Research map / Image generation / Image restoration
Watermark Anything With Localized Messages
Read the paperCheck your idea against 108,967 papers
AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.
Redefines image watermarking as a per-pixel segmentation task with a jointly trained embedder/extractor (WAM), enabling localization of watermarked regions and extraction of multiple 32-bit messages from small areas.
Problem
Traditional image watermarking makes one global decision per image and fails when only a small part is watermarked, as in splicing or inpainting; it also cannot localize watermarks or extract multiple messages.
Approach
Treat watermark extraction as segmentation: an extractor outputs a per-pixel detection score and 32-bit message, trained in two phases (robustness pre-training at low resolution with random masking/augmentation, then JND-based post-training for imperceptibility and multiple watermarks), with DBSCAN clustering to separate multiple messages.
Key results
- On COCO, WAM reaches 100% TPR with 99.2% bit accuracy under inpainting and 95.3% bit accuracy under splicing, where baselines mostly fail to exceed 90%.
- WAM extracts up to five distinct 32-bit messages from non-overlapping 10% regions of 256x256 images with under 1 bit error on average after the second training phase.
- PSNR around 38 dB on COCO and DIV2K, comparable to HiDDeN, DCTDWT, SSL, FNNS and TrustMark.
Measured effects reported in the paper
| What was changed | Where | Measured | Effect |
|---|---|---|---|
| Add JND attenuation and fine-tune in the second training phase (ablation) | WAM · Watermark imperceptibility | PSNR: PSNR ≈ 25 dB -> PSNR ≈ 38 dB | Helped |
| Add JND attenuation without fine-tuning (ablation) | WAM first-phase model · Detection and decoding | detection and decoding performance | Hurt |
| Fine-tune with JND attenuation (ablation) | WAM first-phase model · Detection and decoding | detection and decoding performance | Helped |
| Add multiple-message training with distinct messages in separate masks (ablation) | WAM · Multiple 10% image regions, up to five messages | bit accuracy: more than 95% | Helped |
| Use the first training phase only, without multiple-message post-training (ablation) | WAM · Multiple watermarks in one image | bit accuracy | Hurt |
| Add horizontal flip and contrast adjustment | WAM with five 32-bit messages · Multiple 10% watermarked regions | mIoU: 85% mIoU | Helped |
| Add horizontal flip and contrast adjustment | WAM with five 32-bit messages · Multiple 10% watermarked regions | bit accuracy: exceeds 95% | Helped |
| Also apply JPEG compression after horizontal flip and contrast adjustment | WAM with multiple messages · Multiple watermarks in one image | multiple-message extraction | Hurt |
| Watermark only 10% of the 256 × 256 image | WAM · COCO localization and message extraction | decoded bits: 31 out of 32 bits | Helped |
| Use WAM rather than EditGuard | Localized watermarking · COCO localization, including cropping | localization accuracy | Helped |
| Use WAM rather than other compared watermarking methods | Watermark detection and decoding · COCO and DIV2K, inpainting and splicing | TPR and bit accuracy: COCO: 97.9 TPR, 99.2 Bit acc.; 100.0 TPR, 95.3 Bit acc. | DIV2K: 100.0 TPR, 99.8 Bit acc.; 99.5 TPR, 94.2 Bit acc. | Helped |
Surprising findings
- Without the second training phase, WAM predicts the same wrong message for all watermarked pixels when multiple watermarks are present.
Limitations
- Payload limited to 32 bits per message; training on larger messages is challenging.
- Watermark can remain visible in some areas with repetitive patterns despite JND weighting.
- Fails to decode multiple messages when JPEG compression is added on top of flip and contrast transforms.
Experimental setup
Datasets: MS-COCO DIV2K
Benchmarks: COCO validation DIV2K validation
Metrics: PSNR SSIM LPIPS TPR FPR bit accuracy mIoU
Baselines: HiDDeN DCTDWT SSL watermark FNNS TrustMark EditGuard
Builds on: HiDDeN SETR Segment Anything LDM autoencoder (VQGAN-style) EditGuard
Closest papers by meaning
- Mask Image Watermarking (NeurIPS 2025 · similarity 0.86)
- Black-Box Detection of Language Model Watermarks (ICLR 2025 · similarity 0.84)
- WMarkGPT: Watermarked Image Understanding via Multimodal Large Language Models (ICML 2025 · similarity 0.83)
- Black-Box Forgery Attacks on Semantic Watermarks for Diffusion Models (CVPR 2025 · similarity 0.83)
- WMCopier: Forging Invisible Watermarks on Arbitrary Images (NeurIPS 2025 · similarity 0.83)
- Lightweight-Mark: Rethinking Deep Learning-Based Watermarking (ICML 2025 · similarity 0.83)
Writing a paper in this area? scime draft is a free LaTeX editor with AI included, real-time co-authors and a check of your references and venue rules before you submit. It also imports OpenAI Prism projects.