.
- RoSteALS ensembled with SSL improves accuracy by almost 15%, RivaGAN-robustness by more than 8%, and PSNR by 2dB while keeping 100-bit capacity; HiDDeN capacity rises from 48 to 102 bits when ensembled with RoSteALS.
Measured effects reported in the paper
| What was changed | Where | Measured | Effect |
|---|---|---|---|
| Apply a second watermark after TrustMark Q | TrustMark Q · Watermark coexistence | first watermark accuracy: up to 76% | Hurt |
| Apply HiDDeN after SSL | SSL · Watermark coexistence | first watermark accuracy: 58% | Hurt |
| Apply the same watermark method twice with different secrets | Deep watermarking methods · Watermark coexistence | first watermark accuracy: 0% | Hurt |
| Use parallel rather than series ensembling | Watermark ensembles · RoSteALS + HiDDeN images | PSNR above 40dB: 5.6% | Helped |
| Ensemble TrustMark B with SSL and apply ECC | TrustMark B + SSL ensemble · Watermark ensemble | capacity: 100+100=200 bits to 100 bits | Helped |
| Ensemble RoSteALS with SSL using series application, 0.2 clipping, and ECC | RoSteALS + SSL ensemble · Watermark ensemble | accuracy: almost 15% | Helped |
| Ensemble RoSteALS with SSL using series application, 0.2 clipping, and ECC | RoSteALS + SSL ensemble · RivaGAN augmentations | robustness: more than 8% | Helped |
| Ensemble RoSteALS with SSL using series application, 0.2 clipping, and ECC | RoSteALS + SSL ensemble · Watermark ensemble | image quality: 2dB | Helped |
| Ensemble HiDDeN with RoSteALS using series application, 1.0 clipping, and ECC | HiDDeN + RoSteALS ensemble · Watermark ensemble | capacity: from 48 bits to 102 bits | Helped |
| Ensemble HiDDeN with RoSteALS using series application, 1.0 clipping, and ECC | HiDDeN + RoSteALS ensemble · Watermark ensemble | accuracy | Helped |
| Ensemble HiDDeN with RoSteALS using series application, 1.0 clipping, and ECC | HiDDeN + RoSteALS ensemble · Watermark ensemble | image quality | Helped |
| Clip both watermarks to strength 0.5 (ablation) | Watermark ensembles · Watermark coexistence | accuracy | Hurt |
Surprising findings
- Contrary to expectations, the first watermark's secret is often still decodable with high accuracy after a second watermark is applied.
- Series-ensembled images without strength clipping have a drastic PSNR drop, while parallel ensembling yields higher quality.
Limitations
- Uses PSNR as a proxy for image quality, which does not track human perception well.
- Ensembling doubles encoding and decoding inference cost since both models must run.
- Evaluated only on image watermarks, not video, audio or text.
Experimental setup
Datasets: Adobe Stock images (1020 samples)
Benchmarks: Adobe Stock (1020 images)
Metrics: secret accuracy (fraction fully decoded) robustness under augmentations PSNR capacity (bits)
Baselines: DwtDct DwtDctSvd RivaGAN SSL HiDDeN RoSteALS TrustMark B TrustMark Q
Builds on: Stable Signature RoSteALS TrustMark SSL watermarking RivaGAN
Closest papers by meaning
- Transferable Black-Box One-Shot Forging of Watermarks via Image Preference Models (NeurIPS 2025 · similarity 0.86)
- WMCopier: Forging Invisible Watermarks on Arbitrary Images (NeurIPS 2025 · similarity 0.85)
- WAVES: Benchmarking the Robustness of Image Watermarks (ICML 2024 · similarity 0.85)
- Robust Watermarking Using Generative Priors Against Image Editing: From Benchmarking to Advances (ICLR 2025 · similarity 0.85)
- Lightweight-Mark: Rethinking Deep Learning-Based Watermarking (ICML 2025 · similarity 0.85)
- MuST: Robust Image Watermarking for Multi-Source Tracing (AAAI 2024 · similarity 0.85)
Writing a paper in this area? scime draft is a free LaTeX editor with AI included, real-time co-authors and a check of your references and venue rules before you submit. It also imports OpenAI Prism projects.