Research map / Adversarial robustness and security / Attacks on text and graphs
IWRN:A Robust Blind Watermarking Method for Artwork Image Copyright Protection Against Noise Attack
Read the paperCheck your idea against 108,967 papers
AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.
Proposes IWRN, a blind watermarking method for artwork images that combines a learnable wavelet network, a deform-attention invertible neural network with a decoding optimization module, and joint contrast learning to resist 12 noise attacks.
Problem
Blind watermarking of artwork images must keep the watermark imperceptible while remaining robustly extractable under various noise attacks such as affine transforms, rotation, and cropping.
Approach
Embeds watermarks into learned high-frequency wavelet sub-bands (LWN) using an invertible network whose sub-modules use deformable convolution and SE attention (DA-INN), adds a separate attention-based decoder (DOM) to improve extraction, and trains with a contrastive JCL loss on both encoding and decoding.
Key results
- Average over 12 noise attacks: 46.74 dB PSNR, 96.94% SSIM, and 99.91% accuracy for individual-noise models.
- In the comparison under the shared noise pool, IWRN reaches 41.55 dB PSNR and 99.57% average accuracy, versus 39.74 dB and 97.60% for the next-best CIN.
- Ablation: removing DA-INN, LWN, DOM, or JCL lowers PSNR and accuracy; the full model gets 41.55 dB and 99.57%.
Measured effects reported in the paper
| What was changed | Where | Measured | Effect |
|---|---|---|---|
| add DA-INN, replacing conventional dense blocks with DA-dense blocks (ablation) | IWRN · NAll | PSNR (DB): 37.19 -> 41.55 | Helped |
| add LWN instead of standard convolutional upsampling and downsampling (ablation) | IWRN · NAll | PSNR (DB): 38.39 -> 41.55 | Helped |
| add DOM instead of decoding with a fully connected layer from IRS (ablation) | IWRN · NAll | PSNR (DB): 35.85 -> 41.55 | Helped |
| add JCL (ablation) | IWRN · NAll | PSNR (DB): 40.16 -> 41.55 | Helped |
Surprising findings
- The INN-based baseline CIN is weaker than some end-to-end methods (StegaStamp, PIMoG, DWSF) under affine and rotation attacks.
Limitations
- Robustness drops under higher-intensity affine (89.11% at factor 2.0) and hue (86.06% at factor 2.5) noise.
- Training is per-noise-pool; the paper's main results rely on fixed noise types and 128x128 images.
Experimental setup
Datasets: COCO 2017 WikiArt DIV2K
Benchmarks: COCO 2017 WikiArt DIV2K
Metrics: PSNR SSIM ACC (1-BER) MOS
Baselines: HiDDeN IGA StegaStamp PIMoG CIN DWSF MuST
Builds on: HiNet CIN HiDDeN SimSiam contrastive learning LPIPS
Closest papers by meaning
- Robust Watermarking Using Generative Priors Against Image Editing: From Benchmarking to Advances (ICLR 2025 · similarity 0.85)
- WAVES: Benchmarking the Robustness of Image Watermarks (ICML 2024 · similarity 0.85)
- Embedding Robust Watermarking into Pattern to Protect the Copyright of Ceramic Artifacts (AAAI 2025 · similarity 0.84)
- END^2: Robust Dual-Decoder Watermarking Framework Against Non-Differentiable Distortions (AAAI 2025 · similarity 0.84)
- Hidden in the Noise: Two-Stage Robust Watermarking for Images (ICLR 2025 · similarity 0.84)
- An Undetectable Watermark for Generative Image Models (ICLR 2025 · similarity 0.84)
Writing a paper in this area? scime draft is a free LaTeX editor with AI included, real-time co-authors and a check of your references and venue rules before you submit. It also imports OpenAI Prism projects.