Watermark Anything With Localized Messages
Authors: Tom Sander
Pierre Fernandez
Alain Oliviero Durmus
Teddy Furon
Matthijs Douze
Venue: ICLR 2025 Poster (2025)
Keywords: Image Watermarking; Segmentation
Primary area: applications to computer vision, audio, language, and other modalities
TL;DR: Watermark Anything Models (WAM), the first deep-learning approach for localized image watermarking that can handle small watermarked areas, inpainting, splicing, edited images and multiple watermarks in a single image.

Abstract: Image watermarking methods are not tailored to handle small watermarked areas.
This restricts applications in real-world scenarios where parts of the image may come from different sources or have been edited.
We introduce a deep-learning model for localized image watermarking, dubbed the Watermark Anything Model (WAM). 
The WAM embedder imperceptibly modifies the input image, while the extractor segments the received image into watermarked and non-watermarked areas and recovers one or several hidden messages from the areas found to be watermarked.
The models are jointly trained at low resolution and without perceptual constraints, then post-trained for imperceptibility and multiple watermarks.
Experiments show that WAM is competitive with state-of-the art methods in terms of imperceptibility and robustness, especially against inpainting and splicing, even on high-resolution images. 
Moreover, it offers new capabilities: WAM can locate watermarked areas in spliced images and extract distinct 32-bit messages with less than 1 bit error from multiple small regions -- no larger than 10\% of the image surface -- even for small $256\times 256$ images.
Training and inference code and model weights are available at https://github.com/facebookresearch/watermark-anything.

Published as a conference paper at ICLR 2025
WATERMARK ANYTHING WITH LOCALIZED MESSAGES
Tom Sander Pierre Fernandez Alain Durmus Teddy Furon', Matthijs Douze Meta FAIR CMAP, École polytechnique CCnntee Inria de I'Uiiveritté de Rennes 'Equal contribution, correspondence at (tomsander.pfz) @ meta.com.
ABSTRACT
Image watermarking methods are not tailored to handle small watermarked areas. This restricts applications in real-world scenarios where parts of the image may come from different sources or have been edited. We introduce a deep-learning model for localized image watermarking, dubbed the Watermark Anything Model (WAM). The WAM embedder imperceptibly modifies the input image, while the extractor segments the received image into watermarked and non-watermarked areas and recovers one or several hidden messages from the areas found to be watermarked. The models are jointly trained at low resolution and without percep- tual constraints, then post-trained for imperceptibility and multiple watermarks. Experiments show that WAM is competitive with state-of-the art methods in terms of imperceptibility and robustness, especially against inpainting and splicing, even on high- resolution images. Moreover, it offers new capabilities: WAM can locate watermarked areas in spliced images and extract distinet 32-bit messages with less than bit error from multiple small regions no larger than 10% of the image surface even for small 256 256 images. Training and inference code and model weights are available at
INTRODUCTION
Invisible image watermarking embeds information into image pixels in way that is imperceptible to the human eye and yet robust. It was initially developed for intellectual property and copy protection, such by Hollywood studios for DVDs. However, the applications of watermarking are evolving, particularly in light of the recent development of generative AI models (Kušen & Strembeck, 2018). Regulatory acts such as the White House executive order (USA, 2023), the Californian bill, the EU AI Act (Parliament& & Council, 2024), and Chinese AI governance rules (of the People's 's Republic of China, 2023) require AI Al-generated content to be easily identifiable, They all cite watermarking as either compulsory or a recommended measure to detect and label Al-generated images.
Image splicing one of the most common manipulations, whether applied for benign or malicious purposes (Christlein et al., 2012; Tralic et al., 2013). Splicing involves adding text memes large portion of the image or extracting parts of images and overlaying them on others (Douze et al., 2021). It can bypass the state-of-the-ar watermarking techniques, which take one global decision per image under scrutiny. Indeed, in traditional watermarking, the watermark signal fades away and is no longer detected the surface of the watermarked area decreases. Besides, these techniques poorly answer the paradoxical question of deciding whether an image should be considered watermarked if only a small part carries the watermark. A positive decision triggered by a small area might be unfair to artists who use Al models for inpainting or outpainting, On the other hand, not being robust enough to splicing opens the door to easy removal.
To address these issues, this paper redefines watermarking as a segmentation task, giving birth to the Watermark Anything Models (WAM). Our motivation is to disentangle the strength of the watermark signal from its pixel surface, in contrast to traditional watermarking. More precisely, the WAM extractor detects if the watermark is present and extracts a binary string for every pixel rather than predicting message for the whole image. These outputs are post-processed according to the final task. For global detection, the image is deemed watermarked the proportion of watermarked pixels exceeds a user-defined threshold. For global decoding, majority vote recovers the hidden message. A new application, out of the reach of traditional robust watermarking, is the localization of watermarked areas and the extraction of multiple hidden messages. For that purpose, to apply the DBSCAN clustering algorithm over the pixel-level binary strings because it does not require any prior the number of watermarks (or centroids). This is detailed in Sec. 3.
choose

---

Published as a conference paper at ICLR 2025
Embedding
Editing %
Extraction
1001
mescage
D101
001.0
Original
Messages
Watermarked
Edited (change background, inpaint, etc.)
Predicted dotection mask
0101....
1101
Figure I: Overview. (a) The embedder creates an imperceptible image modification. (b) Traditional transformations (cropping, JPEG compression, etc.) and/or advanced manipulations (mixing wa- termarked and non-watermarked images, inpainting, etc.) may be applied to the image. (c) The extraction creates a segmentation map of watermarked parts and retrieves one or several messages.
These new functionalities require training with objectives, that is split into two phases. The first phase pre-trains the embedder and extractor models for low-resolution images. It essentially targets the robustness criterion. The embedder encodes 7bbis-bit message into watermark signal that is added to the original image. The augmenter randomly masks the watermark in parts of the image and augments the result with common processing techniques (e.g., cropping, resizing, compression). The extractor then outputs a (1 + Tibtt) -diimesional vector per pixel to predict the parts of the image that watermarked and decode the corresponding messages. Detection and decoding losses are used as training objectives. The second training phase targets the following new objectives: (1) minimize the watermark's 's visibility in alignment with the human visual system, (2) allow for multiple messages within the same image. This two-stage training is less prone instability, compared to previous use of adversarial networks and divergent objectives (Zhu et al., 2018). 3). also trains the extractor on both watermarked and non watemmarrdd images, for the first time in the literature. This increases the performance and the robustness of the detection.
We first compare WAM with ftate-of-the the-art methods for regular tasks of watermark detection and decoding on low and high-resolution images. Our results show that WAM achieves competitive performance in terms of imperceptibility and robustness. To further highlight the advantages of WAM, we then evaluate its performance on tasks that are not considered the literature. Namely, we evaluate the localization accuracy between the predicted watermarked areas and the original mask and assess the ability to detect and decode multiple watermarks in a single image. For instance, when hiding five 32-bit messages, each in 10% area of the image, detection of watermarked areas achieves more than 85% mloU, even after images are horizontally flipped and the contrast adjusted, and bit accuracy (for a total of 160 bits) achieves more than 95% under the same augmentation (Sec. 5.5).
In summary, our contributions are:
the definition of watermarking as segmentation task;
two-stage training able to strike good trade-off between invisibility and robustness even for multiple watermarks and high-resolution images;
WAM, an embedder/extractor model competitive with wate-of-thheard methods;
the highlight of new capabilities, localization of watermarks and extraction of multiple messages as depicted Fig. 1, together with specially designed evaluations.
2 RELATED WORK
Semantic segmentation aims to predict category label for every pixel in an image. FCN (Long et al., 2015) employs convolutional network predicting pixel-wise classification logits. More recent works (Zheng et al., 2021; Strudel et al., 2021) aggregate hierarchical context and are based on a ViT encoder (Dosovitskiy, 2020), followed by decoder that generates the pixel-level predictions similar to our extractor's 's architecture. On the other hand, instance segmentation identifies individual objects within image (He et al., 2017; Carion et al., 2020). Recent literature, such as MaskFormer (Cheng et al., 2021) and Mask2former (Cheng et al., 2022), unifies semantic and instance segmentation. Segment Anything (Kirillov al., 2023) and follow-ups (Zhang et al., 2023; Zhao al., 2023a; Ke et al., 2024; Ma et al., 2024; Ravi et al., 2024) go one step further. They now allow users to segment any object images videos using prompts, which are points, bounding boxes, natural language.
2

---

Published as a conference paper at ICLR 2025
Robust watermarking was first designed for copyright protection (Cox et al., 2007). Traditional methods operate either in the spatial domain (Van Schyndel et al., 1994; Nikolaidis & Pitas, 1998)
or in the frequency domain modifying components through invertible transform (e.g.. Fourier, Wavelet) (Cox et al., 1997; Urvoy et al., 2014). These methods were progressively replaced by deep-learning ones which remove the expert need crafting the transforms such that the embedding is imperceptible and robust. The first approach (Vukotić et al., 2018; 2020; Fernandez et al., 2022; Kishore al., 2022: Chen et al., 2022) embeds the watermark into the representations of an off-the- shelf pre-trate rre-traind model. Our method is inspired by the second approach, which jointly trains deep sorming-basel urchitectures to embed and extract watermarks while being robust augmentations seen during training, such as HiDDeN (Zhu et al., 2018) and followers (Zhang et al., 201 2019b; Luo et al., 2020; Tancik et al., 2020; Ma et al., 2022; Bui et al., 2023b;a; Pan et al., 2024).
The two tasks of watermarking, detection and decoding, are rarely performed together. Detection of the watermark, a.k.a., zero-bit watermarking, distinguishes watermarked content from original images. Decoding of hidden message, a.k.a., multi-bit watermarking, implicitly assumes that the content under scrutiny is watermarked. One possibility for combining the two tasks to reserve Tdet bits of the message bits carrying the actual payload. Assuming that the message decoded from a non-watermarker image is random, the False Positive Rate equals n However, a recent study (Fernandez et al., 2023a, App. B.5) shows that the decoded bits are neither equiprobable nor independent. In other words, it is difficult decode hidden message while being confident in detecting watermark.
detection segment that should match a fixed pattern with the remaining
Very few papers in the literature deal with watermarking objects in pictures (Bas et al., 2001; Barni al., 2005). This trend was abandoned together with the object-oriented MPEG-4 video codec.
Active tamper localization relies on semi-fragile watermarking. Areas where the watermark is not recovered are deemed tampered. This idea appears early in the literature (Kundur & Hatzinakos, 1999; Lin al., 2000), although deep-learning methods offer significant improvements (Asnani et al., 2022). There is a trade-off between the granularity of the localization of the tampered areas and the semi-fragility of the watermark. The biggest difficulty to design a watermark robust to benign transformations (e.g., image compression) but fragile to malicious editing.
Our method combines detection and decoding together with a precise segmentation of the water- marked areas. This natively answers applications ranging from copyright protection, detection of Al-generated objects images and tampering localization. EditGuard (Zhang et al., 2024) sequen- tially embeds fragile watermark for localization and a robust watermark for copyright protection. Although the approach shares similarities with ours, it is not robust to geometric augmentations such cropping perspective changes. In contrast, our approach is conceptually simpler since single embedding is used for detection and decoding. It offers better robustness, and enables the extraction of multiple watermarks. The approach most similar to ours is AudioSeal (San Roman et al., 2024), which introduces localized watermarking in the audio domain, but does not handle multiple messages.
An extended related work with more details the methods mentioned above is presented in App. B.
DETECTION, LOCALIZATION, AND MESSAGE EXTRACTION
Before introducing our method and its training, this section presents several applications, i.e., how to WAM's extractor outputs for watermark localization, zero-bit bit detection, and decoding of multiple messages within the same image.
The key feature is the extractor exta- (0* refers the weights of the model after training) which outputs a tensor = exta- (x:) of dimensions (1 + Thax, h, w) for an input image x E R3xhxw This tensor consists of a watermark detection mask اdv E [0, 1] 1 and decoding mask yde [0, 1] Thin xhxw We denote by " E [0, 1] the predicted detection score for pixel i, and by d
(MA...... ... Alc [0, 1] Paus its decoded message.
Localization (or pixel-level detection) spots watermarked pixels of the image. A pixel is deemed watermarked if its detection score y exceeds threshold т. Typically, set empirically, by measuring the False Positive Rate (FPR) on all the pixels of a held-out training set (the FPR is the probability of non- wanermakrdd pixel being flagged as such).
3

---

Published as a conference paper at ICLR 2025
Detection (or image-level detection) decides if image is globally watermarked. From the pixel-level detection score, an image soft detection score can naturally be computed as:
w 10
det
7) [0.
(1)
W
The image is flagged if Sae is higher than a threshold that is the proportion of watermarked pixels that the user considers enough deem a content as watermarked.
Decoding of a single message within an image is done by the following weighted average of the pixel-level soft predictions of the hidden message:
mi {
if =1
Ehem hxw
1. > r} U1t ) 0.5,
otherwise.
Decoding of multiple watermarks within one image uses hard detection approach instead of the previous soft weighting. We isolate pixels detected as watermarked, i.e., pixels i with y > and we compute the local decoded message m, such that for any & E {l...., Thass J. m [ > 0.5}. The DBSCAN (Density-Bane -Baed Spatial Clustering of Applications with Noise) algorithm (Ester et al., 1996; Schubert et al.. 2017) clusters the of locally decoded messages. It outputs some centroids and an assignment for every pixel detected as watermarked. DBSCAN selects these centroids among the initial set, thus ensuring that the final decoded messages are binary words.
DBSCAN offers the ad advantage of not requiring a pre-defined number of clusters. Instead, we need to specify two parameters: (I) man the minimum number of points for cluster be considered valid, and (2) the maximum distance between two samples for one to be considered as in the neighborhood of the other. For further details on the DBSCAN algorithm, see App. C.I.
Handling multiple messages in a single image makes WAM robust against attacks that involve splicing several watermarked images together, which can compromise the decoding of traditional watermarking schemes in real-world scenarios. It also enables active object detection (Asnani et al.. 2024), where the objective is to track watermarked objects. Additionally, it allows for the identification of the use of multiple watermarked AI tools.
4
WATERMARK ANYTHING MODELS
4.1 THE MODEL
WAM considers two joint models: a watermark embedder emb; and a watermark extractor exte. where / gathers the parameters of these functions. The embedder defines the watermark procedure for hiding a message into an image, while the extractor detects watermarking and decodes messages. This section discusses our choices for the different pieces that constitute WAM. App. D.1 gives the technical details the network architectures.
The watermark embedder (emba) consists of an encoder, binary message lookup table, and decoder. The encoder represents an image in a latent space. The lookup table is used to translate the message into tensor which is concatenated to the image representation. From that, the decoder outputs watermark signal, which is added to the original image with adequate scaling.
The autoencoder that we consider is based on the architecture of the variational autoencoder of LDM (Rombach et al., 2022). Its encoder, enc,, compresses a h X w input image x into latent E xdd xw (with downsampling factor f f h/hh w/w'). The binary message lookup table To is of the message m is mapped to the embedding Ta(k, my, E dhss, depending its position & E {l,..., Abits and its value mi E {0, 1). The Thits embeddings are averaged, resulting in a vector of size dmsg which is repeated to form tensor of shape (dmag. h', w'). activation of shape (dN + dmsg) x h x w'.
shape (ribits, 2, d. Each
The concatenation to the image representation yields The decoder, dec,, maps back this activation to the watermark signal ón (x. m) of the same shape as the original image. The range of this signal is [-1, 1] because the last layer of decø is hyperbolic
4

---

Published as a conference paper at ICLR 2025
tangent activation. It is finally added to the original image produce the watermarked output Im emb = x a óœ m). Parameter a E R4 called the watermark strength as controls the distortion applied to the original image.
The watermark extractor (exta) takes on the dual role of detecting watermarked pixels and decoding their embedded messages. We use an architecture similar SETR (Zheng et al., 2021) and Segment Anything (Kirillov et al., 2023). It comprises VIT encoder paired with pixel decoder that upsamples the embeddings to the original image size. The watermark extractor outputs a vector of size Thits for every pixel, as described in Sec. 3.
High-resolution. WAM operates at a fixed resolution anisotropic scaling resizes the image to h and emb computes the watermark signal 8 from this resized image. A bilinear interpolation scales back to the size the original image. The extraction also operates h w, by resizing all images before feeding them the network. Therefore the extraction process remains consistent with the pre- pre- training conditions. We only use these interpolations at embedding time. WAM thus only trained low resolution images (Sec. 4.2) but can be used for high-resolution images too, which represents an important training compute gain. similar approach also appears in the recent literature (Bui al., 2023a).
w. To extend it to higher resolutions,
4.2 PRE-TRAINING MODELS FOR LOCALIZED MESSAGE EMBEDDING AND EXTRACTION
The objective of this first training phase is to obtain robust and localizable watermark hiding -bas-bit message inside parts of an image, without caring much about imperceptibility. This stage does not incorporate any perceptual loss: goal is achieve perfect localization and decoding even after severe augmentations. Figure illustrates the detailed process.
Augmentations are two-step processes. They first splice images æ and um based on binary mask and then apply usual image transformations to improve robustness.
The first step randomly samples mask among full masks, rectangles, irregular shapes, or object segmentation maps (possibly provided by the training dataset). These masks are inverted with probability 0.5. yields a mask Tmask E [0, 1] / Figure shows examples of masks, with more samples displayed in Figure 6 of App. D.2. The first step then computes the spliced image as
Tmasked = Tmask ① 2m + (1 Tmask) ) @ x. where C denotes component-win wise multiplication.
The second step of the augmentation applies processing typical from real-world image editing including geometric transformations (identity, resize, crop, rotate, horizontal flip, perspective) and valuemetric adjustments (JPEG, Gaussian blur, median filter, brightness, contrast, saturation, hue). The geometric transformation alters the positions of watermarked pixels, so is also applied to the mask keep track of the watermarked areas. This adjusted mask is the ground truth for the localization and is denoted yde,, in the sequel. These augmentations are relatively strong to reflect
T
Frzza y
futection
Random
Original
X
yo
Embedder emb,
Extractor ext
4
Editing (crop, JPEG, etc.)
0101. 0010
deoading
Select watermarked pixels with GT mask
Random Peu binary message
Figure 2: The first training phase of WAM, as described in Sec. 4.2, jointly trains the watermark embedder to predict an additive watermark and the watermark extractor to detect watermarked pixels and decode the hidden message. between, the augmenter 1) splices the watermarked and the original images based on random mask and applies classical image transformations.
5

---

Published as a conference paper at ICLR 2025
the transformations found media sharing websites, as opposed to professional photo publications. Additional details and discussions on augmentations are postponed to App. D.4.
When given image goes through the sogeolddr-augmmeaattionn---o depends on the models' parameters (omitted so far for clarity):
sequence, the final output
v(0) [y (0), (()))((()))
(0) exto (transformation
( (masking (embo( m), x)
The training minimizes the objective function ((0) which is a linear combination of the detection and decoding losses: ((0)
Objectives.
Ada
(f) + Ade (f).
The detection loss is the average of the pixel-wise cross-entropy between y²) [0, 1] x and the ground truth y E {0, 1) (pixel watermarked or not). Similarly, the decoding loss the average of the pixel-wise and bit-wise binary cross-entropy between (0) and my only over the watermarked pixels, where m is random message originally embedded in that image. For a given image and message, ldet and laee are:
(0)
-1
Σ
V/3
det,
log(u!" (0)) + 1/i (ol..)) log(11 (01).
W
A
Tlbas
(0)
Di
[me log()/((()) + (1- - m2) log(1 dec (0)) (5)
h Ax10
det,
Abits
Li=1
4.3 POST-TRAINING FOR IMPERCEPTIBILITY AND MULTIPLE WATERMARKS
The model trained in the first phase (Sec. 4.2) produces too visible watermark. Moreover, it cannot deal within multiple watermarks in an image. The second training phase addresses these issues.
Perceptual heatmap. The Just-Noticeable- DiffelrreDe (JND) map a hand-crafted model of the minimum artifact perceivable by human at every pixel. For instance, artifacts on flat, uniform areas are more visible than on textured ones. The JND map was introduced by Chou Li (1995) and later used by Wu et al. (2017). App. C.2 gives more details on its computation.
Given an image v, we have (ND(x) (z) E gixhxx We modulate the intensity of the watermark per pixel embedding time: the final watermarked image is computed as Zm = x + JND (x) (x) dg m). In practice, we found that applying this JND on the model trained in the first phase slightly degrades the detection and decoding performance. The fine-tuning cancels this degradation. Applying JND only in the second training phase makes training easier than previous methods relying on "perceptual" "contradictory" losses (like StegaStamp (Tancik et al., 2020) HiDDeN (Zhu et al., 2018)).
Multiple watermarks. Since the first training phase (Sec. 4.2) uses a single message, it tends to decode a constant message across pixels even on image regions with different messages. The second training phase introduces several masks to address this limitation. The masks are generated as before with distinct random messages each the masked areas. The number of disjoint masks goes from 1 to 3 with probabilities 0.6, 0.2, and 0.2 respectively (see App. D.2).
Original
Distortion
Watermarkeed imagge ( di)
Original
Distortion with JND attonuation
What Waterrarkee imagge (PSNR
(a) Without JND
(b) With JND
Figure Impact of the JND map on imperceptibility.. (Left) After the first training phase, the watermark is highly perceptible. (Right) When applying the JND attenuation, it is hidden areas where the eye is not sensitive to changes, which makes less visible. Fine-tuning with the JND recovers the initial robustness. The difference is displayed 10 x abs( -r)) x)).

---

Published as a conference paper at ICLR 2025
Table 1: Evaluation of the watermark imperceptibility. We report the PSNR. SSIM, and LPIPS be- tween watermarked and original images of COCO (low/mid-resolution) and DIV2K nigh-resolution).
HiDDeN
DCTDWT
SSL
FNNS
TrustMark
WAM (ours)
DIV2K COCO
PSNR (1)
38.2
37.0
37.8
37.7
40.3
38.3
SSIM (1)
0.98
0.98
0.98
0.98
0.99
0,99
LPIPS ())
0.05
0.02
0.07
0.06
0.01
0.04
PSNR (1)
38.4
38.7
38.2
39.0
39.1
38.8
SSIM (1)
0.98
0.99
0.98
0.99
0.99
0.99
LPIPS ())
0.07
0.03
0.11
0.04
0.01
0.03
The detection loss fae takes the union of all masks as ground truth y;
det,* The decoding loss fde computed separately for each message and the losses are summed up. The scenario multiple watermarks within a single image arises when watermarked images are combined. Unlike other methods producing a global message, WAM can now distinguish and decode each message separately,
EXPERIMENTS & RESULTS
5.1 IMPLEMENTATION DETAILS
We provide here further implementation details using the notations introduced in Sec. 4.1, and the rest of the architectures are described in App. D.1. All experiments are run with Fhits = 32. There is total 1.1M parameters for the embedder and 96M for the extractor (equivalent a ViT-base). In our experiments, we found it necessary to increase the size of the extractor compared to the embedder. This is probably because the extractor has more tasks handle, such as segmenting and extracting multiple messages, while the embedder only needs to embed one message into an image. Also, it important for the embedding process be quick since it happens on the user-side, so we keep voluntarily small to be fast and usable at scale. We train our model on the MS-COCO training set with blurred faces (Lin et al., 2014), that contains 118,000 images, many them with segmentation 256 x 256, and with f 8 (so h' x w' = 32 x 32). The
masks. We train at resolution / x first training phase (Sec. 4.2) is optimized with AdamW (Kingma, 2014; Loshchilov, 2017) with a linear warmup of the learning rate in 5 epochs from 1 10-6 to 1 10-4 and cosine annealing to 1 x 10-6 We set Adec = 10, Adet = 1, a 0.3. We train with a batch size of 16 per GPU for 300 epochs using V100 GPUs which takes roughly days. The second training phase (Sec. 4.3) further trains the model with the JND attenuation for 200 epochs, hiding up to 3 messages per image using either randomly sampled rectangles or segmentation masks. During this phase, QUND 2. App. D.2 provides details on the generation of masks used during both training phases. For the extraction of multiple messages, we use the Scikit-learn DBSCAN implementation (Pedregosa et al., 2011).
5.2 QUALITY
Table evaluates quantitatively the difference between the watermarked and original images with PSNR, SSIM and LPIPS (Zhang et al., 2018) metrics. We adapt the methods so that they are comparable in terms of imperceptibility. We show qualitative examples for COCO and DIV2k images in App. F. The perceptual quality is good: the JND map successfully modulates the watermark signal in areas where the eye is not sensitive. Nevertheless, repetitive and regular patterns can observed in some images when the bright textured areas big enough (furs of animals for instance).
5.3 DETECTION AND DECODING
We benchmark WAM's performance against several watermarking methods: DCTDWT (Al-Haj, 2007), HiDDeN (Zhu et al., 2018), TrustMark (Bui et al., 2023a), SSL (Fernandez et al., 2022), FNNS (Kishore et al., 2022). We also compare WAM to generation-time watermarking methods (Fer- nandez et al., 2023a; Wen et al., 2023) App. E. Although this list is not exhaustive, it covers the main types of late-of-the-art methods. For HiDDeN, use model which hides 48 bits. FNNS,
7

---

Published as a conference paper at ICLR 2025
SSL, and DCTDWT can hide messages arbitrary length, choose to hide 48 bits as well. We use the first 16 bits for detection and 32 bits for message decoding. For detection, an image is flagged as watermarked if at most 1 bit is wrongly decoded. This corresponds to a theoretical False Positive Rate (FPR) of 2.6 x 10-1, i.e., 2.6 out of 10,000 images are falsely flagged as watermarked on average. TrustMark (Bui et al., 2023a) directly outputs boolean (watermarked not). We use the version that hides 40 bits, but only use the first 32 bits. For all evaluations, we apply the watermark embedding and extraction at the original image resolution as described in the high-resolution paragraph of Sec. 4.1. Finally, for WAM, an image is flagged if Sdet (Eq. 1) is higher than 0.07. This value empirically delivers an approximately similar FPR on the COCO validation set.
We evaluate the robustness against various transformations: geometric (flip, crop, perspective, and rotation), valuemetric (adjustments in brightness, hue, contrast or saturation, median or Gaussian filtering, and JPEG compression), splicing: scenarios where only 10% of the image is watermarked superimposed onto the original or an other background. We also evaluate the robustness against inpainting, using the LaMa (Suvorov et al., 2022) model to inpaint areas of the watermarked image specified by random or segmentation masks. For COCO, we use the union of all segmentation masks for each image which in average corresponds to 30% of the image, and for DIV2k we a randomly generated mask (because there are no segmentation masks) that covers around 35% of the image. We give details on the compared baselines in App. D.3 and on the transformations in App. D.4.
Table 2a presents the detection and decoding results for low/mid-resolutionn images, averaged over the first 10k images of the COCO validation set the detailed results for every augmentation used to form the different groups are in App. E.3. Table 2b does the same for high-resolution images from the DIV2K (Timofte et al., 2018) validation set. For both distributions, WAM is competitive and even shows improved robustness on classical geometric/valuemerii
transformations. Most importantly,
WAM performs better on splicing or inpainting where other methods fail achieve more than 90% TPR and Bit acc. This is true even if WAM was not explicitly trained on high resolution images or to be robust against inpainting. We also show examples of WAM's detection masks after inpainting in Fig. 10 of App. E,, where some modified parts of images are not detected as watermarked anymore.
5.4 LOCALIZATION
WAM and EditGuard (Zhang et al., 2024) are the only methods that provide watermark localization. We therefore consider images at fixed resolution 512 x 512 (unlike in Sec. 5.3) to align with the setup of EditGuard. We nevertheless observe similar results different resolutions for WAM. We focus on the COCO validation set and splice centered watermarked rectangles of various sizes within the images ensure a controllddll experiment. We then either apply no transformation or crop the upper left part of the image (25%). which is then resized to the original size. By doing so, the proportion of watermarked pixels still the same as in the spliced image before cropping, which allows us to evaluate the robustness of the localization. Figure 7 of App. D.5 illustrates this protocol.
Figure reports the mean Intersection over Union (mloU) to evaluate the localization, as commonly done in the segmentation literature. Figure 4 evaluates the bit accuracy through localization following Eq. 2. We observe that WAM accurately predicts both classes, even after cropping and resizing, except when the watermarked area covers 95% of the image. in which case the extractor tends to classify all pixels as watermarked. In terms of bit accuracy, WAM recovers in average 31 out of 32 bits even when only 10% of the 256 x 256 image is watermarked, and around 25 bits when only 10% of a 25% crop is watermarked (which corresponds to 2.5% of the overall number of pixels). For both evaluations, WAM outperforms EditGuard which, in particular, is not robust to cropping.
5.5 MULTIPLE WATERMARKS
We compare the detection and decoding of multiple watermarks before and after the second training phase of WAM (Sec. 4.3). We embed up to five distinct messages into five separate 10% areas of every image (first resized to 256 to ease the experiments). This is done by feeding the image several times to WAM's embedder, then pasting the different watermarked areas onto the original image. These areas are squares disposed in a checkerboard pattern, which ensures that the watermarked areas do not overlap and have the same size (see Fig. 8 of App. D.6). This is arbitrary choice made to remove confounding factors during evaluation. although the training does not require the watermarked areas to be squared nor to have the same size. Following the methodology detailed in Sec. 3, we apply the
8

---

Published as a conference paper at ICLR 2025
Table 2: Detection and decoding after image editing (detailed in Sec. D.4). We show the bit accuracy (Bit acc.) between the encoded and decoded messages, the proportion of images correctly deemed watermarked (TPR), and the proportion of non-we watermaardd images falsely detected as watermarked (FPR), in %. Since HiDDeN, DCTDWT, SSL and FNNS do not naturally provide a detection result, we hide 48 bits and reserve 16 bits for detection, and flag an image as watermarked if strictly less than two bits incorrectly decoded (these baselines are detailed in Sec. 5.3).
(a) On the first 10k validation images of COCO (low to mid resolution)
Augmentations
None
Geometric TPR
Valuemetric TPR Bit acc.
Inpainting TPR Bit acc.
Splicing TPR Bit acc.
Method
FPR
TPR
Bit acc.
Bit acc.
HiDDeN
76.9
95.5
31.2
80.1
48,4
87.2
44.7
88.7
68.0
DWTDCT
0.02
77.1
91.4
0.0
50.5
13.6
58.1
47.8
81.7
59.9
SSL
0.00
99.9
100.0
14.3
76.5
70.5
92.1
67.7
91.1
0.4
58.9
FNNS
0.10
99.6
99.9
62.4
86.6
82.1
93.9
89.4
97.3
38.7
88.5
TrustMark
2.88
99.8
99.9
36.3
71.4
90.1
98.2
39.4
83.2
83.2
57.1
WAM (ours)
100.0
100.0
99.3
91.8
100.0
99.9
97.9
99.2
100.0
(b) On the 100 validation images of DIV2k (high resolution)
Augmentations
None
Geometric TPR
Valuemetric TPR Bit acc.
Inpainting TPR Bit acc.
Splicing
Method
FP
TPR
Bit acc.
Bit acc.
TPR
Bit acc.
HiDDeN
0
72.0
95.8
33.5
81.3
53.3
88.1
53.3
88.1
1.5
70.2
DWTDCT
0
75.0
88.9
0.0
50.6
18.4
58.9
73.0
86.7
31.5
71.6
SSL
100.0
100.0
32.5
83.6
92.8
95.0
96.1
FNNS
0
97.0
99.9
63.5
87.2
79.8
93.9
94.0
99.2
48.5
89.5
TrustMark
5
100.0
100.0
33.1
70.5
87.4
97.9
0.0
72.1
1.5
57.3
WAM (ours)
100.0
99.9
96.1
89.0
100.0
99.9
100.0
99.8
99.5
94.2
DBSCAN algorithm to the vector outputs m, of the extractor corresponding to all pixels identified as different watermarked regions without
watermarked (u > 7). It identifies clusters corresponding requiring the number of hidden messages to be known in advance. We use 7 = 0.5 to threshold the and min
watermarked pixels, and choose rather strict setup with (around 2% of the image) in our evaluations, resulting from an hyperparameter search detailed in Fig. of App. E.2. This means that a cluster will be considered only if it has at least 2% of the image's pixels, and that the maximum distance between two predicted messages to be neighbors is 1.
1000 pixels
Figure 5 presents the results. We compute the bit accuracies by comparing the centroid of each detected cluster (decoded message) with the ground truth message that has the largest overlapping area: the bit accuracy is thus computed only across the clusters that are discovered by DBSCAN.
1.0
1.0
Detection mioU
Bit Accuracy
0.4
WAM (identity)
0.2
upper left crop)
0.6
EditGuard lidentity)
0.0
EditGuard (25% upper left crop)
0.5
20
40
60
80
100
0
20
40
60
80
100
Watermarked Area (in %)
Watermarked Area (in %6)
Figure 4: Evaluation of the localization on the validation set of COCO, with or without cropping before extraction, following the setup described in Sec. 5.4. (Left) Localization accuracy using intersection over union between the predicted watermarked areas and the ground-truth mask. (Right) Bit accuracy between the ground truth message and the decoded message, computed from Eq. (2).

---

Published as a conference paper at ICLR 2025
Without the second phase of training, the messages get mixed up, and WAM predicts the same (wrong) message for all watermarked pixels. After the training, WAM is able to accurately extract up to five different 32-bit bit messages from the areas covering 10% of the image each. Therefore, although the second phase of training embeds between and 3 watermarks per image, WAM generalizes to more watermarks. It also shows that WAM's effective capacity is greater than 32 bits (since it can hide multiple messages) if we do not consider heavy crops as a transformation we want the method to be robust against, similarly as (Bui al., 2023b; Tancik al., 2020; Wen et al., 2023).
This method remains effective after some image manipulations; extended quantitative results are presented Fig. 9 of App. E.2. For example, WAM achieves 85% mIoU even when the images have been horizontally flipped and the contrast adjusted. Furthermore, the bit accuracy, averaged across messages totaling 160 bits, exceeds 95% under the same conditions. However, WAM fails when JPEG compression is also added on top of these two transformations. Illustrative examples of the identified clusters in various scenarios can be found in Fig. 8 of App. D.6.
6 CONCLUSION, LIMITATIONS, AND FUTURE WORK
Conclusion. This work introduces the Watermark Anything Model, which approaches image watermarking as a segmentation task. WAM is able to predict whether an image is watermarked or not, well to localize its watermarked regions. It thus handles images with small watermarked part, or where parts of the image have been removed or edited. Additionally, it is able to detect and extract multiple watermarks within the same image, for the first time in the literature. Our training which introduces localization under heavy augmentations also offers state-of-the-ar robustness on classical settings considered by current watermark methods, where most of the image is watermarked.
We identify two main limitations that we address in the next paragraphs.
Low payload. In our experiments, WAM's capacity limited to 32 bits, and training on larger messages is challenging. In contrast, other watermarking methods such as EditGuard or RoSteALS can successfully embed more than 100 bits per image, but are not robust to crops or outpainting. This is a trade-off between capacity and robustness. Note that in practice, other methods use decoding to match with the original message and conclude if an image is watermarked. In contrast, WAM's detection process is separate from the decoding, so 32 bits may be enough for most applications.
Perceptual quality. In spite of the JND weighting, we notice that the watermark can still be visible in some areas of the watermarked images, even at a relatively high PSNR (see examples in App. F). This could be due to the JND map focusing only on the cover image and not on the watermark signal itself. Improvements might be achieved by employing more sophisticated Human Visual System (HVS) models or by regularizing the watermark to eliminate repetitive patterns during training.
Post-ICLR rebuttal changes. We added Appendix further discuss WAM's operating point and include additional experiments: more baseline comparisons, robustness to diffusion- purification, neural compression, overlapping watermarks, and balancing the perceptibllity/robuunees trade-off
WM
WM
WM
WM
WM
WM
WM
11.0 Tass
11.0
-1,0
0.98 +0000 91
0.8
-088
2.34
00.
-0.8
0.66
6.12..62
0.6
1.03
-0.6
006
DBSCAN Clusters
Accuracy
DBSCAN Clusters
Accuracy
(a) After first training phase (PSNR x 25 dB)
(b) After second training phase (PSNR ~ 38 dB)
Figure 5: Results on multiple watermarks extracted from single image. We use non overlapping 10 % rectangular masks to watermark up to 5 parts of images from COCO, with different messages, and report the average number of clusters detected by DBSCAN, bit accuracy across found messages, as well the mloU of watermark detection on all objects. (Left) After the first training phase, the bit accuracy strongly decreases as the number of watermarks grows. (Right) After fine-tuning, it stays roughly constant matter the number of watermarked parts. The mloU stays stable in both cases.
10

---

Published as a conference paper at ICLR 2025
REPRODUCIBILITY STATEMENT
Section provides the specifics of our training and evaluation setup. Further implementation details, including network architectures, mask designs, transformation parameters for robustness evaluation, and settings for baseline comparisons, are presented in App. D. The models and code for inference and training used in this paper will be made available upon publication. The code is based on Py Torch, the training dataset is publicly available, and the training requires half week on 8 V100 GPUs, which makes the models reproducible at reasonable cost.
The training and inference code, as well as trained models are available at: https://// thub. com/ wawacbbokkreeeerc//atttttteceeee aag. anything
REFERENCES
Mahdi Ahmadi, Alireza Norouzi, Nader Karimi, Shadrokh Samavi, and Ali Emami. Redmark: Framework for residual diffusion watermarking based deep networks. Expert Systems with Applications, 2020.
Ali M. Al-Haj. Combined dwt-det digital image watermarking. Journal of Computer Science, 740-746, 2007. URL https: /api. semant inscholaacccolar.....m org/ /orr/ooI:::
Vishal Asmani, Xi Yin, Tal Hassner, Sijia Liu, and Xiaoming Liu. Proactive image manipulation detection. In Proceedings of the IEEE/CVF conference on computer vision and pattern recognition, pp. 15386-15395, 2022.
Vishal Asnani, Abhinav Kumar, Suya You, and Xiaoming Liu. Probed: proactive object detection wrapper. Advances in Neural Information Processing Systems, 36, 2024.
Shumeet Baluja. Hiding images in plain sight: Deep steganography. NeurlPS, 2017.
Mauro Barni, Franco Bartolini, Vito Cappellini, and Alessandro Piva. A det-domain system for robust image watermarking. Signal processing, 66(3):357-377 1998.
Mauro Barni, Franco Bartolini, and Alessandro Piva. Improved wavelet-based watermarking through pixel-wise masking, IEEE transactions on image processing, 10(5):733-791, 2001.
Mauro Barni, Franco Bartolini, and Nicola Checcacci. Watermarking of mpeg-4 video objects. IEEE Transactions Multimedia, 7(1):23-32 32, 2005.
Patrick Bas, Nikolaos V Boulgouris, Filippos D Koravos, Jean-Mare Chassery, Michael G Strintzis, and Benoit MM Macq. Robust watermarking of video objects for mpeg-4 applications. In Applications of Digital Image Processing XXIV, volume 4472, pp. 85-94. SPIE, 2001.
Patrick Bas, J-M Chassery, and Benoit Macq. Geometrically invariant watermarking using feature points. IEEE transactions on image Processing, 11(9):011--128, 2002.
Patrick Bas, Nicolas Le Bihan, and J-M Chassery. Color image watermarking using quaternion fourier transform. 2003 IEEE International Conference on Acoustics, Speech, and Signal Processing, 2003. Proceedings. (ICASSP volume 3, pp. III-521. IEEE, 2003.
Adrian G Bors and Ioannis Pitas. Image watermarking using det domain constraints. In ICIP, 1996.
Tu Bui, Shruti Agarwal, and John Collomosse. Trustmark: Universal watermarking for arbitrary resolution images. arXiv preprint arXiv:2311.18297, 2023a.
Tu Bui, Shruti Agarwal, Ning Yu, and John Collomosse. Rosteals: Robust steganography using autoencoder latent space. In Proceedings of the IEEF/CVF Conference Computer Vision and Puttern Recognition, pp. 933-942, 2023b.
Nicolas Carion, Francisco Massa, Gabriel Synnaeve, Nicolas Usunier, Alexander Kirillov, and Sergey Zagoruyko. End-to-end object detection with transformers. In European conference on computer vision, pp. 213-229. Springer, 2020.
11

---

Published as a conference paper at ICLR 2025
Mathilde Caron, Hugo Touvron, Ishan Misra, Hervé Jégou, Julien Mairal, Piotr Bojanowski, and Armand Joulin. Emerging properties in self-supervised vision transformers. ICCV, 2021.
Xiangyu Chen, Varsha Kishore, and Kilian Q Weinberger. Learning iterative neural optimizers for image steganography. In The Eleventh International Conference on Learning Representations, 2022.
Bowen Cheng, Alex Schwing, and Alexander Kirillov. Per-pixel classification is all you need for semantic segmentation. Advances in neural information processing systems, 14:17864-17875, 2021.
Bowen Cheng, Ishan Misra, Alexander G Schwing, Alexander Kirillov, and Rohit Girdhar. Masked- attention mask transformer for universal image segmentation. In Proceedings of the IEEE/CVF conference on computer vision and paitern recognition, pp. 1290-1299, 2022.
Chun-Hsien Chou and Yun-Chin Li. A perceptually tuned subband image coder based the measure of must-noticaable-dittttii profile. IEEE Transactions on circuits and systems for video technology, 5(6):467-476, 1995.
Vincent Christlein, Christian Riess, Johannes Jordan, Corinna Riess, and Elli Angelopoulou. evaluation of popular copy-move forgery detection approaches. IEEE Transactions on information forensics and security, 166):1841-1854, 2012.
Hai Ci, Yiren Song, Pei Yang, Jinheng Xie, and Mike Zheng Shou. Wmadapter: Adding watermark control to latent diffusion models. arXiv preprint arXiv:2406.083377 2024a.
Hai Ci, Pei Yang. Yiren Song, and Mike Zheng Shou. Ringid: Rethinking tree-ring watermarking for enhanced multi-key identification. arXiv preprint arXiv:2404.14000 2024b.
Ingemar Cox, Matthew Miller, Jeffrey Bloom, Jessica Fridrich, and Ton Kalker. Digital watermarking and steganography. Morgan kaufmann, 2007.
Ingemar J Cox, Joe Kilian, F Thomson Leighton, and Talal Shamoon. Secure spread spectrum watermarking for multimedia. IEEE transactions on image processing, 6(12):1673-1687, 1997.
Alexey Dosovitskiy. An image is worth 16x16 words: Transformers for image recognition at scale. arXiv preprint arXiv:2010. /929, 2020.
Matthijs Douze, Giorgos Tolias, Ed Pizzi, Zoë Papakipos, Lowik Chanussot, Filip Radenovic, Tomas Jenicek, Maxim Maximov, Laura Leal-Taixé, Ismail Elezi, et al. The 2021 image similarity dataset and challenge. arXiv preprint (.XXx:210609666 2021.
Patrick Esser, Robin Rombach, and Bjorn Ommer. Taming transformers for high- reghurreotttion image synthesis. In Proceedings of the IEEE/CVF conference on computer vision and pattern recognition, pp. 12873-12883 2021.
Martin Ester, Hans-Peter Kriegel, Jörg Sander, Xiaowei Xu, et al. A density-based algorithm for discovering clusters in large spatial databases with noise. In kdd, 1996.
Gautier Evennou, Vivien Chappelier, Ewa Kijak, and Teddy Furon. Swift: Semantic watermarking for image forgery thwarting. arXiv preprint arXhv:2407.18995 2024.
Han Fang, Yupeng Qiu, Kejiang Chen, Jiyi Zhang, Weiming Zhang, and Ee- Ce-Chien Chang. Flow-based robust watermarking with invertible noise layer for black-box distortions. In Proceedings of the AAAI conference on artificial intelligence, volume 37, pp. 5054-5061, 2023.
Jianwei Fei, Zhihua Xia, Benedetta Tondi, and Mauro Barni Supervised gan watermarking for intellectual property protection. In 2022 IEEE International Workshop on Information Forensics and Security (WIFS), pp. 1-6. IEEE, 2022.
Jianwei Fei, Zhihua Xia, Benedetta Tondi, and Mauro Barni. Robust retraining- frre gan fingerprinting via personalized normalization. In 2023 IEEE International Workshop on Information Forensics and Security (WIFS), pp. 1-6. IEFF, 2023.
12

---

Published as a conference paper at ICLR 2025
Jianwei Fei, Zhihua Xia, Benedetta Tondi, and Mauro Barni. Wide flat minimum watermarking for robust ownership verification gans. IEEE Transactions on Information Forensics and Security, 2024.
Liu Ping Feng, Liang Bin Zheng, and Peng Cao. A dwt-det based blind watermarking algorithm for copyright protection. In ICCSIT. IEEE, 2010.
Weitao Feng, Wenbo Zhou, Jiyan He, Jie Zhang, Tianyi Wei, Guanlin Li, Tianwei Zhang, Weiming Zhang, and Nenghai Yu. Aqualora: Toward white-box protection for customized stable diffusion models via watermark lora. arXiv preprint 2xXi:2405.11135. 2024.
Pierre Fernandez, Alexandre Sablayrolles, Teddy Furon, Hervé Jégou, and Matthijs Douze. Wa- termarking images in self-supervised latent spaces. In ICASSP 2022-2022 IEEE International Conference on Acoustics, Speech and Signal Processing (ICASSP), pp. 3054-3058. IEEE, 2022.
Pierre Fernandez, Guillaume Couairon, Hervé Jégou, Matthijs Douze, and Teddy Furon. The stable signature: Rooting watermarks in latent diffusion models. In Proceedings of the IEEE/CVF International Conference Computer Vision, pp. 2244777777,, 2023a.
Pierre Fernandez, Matthijs Douze, Hervé Jégou, and Teddy Furon. Active image indexing. In International Conference Learning Representations (ICLR), 2023b.
Teddy Furon and Patrick Bas. Broken arrows. EURASIP Journal on Information Security, 2008: 1-13, 2008.
Kaiming He, Georgia Gkioxari, Piotr Dollár, and Ross Girshick. Mask r-cnn. In Proceedings of the IEEE international conference on computer vision, pp. 2961-2969, 2017.
Jonathan Ho, Ajay Jain, and Pieter Abbeel. Denoising diffusion probabilistic models. Advances in neural information processing systems, 1866840-8851, 2020.
Seongmin Hong, Kyeonghyun Lee, Suh Yoon Jeon, Hyewon Bae, and Se Young Chun. On exact inversion of dpm-solvers. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pp. 7069-7078, 2024.
Jiangtao Huang, Ting Luo, Li Li, Gaobo Yang, Haiyong Xu, and Chin-Chen Chang. Arwgan: Attention-guided robust image watermarking model based on gan. IEEE Transactions on Instru- mentation and Measurement, 72:1-17, 2023.
Zhaoyang Jia, Han Fang, and Weiming Zhang. Mbrs: Enhancing robustness of dnn-based water- marking by mini-batch of real and simulated jpeg compression. In Proceedings of the 29th ACM international conference on multimedia, pp. 41-49, 2021.
Qiuping Jiang, Zhentao Liu, Shiqi Wang, Feng Shao, and Weisi Lin. Towards top-down just noticeable difference estimation of natural images. IEEE Transactions on Image Processing, 2022.
Junpeng Jing, Xin Deng, Mai Xu, Jianyi Wang, and Zhenyu Guan. Hinet: Deep image hiding by invertible network. In Proceedings of the IEEF/CVF international conference computer vision, pp. 4733-4742, 2021.
Lei Ke, Mingqiao Ye, Martin Danelljan, Yu- Yu-Wing Tai, Chi- KheiK Tang, Fisher Yu, et al. Segment anything in high quality. Advances in Neural Information Processing Systems, 36, 2024.
Changhoon Kim, Kyle Min, Maitreya Patel, Sheng Cheng. and Yezhou Yang. Wouaf: Weight modulation for user attribution and fingerprinting in text-to-image diffusion models. In Proceedings of the IEFF/CVF Conference on Computer Vision and Pattern Recognition, pp. 9974-8988 2024.
Diederik Kingma. Adam: A method for stochastic optimization. arXiv preprint arXiv: 1412.698.. 2014.
Alexander Kirillov, Eric Mintun, Nikhila Ravi, Hanzi Mao, Chloe Rolland, Laura Gustafson, Tete Xiao, Spencer Whitehead, Alexander C Berg, Wan- Yen Lo, et al. Segment anything. In Proceedings of the IEFF/CVF International Conference Computer Vision, pp. 4015-4026, 2023.
13

---

Published as a conference paper at ICLR 2025
Varsha Kishore, Xiangyu Chen, Yan Wang, Boyi Li, and Kilian Q Weinberger. Fixed neural network steganography: Train the images, not the network. In International Conference on Learning Representations, 2022.
Lester E Krueger. Reconciling fechner and stevens: Toward unified psychophysical law. Behavioral and Brain Sciences, 12(2):251-267, 1989.
D. Kundur and D. Hatzinakos, Digital watermarking for telltale tamper proofing and authentication. Proceedings of the IEEE, 87(7): 167-1180, 1999. doi: 10. 109/5.771070.
Ema Kušen and Mark Strembeck. Polities, sentiments, and misinformation: An analysis of the twitter discussion on the 2016 austrian presidential elections. Online Social Networks and Media, 37-50, 2018.
Alexandre Lacoste, Alexandra Luccioni, Victor Schmidt, and Thomas Dandres. Quantifying the carbon emissions of machine learning. arXiv preprint arXiv:1910.09700 2019.
Liangqi Lei, Keke Gai, Jing Yu, and Lichuang Zhu. Diffusetrace: A transparent and flexible
watermarking scheme for latent diffusion model. arXiv preprint (tt::2405000696, 2024.
Zhen Li. Kim-Hui Yap, and Bai- Ying Lei. A new blind robust image watermarking scheme in svd-det composite domain. In ICIP, 2011.
Eugene Lin, Christine I. Podilchuk, and Edward Delp III. Detection of image alterations using semifragile watermarks. In Ping Wah Wong and Edward J. Delp III (eds.), Security and Watermarking of Multimedia Contents II, volume 3971, pp. 152 163. International Society for Optics and Photonics, SPIE, 2000. doi: 10.1 17.111991.,84499 URL https: org/
1117/12.384663
Tsung-YY Yi Lin, Michael Maire, Serge Belongie, James Hays, Pietro Perona, Deva Ramanan, Piotr Dollár, and C Lawrence Zitnick. Microsoft coco: Common objects in context. In Computer Vision- ECCV 2014: 13th European Conference, Zurich, Switzerland, September 6-12, 2014, Proceedings, Part V 13, pp. 740-755. Springer, 2014.
Jonathan Long, Evan Shelhamer, and Trevor Darrell. Fully convolutional networks for semantic segmentation. In Proceedings of the IEEE conference on computer vision and pattern recognition, pp. 3431-3440, 2015.
I Loshchilov. Decoupled weight decay regularization. arXiv preprint arXiv: 2017.
Sasha Luccioni, Bruna Trevelin, and Margaret Mitchell. The environmental impacts of ai primer. Hugging Face Blog, September 2024. URL httttss:/hhagiingaaaeee htt.//ac...cc.c.ooooooeeeeoooooe og/ community.
Xiyang Luo, Ruohan Zhan, Huiwen Chang, Feng Yang, and Peyman Milanfar. Distortion agnostic deep watermarking. In CVPR, 2020.
Jun Ma, Yuting He, Feifei Li, Lin Han, Chenyu You, and Bo Wang. Segment anything in medical images. Nature Communications, 15(1):654, 2024.
Rui Ma, Mengxi Guo, Yi Hou, Fan Yang, Yuan Li, Huizhu Jia, and Xiaodong Xie. Towards blind watermarking: Combining invertible and non-invertible mechanisms. Proceedings of the 30th ACM International Conference on Multimedia, pp. 1532-1542, 2022.
Sébastien Marcel and Yann Rodriguez. Torchvision the machine-vision package of torch. In International Conference on Multimedia. ACM, 2010.
Zhicheng Ni, Yun-Qing Shi, Nirwan Ansari, and Wei Su. Reversible data hiding. JEEE Transactions on circuits and systems for video technology, 2006.
Nikos Nikolaidis and loannis Pitas. Robust image watermarking in the spatial domain. Signal processing, 1998.
Augustus Odena, Vincent Dumoulin, and Chris Olah. Deconvolution and checkerboard artifacts. Distill, 1(10):e3, 2016.
14

---

Published as a conference paper at ICLR 2025
State Council of the People's Republic of China. New generation artificial intelligence development plan, 2023, URL https:/ /t/wwwwwwww www. gov. cn/ hetponnggcccoontttteeeeeee 2200002233222 200002000////eetttecc
6884925. htm.
Maxime Oquab, Timothée Darcet, Theo Moutakanni, Huy Vo, Mare Szafraniec, Vasil Khalidov, Pierre Fermandez, Daniel Haziza, Francisco Massa, Alaaeldin El-Nouby, Russell Howes, Po- Yao Huang, Hu Xu, Vasu Sharma, Shang-Wae Li, Wojeiech Galuba, Mike Rabbat, Mido Assran, Nicolas Ballas, Gabriel Synnaeve, Ishan Misra, Herve Jegou, Julien Mairal, Patrick Lahatut, Armand Joulin, and Piotr Bojanowski. Dinov2: Learning robust visual features without supervision, 2023.
Junlin Ouyang, Gouenou Coatrieux, Beijing Chen, and Huazhong Shu. Color image watermarking based quaternion fourier transform and improved uniform log-polan mapping. Computers & Electrical Engineering, 2015.
Minzhou Pan, Yi Zeng. Xue Lin, Ning Yu, Cho-Jui Hsieh, Peter Henderson, and Ruoxi Jia. Jigmark: A black-box approach for enhancing image watermarks against diffusion model edits. arXiv preprint arXiv:2406.037200 2024.
European Parliament and Council. Regulation (eu) 2024/1689 of the european parliament and of the council on artificial intelligence, 2024. URL
-errr-eex.ee europa.ee
legal-content/ Ett.e//////////eeeeeee wtt.://nwe.../...tttt/rtrtta-aaa ?uri=CELEX 32C24R1689.
F. Pedregosa, G. Varoquaux, A. Gramfort, V. Michel, B. Thirion, O. Grisel, M. Blondel, P. Pretten- hofer, R. Weiss, V. Dubourg, J. Vanderplas, A. Passos, D. Cournapeau, M. Brucher, M. Perrot, and E. Duchesnay. Scikit-learn: Machine learning in Python. Journal of Machine Learning Research, 12:2825-28325 2011.
Alessandro Piva, Mauro Barni, Franco Bartolini, and Vito Cappellini. Det-based watermark recovering without resorting to the uncorrupted original image. Proceedings of international conference on image processing, volume 1, pp. 520-523. IEEE, 1997.
Nikhila Ravi, Valentin Gabeur, Yuan- Ting Hu, Ronghang Hu, Chaitanya Ryali, Tengyu Ma, Haitham Khedr, Roman Rädle, Chloe Rolland, Laura Gustafson, et al. Sam 2: Segment anything in images and videos. arXiv preprint orXiv:2408.0077 2024.
Ahmad Rezaei, Mohammad Akbari, Saeed Ranjbar Alvar, Arezou Fatemi, and Yong Zhang. Lawa: Using latent space for in-generation image watermarking. arXiv preprint urXiv:2408. 200.0888. 2024.
Robin Rombach, Andreas Blattmann, Dominik Lorenz, Patrick Esser, and Björn Ommer. High- resolution image synthesis with latent diffusion models. Proceedings of the IEEE/CVF Confer- ence on Computer Vision and Pattern Recognition, pp.
2022.
Robin San Roman, Pierre Fernandez, Hady Elsahar, Alexandre Défossez, Teddy Furon, and Tuan Tran. Proactive detection of voice cloning with localized watermarking, In International Conference on Machine Learning, 2024.
Erich Schubert, Jörg Sander, Martin Ester, Hans Peter Kriegel, and Xiaowei Xu. Dbscan revisited, revisited: why and how you should (still) use dbscan. ACM Transactions on Database Systems (TODS), 42(3):1-22 1-1 2017.
Robin Strudel, Ricardo Garcia, Ivan Laptev, and Cordelia Schmid. Segmenter: Transformer for semantic segmentation. In Proceedings of the IEEE/CVE international conference on computer vision, pp. 7262-7272, 2021.
Roman Suvorov, Elizaveta Logacheva, Anton Mashikhin, Anastasia Remizova, Arsenii Ashukha, Aleksei Silvestrov, Naejín Kong, Harshith Goka, Kiwoong Park, and Victor Lempitsky. Resolution- robust large mask inpainting with fourier convolutions. In Proceedings of the IEEE/CVE winter conference on applications of computer vision, pp. 2149-2159, 2022.
Matthew Tancik, Ben Mildenhall, and Ren Ng. Stegastamp: Invisible hyperlinks in physical pho- tographs. In CVPR, 2020.
15

---

Published as a conference paper at ICLR 2025
Radu Timofte, Shuhang Gu, Jiqing Wu, Lue Van Gool, Lei Zhang. Ming- Yang, Muhammad Haris, et al. Ntir 2018 challenge on single image super-resolution: Methods and results. In The IEEE Conference Computer Vision and Pattern Recognition (CVPR) Workshops, June 2018.
Dijana Tralic, Ivan Zupancic, Sonja Grgic, and Mislav Grgic. Comofod new database for copy-move forgery detection. In Proceedings F.IMAR-2013, pp- 49-54, TEEE, 2013.
Matthieu Urvoy, Dalila Goudia, and Florent Autrusseau. Perceptual dft watermarking with improved detection and robustness geometrical distortions. IEEE Transactions Information Forensics and Security, 2014.
USA.
Ensuring //www. wwwtehouse. gov www.:oouww.ooo/oooooooooeee
safe,
secure, and
trustworthy ai.
https:
Ensuring- Safe Secure- and- wncuuee-nd--russtorrteeeeee T July 2023. [july 2023].
Accessed:
Ron Van Schyndel, Andrew Tirkel, and Charles F Osborne. A digital watermark. Proceedings of 1st international conference image processing, volume 2, pp. 86-90. IEEE, 1994.
Vedran Vukotić, Vivien Chappelier, and Teddy Furon. Are deep neural networks good for blind image watermarking? In WIFS, 2018.
Vedran Vukotić, Vivien Chappelier, and Teddy Furon, Are classification deep neural networks good for blind image watermarking? Entropy, 2020.
Andrew B Watson. Det quantization matrices visually optimized for individual images. Human vision, visual processing, and digital display IV, volume 1913, pp. 202-216. SPIE, 1993.
Bingyang Wen and Sergul Aydore. Romark: A robust watermarking system using adversarial training. arXiv preprint arXiv: 1910.01211. 2019.
Yuxin Wen, John Kirchenbauer, Jonas Geiping, and Tom Goldstein. Tree-ring watermarks: Fin- gerprints for diffusion images that are invisible and robust. arXiv preprint arXiv:2305.20030. 2023.
Eric Wengrowski and Kristin Dana. Light field messaging with deep photographic steganography. In Proceedings of the IEEE/CVF conference on computer vision and pattern recognition, pp.
1515-1524, 2019.
Hanzhou Wu, Gen Liu, Yuwei Yao, and Xinpeng Zhang. Watermarking neural networks with watermarked images. IEEE Transactions on Circuits and Systems for Video Technology, 31(7): 2591-2601, 2020.
Jinjian Wu, Leida Li, Weisheng Dong, Guangming Shi, Weisi Lin, and C-C Jay Kuo. Enhanced just noticeable difference model for images with pattern complexity. IEEE Transactions on Image Processing, 2017.
Xiang-Gen Xia, Charles G Boncelet, and Gonzalo R Arce. Wavelet transform based watermark for digital images. Optics Express, 1998.
XK Yang, WS Ling, ZK Lu, Ee Ping Ong, and SS Yao. Just noticeable distortion model and its applications in video coding. Signal processing: Image communication, 20(7):662-680, 2005.
Chong Yu. Attention based data hiding with generative adversarial networks. In AAAI, 2020.
Ning Yu, Vladislav Skripniuk, Sahar Abdelnabi, and Mario Fritz. Artificial fingerprinting for generative models: Rooting deepfake attribution in training data. In Proceedings of the IEEE/CVF International conference on computer vision, pp. 14448-1a 14488-14,7,,,-- 2021.
Ning Yu, Vladislav Skripniuk, Dingfan Chen, Larry Davis, and Mario Fritz. Responsible disclosure of generative models using scalable fingerprinting. In International Conference on Learning Representations (ICLR), 2022.
16

---

Published as a conference paper at ICLR 2025
Aditi Zear, Amit Kumar Singh, and Pardeep Kumar. A proposed secure multiple watermarking technique based on dwt, det and svd for application in medicine. Multimedia tools and applications, 77:4863-4888 2018.
Chaoning Zhang, Dongshen Han, Yu Qiao, Jung Uk Kim, Sung-Ho Bae, Seungkyu Lee, and Choong Seon Hong. Faster segment anything: Towards lightweight sam for mobile applications. arXiv preprint arXiv:2306. 2023.
Honglei Zhang, Hu Wang, Yuanzhouhan Cao, Chunhua Shen, and Yidong Li. Robust watermarking using inverse gradient attention. arXiv preprint arXiv:2011.10856 2020.
Kevin Alex Zhang, Alfredo Cuesta- Lei Xu, and Kalyan Veeramachaneni. Steganogan: High capacity image steganography with gans. arXiv preprint arXiv:1901.00389: 2019a.
Kevin Alex Zhang, Lei Xu, Alfredo Cuesta-Infante, and Kalyan Veeramachaneni. Robust invisible video watermarking with attention. arXiv preprint 1rXiv:1909.01285, 2019b.
Richard Zhang, Phillip Isola, Alexei Efros, Eli Shechtman, and Oliver Wang. The unreasonable effectiveness of deep features as perceptual metric. In CVPR, 2018.
Xiaohui Zhang, Weisi Lin, and Ping Xue. Just-noticeable difference estimation with pixels in images. Journal of Visual Communication and Image Representation, 19(1):30-41 2008.
Xuanyu Zhang, Runyi Li, Jiwen Yu, Youmin Xu, Weiqi Li, and Jian Zhang. Editguard: Versatile image watermarking for tamper localization and copyright protection. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pp. 11964-11977 2024.
Xu Zhao, Wenchao Ding, Yongqi An, Yinglong Du, Tao Yu, Min Li, Ming Tang, and Jinqiao Wang. Fast segment anything. arXiv preprint arXiv:2306. 12156, 2023a.
Yunqing Zhao, Tianyu Pang, Chao Du, Xiao Yang. Ngai-Man Cheung, and Min Lin. A recipe for watermarking diffusion models. arXiv preprint arXiv:2303. 2...ii:2333101110 10137, 2023b.
Sixiao Zheng, Jiachen Lu, Hengshuang Zhao, Xiatian Zhu, Zekun Luo, Yabiao Wang, Yanwei Fu, Jianfeng Feng. Tao Xiang, Philip HS Torr, et al. Rethinking semantic segmentation from -equence-to-sequeenee sequence perspective with transformers. In Proceedings of the IEEE/CVF conference on computer vision and pattern recognition, pp. 6881-688 1-890, 2021.
Jiren Zhu, Russell Kaplan, Justin Johnson, and Li Fei-Fei. Hidden: Hiding data with deep networks. In Proceedings of the European conference on computer vision (ECCV), pp. 657-672, 2018
17

---

Published as a conference paper at ICLR 2025
A ETHICAL STATEMENT
A.1 SOCIETAL IMPACT
Watermarking in general improves the traceability of content, be it Al-generated, or not. It can have positive consequences, for example when it is used to trace the origin of fake news to protect intellectual property. This traceability can also have negative consequences, for example when is used trace political opponents in authoritarian regimes or whistleblowers in secretive companies. Besides, it is not clear how to disclose watermark detection results, which may foster a closed ecosystem of detection tools. It may also exacerbate misinformation by placing undue emphasis on content that is either not detected, generated by unknown models, or authentic but used out of context. We however believe that the benefits of watermarking outweigh the risks, and that the development of robust watermarking methods is positive step for our society.
A.2 ENVIRONMENTAL IMPACT
The cost of the experiments and of model training is high, though order of magnitude less than other computer vision fields (Oquab et al., 2023). One training with a schedule similar to the one reported in the paper represents & 30 GPU-days. We also roughly estimate that the total GPU-days used for running all our experiments to 5000, or & 120k GPU-hours. This amounts to total emissions in the order of 20 tons of CO2eq. Estimations are conducted using the Machine Learning Impact calculator presented by Lacoste et al. (2019). We do not consider in this approximation: memory storage, CPU-hours, production cost of GPUs/ CPUs, etc.
We were careful to limit the environmental impact of our research by doing most of our experiments on smaller models, on fewer epochs (100) and at lower resolutions (128 x 128), before scaling up to larger models, more epochs and higher resolutions. We also focus on small specialized model that are efficient inference time and more environmental-friendd the day, we believe that the environmental cost of this research is justified by the potential benefits of WAM.
(Luccioni et al., 2024). At the end of
B EXTENDED RELATED WORK ON IMAGE WATERMARKING
B.1 TRADITIONAL WATERMARKING
We call traditional watermarking technique embedding digital watermark in a host content. As far as images are concerned, the first methods are usually classified into two categories depending on the space which the watermark embedded. In spatial domain, the watermark encoded by directly modifying pixels, such as flipping low-order bits of selected pixels (Van Schyndel et al., 1994). For example, Nikolaidis Pitas (1998) slightly modify the intensity of randomly selected image pixels while taking into account properties of the human visual system. robustly JPEG compression and lowpass filtering. Bas et al. (2002) create content descriptors defined by salient points and embed the watermark by adding a pattern triangles formed by the tessellation of these points. Ni al. (2006) use the zero or the minimum points of the histogram of an image and slightly modifies the pixel grayscale values to embed data into the image. The second category frequency domain watermarking offers better robustness. It usually spreads pseudorandom noise sequence across the entire frequency spectrum of the host signal (Cox et al., 1997). The first step is transformation that computes the frequency coefficients. The watermark is then added to these coefficients, taking into account the human visual system. The coefficients are mapped back onto the original pixel space through the inverse transformation to generate the watermarked image. The transform domains include Discrete Fourier Transform (DFT) (Urvoy et al., 2014), Quaternion Fourier Transform (QFT) (Bas et al., 2003; Ouyang al., 2015), Discrete Cosine Transform (DCT) (Bors & Pitas, 1996; Piva et al., 1997; Barni et al., 1998; Li et al., 2011), 1), Discrete Wavelet Transform (DWT) (Xia et al., 1998; Barni et al., 2001; Furon & Bas, 2008), both DWT and DCT (Feng al., 2010; Zear al., 2018) (018, etc.
Deep learning-base based methods have recently emerged as alternatives for traditional watermarking, The first attempts use neural networks as a fixed transform into latent space (Vukotić al., 2018; 2020; Kishore et al., 2022; Fernandez et al., 2022) Since there is no inverse transform, the embedding is done iteratively by gradient descent over the pixels. The recent approaches are often built as
18

---

Published as a conference paper at ICLR 2025
embedderr/extracto networks. They are trained end-to-end to invisibly encode information while being resilient to transformations applied during training. This makes it easier to build robust systems and avoids algorithms hand-crafted for specific transformations. HiDDeN (Zhu et al., 2018) is famous representative of this approach and has been extended in several ways. Luo et al. (2020) add adversarial training in the attack simulation to bring robustness unknown transformations. Zhang et al. (2019b; 2020); Yu (2020) use an attention filter further improving imperceptibility. Ahmadi al. (2020) adds circular convolutional layer that helps spreading the watermark signal over the image. Wen & Aydore (2019) use robust optimization with worst-case attack as if an adversary were trying to remove the mark. Many other approaches focused on improving robustness, imperceptibility. speed, etc. (Jia et al., 2021; Bui et al., 2023b;a; Huang et al., 2023; Evennou et al., 2024; Pan et al., 2024).
Another line of works focuses on steganography (Baluja, 2017; Wengrowski & Dana, 2019; Zhang et al., 2019a; Tancik et al., 2020; Jing et al., 2021; Ma et al., 2022) that pursues different goal. Steganography hides message in the image without leaving any statistical traces, but the robustness is null or limited.
B.2 WATERMARKING FOR GENERATIVE AI
The most trendy research direction in watermarking is arguably the detection of Al Al-generated images for transparency and for filtering such results when building new models. The Post pest-gemeration or post- hoc approach uses traditional watermarking: the content is first generated and then watermarked. On the contrary, the generation-tinn longer incurs additional runtime and is more robust and secure than post-hoc. We broadly categorize generation-time watermarking into the two following categories.
methods natively generate watermarked images. Watermarking no
In-model methods modify the weights of the generative model. This allows open- sourcing the model without revealing the watermark. The earliest methods (Wu et al., 2020; Yu et al., 2021; Zhao et al., 2023b) watermark the images of the training set with the hope that the model learns what watermark is during its training. This is computationally expensive and not scalable. Alternatively, some proposals (Fei et al., 2022; 2024) train Generative Adversarial Networks (GAN) with additional watermarking losses such that generated images contain the watermark. Stable Signature (Fernandez et al., 2023a) focuses on Latent Diffusion Models (LDM) and fine-tunes the latent decoder to embed the watermark, while Feng al. (2024) fine-tun tine-tunete the U-Net that predicts the latent diffusion noise instead. To eliminate the need to fine-tune the model for every user, some papers use hyper-network predicting the modifications to be applied to the generative model, be it GAN (Yu et al., 2022; Fei et al., 2023) or diffusion-based (Kim et al., 2024).
Out-of-model methods alter the generation process. This easier to implement since does not require training or fine-tuning the model. Ci et al. (2024a) and Rezaei et al. (2024) propose an adapter to the decoder that takes the secret message as input. A different class of out-of-model methods, specific to diffusion models, embed the watermark by adding patterns to the initial noise (seed). For example, Tree- Tree-Ring (Wen et al., 2023) adds circular patterns to the initial noise and inverts the diffusion process to extract the watermark. As follow-up works, Hong et al. (2024) improve the inversion of the diffusion process, Ci et al. (2024b) extend the method to multi-bit watermarking, and Lei et al. (2024) deploy the embedder/extrratoo framework over the noise.
C ALGORITHMS DETAILS
C.I DBSCAN
DBSCAN (Density-Based Spatial Clustering of Applications with Noise) (Ester et al., 1996; Schubert et al., 2017) is clustering method that groups points in dataset based on their density and proximity to each other. In our case, points are locally decoded messages (one per pixel deemed as watermarked). It works as follows:
1. Initialization: Set the parameters (maximum distance between two samples for one to be considered as in the neighborhood of the other) and minsamples (minimum number of samples in a cluster).
19

---

Published as a conference paper at ICLR 2025
2. Neighborhood search:
For each point p in the dataset, find all points within distance of from p. This forms the neighborhood of p.
3. Cluster formation: If the neighborhood of p contains at least samples points, form cluster around p. Otherwise, mark p as noise.
4. Cluster expansion: For each point in the cluster, find all points within distance of from
q. Add these points to the cluster if they are not already part of it.
5. Repeat steps 3-4: Continue expanding the cluster until more points can be added.
6. Assign labels: Assign a label to each point in the dataset indicating which cluster it belongs to (if any).
is important to note that is neither hard boundary nor a maximum bound on the distances of points within cluster: points that are further apart than E but still within the neighborhood of core point (a point with at least aiples neighbors within e distance) can also part of the same cluster.
One of the significant advantages of DBSCAN is its ability to cluster points without knowing the number of clusters beforehand, unlike some other clustering algorithms like K-Means. Additionally, it identifies arbitrarily shaped clusters (watermarked area in our case), including those that may be surrounded by different cluster. This clustering is also robust to outliers. However, DBSCAN also has some limitations. It is sensitive to hyper-parameters and gaplesp and to the choice of the distance metric (bit difference our case), which may affect the clustering results. DBSCAN may also be computationally expensive for large number of data points. This is less of an issue in case since it is lower than 256 x 256.
We the Scikit-learn (Pedregosa al., 2011) implementation of DBSCAN in our experiments.
C.2 SEC--NOTICEABLE-IIFEERE
The maximum change that the human visual system (HVS) cannot perceive is referred to as the Just- Noticeable- Difffernneee (JND) (Krueger, 1989). used in image/video watermarking, compression, quality assessment, etc. JND models in the pixel domain directly calculate the JND at each pixel location (i.c., how much pixel difference is perceivable by the HVS).
This section describes in detail the JND map used in Sec. 4.3. It is based on the work of Chou & Li (1995). We use this model for its simplicity. its efficiency, and its good qualitative results. More complex HVS models could also be used if higher imperceptibilityy is needed (Watson, 1993; Yang et al., 2005; Zhang et al., 2008; Jiang et al., 2022). The JND map takes into account two characteristics of the HVS, namely the luminance adaptation (LA) and the contrast masking (CM) phenomena. We follow the same notations as Wu et al. (2017); Fernandez et al. (2023b), and consider images that are in the range [0, 255] 3x56xx25
Luminance masking. Luminance masking refers to the phenomenon where the HVS is less sensitive distortions in bright regions of an image. We denote by Klum the luminance kernel, and x the input image. The local background luminance of the image is:
1
1
17
2
2
2
((x) 32
Σ
Kium (k:, 1) xii + k.j + 1), with Kiam
2
0
2
(6)
k
1
2
2
2
1
1
1
1
These luminance values are then post- post-processed as follows to account for the non-linear response of the HVS:
17. 1 (1- (1-V
+c) +3, B(x) $ 127 B(x)(.)) (Bo(B))) 127
LA(x)(i,j)
(7)
(i,)) - 127) + +3, (ia) > 127,
128
where is small positive value to ensure differentiability during back-prop.g
20

---

Published as a conference paper at ICLR 2025
Contrast masking. Contrast masking refers to the phenomenon where the HVS is less sensitive to distortions in regions of high contrast. The gradient magnitude is:
c())(1,)= - / Σ
Kx(k,)) aii+ 4
k, +
Σ
(Y
xii + k,j +
(8)
R2
[-1 2
0
17 Ky =
2
with Kx
=
0 1
(9)
where Kx and Ky are the horizontal and vertical gradient kernels, and x: is the input image. To account for the non-linear response of the HVS, the contrast masking values (M) at each pixel location:
16 C(x)24
(M = C(z)² + 262
(10)
Heatmap generation. The heatmap generation component of the JND model combines the lumi- nance masking and contrast masking values to produce the JND heatmap:
(z)) = LA(x) + CM)()) - 7 min(LA()), CM())),
(11)
where y is a parameter that controls the trade-off between luminance masking and contrast masking.
For color images, compute the heatmap from the image's luminance. Then repeat it over the color channels but with a scaling that differs for each channel: HJND = [o H ag a agH], where (a.n, ag, Qg) (1, 1, 2). because the human eye is more sensitive red and green than blue color shifts. This produces slightly more distortion in the blue channel.
D IMPLEMENTATION DETAILS & PARAMETERS
D.1 ARCHITECTURES OF THE WATERMARK EMBEDDERREXTRACTOR
We hereby detail the modeling choices and architectures of Sec. 4.1. Our models, in particular the embedder, are kept voluntarily small to be fast and usable at scale. For instance the embedder and extractor deseribed bellow have respectively 1.1M and 96M (z ViT-Base) parameters. Further work could explore how to build larger models with same throughput to improve the results.
In the following we consider an image z E 3 H xW and message E 10,1)% Tois The embedder and extractor operate at resolution h x w 256 x 256 (see Sec. 4.1).
Embedder. Our goal is to embed message in image in way that is imperceptible to the human eye. This task is similar in many ways to image compression or image-to songe-tt--mage translation. The most used architectures for this arguably come from the works of Rombach et al. (2022); Esser et al. (2021), which strike a very good balance between image quality and efficiency.
The encoder and decoder are described in Tab. 3 (we refer the VQGAN paper (Esser al., 2021) for more details). They mainly consist of residual blocks optionally followed by upsampling or downsampling blocks. For the encoder, d = 32, 32, 32, d" = 64, downsampling factor of 2 for the 3 first blocks (leading to a division by 8 of the edge size of the latent map), and dg 4. The decoder mirrors the encoder, and we choose dass = Aib 32. The Up block interpolates the activation map to the new size, then applies a 2D convolution with kernel size 3, stride 1 and padding In particular, we choose not use deconvolution layers (ConyTranspoosee Transpose2D) because of the checkerboard patterns they introduce (Odena et al., 2016). The Down block porras the activation map with 2 kernels with stride
use m 4 residual blocks with output channels
Our task does not need a bottleneck, since we are not interested in learning compressed representations. Therefore the autoencoder predicts signal E [-1, 1,-1,113x26 x xW and not directly the final image which is added to the image with residual layer. Another difference is that the message is embedded in the latent space of the encoder, which means that the first layer of the decoder is bigger. As a reminder, the binary message lookup table is To E IR" Plus x Each bit of the message to the embedding To (k, my. :) E Rdws, depending on its position & E { my E {0, 1), then repeated, which yields Zmsg repeat (1 Mhits Rhic To (k, m2, :)) Bm x32x32
mapped {1..... Abaas) } and its value
21

---

Published as a conference paper at ICLR 2025
Table High-level architecture of the encoder and decoder of the watermark embedder embg. The design of the networks follows the architecture presented by Ho et al. (2020); Esser et al. (2021); Rombach et al. (2022).
Encoder
Decoder
E 1xx ,. {0, 1|
(z, Zmsz) E IR (
Interpolation, Conv2D - R 2dx256x256
Conv2D - I2 x32x32
mx Residual Block, Down Block) + Rd x32x32
Residual Block - 12 x32x32
Residual Block + R x32x32
Non-Local Block + Rd x32x32
Non-Local Block + R x32x32
Residual Block -> I2d x32x32
Residual Block - R x32x32
mx Residual Block, Up Block) + 22.x256x2566
GroupNorm. Swish. Conv2D + 1t X32xx32x32
GroupNorm, Swish, Conv2D - _2 x233x556x266
Ta(m), Repeat- R dlng x32x32
TanH, Interpolation + [- 3
Table 4: High-level architecture of the encoder and decoder of the watermark extractor exte. The design of the networks follows the architecture presented by Zheng et al. (2021); Kirillov et al. (2023).
Image encoder (VIT)
Pixel decoder (CNN)
E RaxHx
Rd 16
Interpolation R 2566222566
m' Residual Block, Up Block + RR x526x255
Patch Embed (Conv2D). Pos. Embed + 1d
Linear -> IR (1+ 2556x256
mx Traasformmr Block + 16x16
Sigmoid (optional) - [
LayerNorm, GELU, Conv2D + Rd 16111
Interpolation R xx++ xx
Extractor. Our goal is to detect and extract the message from an image, at the pixel level. This task similar to image segmentation. Our extractor is based on vision transformer (ViT) (Dosovitskiy, 2020) followed by pixel decoder, commonly done in the literature (Kirillov et al., 2023; Zheng et al., 2021; Oquab et al., 2023).
The architecture of the extractor is detailed in Tab. 4. The encoder is ViT which consists of series of attention blocks to process the image's patches into a high-dimensional feature space. We use ViT-Base architecture (86M parameters), with patch size 16 (Dosovitskiy, 2020), with d = d' 768. The patch embeddings are then upscaled by the pixel decoder to predict the segmentation masks and messages for every pixel. The latter uses m' = 3 Up blocks which upsample (bilinearly) the activation map by factors 4, 2, respectively (total upscale factor is 16, which is the patch size used in the VIT encoder). Each Up block is followed by Conv2D with kernel size of 3 and stride of 1, LayerNorm, and a GELU activation. The number of channels output by the convolution is its number of input channels divided by the upsampling factor of the Up block that precedes. We obtain latent map of shape (d" = d/16, 256, 256), which is mapped to (1 + Meas ( -dimensional pixel features by linear layer. Finally. Sigmoid layer scales the outputs to [0, 1] (this is in fact only done at inference. since the training objective implicitly applies it in PyTorch).
D.2 MASK GENERATION
We follow the protocol of LaMa (Suvorov et al., 2022), and generate most of our masks used during the two phases of training by adapting the authors' code github.com/advimmin some qualitative examples. More specifically, a diverse set of random masks are used:
Figure 6 shows
Box-shaped masks are defined with margin of 10 pixels and bounding box sizes width and height randomly chosen, ranging from 30 to 100 pixels. They can be generated multiple times (I to times) per image.
Full-image masks cover the entire image.
crimmentttioonbbseed masks segments corresponding to object boundaries or specific areas within an image. We use the masks of the COCO dataset, and either select the union of all masks with probability 0.5, or the union of random number of objects.
22

---

Published as a conference paper at ICLR 2025
Irregular masks are random brush strokes, characterized by parameters such as maximum and minimum angles (up to degrees), lengths and widths (ranging from 20 to 50 pixels). The brush strokes can be applied between to 5 times per image.
During the first training phase (described in Sec. 4.2), we use irregular, box-shaped, full-image, and segmentation-base masks, each with a probability of 0.25. Additionally, there is 50% chance of inverting any of the masks.
During the second training phase (described in Sec. 4.3), we use the same masks except that:
for "box-shaped masks", with probability 0.5, instead of outputting a single mask as in the first phase, we output a random number from 1 to of non overlapping rectangles;
for "segmentation- based masks", with probability 0.5, instead of outputting single mask in the first phase, output random number from to 3 of segmented objects.
When randomly selected during this post-training phase, both types of multiple masks cannot be inverted and they are used to hide different watermarks within the same image.
D.3 WATERMARKING METHODS
We follow the evaluation setup used by Fernandez et al. (2023a). For HiDDeN (Zhu et al., 2018), we use the model available in github.com//ef httpu//cooo/ccccookreerccc//ce/ the same JND mask. For DCTDWT, we use the implementation of github.com/Shiee. http.hoiiiiin//nniiiiiiiia watermark (the one used in Stable Diffusion). For SSL Watermark (Fernandez et al., 2022) and FNNS (Kishore et al., 2022) the watermark embedded by optimizing the image, such that the output of pre-trained model is close the given key. SSL Watermark DINO (Caron et al., 2021), while FNNS uses the HiDDeN extractor used in all our experiments, and SteganoGan (Zhang al., 201 9a) in the original paper. We optimize the distortion image for 10 iterations, and modulate it with the same JND mask. This avoids visible artifacts and gives a PSNR comparable
signature and modulate the output with
model pre-trained with
method (Re 38dB). For TrustMark (Bui et al., 2023a), we the "C variant" with 40 bits in the official implementation github. com/aaoob//ruuummaa... as it achieves a similar PSNR.
D.4 TRANSFORMATIONS
Transformations seen at training time and evaluated in Sec. simulate common image processing steps. We categorize them into different groups: valuemetric, which change the pixel values; geometric, which modify the image's geometry; splicing, which add watermarked areas inside
(a) Random masks
(b) Segmentation masks
Figure 6: Examples of masks used during training. Only the white areas of the image end up being watermarked, (a) Random masks (irregular, rectangles, inverted, full, null or inverted). (b) Segmentation masks created from the union of COCO's segmentation masks.
23

---

Published as a conference paper at ICLR 2025
Table Illustration of transformations evaluated in Sec. 5.
Identity
Contrast 0.5
Contrast 1.5
Brightness 0.5
Brightness
Hue 0.5
Saturation 1.5
Median filter? 7
Gaussian blur 17
JPEG 40
Crop 0.33
Resäze 0.5
Rolation
Perspective 0.5
Horizontal flipping
the image; and inpainting, which fill masked areas with plausible content. The geometric and valuemetric transformations are displayed in Tab. and detailed in the following table:
Transformation
Type
Parameter
Training
Evaluation
Brightness
Valuemetric
from torchvision
Random between 0.5 and 2.0
1.5 and 2.0
Contrast
Valuemetric
from torchvision
Random between 0.5 and 2.0
1.5 and 2.0
Hue
Valuemetric
from torchvision from torchvision kernel size k kernel size k quality Q
Random between -0.1 1 and 0.1
-0.1 and 0.1
Saturation
Valuemetric
Random between 0.5 and 2.0
1.5 and 2.0
Gaussian blur
Valuemetric
Random odd between 3 and 17
and 17
Median filter
Valuemetric
Random odd between 3 and
and 7
JPEG
Valuemetric Geometric
Random between and
50 and 80
Horizontal flip
NA
Crop
Geometric edge size ratio
Random between 0.33 and 1.0
0.33 and 0.5
Resize
Geometric edge size ratio
Random between 0.5 and 1.5
0.5
Rotation
Geometric angle
Random between -10 and 10
-10 and 10
Perspective
Geometric
distortion scale
Random between 0.1 and 0.5
0.1 and 0.5
For crop and resize, each new edge size is selected independently, which means that the aspect ratio can change (because the extractor resizes the image). Moreover, an edge size ratio of 0.33 means that the new area of the image is 0.33² x 10% times the original area. For brightness, contrast, saturation, and sharpness, the parameter is the default factor used in the PIL and Torchvision (Marcel & Rodriguez, 2010) libraries. For splicing, the same location on the original image or on a different background image.
crop random area of the image and paste back at
For evaluation (Sec. 5.3) select parameters given in the table. We chose these parameters high enough to have pronounced effects on the robustness of the watermark. In practice, they quite strong and would not not be encountered often in real-world scenarios. Additionally we evaluate the robustness against inpainting which is seen at training time. We LaMa (Suvorov et al., 2022) modify masked areas in the image conditioned on the rest of the image.
transformations from the list above and apply them with the
D.5 LOCALIZATION EXPERIMENTS
Figure gives an example of how the evaluation for watermark localization performed in Sec. 5.4, for the "crop 0.25" augmentation. The mask used to place the watermark (second image) is the same for each image with an area covering from 10% to 100% of the image. We perform a 25% crop the upper left corner. After that, resize the image its original size. Note that after this augmentation, the watermarked area still recovers the same proportion the crop (by design, as the watermarked area was originally centered).
24

---

Published as a conference paper at ICLR 2025
D.6 MULTIPLE WATERMARKS
Figure shows an example of how the evaluation for multiple watermarks is performed in Sec. 5.5. After watermarking 5 areas of the image that are 10% each with different messages, the extractor detects several watermarked areas and outputs one message for each.
Fr
Original Image
Position
Watermarked Image
Augmented Watermarked Image (crop 25% then resize)
Position the watermark crop 25% then resize)
WAM's detection
watermark
Figure 7: Experimental protocol for the evaluation of watermark localization as performed in Sec. 5.4.
Original
Position (10%
Multi-WW Wetemrrred Image
detection
message decading DBSCAN
(a) After the first phase the training. evaluation without augmentation
FIB
Original
message decoding
watermarss (10%
Image
(b) After second phase the training, evaluation without augmentation
Original Image
Position of the watermarka (10% each)
Multi-Mateermrkkane Imagge after JPEG-BB 80, Horizontal Flip and Contrast 1.5
WAM's detection of watermarked areas
WAM's message decodiing with DBSCAN
(c) Failure: after the second phase of the training, with JPEG-80, horizontal flip and contrast 1.5
Figure 8: Evaluation protocol for multiple watermark extraction as described Sec. 5.5. The masks used to place the different watermarks (second image) the same for each image. We then evaluate the bit accuracy across all discovered messages and their ground truth. Different colors represent different detected clusters for each image, but the color scheme is not coherent between images.
25

---

Published as a conference paper at ICLR 2025
Table 6: Detection results for WAM and generation-time watermarking methods, on Ik negative (non-watermarked), and 1k positive (watermarked), possibly edited, images. AUC refers to the Area Under the ROC curve, TPR @ 10-2 the TPR FPR= 10-2 Stable Signature (Fernandez et al., 2023a) embeds a 48-bit message and uses the bit accuracy as score, while Tree-Ring (Wen et al., 2023) and WAM output a detection score. WAM is competitive with watermarking methods for generative models (although the latter offer noteworthy advantages).
AUC
TPR "PR@1002 10
T 10"
Stable Sig.
Tree-Ring
WAM
Stable Sig.
Tree-Ring
WAM
Stable Sig.
Tree-Ring
WAM
None
1.00
1.00
1.00
1.00
1.00
1.00
1.00
1.00
1.00
Valuemetric
0,94
1.00
0.90
1.00
1.00
0,90
1.00
1.00
Gcometrie
1.00
0.91
1.00
0.97
0.56
1.00
0.87
0.43
1.00
Comb. 1.00
0.75
1.00
0.99
0.05
1.00
0.99
0.01
1.00
Splicing
0.97
0.72
1.00
0.90
0.00
1.00
0.81
0.00
0.00
E ADDITIONAL RESULTS
E. COMPARISON WITH WATERMARKING METHODS FOR GENERATIVE MODELS
So far, we only considered general watermarking methods that apply the watermark on existing images. We compare WAM to methods specific for LDM, which watermark generation time. We generate 1k images from text prompts with Stable Signature (Fernandez et al., 2023a), Tree-Ring (Wen et al., 2023) and without watermarking. We also generate set of watermarked images with WAM from this last set. For each method, we retrieve a detection score for both the watermarked set of images and the oon-watermarked images, that Operating Characteristic (ROC) curve and the Area Under the Curve (AUC) for each method. In the case of Stable Signature, we embed 48-bit binary message and the score is the bit accuracy with this message, while Tree-Ring and WAM directly output detection score.
to compute the Receiver
The results are shown in Tab. We observe that WAM overall obtains better performance. However, the watermarking methods for generative models are still competitive and offer important advantages, namely, the possibility to open-source
model for Stable Signature, with virtually no image degradation as well very strong robustness against valuemetric transforma- tions for Ring. Note that the results are not perfectly apple-to-apple since the efficiency of the extractor is different between methods: Tree-Ring requires to inverse the diffusion noise which is considerably heavier, while Stable Signature uses a very small extractor (#e 100k parameters).
possibility to watermark
E.2 HYPER PARAMETER SEARCH FOR DBSCAN
In Section 5.5, the DBSCAN algorithm is used to decode multiple messages from each image, with parameters set displays the results of a hyperparameter search conducted under two scenarios: images that underwent horizontal flipping and a contrast adjustment with parameter of 1.5 on the left, and the same
1 and minpessses 1000. Under the experimental setting, Figure
Number of Clusters
Average Bit Accuracy
Number of Clusters
Average Bit Accuracy
Min Samples
4.95
4.86
4.07
4
0.95
0.35
0.95
0.9
Min Samples
500
4.64
3.01
1.37
0.60
0.60
0.59
0.9
0.8
1500
1.35
-2
3000
4.44
4.56
3.88
0.96
0.96
0.95
0.8
3000
2.36
-1
0.62
0.61
0.6
0.5
1.0
3.0
1.0
2.0
3.0
1.0
2.0
3.0
(a) After horizontal hlip and contrast adjustment of 1.5. The overall mloU is at 85%.
(b) After horizontal hlip, contrast adjustment of 1.5and JPEG-80. The overall mloU is at 59%.
Figure 9: DBSCAN hyperparameter search the same setting as in Sec. 5.5, under two different types of augmentations. Qualitative examples are shown in Fig. 8.
26

---

Published as a conference paper at ICLR 2025
Table Full decoding results on the COCO validation set, used for the aggregated results presented in Tab. 2a of Sec 5.3. "Combination" corresponds to JPEG-80, Brightness 1.5 and Crop 50% all on the same image, and was not part of the evaluation of Sec. 5.3. TPR for threshold on the detection score dde such that FPR 0.04%. The bit accuracy is computed as described in Eq. 2.
HiDDeN
DCTDWT
SSL
FNNS
TrustMark
WAM
TPR/ acc.
TPR/
acc.
TPR/ Bit acc.
TPR/
Bit acc.
TPR
Bit acc.
TPR
Bit acc.
None
76.0
95.5
77.1
91.4
99.9
100.0
99.6
99.9
99.8
99.9
100.0
100.0
Crop (20%)
66.5
93.3
0.1
50.2
3.3
68.8
98.5
99.6
2.1
50.3
99.7
88.8
Crop (50%)
71.0
94.6
0.0
50.4
7.0
73.4
99.2
99.8
1.9
60.9
99.6
95.9
Rot (10%)
7.1
80.8
0.0
50.7
11.2
78.1
76.0
94.9
3.0
56.4
97.7
77.0
Perspective (0.1)
65.7
93.6
0.0
51.8
15.6
80.0
98.0
99.6
77.8
96.7
100.0
99.8
Perspective (0.5)
32.3
61.3
51.6
91.3
50.8
100.0
96.0
Horizontal Flip
0.1
54.3
0.0
50.2
32.7
86.2
0.1
56.2
99.8
99.9
100.0
100.0
Brightness (1.5)
85.6
96.9
16.1
60.9
90.9
97.7
99.1
99.7
83.2
97.1
100,0
100.0
Brightness (2.0)
83.2
96.2
0.1
49.4
67.8
91.9
97.2
99.0
58.8
92.2
100.0
99.9
Contrast (1.5)
74.1
95.4
20.4
63.4
92.9
98.2
98.9
99.7
77.1
96.2
100.0
100.0
Contrast (2.0)
67.3
94.3
0.6
49.4
66.0
92.4
97.0
99.4
90.8
100.0
99.9
Hue (-0.1)
9.0
77.4
29.5
66.7
98.0
99.4
96.7
99.2
99.3
99.9
100.0
100.0
Hue (+0.1)
19.3
84.0
59.4
81.2
97.7
99.3
98.5
99.5
99.5
99.9
100,0
100.0
Saturation (1.5)
80.6
96.2
21.3
61.7
99.7
99.9
99.5
99.9
99.0
99.8
100.0
100.0
Saturation (2.0)
81.7
0.3
98.3
99.4
99.8
99.5
100.0
100.0
Median filter (3)
74.6
94.9
0.9
53.2
82.8
96.5
99.4
99.9
99.7
99.9
100.0
100.0
Median filter (7)
23.4
83.0
0.4
53.0
20.4
80.7
61.1
90.2
99.4
99.9
100.0
100.0
Gaussian Blur (3)
47.1
88.0
41.7
77.0
97.2
99.1
87.3
95.5
99.8
99.9
100.0
100.0
Gaussian Blur (17)
0.1
51.2
0.0
49.8
3.8
69.6
0.0
50.5
98.7
99.8
100.0
99.8
JPEG (50)
11.2
77.3
0.0
49.8
72.5
34.5
86.9
99.1
99.8
99.9
99.0
JPEG (80)
32,8
86.8
0.1
50.5
66.1
92.6
80.5
95.4
99.6
99.9
100,0
99.9
Proportion (10%
0.8
65.9
1.1
56.9
0.6
61.8
36.3
88.2
2.0
58.6
99.9
94.2
Collage (10%)
0.9
70.1
0.5
62.8
0.1
55.9
41.1
88.7
1.3
55.7
100.0
96.5
Combination
44.7
0.0
49.9
1.2
87.7
96.1
58.8
87.2
transformations followed by JPEG compression quality level of 80 on the right. In the absence of JPEG compression, WAM effectively recovers the correct number of messages with satisfactory bit accuracies. However, when JPEG compression is applied top, WAM encounters difficulties. For both scenarios, smaller values of æ and min yielded the most favorable outcomes. These findings guided the selection of the aforementioned values for the primary evaluation in sec. 5.5.
E.3 DETAILED ROBUSTNESS RESULTS
Table 7 shows the detailed results for all the transformations. We observe that WAM handles many of them, although the performance decreases as they get stronger (e.g., for the combination). Figure 10 shows several examples of segmentation masks predicted after LaMa inpainting applied to both COCO DIV2K datasets, consistent with the evaluation settings described in Sec. 5.3.
F QUALITATIVE EXAMPLES
We show examples of images from the COCO dataset in Fig. 11 and for DIV2k in Fig. We observe that the watermark is imperceptible to the human eye, primarily due to the JND map used to mask the watermark in areas where the human visual system is less sensitive. With enough attention, it is however possible boat in the last row Fig. 11) and in the fur of the animals (e.g.. the wolf and the penguin of Fig. 12). We hypothesize that it comes from the fact that the JND map only accounts for the cover image where the watermark signal is added, and not for d itself. However, repetitive and regular patterns perceptible, and, when the bright textured areas are big enough, this becomes noticeable. We believe that further work could improve the imperceptibility of the watermark, for instance by using more complex HVS models (Watson, 1993) or by using a regularization on the watermark signal to remove repetitive or structured patterns.
it in some images, especially in very white very dark areas (e.g., the
27

---

Published as a conference paper at ICLR 2025
Bit aco. 32/32
52/52
Bit acc. 32/32
Watermarked
Mask for inpainting
Watermarked image after inpainting
WAM's detection of watermarked
Figure 10: Examples of WAM's detection after inpainting with LaMa (Suvorov et al., 2022), with the experimental set-up detailed in Sec. 5.3. The first two lines with images from the validation set of COCO (using the union of the segmentation masks), while the third line is with an image from the DIV2k dataset, with a random mask.
Original
Watemnurked
Difference
Original
Watemnurked
Difference
Figure 11: Qualitative results on the validation set of MS-COCO, at various resolutions and for
32-bits message. The difference image is displayed 10 x abs(2.m 2:).
28

---

Published as a conference paper at ICLR 2025
Original
Waternurked
Diflerence
Figure 12: Qualitative results on images from DIV2k, at higher resolution and for a 32-bits message.
The difference image is displayed as 10 abs(#m x).
29

---

Published as a conference paper at ICLR 2025
Table 8: Bit accuracy for MBRS, CIN, and WAM under different augmentations.
Method
None
Geometric
Valuemetric
Splicing
PSNR/SSIM/I.PIPS
MBRS CIN
100.0
50.4
99.8
65.31
38.8/0.99/0007
100.0
50.3
100.0
96.47
38.3/0.99/0.m
WAM (ours)
100.0
91.8
100.0
95.30
38.3/0.99/0.04
G ADDITIONAL DETAILS AND EXPERIMENTS AFTER REBUTTAL
This section provides further insights and experimental results following discussions with the review- ers. We address the operating point of WAM and additional experiments on robustness evaluations.
G.1 OPERATING POINT: ARE 32 BITS ENOUGH?
Our primary objective is to achieve extreme robustness against typical internet/social network image sharing, which necessitates trade-off with capacity. WAM demonstrates significant robustness against geometric augmentations compared to other methods (see Table 2a). can localize watermarks and extract 32-bit message from just 10% of 256 image, which is the operating point have chosen. Alternative configurations could be considered.
WAM offers three additional functionalities: localization, the ability to hide multiple 32-bit messages, and detection separate from decoding. The second functionality indicates a higher true capacity than the 32 bits, and the third ensures that 32 bits sufficient for many applications. To obtain larger payloads, one could theoretically extend the training. Increasing the localization constraint from 10% to 20% of 256x256 training on 512x512 resolution while maintaining 10% target area, or lightening the robustness constraints during training could also help.
G.2 CHOICE BASELINES FOR COMPARISON
We compared methods present in the paper as they constitute solid baseline. Our goal was not to demonstrate that WAM is more robust than all methods in every setting, but rather to show that it performs well for classical watermarking while introducing new capabilities. We argue that MBRS (Jia et al., 2021), I), FIN (Fang al., 2023), and CIN (Ma et al., 2022) are not robust to crops, indicating a different operating point. Our focus is on decoding the image even from small watermarked areas.
As asked by two reviewers, we add comparisons to CIN and MBRS. Specifically, MBRS has 256-bit payload. Like other methods, we encode 16 bits for detection and 32 bits for decoding. We encode this 16+32 = 48-bit message 5 times, occupying 240 bits. At decoding time, average the outputs of the decoder every 48 bits (soft majority vote) and output the decoded 48-bit message. CIN, on the other hand, only handles 30 bits. We show the bit accuracy for the first 30 bits of the message for CIN and do not perform detection (a favorable setup for CIN). For both methods, we seale the distortion to achieve similar PSNR for all models. Results are shown in Table 8. This is the exact same evaluation set-up as for Table 2a and Table on COCO.
G.3 ROBUSTNESS AGAINST NEURAL PURIFICATION
Diffusion based purification. We evaluate robustness against diffusion--asse purification in Ta- ble 9, acknowledging its challenge for all watermarks. While Al-based purification significant challenge for image watermarks, it is not the focus of our work, and we share the same limitations as others. efficient to remove post-hoc watermarks, but it requires a good adversary, and less likely to happen "in the wild". However, Table 2a shows WAM's robustness against strong inpainting, which is more likely to happen by typical non adversarial user.
Neural encoders. We conducted new experiments to assess WAM's performance against VAE attacks, as done by Fernandez et al. (2023a). We measured bit accuracy for a 32-bit message, consistent with Table 2a. WAM remains robust until the VAE significantly compresses the image
30

---

Published as a conference paper at ICLR 2025
Table 9: Robustness of various methods against DiftPure purification and VAE attack at different
PSNR levels between original and recovered image.
DiftPure (PSNR)
VAE Attack (PSNR)
Method
30.1
28.4 27.0 24.9
32.9
32.4
28.6
25.5
HiDDeN
88.6
65.2
56.2
51.6
82.8
80.6
56.9
50.7
DWTDCT
80.4
48.6
49.0
49.5
72.4
63.1
49.7
49.5
SSL
99.2
63.0
54.2
52.0
98.4
97.6
66.8
51.6
FNNS
97.9
64.1
53.0
50.1
97.9
95.1
55,9
50.2
TrustMark
100.0
98.3
74.9
54.3
100.0
100.0
99.9
98.1
MBRS
100.0
99.5
85.1
64.8
100.0
100.0
100.0
97.7
CIN
100.0
100.0
82.3
61.9
98.1
100.0
99.7 67.6
WAM (ours)
100.0
99.4
71.3
49.1
100.0
99.8
98.6 53.7
(PSNR=25 dB). this scenario, only MBRS and TrustMark maintain robustness, but they lack resilience against geometric transformations, representing different trade-off choice.
G.4 ROBUSTNESSS//PPEREPTIIII TRADE-OFF
The tobustness/mprrretbbiitty trade-off can be con- trolled at encoding time by varying the distortion factor OUND which scales the watermark distortion added to the image. Even if trained for specific value (2 in our case), a different value can be used at inference to enhance robustness (albeit with increased visibility). Ta- ble 10 illustrates the bit-accuracy of a 32-bit message for different values of ØNND (from 1 to 3) against a com- bination of JPEG-80, center 50% crop resize, and brightness 1.5. This approach allows for a flexible trade- off between robustness and imperceptibility, providing users with the ability to adjust settings based on specific application needs.
Method
PSNR
Bit Acc.
WAM1.
44.1
71.0
WAM1.
40.7
84.3
WAM2.0
38.3
88.8
WAM2.5
36.4
90.8
WAMa.0
34.8
91.9
Table 10: Bit accuracy of a 32-bit message for different values of aunD after strong post processing, demonstrating the robust- ness/imperceptibiliiy trade-off.
G.5 DETECTION OF OVERLAPPING WATERMARKS
We demonstrate that WAM can still detect the presence of watermark even if two watermarks overlap entirely on the whole image with different messages. This highlights the advantage of having decoding separated from detection. Table 11 shows the detection accuracy for one and two overlapping watermarks on one hundred COCO validation images.
Condition
Detection accuracy
One watermark
100/100
Two overlapping watermarks
100/100
Table 11: Detection accuracy of WAM for one and two overlapping watermarks.
In summary, the additional experiments and analyses presented in this appendix further validate the robustness and versatility of WAM in various challenging scenarios. We appreciate the reviewers' feedback, which has helped us enhance the clarity and depth of our work.
31


Reviews:
[{"review_id": "SoQOLNFZRz", "reviewer": "Reviewer_p14G", "summary": "This paper proposes a new method, Watermark Anything Model (WAM), for adding watermarks to images. The method demonstrates state-of-the-art performance even under various manipulations, such as splicing, geometric transformations, color changes, and inpainting. It consists of an embedder and an extractor capable of localizing the watermark region and decoding distinct messages in different areas of the image. The paper is well-written and easy to understand. Overall, the proposed approach offers a robust solution for image watermarking, with potential applications across diverse digital media fields.", "questions": "In the paper, the authors talk about generative AI models, but they do not show how strong the model is against these types of AI, like Stable Diffusion, which is popular in the AI art community. With Stable Diffusion, it’s possible that all the hidden messages could disappear when the image is changed. It’s important to show that the model can handle generative AI modifications, like Stable Diffusion. For example, if I use Stable Diffusion-based super-resolution (a common tool for improving image quality) on the image, can the model still detect the watermark? If not, the watermark becomes easy to remove.\n\nAnother useful test would be to see if adding a second watermark to an image removes or covers the first one. For instance, after editing an image, if I use WAM again to add my own watermark, can the original watermark message still be found?\n\nPlease do these tests to show how strong the model is, or suggest ways to prevent these possible problems.", "limitations": "", "rating": 8, "confidence": 3, "soundness": 3, "presentation": 3, "contribution": 3, "strengths": "The method has been tested against various manipulations, showcasing its robustness. It reliably detects watermarks even in image splicing and inpainting, including small or detailed areas. The paper is well-structured, making it clear, easy to read, and accessible to the reader.", "weaknesses": "The watermark model has not yet been tested against attacks from generative AI, which is widely used today. The paper would be strengthened if the watermark remains detectable after processing with super-resolution models (whether CNN-based or Stable Diffusion-based). Otherwise, people could easily remove the watermark without much effort. The model demonstrates a 100% true positive rate in many cases; however, most of these manipulations are included in the training augmentation, which may indicate overfitting rather than true robustness. If a manipulation is not included in the training data, can the watermark still be detected? Please also elaborate on the model performance against VAE attack and diffusion attack.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "PZr15XVdiZ", "reviewer": "Reviewer_mbVM", "summary": "This paper introduced a new approach to image watermarking called the Watermark Anything Model (WAM). It allowed identify and localize the watermarked regions rather than just determined if an image is watermarked. \nWAM used a two-stage training process. In the first stage, based on the traditional LDM encoder-decoder architecture, the watermark messages were embedded into every single pixel of the image. Detection and Decoding were then measured by calculating the portion or weighted average of the detected watermarked pixels. The second stage applied the Just-Noticeable-Difference map to make the watermark more imperceptible. \n This paper introduced a novel approach that allowed the localization of the watermarked regions; it proposed a two-stage training process rather than traditional DNN-based method that balanced between robustness and imperceptibility; It allowed multiple distinct watermarks to be embedded into a single image.", "questions": "1.\tIn the two-stage training process, robustness and imperceptibility were trained separately.  Could the authors clarify how they ensure that this separation does not lead to conflict? For instance, robustness training led to visible artifacts, while imperceptibility training weakened robustness. How is this balance maintained effectively? \n2.\tCould the authors discuss the trade-off between the bit capacity, robustness, imperceptibility? It is well-known that there is an inherent trade-off among these three dimensions in watermarking. In this paper, bit capacity was sacrificed, yet imperceptibility was not outstanding than the baseline, and robustness comparisons were limited to a specific scenario: localized watermarked regions. \n3.\tWhile WAM used a JNP map to enhance imperceptibility, its imperceptibility was comparable but not outstanding relative to baseline methods. Is there potential for further improvement in imperceptibility without compromising robustness?\n4.\tGiven that the capacity of WAM was limited, its ability to support multiple distinct watermarks is constrained. As the amount of AIGC grows rapidly, do the authors have suggestions for extending WAM to support larger payload?", "limitations": "", "rating": 5, "confidence": 4, "soundness": 2, "presentation": 2, "contribution": 2, "strengths": "Originality:\nWAM aimed to localize the watermarked region within an image, which is a novel perspective in watermarking. On the other hand, WAM was able to handle multiple distinct watermarks within a single image, which was rarely addressed in prior work. Additionally, WAM has a two-stage training process, first stage trained robustness while the second stage trained imperceptibility,  which is different from the traditional DNN-based methods. \n\nQuality:\nThe authors provided comprehensive experiments on standard datasets, which strengthened the validity of the results. \n\nClarity:\nThe paper was well-structured and clearly explained. The use of toy examples and tables enhanced the readability and understanding of the paper.\n\nSignificance:\n The paper introduced watermark localization and a two-stage training process, which could open up new possibilities in watermarking technology.", "weaknesses": "1.\tLimited capacity\nWAM’s capacity was limited to 32 bits, which may be insufficient for many real-world applications. On the other hand, the comparison with the baseline method were not entirely fair when they are designed for larger capacity.\n2.\tAlthough utilized the JND map to improve watermark imperceptibility, it was only comparable to, but not outstanding among, baseline methods. On the other hand, since WAM used a two-stage training process, first training for robustness and then for imperceptibility, it was unclear how well WAM balanced the trade-off between robustness and imperceptibility when training these aspects separately.\n3.\t The paper lacked discussion of the computational complexity, which would be valuable for understanding its efficiency and scalability in real-world applications.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "CSJQLyCUmC", "reviewer": "Reviewer_n1mi", "summary": "The paper presents a novel framework, WAM, for localized image watermarking that embeds and extracts watermarks from specific regions within an image. WAM’s key innovation is treating watermarking as a segmentation task, which enables the model to identify and decode watermarked regions even when only small parts of an image are modified. The model operates in two phases: initial training for robustness and a fine-tuning stage to ensure imperceptibility and support for multiple watermarks.", "questions": "Please clarify the inovitive of WAM accoding to the weakness.", "limitations": "", "rating": 5, "confidence": 4, "soundness": 2, "presentation": 3, "contribution": 2, "strengths": "1. WAM redefines watermarking as a pixel-level segmentation task, allowing for precise localization and recovery of watermarks within small image regions. This advancement expands watermarking capabilities beyond global, image-wide methods.\n2. WAM’s architecture combines an encoder-decoder structure and clustering techniques, making it well-suited for segmentation. The two-stage training, which introduces imperceptibility and multi-message support, adds flexibility and enhances usability in high-resolution and high-precision tasks.", "weaknesses": "1. Although the paper compares WAM with several baseline watermarking models, including advanced steganographic methods could provide a more comprehensive assessment of WAM's relative strengths and limitations. Additionally, embedding and extracting multiple watermarks in different regions of an image is not a unique concept, as it has been previously introduced in methods such as [a] and [b].\n2. The need for pixel-level detection across high-resolution images could make WAM computationally intensive, especially in scenarios requiring real-time analysis. Further evaluation of computational costs would help contextualize its practical limitations.\n3. The paper acknowledges WAM’s limited payload capacity (32 bits per region). While suitable for smaller messages, the model may face challenges in applications requiring larger payloads. Future work could explore optimizing the architecture to balance capacity and robustness.\n4. The reliance on DBSCAN parameters for multi-watermark clustering introduces an element of complexity. Parameter tuning may be required across different datasets or conditions, potentially complicating deployment.\n\n[a] Pan, Wenwen, Yanling Yin, Xinchao Wang, Yongcheng Jing, and Mingli Song. \"Seek-and-hide: adversarial steganography via deep reinforcement learning.\" IEEE Transactions on Pattern Analysis and Machine Intelligence 44, no. 11 (2021): 7871-7884.\n[b] Meng, Ruohan, Qi Cui, Zhili Zhoul, Chengsheng Yuan, and Xingming Sun. \"A Novel Steganography Algorithm Based on Instance Segmentation.\" Computers, Materials & Continua 63, no. 1 (2020).", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "tIrgcuvEwQ", "reviewer": "Reviewer_oRgo", "summary": "This paper addresses the limitation of current image watermarking methods in handling small watermarked areas. The authors redefine the watermarking task as a segmentation problem, decomposing it into localization and detection tasks. They adopt a two-stage training strategy to separately achieve robustness and imperceptibility. By incorporating localization capabilities, the authors enable embedding multiple watermarks within a single image. Extensive experiments demonstrate the broad applicability of their method.", "questions": "See weaknesses.", "limitations": "", "rating": 8, "confidence": 4, "soundness": 3, "presentation": 2, "contribution": 3, "strengths": "1. The paper introduces an innovative approach by transforming the watermarking task into a segmentation task, enabling the embedding of multiple watermarks at different locations in an image and supporting watermarking of small areas.\n2. The proposed method shows broad applicability and can handle high-resolution images and images of various sizes.\n3. The design motivations are well-justified, and the implementation details are clear. For improving visual quality, the authors opted for the JND approach instead of common \"perceptual\" or \"contradictory\" losses. Extensive experiments validate the effectiveness of using JND for watermarking.", "weaknesses": "1. Although the authors discuss different model architectures, the overall parameter size remains significantly larger compared to prior models such as HiDDeN (454.4K), FIN (737.8K) [2], and CIN (36.01M) [3]. While the authors highlight that their encoder (1.1M parameters) is relatively compact, it is still substantially larger compared to earlier models like HiDDeN (188.93K) and FIN (747.80K). This large parameter size may limit the method's applicability in resource-constrained environments.\n2. The comparative experiments are not comprehensive. The authors do not consider more advanced watermarking models, such as MBRS, FIN, and CIN, which significantly outperform HiDDeN.\n3. It would be helpful for the authors to provide a relationship graph between the extractor’s parameter size and performance, to justify the necessity of the large parameter size for detection and decoding tasks.\n\nOverall, I am optimistic about the paper's method and the problem it addresses. I am particularly intrigued by the authors' segmentation-based approach for embedding multiple watermarks within a single image. My final score will depend on the authors' rebuttal.\n\n\n[1] Fang H, Qiu Y, Chen K, et al. Flow-based robust watermarking with invertible noise layer for black-box distortions[C]//Proceedings of the AAAI conference on artificial intelligence. 2023, 37(4): 5054-5061.\n\n[2] Ma R, Guo M, Hou Y, et al. Towards blind watermarking: Combining invertible and non-invertible mechanisms[C]//Proceedings of the 30th ACM International Conference on Multimedia. 2022: 1532-1542.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "MapGBBBSyS", "reviewer": "Reviewer_pZCp", "summary": "The paper generalizes for multi-source images and achieves image locality preservation without a priori knowledge. The most innovative is to define watermarking as a segmentation task. Other contributions have been proposed in state-of-the-art papers, not for the first time in this thesis, and are not innovative enough.", "questions": "1. The paper compares EditGuard's work, but does not compare the work that is very similar to this paper [1], please explain the difference between the two;\n2. How to guarantee the imperceptibility of the framework, and did not see the loss module in the mature watermarking framework, such as the MSE loss between the embedded image x_m and x, the loss of discriminative networks, etc.", "limitations": "", "rating": 8, "confidence": 3, "soundness": 3, "presentation": 3, "contribution": 4, "strengths": "The paper introduces the Watermark Anything Model (WAM), a deep learning-based approach for embedding and extracting localized image watermarks, which excels in efficiently embedding and locating watermarks within small areas, demonstrating resilience against image tampering and splicing. It can extract distinct 32-bit messages from multiple regions, each less than 10% of the image area, with minimal bit error rates. Trained at low resolutions and further optimized for perception invisibility and multiple watermarks, WAM competes with state-of-the-art methods in terms of imperceptibility and robustness, offering new possibilities and enhanced practicality for image watermarking technology.", "weaknesses": "1. Insufficient innovation, little change in the existing image watermarking framework, no analysis for specific modules, still using the traditional training architecture, just increase the template after random clipping, to achieve the application of the scene changes. \n2.Many existing work has been involved in local image watermarking, known as multi-source image watermarking [1]. The arbitrary image watermarking framework proposed in this paper though does not require prior knowledge and can be protected against any image. But only the major part of the image in a real scene has a role to play and there is no need to add watermarking information for any pixel.\n\n[1] Wang G, Ma Z, Liu C, et al. MuST: Robust Image Watermarking for Multi-Source Tracing[C]//Proceedings of the AAAI Conference on Artificial Intelligence. 2024, 38(6): 5364-5371.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "hvX0Dut0k0", "reviewer": "Reviewer_UTj6", "summary": "This work proposes a deep-learning-based image watermarking method, dubbed WAM. The encoder of WAM can watermark images with multiple watermarks/32-bit messages and the decoder of WAM can output a detection/segmentation map that identifies the regions containing watermarks and those that do not (called detection) and also a message map that presents the message in each watermarked area (called decoding).", "questions": "Please refer to the weaknesses", "limitations": "", "rating": 3, "confidence": 4, "soundness": 3, "presentation": 2, "contribution": 2, "strengths": "1. The proposed method is able to embed multiple watermarks/32-bit messages\n2. The method can output a detection/segmentation map that identifies the regions containing watermarks and those that do not", "weaknesses": "1. I am unclear on how the model achieves multiple watermark encodings. If I understand correctly, according to Figure 2, the model does not accept a mask input during the inference stage. In that case, how does it inject different messages into different regions? This makes Figure 1 somewhat misleading, as the first two steps suggest that the message can be precisely controlled to be encoded into specific objects. Could the authors provide further clarification on this point?\n\n2. Could you clarify how the mask for the watermark's position is inputted into WAM in Figure 7 of the Appendix? Additionally, could you explain why this specific position was chosen for the localization experiment?\n\n3. In lines 226-232, if I am not mistaken, this method appears to be identical to the method proposed by Bui et al., rather than merely 'a similar approach'. Please provide proper credit.\n\n4. Regarding the claim in lines 304-305, it is unclear why applying JND would make training easier compared to using perceptual loss. Could the authors provide evidence or reasoning to support this claim?   'Applying JND only in the second training phase makes training easier than previous methods relying on “perceptual” or “contradictory” losses.'\n\n5. I believe the reason WAM outperforms the baselines in terms of bit accuracy for splicing is simply because WAM incorporates splicing during training, whereas the other models do not. If the other models were to apply splicing as an augmentation or attack during training, would WAM still outperform them in terms of bit accuracy?\n\n6. Typically, the TPR is reported at a fixed FPR, as seen in Tree Ring. Is the approach in this paper, reporting TPR at varying FPRs, fair and appropriate?\n\n7. I am not entirely convinced of the necessity of embedding multiple messages separately into a single image. If the embedding capacity is large enough (e.g., 100 bits), users could already encode several different messages within a single bit stream. Could the authors provide some practical scenarios where embedding multiple separate messages would be particularly beneficial?\n\n8. What happens if the position masks of multiple watermarks overlap? Additionally, for the watermark to be successfully extracted, what is the minimum proportion the watermark mask should cover relative to the overall image size? How many watermarks can be embedded in a single image at most?\n\n9. A small typo on line 407, 'hide messages or arbitrary length' should be 'hide messages of arbitrary length'?\n\n10. Will the source code and pretrained model be released for the community?\n\n11. Is WAM robust to the new type of regeneration attacks [1], like diffusion-based regeneration?\n\n---\n[1] Invisible Image Watermarks Are Provably Removable Using Generative AI\n\n---\n\nI hope I have understood the method correctly. If there are any misunderstandings leading to wrong judgment, I apologize to the authors. I would be open to adjusting my score if the authors address my concerns during the rebuttal.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}]

Author rebuttal:

Decision: Accept (Poster)