Research map / Architectures and efficiency / RNNs and normalization
END^2: Robust Dual-Decoder Watermarking Framework Against Non-Differentiable Distortions
Read the paperCheck your idea against 108,967 papers
AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.
Proposes END^2, a dual-decoder watermarking framework where a teacher decoder on clean watermarked images drives encoder gradients and a student decoder on non-differentiably distorted images is aligned to it via cosine feature loss, with swapping and momentum updates.
Problem
Training DNN image watermarking end-to-end requires differentiable noise layers, but real-world distortions (JPEG, photo filters, black-box style transfer) are non-differentiable, so robustness to them is poorly trained.
Approach
Use two structurally identical decoders: a Teacher Decoder on clean watermarked images that backpropagates to the encoder, and a Student Decoder on distorted images (gradient-truncated) whose latent features are aligned to the teacher's on a hypersphere via cosine similarity; the decoders are swapped periodically and the teacher is updated by momentum from the student.
Key results
- Under random combined distortion, END^2 reaches 94.55% ACC at 45.62 PSNR, versus 94.10% for TDSL (36.32 PSNR) and 92.37% for Forward ASL.
- Under real JPEG compression at Q=50 (PSNR fixed at 38), END^2 achieves 99.95% accuracy versus 99.76% for Forward ASL and 74.58% for TDSL.
- Ablation shows feature alignment alone raises ACC from 78.93% to 86.79%, and FA+MU+SL reaches 94.55%.
Measured effects reported in the paper
| What was changed | Where | Measured | Effect |
|---|---|---|---|
| use END^2 instead of TDSL | MBRS-based watermarking · Random distortion | ACC: 94.10 -> 94.55 | Helped |
| use END^2 instead of TDSL | MBRS-based watermarking · Random distortion | PSNR: 36.32 -> 45.62 | Helped |
| use END^2 instead of Forward ASL | MBRS-based watermarking · Real JPEG compression Q=30 | ACC: 80.43 -> 83.41 | Helped |
| use END^2 instead of Forward ASL | MBRS-based watermarking · Real JPEG compression Q=40 | ACC: 96.39 -> 94.39 | Hurt |
| add feature alignment loss (ablation) | END^2 · Ablation configurations | ACC: 78.93 -> 86.79 | Helped |
| add momentum updating to feature alignment (ablation) | END^2 · Ablation configurations | ACC: 86.79 -> 92.23 | Helped |
| add swapping learning to feature alignment (ablation) | END^2 · Ablation configurations | ACC: 86.79 -> 93.96 | Helped |
| add swapping learning alongside momentum updating (ablation) | END^2 with feature alignment and momentum updating · Ablation configurations | ACC: 92.23 -> 94.55 | Helped |
| replace proposed feature alignment with MSE loss (ablation) | END^2 · Feature alignment loss comparison | ACC: 94.55 -> 94.70 | No clear effect |
| replace proposed feature alignment with DINO alignment loss (ablation) | END^2 · Feature alignment loss comparison | ACC: 94.55 -> 91.39 | Hurt |
| replace proposed feature alignment with MSE loss (ablation) | END^2 · Feature alignment loss comparison | PSNR: 45.62 -> 42.92 | Hurt |
Surprising findings
- Even without a differentiable noise layer, END^2 surpasses MBRS trained with a differentiable noise layer (89.17% ACC) under random distortion.
- Momentum updating alone with feature alignment lowers PSNR (39.26) while raising ACC, indicating a visual-quality trade-off.
Limitations
- Gradient truncation via stop-gradient on the distortion is used to simulate non-differentiability, which is an approximation of the deployment setting.
- Experiments use a single 30-bit message length and a single base architecture (MBRS), limiting evidence of generality across END architectures.
- Some comparisons are single-run with fixed PSNR targets; the paper does not report variance.
Experimental setup
Datasets: DIV2K COCO ImageNet
Benchmarks: DIV2K COCO ImageNet
Metrics: bit accuracy PSNR SSIM
Baselines: TDSL Forward ASL MBRS HiDDeN StegaStamp
Builds on: MBRS TDSL Forward ASL HiDDeN
Closest papers by meaning
- Lightweight-Mark: Rethinking Deep Learning-Based Watermarking (ICML 2025 · similarity 0.89)
- Decoder Gradient Shield: Provable and High-Fidelity Prevention of Gradient-Based Box-Free Watermark Removal (CVPR 2025 · similarity 0.89)
- Mask Image Watermarking (NeurIPS 2025 · similarity 0.87)
- RAW: A Robust and Agile Plug-and-Play Watermark Framework for AI-Generated Images with Provable Guarantees (NeurIPS 2024 · similarity 0.87)
- Image Watermarks are Removable using Controllable Regeneration from Clean Noise (ICLR 2025 · similarity 0.85)
- T2SMark: Balancing Robustness and Diversity in Noise-as-Watermark for Diffusion Models (NeurIPS 2025 · similarity 0.85)
Writing a paper in this area? scime draft is a free LaTeX editor with AI included, real-time co-authors and a check of your references and venue rules before you submit. It also imports OpenAI Prism projects.