Decoupling Defense Strategies for Robust Image Watermarking

AI summary

Overview

Research area: Computer vision security, specifically deep learning-based image watermarking and its robustness against attacks.

Technical level: Advanced. The paper assumes familiarity with adversarial training, PGD optimization, diffusion-model regeneration attacks, bit accuracy metrics, and encoder-decoder watermarking architectures.

Scope: This paper proposes AdvMark, a two-stage fine-tuning framework that separates defenses against three distinct attack families, evaluated on two datasets, nine watermarking methods, and ten attacks.

What This Paper Is About

Deep learning watermarking can hide a secret message inside an image so that a decoder can later recover it, but existing methods that train encoder and decoder together against simulated distortions remain breakable by diffusion-based regeneration attacks and by adversarial attacks such as WEvade. The authors identify two problems with this joint-training approach: training the decoder adversarially lowers accuracy on clean, unattacked images, and forcing one model to learn all three attack types at once converges slowly and yields only limited robustness. AdvMark's goal is to defend against all three attack families while keeping both image quality and clean accuracy high, by splitting the defense into two separate stages instead of optimizing everything jointly.

Key Contributions

1. First systematic evaluation across three attack families. The authors state they are the first to evaluate existing watermarking methods against distortion, regeneration, and adversarial attacks together, and they use this evaluation to identify two challenges: clean-accuracy loss from decoder training, and limited robustness from simultaneous training of non-trivial attacks.

2. Stage 1 — encoder-focused adversarial fine-tuning with a defender-tailored attack. They design a modified adversarial example construction that drives the decoded bit accuracy toward 0.5 (a random guess) rather than toward a separate random target message, and a training paradigm that mainly fine-tunes the encoder while updating the decoder only when robustness falls below a threshold.

3. Stage 2 — direct image optimization with a constrained image loss. They optimize the encoded image directly against distortion and regeneration attacks, adding a term that limits deviation from the previously encoded image, justified by a theorem about preserving the robustness gained in stage 1. They also replace the usual epsilon-ball projection with a quality-aware PGD variant that early-stops on a PSNR budget.

4. Extensive empirical validation. Experiments with nine watermarking methods against ten attacks show AdvMark achieves the highest image quality and comprehensive robustness, reported as up to 29%, 33%, and 46% accuracy improvement for distortion, regeneration, and adversarial attacks respectively.

Main Findings

• Clean accuracy is preserved by moving images rather than shifting boundaries. The paper reports that joint adversarial training on MBRS improves robustness but drops clean accuracy to 0.94 due to significant landscape modification, whereas the encoder-focused alternative (MBRS-EAT) maintains high clean accuracy while achieving competitive robustness. AdvMark reports 1.00 clean accuracy on MS-COCO and DiffusionDB in Table 2.

• Stage 1 alone is not enough. The authors report that encoder-focused adversarial training still leaves accuracy of 0.65 against regeneration and 0.77 against WEvade, showing a gap compared with JPEG, which motivates the second stage.

• Substantial robustness gains over baselines. On MS-COCO, AdvMark reaches 0.99, 1.00, 1.00, and 1.00 on four distortion attacks, 0.83 on the four combined, 0.87 on V1-4 and V1-5, 0.98 against WEvade, 1.00 against Black-S, and 0.73 against Black-Q. On DiffusionDB the corresponding figures are 0.98, 1.00, 1.00, 1.00, 0.83, 0.85, 0.85, 0.96, 1.00, and 0.74. Comparisons include MBRS (0.76 on combined distortions, 0.82 against WEvade) and other baselines.

• Highest reported visual quality. For 128x128 images with a 30-bit message, AdvMark achieves PSNR 37.0, SSIM 0.99, LPIPS 0.01 on MS-COCO, improving on the original MBRS PSNR of 32.1. At 256x256 with a 100-bit message it reaches PSNR 38.9 / SSIM 0.99 / LPIPS 0.01 on MS-COCO and 38.8 / 0.99 / 0.01 on DiffusionDB. The authors attribute this to the two-stage design and the losses in Equations 5 and 9.

• Ablation confirms both stages are necessary. Removing stage 1 drops PSNR to 34.7 and WEvade accuracy to 0.50; removing stage 2 leaves WEvade at 0.99 but reduces JPEG accuracy to 0.88 and combined-distortion accuracy to 0.65.

• A theoretical guarantee on robustness preservation. Assumption 1 states that the constrained image loss is minimized such that the distance between the stage-2 and stage-1 encoded images is at most δ < α. Theorem 1 then shows that if the stage-1 image is robust within budget α, the stage-2 image stays robust within the reduced budget α − δ. The authors report an empirical check with α = 0.012, δ = 0.007, and an actual η2 bound of 0.010, which exceeds α − δ.

• Baselines improve when given stage 2. Applying direct image optimization after HiDDeN, Stable Signature, and PIMoG improves their robustness against distortion and regeneration attacks, and applying the full two-stage pipeline to HiDDeN raises comprehensive robustness with only 0.4 dB of PSNR improvement and up to 34% accuracy improvement — the paper attributes the quality trade-off to HiDDeN's own vulnerability to simple distortions.

• Strength-tuning alone cannot match the proposed method. MBRS variants with strength factors S = 0.6, 1.0, and 2.0 yield PSNR of 38.0, 32.1, and 28.1 respectively, trading quality for robustness, yet AdvMark still beats the S = 2.0 baseline with a reported 9% accuracy improvement against regeneration and adversarial attacks.

• Robustness across geometric and combined attacks. With Crop (p = 0.035), Resize (r = 0.7), Dropout (p = 0.3), SaltPepper (p = 0.1), Rotation (a = 30 degrees), and Hue (δ = 0.2), AdvMark reports 1.00 on all six geometric attacks, and 0.87 / 0.81 on Reg+Adv and Adv+Reg combined attacks.

• Moderate overhead. Training cost is described as O(1/2 * N) for AdvMark versus O(N) for typical joint adversarial training, where N is total iterations; the paper reports real-time decoding with acceptable overhead from image optimization.

• Black-box query attacks force greater distortion. The authors report AdvMark extracts roughly 15 PSNR of quality loss from the Black-Q attack, which they attribute to the image-moving strategy.

Methodology in Plain English

The starting point is a pretrained encoder-decoder pair (the paper uses MBRS). The encoder hides a message in an image; the decoder reads it back; bit accuracy measures how many bits match.

Stage 1 targets adversarial attacks, where an attacker perturbs the watermarked image slightly to fool the decoder. The authors build adversarial examples with a modified objective: instead of pushing the decoder output toward some arbitrary wrong message, they push it toward a coin-flip result (bit accuracy of about 0.5 relative to the true message). They then fine-tune mostly the encoder, for a fixed number of rounds, using a loss that combines adversarial robustness, clean accuracy, and image similarity (MSE plus LPIPS). Only if the final robustness accuracy falls below a threshold does the decoder get a single update. The intuition given is that the encoder learns to move images into a "non-attackable" region rather than reshaping the decoder's decision boundary, which is what protects clean accuracy.

Stage 2 targets distortion attacks (for example JPEG, noise, blur, brightness) and diffusion-based regeneration attacks, which the authors treat with direct optimization of the encoded image itself, because these attacks do not require differentiating through the decoder in the same way. The loss averages the bit-accuracy losses of the differentiable attack simulations, keeps clean accuracy, and adds a constrained image term that includes the distance to the original cover image plus two times the distance to the stage-1 encoded image. This last term is what the theorem says preserves the earlier adversarial robustness. Optimization uses a sign-based update with a twist: instead of projecting the image into an epsilon-ball, the algorithm accepts an update only if PSNR relative to the cover image stays at or above a budget p, and stops early when PSNR falls below p. Attacks whose bit accuracy already exceeds a threshold are dropped from the loss to avoid wasted optimization.

Key settings reported: encoder iterations iter_E = 10 in stage 1, learning rates α_E = α_D = 5e-4, perturbation budget r = 20/255, weights λ_w1 = 1 and λ_i1 = 3; in stage 2, K = 4 distortion attacks with JPEG weight λ_a2 = 1 and the rest λ_ak = 0.1 for k in [3,6], optimization iterations iter_o = 10, learning rate α_x = 5e-2, weights λ_w2 = 0.1 and λ_i2 = 5, and PSNR budget p = 36. Both thresholds are set to τ1 = τ2 = 0.95, and the black-box query attack threshold is τ' = 0.75. Regeneration uses two Stable Diffusion checkpoints; all experiments run on an NVIDIA RTX 4090.

Why This Matters

Impact on research: The paper reframes watermarking robustness as a decoupling problem rather than a single joint optimization, and it provides an empirical demonstration that decoder adversarial training is the source of clean-accuracy degradation in this setting. It also contributes the constrained image loss with a stated theorem linking stage-2 image movement to preserved adversarial robustness, plus a quality-aware substitute for epsilon-ball projection. For the broader adversarial-robustness community, the result that moving inputs into a safer region can outperform boundary expansion is a reusable insight.

Real-world applications:

• Tracing and authenticating AI-generated content, which the paper cites as the motivating use case given models such as Stable Diffusion and Sora.
• Intellectual property protection for images, where the watermark must survive re-encoding, resizing, and editing pipelines.
• Provenance and authenticity verification on content platforms that automatically recompress and transform uploaded media.
• Defending against malicious watermark-removal services, since the method is explicitly evaluated against WEvade, black-box query attacks, and surrogate-based transfer attacks.

Industry relevance: Any organization deploying invisible watermarking for AIGC provenance needs robustness against regeneration and adversarial stripping, not just JPEG. The reported overhead figures matter here: real-time decoding and O(1/2 * N) training cost are more deployable than approaches the paper contrasts with, such as EditGuard's inverse neural network or VINE's heavy diffusion model. The result that stage 2 can be bolted onto other backbones (HiDDeN, Stable Signature, PIMoG) also suggests the technique is portable rather than tied to one vendor's model.

Future Directions

• Extending beyond images. All experiments here are on 128x128 and 256x256 images from MS-COCO and DiffusionDB; whether the same decoupling works for video or audio watermarking is untested.

• Making adversarial optimization on attacked images feasible. The authors deliberately avoid optimizing against adversarial attacks in stage 2 because first-order derivatives of the image would require higher-order derivatives with prohibitive computation and memory cost, and because ReLU networks are locally almost linear, making second derivatives near zero and convergence hard. Relaxing this constraint is an open problem they raise.

• Broadening the theoretical guarantee. Theorem 1 depends on Assumption 1 and is checked empirically at a single setting (α = 0.012, δ = 0.007, actual η2 bound 0.010). Testing the bound across more images, message lengths, and attack budgets would strengthen the claim.

• Adapting to stronger and unseen adaptive attacks. The paper already notes that geometric and advanced combined attacks are handled in a supplementary table, and that Reg+Adv behaves like regeneration alone because regeneration degrades quality enough to break the adversarial budget. Whether attackers who know about the two-stage design can defeat it remains open.

Target Audience

This paper is most useful for researchers and engineers working on watermarking, adversarial robustness, or AIGC provenance who already understand encoder-decoder watermarking and PGD-style optimization. It also suits practitioners evaluating deployable watermarking under realistic threat models, and graduate students looking for a worked example of decoupling a multi-attack defense problem into sequential fine-tuning stages with an accompanying theoretical argument. Readers without a background in adversarial attacks, diffusion models, or the PSNR/SSIM/LPIPS metrics will find the methodology sections difficult.

Authors’ abstract

Deep learning-based image watermarking, while robust against conventional distortions, remains vulnerable to advanced adversarial and regeneration attacks. Conventional countermeasures, which jointly optimize the encoder and decoder via a noise layer, face 2 inevitable challenges: (1) decrease of clean accuracy due to decoder adversarial training and (2) limited robustness due to simultaneous training of all three advanced attacks. To overcome these issues, we propose AdvMark, a novel two-stage fine-tuning framework that decouples the defense strategies. In stage 1, we address adversarial vulnerability via a tailored adversarial training paradigm that primarily fine-tunes the encoder while only conditionally updating the decoder. This approach learns to move the image into a non-attackable region, rather than modifying the decision boundary, thus preserving clean accuracy. In stage 2, we tackle distortion and regeneration attacks via direct image optimization. To preserve the adversarial robustness gained in stage 1, we formulate a principled, constrained image loss with theoretical guarantees, which balances the deviation from cover and previous encoded images. We also propose a quality-aware early-stop to further guarantee the lower bound of visual quality. Extensive experiments demonstrate AdvMark outperforms with the highest image quality and comprehensive robustness, i.e. up to 29\%, 33\% and 46\% accuracy improvement for distortion, regeneration and adversarial attacks, respectively.