SpecGuard: Spectral Projection-based Advanced Invisible Watermarking

AI summary

Overview

• Research area: Computer vision and digital media security, specifically learning-based invisible image watermarking for authenticity verification and copyright protection.
• Technical level: Intermediate to Advanced. The method combines wavelet decomposition, Fast Fourier Transform-based spectral projection, a learnable threshold derived from Parseval's theorem, and end-to-end encoder/decoder training, though the paper's framing and reported metrics are accessible to a general machine-learning reader.
• Scope: The paper proposes SpecGuard, a watermark encoder-decoder that embeds binary messages into the high-frequency wavelet band of an image in the spectral domain and extracts them reliably under distortions, regeneration, and adversarial attacks.

What This Paper Is About

Invisible watermarking hides a pattern in an image so that authenticity and ownership can later be verified. Existing deep watermarking methods such as StegaStamp, Stable Signature, and HiDDeN embed watermarks end-to-end but are fragile to common operations like resizing, cropping, compression, and noise, and are also vulnerable to adversarial perturbation. SpecGuard addresses this by embedding message bits into high-frequency spectral components instead of the spatial domain, so the watermark remains imperceptible while surviving a wider range of transformations.

Key Contributions

1. Spectral high-frequency embedding: A watermarking approach that embeds message bits in high-frequency spectral components via wavelet and spectral projection inside hidden convolutional layers, targeting the S_HH sub-band rather than the image pixels directly.
2. Parseval-based learnable threshold: Adaptation of Parseval's theorem as a learnable threshold that optimizes the model and spectral masking, allowing robust watermark bit recovery under distortions, regeneration, and adversarial attacks.
3. Efficient FFT approximation: A spectral projection computed by symmetrically extending an N×N matrix to 2N×2N by mirroring, then applying a 2D FFT so the spectral coefficients are read from the real part, keeping the transform computationally efficient.
4. Broad empirical evaluation: Experiments reporting superior bit embedding capacity and better-quality watermarked images compared with state-of-the-art (SOTA) pre-processing and post-processing watermarking methods.

Main Findings

• Perceptual quality across resolutions: With a fixed 30-bit message length, SpecGuard reaches PSNR/SSIM of 40.361/0.9889 (256×256 CelebA-HQ), 40.320/0.9888 (256×256 MS-COCO), 44.651/0.9927 (512×512 CelebA-HQ), 44.680/0.9927 (512×512 MS-COCO), 48.170/0.9937 (1024×1024 CelebA-HQ), and 48.081/0.9936 (1024×1024 MS-COCO). FID ranges from 16.451 to 17.446 and MSE is 0.0002 at 256×256 and 0.0001 at both 512×512 and 1024×1024.

• Comparison without attacks: At a 128-bit message length, SpecGuard reports a PSNR of 42.89 (the highest among compared methods), an SSIM of 0.99, an FID of 17.0, and a Bit Recovery Accuracy (BRA) of 0.99. At 64 bits it reports 42.59 PSNR / 0.98 SSIM / 17.2 FID / 0.99 BRA, and at 256 bits 40.86 PSNR / 0.99 SSIM / 17.6 FID / 0.98 BRA. The paper states SpecGuard attains the highest SSIM of 0.99 at BL 128 and 256, the lowest FID of 17.0, and the highest BRA of 0.99 among all compared methods.

• Capacity: Experiments at 64, 128, and 256 bits show high embedding capacity maintained alongside perceptual quality and robustness. The paper notes that unlike StegaStamp and HiDDeN, which lose BRA at higher message bit counts, SpecGuard consistently extracts bits across all tested lengths.

• Robustness to distortions: Against cropping and rotation, SpecGuard reports an Avg P of 0.998 and 0.687 respectively. Across combined distortion-based attacks it reports an Avg P of 0.911 and an Avg Q of 0.952. The comparison table defines "inf" as no attack being sufficient to push performance below the threshold (strong robustness) and "−inf" as even the weakest attack dropping detection below the threshold (weak robustness); several SpecGuard cells are "inf".

• Robustness to regeneration and adversarial attacks: SpecGuard is reported to maintain high Avg P against regeneration attacks such as Rinse-2xDiff (an image is noised then denoised by Stable Diffusion v1.4 two times, with strength as a number of timesteps, 20–100) and Regen-VAE, and to consistently preserve watermark detectability under adversarial attacks, outperforming existing techniques (the text is truncated at this point in the provided content).

• Social media and Photoshop Neural Filters: On 200 randomly selected MS-COCO images, SpecGuard reports PSNR/SSIM and BRA of 48.56/0.97 and 0.97 after Facebook upload, 47.55/0.97 and 0.96 after LinkedIn, 48.56/0.98 and 0.98 after Instagram, 42.10/0.96 and 0.97 after WhatsApp, and 49.25/1.00 and 0.99 after X (Twitter). Under Photoshop Neural Filters: Depth Blur 25.25/0.89 with 0.85 BRA, Artistic Style Transfer 25.12/0.84 with 0.85 BRA, Super Zoom 36.15/0.88 with 0.95 BRA, JPEG Artifacts 31.01/0.85 with 0.94 BRA, and Colorize 23.15/0.82 with 0.92 BRA.

• Ablation: With M = 128, r = 100, and s = 20, wavelet projection at level 1 alone gives 40.51/0.96 PSNR/SSIM and 0.92 BRA, while adding FFT-approximated spectral projection raises this to 42.89/0.99 and 0.99 BRA. Wavelet projection at level 2 alone gives 38.15/0.93 and 0.87 BRA; with spectral projection, 36.25/0.92 and 0.89 BRA. Under attack, BRA stays at 0.82 for 45-degree rotation, 0.65 for 90-degree rotation, 0.98 for blur at 0.3 and 0.6, 0.93 for geometric attack at 0.3, and 0.86 at 0.6.

Methodology in Plain English

SpecGuard splits into an encoder and a decoder. The encoder takes a cover image and a binary message and works on a wavelet decomposition of the image, which produces low-frequency and high-frequency sub-bands. The high-frequency S_HH sub-band, which carries fine detail, is the target: the

Authors’ abstract

Watermarking embeds imperceptible patterns into images for authenticity verification. However, existing methods often lack robustness against various transformations primarily including distortions, image regeneration, and adversarial perturbation, creating real-world challenges. In this work, we introduce SpecGuard, a novel watermarking approach for robust and invisible image watermarking. Unlike prior approaches, we embed the message inside hidden convolution layers by converting from the spatial domain to the frequency domain using spectral projection of a higher frequency band that is decomposed by wavelet projection. Spectral projection employs Fast Fourier Transform approximation to transform spatial data into the frequency domain efficiently. In the encoding phase, a strength factor enhances resilience against diverse attacks, including adversarial, geometric, and regeneration-based distortions, ensuring the preservation of copyrighted information. Meanwhile, the decoder leverages Parseval's theorem to effectively learn and extract the watermark pattern, enabling accurate retrieval under challenging transformations. We evaluate the proposed SpecGuard based on the embedded watermark's invisibility, capacity, and robustness. Comprehensive experiments demonstrate the proposed SpecGuard outperforms the state-of-the-art models. To ensure reproducibility, the full code is released on \href{https://github.com/inzamamulDU/SpecGuard_ICCV_2025}{\textcolor{blue}{\textbf{GitHub}}}.