Robust Watermarking Using Generative Priors Against Image Editing: From Benchmarking to Advances
Authors: Shilin Lu
Zihan Zhou
Jiayou Lu
Yuanzhi Zhu
Adams Wai-Kin Kong
Venue: ICLR 2025 Poster (2025)
Keywords: AI Security
Watermark
Diffusion Model
Image Editing
Primary area: alignment, fairness, safety, privacy, and societal considerations
TL;DR: We present the first comprehensive benchmark for evaluating the robustness of eleven watermarking methods against prevalent image editing techniques and propose a watermarking model based on SDXL-Turbo that remains robust to these editing methods.

Abstract: Current image watermarking methods are vulnerable to advanced image editing techniques enabled by large-scale text-to-image models. These models can distort embedded watermarks during editing, posing significant challenges to copyright protection. In this work, we introduce W-Bench, the first comprehensive benchmark designed to evaluate the robustness of watermarking methods against a wide range of image editing techniques, including image regeneration, global editing, local editing, and image-to-video generation. Through extensive evaluations of eleven representative watermarking methods against prevalent editing techniques, we demonstrate that most methods fail to detect watermarks after such edits. To address this limitation, we propose VINE, a watermarking method that significantly enhances robustness against various image editing techniques while maintaining high image quality. Our approach involves two key innovations: (1) we analyze the frequency characteristics of image editing and identify that blurring distortions exhibit similar frequency properties, which allows us to use them as surrogate attacks during training to bolster watermark robustness; (2) we leverage a large-scale pretrained diffusion model SDXL-Turbo, adapting it for the watermarking task to achieve more imperceptible and robust watermark embedding. Experimental results show that our method achieves outstanding watermarking performance under various image editing techniques, outperforming existing methods in both image quality and robustness. Code is available at https://github.com/Shilin-LU/VINE

Published as a conference paper at ICLR 2025
ROBUST WATERMARKING USING GENERATIVE PRI- ORS AGAINST IMAGE EDITING: FROM BENCHMARK- ING TO ADVANCES
Shilin Lu', Zihan Zhou', Jiayou Lu', Yuanzhi Zhu", Adams Wai-Kin Kong*
Nanyynn Technological University. 2ETH Zürich {shilin002, zihan010, Jiayeu001]ee htw.:oo.eeeee.eeeeooooeo edu. 2yzercer@gmail com, adamskengentu. edu.s.
ABSTRACT
Current image watermarking methods are vulnerable advanced image editing techniques enabled by large-scale text-to-image models. These models can dis- tort embedded watermarks during editing, posing significant challenges to copy- right protection. In this work, we introduce W-Bench. the first comprehensive benchmark designed to evaluate the robustness of watermarking methods against a wide range of image editing techniques, including image regeneration, global editing, local editing, and image-to-video generation. Through extensive evalu- ations of eleven representative watermarking methods against prevalent editing techniques, we demonstrate that most methods fail to detect watermarks after such edits. To address this limitation, propose VINE, watermarking method that significantly enhances robustness against various image editing techniques while maintaining high image quality. Our approach involves key innova- tions: (1) we analyze the frequency characteristics of image editing and identify that blurring distortions exhibit similar frequency properties, which allows use them as surrogate attacks during training to bolster watermark robustness; (2) we leverage a large-scale pretrained diffusion model SDXL-Turbo, adapting it for the watermarking task to achieve more imperceptible and robust water- mark embedding. Experimental results show that our method achieves outstanding watermarking performance under various image editing techniques, outperform- ing existing methods in both image quality and robustness. Code is available https://gitub..oo//hhhiLLLU
INTRODUCTION
The primary function of an image watermark is assert copyright verify authenticity. A key aspect of watermark design is ensuring its robustness against various image manipulations. Prior deep learning-based based watermarking methods (Bui et al., 2023; Taneik et al., 2020; Zhu, 2018) have proven effective at withstanding classical transformations (e.g., compression, noising, scaling, and cropping). However, recent advances in large scale text-to-image (T2I) models (Chang et al., 2023; Ramesh et al., 2022; Rombach et al., 2022; Saharia et al., 2022) have significantly enhanced image editing capabilities, offering wide array of user-friendly manipulation tools (Brooks et al., 2023; Zhang et al., 2024b), These T2I-based editing methods produce highly realistic modifications, ren- dering the watermark nearly undetectable the edited versions. This poses challenges for copyright and intellectual property protection, as malicious users can easily alter artist's 's or photographer's work, even with embedded watermarks, to create new content without proper attribution.
In this work, we present W-Bench, the first holistic benchmark that incorporates four types of image editing techniques to assess the robustness of watermarking methods, as shown in Fig- ure ((a). Eleven representative watermarking methods are evaluated on W-Bench. The benchmark encompasses image regeneration, global editing, local editing, and image-to-vine generation (I2V). (1) Image regeneration involves perturbing image into noisy version and then reconstructing it, which can be categorized as either stochastic (Meng et al., 2021; Zhao et al., 2023b) or deter- ministic (also known image inversion) (Mokady al., 2022; Song al., 2020a). (2) For global

---

Published as a conference paper at ICLR 2025
VINE-B
Image Regeneration
DWIDCTSVD
d
CIN TreetMark
Normalizad Image Quality
SSL
VINE-K
Riv
SepMark
Global Editing
BaiGGard
PIMoG
Watermark
Watermark
Encoder
Decoder
0.4
Local Editing
Global Eddtingg
Computer Vision'
Image-to toe--tt--iiio Gemeration
Computer
0.2
Bapas
Editiag
StegaStamp
Vision
0.0
Graeration
Extracted Watemaak
Watermark
Image Editing
Edited Version
Robustness against Image Editing (TPR@O 1%FPR)
(a) Flowchart W-Bench Evaluation Process
(b) Watermarking Performance
Figure I: (a) Flowchart of the W-Bench evaluation process. (b) Watermarking performance. Each method is illustrated with a diamond and four bars. The area of the diamond represents the method's encoding capacity. The y-coordinate of the diamond's ' center indicates normalized image quality, calculated by averaging the normalized PSNR, SSIM, LPIPS, and FID) between watermarked and input images. The x-coordinate represents robustness, measured by the True Positive Rate 0. % False Positive Rate (TPR @0.1 (FFR)) averaged across four types of image editing methods, encom- passing total of seven distinct models and algorithms. The four bars are oriented to signify different editing tasks: image regeneration (left), global editing (top), local editing (right), and image-to-vins generation (bottom). The length of each bar reflects the method's normalized TPR @.. 1FFRR after each type of image editing the longer the bar, the better the performance.
editing, we use models such as Instruct-Pix2Pin (Brooks et al., 2023) and MagicBrush (Zhang et al., 2024b), which take the image and text prompt as inputs to edit images. (3) For local editing, employ models like ControlNet-Inpainttig (Zhang et al., 2023) and UltraEdit (Zhao et al., 2024c), which allow additional mask input to specify the region be modified. (4) Additionally, evaluate watermarking models in the context of image-to-video generation using Stable Video Dif- fusion (SVD) (Blattmann et al., 2023) to determine whether the watermark remains detectable in the resultant video frames. Although this is not a conventional image editing approach, we consider it a special case that allows us to identify if the generated videos use copyrighted images. Experimental results (Figure ((b)) reveal that most previous watermarking models struggle to extract watermarks after images are edited by these methods. StegaStamp (Tancik et al., 2020) and MBRS (Jia al., 2021) manage to retain watermarks in certain cases, but at the expense of image quality.
To this end, we propose VINE, an invisible watermarking model designed to be robust against im- age editing. Our improvements focus on two key components: the noise layers and the watermark encoder. For the noise layers, a straightforward way to train a watermarking model robust to im- age editing would be to incorporate editing processes into the training pipeline. However, this is nearly infeasible for large scale T2I model- based image editing because it requires backpropagating through the entire sampling process, which can lead to memory issues (Salman et al., 2023). Instead, we seek surrogate attacks by analyzing image editing from a frequency perspective. The key insight is that image editing tends remove patterns embedded in high-frequency bands, while those in low-frequency bands are less affected. This property is also observed in blurring distortions (c.g., pixelation and defocus blur). The experiments show that incorporating various blurring distortions into the noise layers can enhance the robustness of the watermarking against image editing.
However, this robustness comes at the cost of watermarked image quality, which is limited by the capability of the watermark encoder. To address this, we leverage large-scale pretrained generative model, such as SDXL-Turbo (Sauer et al., 2023), as a powerful generative prior, adapting it specif- ically for the watermarking task. In this context, the watermark encoder functions as conditional generative model, taking original images and watermarks as inputs and generating watermarked im- ages with distinct distribution that can be reliably recognized by the corresponding decoder. By utilizing this strong generative prior, the watermark is embedded more effectively, resulting in both improved perceptual image quality and enhanced robustness.
Our contributions are summarized as follows:
1. We present W-Bench, the first comprehensive benchmark designed to evaluate eleven repre- sentative watermarking models across various image editing methods: image regeneration,
2

---

Published as a conference paper at ICLR 2025
global editing, local editing, and toage-to-video generation. This evaluation covers seven widely used editing models and algorithms and demonstrates that current watermarking models are vulnerable them.
2. We reveal that image editing predominantly removes watermarking patterns in high- frequency bands, while those in low-frequency bands remain less affected. This phe- nomenon is also observed in certain types of blurring distortion. Such distortions can be used as surrogate attacks overcome the challenges from using T2I models during train- ing and to enhance the robustness of the watermark.
3. We approach the watermark encoder as a conditional generative model and introduce two techniques to adapt SDXL-Tuubo a pretrained one-step text-to-image model, for the wa- termarking task. This powerful generative prior improves both the perceptual quality of watermarked images and their robustness to various image editing. Experimental results demonstrate that our model, VINE, is robust against multiple image editing methods while maintaining high image quality, outperforming existing watermarking models.
2 RELATED WORK
Watermarking benchmark. To the best of our knowledge, WAVES (An et al., 2024) is currently the only comprehensive benchmark for evaluating the robustness of deep learning- water- marking methods against image manipulations driven by large-scale generative models. However, WAVES considers only image regeneration (Zhao et al., 2023b) among prevalent image editing tech- niques and does not include other T21-based editing models. In contrast, W-Bench encompasses not only image regeneration but also global editing (Brooks et al., 2023), local editing (Zhang et al., 2023), and image-to-vides generation (Blattmann al., 2023), thereby broadening the scope of our assessment of image editing methods. Furthermore, WAVES evaluates only three watermarking methods--StegaStamp (Taneik et al., 2020), Stable Signature (Fernandez et al., 2023), and Tree- Ring (Wen et al., 2023). Notably, Stable Signature and Tree-Ring are limited to generated images and cannot be applied real ones. In contrast, W-Bench designed to evaluate watermarking mod- els that work with any type of image, thereby enhancing their effectiveness for copyright protection.
Robust watermarking. Watermarking has long been studied for purposes such as tracking and protecting intellectual property in images (AI-Haj. 2007; Cox et al., 2007; Navas et al., 2008), videos (Fernandez et al., 2024; Li et al., 2024), and 3D assets (Ren et al., 2025). Recently deep learning-based methods (Bui et al., 2023; Chen & Li, 2024; Fang et al., 2022; 2023; Jia et al., 2021; Kishore et al., 2021; Luo et al., 2020; 2024; Ma et al., 2022: Tancik et al., 2020; Wu et al., 2023; Zhu, 2018; Zhang et al., 2019; 2021), have demonstrated competitive robustness against a wide range of transformations. However, these methods remain vulnerable to image editing powered by large-scale generative models. Three recent 2024), and JigMark (Pan et al., 2024)-have begun to develop watermarking models that are ro- bust to such image editing. However, although EditGuard, which replaces the unedited regions of an edited image with corresponding areas of the unedited watermarked version, demonstrates good performance, its application in real-world scenarios could be ineffective if the detector has no access to the unedited watermarked image. In our benchmark, we assume that the detector has access only to the edited image without any additional information. JigMark employs contrastive learning to train a watermark encoder and a classifier that determines if image is watermarked, but it does not support decoding free-form messages. Robust-Wite incorporates Instruct-Pix2PP into the noise layer using gradient truncation, but its generalization to other editing models could be less effective.
(Zhang et al., 2024d), Robust-Widd (Hu al.,
3 METHOD
Given original image v. and watermark w, our goal is imperceptibly embed the watermark into the image by an encoder E(-) to obtain a watermarked image æ E(x., w) The watermark should be accurately extracted by corresponding decoder D(-) from Tw. i.e., w' = D( even when x. undergoes image editing c(.).
In Section 3.1, we examine the frequency properties of various image editing methods and identify surrogate attacks that enhance the robustness of watermarking against them. In Section 3.2, we further improve both the robustness and quality of the watermarked image by adapting one-step
3

---

Published as a conference paper at ICLR 2025
constant
FFT
value to the spectrum
IFFT
((..)
F F(
Instruct- Pxx2Pix
Instract 2ixx
Abre the wolkk
forr to the valee!
HFT
FPT
[F(e(z))) (c(())))
(e
<xFu)
i
Figure 2: Process for analyzing the impact of image editing on an image's frequency spectrum. In this example, the editing model represents the Fourier transform, and we visualize its magnitude logarithmic scale.
denoted as c(-), is employed. The function F(-)
text-to-image model the watermark encoder. Additionally, introduce several techniques to facilitate this adaptation. Section 3.3 details the training loss functions and strategies employed, as well as a resolution scaling method used our experiments.
3.1 FREQUENCY NATURE OF IMAGE EDITING
To develop a robust watermarking model against image editing, a straightforward way is to integrate image editing models in the noise layers between the encoder and decoder during training. How- ever, many prevalent image editing methods are based on diffusion models, which typically involve multiple sampling steps produce edited images. This can lead memory issues when backprop- agating through the denoising process. Alternative methods, such as gradient truncation (Hu et al., 2024; Yuan al., 2024), achieve subpar results, and the straight-through estimator (Bengio al., 2013) fails to converge when training from scratch. Thus, we seek surrogate attacks during training.
We start by examining how image editing methods influence the spectrum of an image. Specifically, we conduct three sets of experiments in which symmetric patterns are inserted into the low-, mid-, and figh-frequency bands. Figure 2 illustrates the analysis process for pattern inserted into the low- frequency band. In this procedure, ring-shaped pattern, wn with constant value is embedded in the low-frequency region of the Fourier spectra the RGB channels of the original image, a. i.e., F(æx)) + u. The inverse Fourier transform is then applied to obtain the watermarked one, w. The image editing model, denoted as e(-), applied to both the original image C, and the watermarked one Fw. producing edited versions e(xx) and e (ww). respectively. Finally, compute the difference between their Fourier spectra, [F(<((..)) -F(((xt ((c(x.))l to assess how the inserted pattern is affected by the editing process. The details of the used image editing methods provided in Section 4.1.
Figure 3 illustrates that image editing methods typically remove patterns in the mid and high- frequency bands, while low-frequency patterns remain relatively unaffected. This suggests that T21- based image editing methods often fail to reproduce intricate mid and high-frequency details. We infer that this occurs because T2I models are trained to prioritize capturing the overall semantic content and structure of images (i.e., primarily the low-frequency components) for aligning with the text prompts. As result, high-frequency patterns are smoothed out during the generation process.
To develop robust watermarking model against image editing, it should learn to embed informa- tion into the low-frequency bands. To identify effective surrogate attacks, we explore various image distortions, denoted as T-),, that resemble image editing to some extent. Both image editing and distortion methods preserve the overall image layout and most of the content, although image dis- tortions typically result in lower perceptual quality. Notably, as shown in Figure 3, certain blurring distortions (e.g., pixelation and defocus blur) exhibit a similar trend to image editing. In contrast, widely used distortions, such JPEG compression and saturation, do not display this behavior. Since these blurring distortions are computationally efficient, we incorporate them with varying severity levels into noise layers during training. This encourages the model to embed informa- tion within the low-frequency bands (see the frequency patterns of each watermarking method in Appendix B). Consequently, the robustness against image editing is enhanced, demonstrated by

---

Published as a conference paper at ICLR 2025
Image Editing
Image Distortion
Pallens
CadNNet- ChiNNel-Inpint
Inversion
Instruct- Pix2xx Ultralddit
Pixdlate
JPEG
Sahurato
11.0
Low Preq
O
105
160
Mid
5.
Fioq
High
Preq
F((((w)) F(c
(T F (T (ax))
Figure 3: Impact of various image editing techniques and distortions on the frequency spectra of images. Results are averaged over 1,000 images. Image editing methods tend to remove frequency patterns in the mid- and high-frequee high-frequency bands, while low-frequency patterns remain largely unaf- fected. This trend is also observed with blurring distortions such pixelation and defocus blur. In contrast, commonly used distortions like JPEG compression and saturation do not exhibit similar behavior in the frequency domain. The analysis of SVD is not included, it removes all patterns, rendering them invisible to the human eyc. A discussion on SVD can be found in Section 4.3.
the ablation study in Table 2. The complete of distortions applied in the noise layer includes common distortions such as saturation, contrast, brightness adjustments, JPEG compression, Gaus- sian noise, shot noise, impulse noise, and speckle noise counteract image degradation caused by transmission. Additionally, we incorporate various blurring distortions suchnssssschhhhe such as pixelation, defocus blur, zoom blur, Gaussian blur, and motion blur- to resist image editing.
3.2 GENERATIVE PRIOR FOR WATERMARK ENCODING
Although incorporating image distortions into the noise layers enhance robustness against image editing, this improvement comes at the expense of watermarked image quality, which is constrained by the capabilities of the watermark encoder. The watermark encoder can be viewed conditional generative model, where the conditions include both a watermark and detailed image, rather than simpler representations like depth maps, Canny edges, scribbles. We hypothesize that powerful generative prior can facilitate embedding information more invisibly while enhancing robustness. Thus, we aim to adapt large-scale T21 model as a watermark encoder. There are two types of large scale T2I models: multi-step and one-step. Multi-step T2I models complicate the backpropagation of watermark extraction loss and suffer from slow inference speeds. Thus, we use one-step pre- trained text-to-image model, SDXL-Turbo (Sauer et al., 2023).
To convert SDXL-Turbo into a watermark encoder, an effective strategy incorporate both the input image and the watermark into the model is essential. A common strategy for integrating conditions into diffusion models to introduce additional adapter branches (Mou et al., 2024; Zhang et al., 2023). However, in the one-step generative model, the noise map-the the input the UNet-directly determines the final layout the generated images (Sauer et al., 2023). This contrasts with multi- step diffusion models, where the image layout gradually established during the early sampling stages. Adding an extra conditional branch to the one-step model causes the UNet to receive two sets of residual features, each representing distinct structures. This makes the training process more challenging and results in subpar performance, Instead, as illustrated in Figure 4, we employ a condition adaptor fuse the information from the input image and the watermark (the architecture of the condition adaptor is shown in Figure 11). This fused data then fed into the VAE encoder obtain latent features, which are subsequently input into the UNet and VAE decoder to generate the final watermarked image. We also attempted to input the watermark through the text prompt and finetune the text encoder simultancously. but this approach failed to converge. Thus, during training, the text prompt is set null prompt.
demonstrated by the ablation study in Table 2.
Despite the general effectiveness of SDXL-Turbo 's VAE, architecture not ideally suited for watermarking tasks. The VAE is designed to balance reconstructive and compressive capabilities, thus the reconstructive fidelity is traded off for smoother latent spaces and better compressibility. In the context of watermarking, however, the reconstruction capability is crucial to make sure that

---

Published as a conference paper at ICLR 2025
Trainable (all stages)
Watermark Decoder
Tratnable (after 1st stage)
LECR
010010
Untrainable
'Computer Vision'
010010
Zero-Conv
Noise Layer
Zero-Conv
Condition A daptor
VA Encoder
VAE Decoder
UNet
SDXL-Turbo
Discriminator
W Watermark Encoder
LMSE + CLPIPS
CGAN
The overall framework of our method, VINE. We utilize the pretrained one-step text-to- image model SDXL-Turbo as the watermark encoder. condition adaptor incorporated fuse the watermark with the image before passing the information the VAE encoder. Zero-convolution lay- ers (Zhang et al., 2023) and skip connections are added for better perceptual similarity. For decoding the watermark, connected layer to output a 100-bit watermark. Throughout the entire training process, the SDXL- Turbo text prompt is null prompt. Figure 11 shows the condition adaptor architecture.
Figure 4:
employ ConvNeXI-B (Liu al., 2022b) the decoder, with an additional fully
the watermarked image is perceptually identical to the input image. Thus, we enhance the VAE by introducing skip connections between the encoder and decoder (Figure 4). Concretely, extract four intermediate activations after each downsampling block the encoder, pass them through zero- convolution layers (Zhang al., 2023), and feed them into the corresponding upsampling block in the decoder. This modification significantly improves the perceptual similarity between the water- marked image and the input image, indicated in Table 2. To decode the watermark, utilize ConvNeXt-B (Liu et al., 2022b) as the decoder, with an additional fully connected layer to output 100-bit watermark.
3.3 OBJECTIVE FUNCTION AND TRAINING STRATEGY
Objective function. We follow the standard training scheme, which balances the quality of the wa- termarked image with the effectiveness watermark extraction under various image manipulations. The total loss function is follows:
CALL LIMG (Io, xw) + aLBCE (w, (o))"").
(1)
where a is a trade-off hyperparameter, LBCB is the standard binary cross-entrops loss calculated between the extracted watermark and the ground truth. The image quality loss LIMG is defined as:
LIMG SSS (a()),, (xx,)) + PLPIPSCPPPS (ww BGANLGAN (mo, aww)
(2)
where fMSE, LLPIPS and AGAN are the weights of the respective loss terms. Here, 7(-) is a differen- tiable, non-parametric mapping that transforms the input image from RGB color space into the more perceptually uniform YUV color space, LLPMPS (æo, Zw.) is the perceptual loss, and LGAN (æ., F..) standard adversarial loss from GAN discriminator Daise:
LGAN = Ege, llgg Daise (x.)] + Ez,. [og (1 Ddis:EE(xo: w))).
(3)
Training strategy. In the first training stage, we prioritize the watermark extraction loss by setting to 10 and fMSE; SLPIPS, ACAN each to 0.01. To preserve the generative prior, the UNet and VAE decoder of the SDXL-TTuro, along with the added zero-convolution layers, are frozen. Once the bit accuracy exceeds 0.85, we transition to the second stage, unfreezing all parameters for further training. At this point, the loss weighting factors are adjusted to 1.5, 8MSE 2.0, BLIIPS 1.5, and AGAN = 0.5. The model after the first two stages serves as our base model, dubbed VINE-B. We then fine-tune VINE-B B in the third stage by incorporating Instruct-Pix2Pix (Brooks et al., 2023), representative instruction-drit image editing model, into our noise layer. Gradients are backprop- agated through ttraight-through estimator (Bengio et al., 2013). Note that it cannot converge if it.

---

Published as a conference paper at ICLR 2025
is applied directly during the early training stages. The fine-tuned model is referred to VINE-R. Additional implementation details are provided in Appendix F.
Resolution scaling, Different watermarking models typically trained using fixed input reso- lution, limiting them to accepting only fixed-resolution inputs during testing. However, in practical applications, supporting watermarking the original resolution is crucial to preserve the input image quality. Bui et al. (2023) propose a method (detailed in Appendix D.I) to adapt any watermarking model handle arbitrary resolutions without compromising the quality of the watermarked images and their inherent robustness, as demonstrated in Appendices D.2 and D.3. In our experiments, we apply this resolution scaling method all methods, enabling them to operate a uniform resolution of 512 x 512, which is compatible with image editing models.
4 EXPERIMENTS
In W-Bench, we assess the robustness of eleven representative watermarking models against a vari- cty of image editing methods, including image regeneration. global editing, local editing, and image- vi-video generation. Section 4.1 and Section 4.2 outline the employed image editing methods and the benchmark setup, respectively. Section 4.3 analyzes the henchmarking results. In Section 4.4, conduct ablation studies to understand the impact of the key components.
4.1
IMAGE EDITING METHOSS
Image regeneration. Image regeneration involves perturbing an image into noisy version and then reconstructing it. The perturbing process can be either stochastic or deterministic. the stochastic method (Meng et al., 2021; Nie et al., 2022; Zhao al., 2023b), random Gaussian noise is intro- duced to the image, with the noise level typically controlled by a timestep ts using common noise schedulers such as VP (Ho et al., 2020). VE (Song & Ermon, 2019; Song et al., 2020b). FM (Lipman et al., 2022; Liu et al., 2022a), and EDM (Karras et al., 2022). The diffusion model then denoises the noisy image starting from timestep to to produce clean image. In contrast, the deterministic method (Mokady et al., 2022: Song et al., 2020a; Wallace et al., 2022), also known as image inver- sion, utilizes diffusion model deterministicly invert a clean image into noisy version through multiple sampling steps Rd. The image is then reconstructed by applying the same sampling methods over the same number of sampling steps Tug- We employ the widely used VP scheduler for stochastic regeneration, testing noise timesteps L, from 60 to 240 in increments of 20. For deterministic regen- eration, we utilize the fast sampler DPM-solver (Iuu et al., 2022a;b) and evaluate sampling steps nd of 15, 25, 35, and 45. See Appendix G.2 for the effects of image regeneration on images.
Global and local editing. Although global editing typically involves stylization, we also consider editing methods guided solely by text prompts. In these cases, unintended background changes fre- quently occur, regardless of the requested edit-adding, replacing, or removing objects; altering actions; changing colors; modifying text patters; or adjusting object quantities. Even though the edited background often appears perceptually similar to the original, these unintended alterations can compromise the embedded watermark. In contrast, local editing refers to editing models that use region masks as input, ensuring that the area outside the mask remains unchanged in the edited image. We employ Instruct-Pix2Pix (Brooks et al., 2023), MagicBrush (Zhang et al., 2024b), and UltraEdit (Zhao et al., 2024c) for global editing, while ControlNet-IIpaintin (Zhang et al., 2023) and UltraEdit are used for local editing. Notably, UltraEdit can accept a region mask or operate without it, allowing us to utilize this model for both global and local editing. We use each model's default sampler and perform 50 sampling steps to generate edited images. The difficulty of global editing is controlled by the Massifier-free guidance scale of text prompts (Ho & Salimans, 2022), which ranges from 5 to 9, while the image guidance fixed at 1.5. For local editing, difficulty de- termined by the percentage of the edited region with respect to the entire image (i.c., the size of the region mask), with intervals set at 10-20%, 20-30%, 30-40%, 40-50%, and 50-60%. In all cases of local editing, the image and text guidance values consistently set to 1.5 and 7.5, respectively.
Image-to-video generation. In the experiments, we utilize SVD (Blattmann et al., 2023) to generate video from a single image. We assess whether the watermark remains detectable in the resulting video frames. Since the initial frames closely resemble the input image, we begin our analysis with frame and continue through frame 19, selecting every second frame.
7

---

Published as a conference paper at ICLR 2025
Table I: Comparison of watermarking performance in terms of watermarked image quality and de- tection accuracy across various image editing methods at a uniform resolution 512 x 512. Quality metrics are averaged over 10,000 images, and the TPR @0.1 &FPR for each specific editing method is averaged over 5,000 images. The best value in each column is highlighted in bold, and the second best value is underlined. Abbreviations: Cap = Encoding Capacity; Sto Stochastic Regeneration; Det = Deterministic Regeneration; Pix2Pix = Instruct-Pix2Pix; Ultra = UltraEdit; Magic- = Mag-
icBrush; CtrlN = ControlNet-Impaanninng SVD Stable Video Diffusion.
TPR go PSFPR Coveraged
difficulty levels)
Mothod
Cup
PSNR
SSIM T LPIPS L
FID L
Regeneration
Editing Ultra
Editing
12V
Sta
Dect
Pac2Pix
Magic
CurN
SVD
MBRS (Jix et. 2021)
30
27.37
0.8940
0.1877
6.85
99.53
99.35
7.50
88.
99.60
89, 16
13.55
CIN (Mi et ol., 2022)
30
43.19
0.9847
0.0270
1.13
44.85
51.65
51.40
17.00
68. 38
51.28
66.04
2.91
PIMaGi et ol. 2022)
30
37.72
0.9863
0.0289
3.45
82.85
71.18
72.78
40.14
$1.88
74.30
64,22
14.33
RivaGAN
2019)
32
40.43
0.9702
0.0488
1,86
10.12
12.50
6.22
4.14
33.96
34.28
56.92
3.15
SepMark (Wu al., 2023)
30
35.48
0.9814
0.0150
1.72
61.21
73.85
67.58
97.14
DWIDCT (A--H,,,,), 20073
30
40.45
0.9705
0.0136
0.24
0.09
0.00
0.06
0.56
0.01
DWTDCTSVD (Navas et al., 2008)
30
40.60
0.9799
0.0265
0.86
3.12
1.43
3.83
4.02
30.84
24.56
50.04
0.76
SSL (Fermanee et al,, 2022)
30
41.77
0.9796
0.0350
3.54
1.76
9.70
25.06
10.58
50 10
25.28
31 .64
3.65
SeegaStamp (Tancik et al.. 2020)
100
29.65
0.9107
0.0645
7.61
91.09
92.13
93.72
51.24
91
98.84
99.06
30.85
Trustarr (Bui al.. 2023)
100
41.27
0.5910
0,0026
0.86
9.22
34,20
77.72
43.48
85. 85.90
76.62
59,78
39.60
EdiiGuard (Zhang nl., 20244)
64
37,58
0.0171
0.51
6,00
2.66
0.18
VINE- VINE-Robus.
100
40.51
0.0029
0.08
91.00
96.30
80.90
89
99,60
100
37.34
0.9934
0.0063
0.15
99.66
99.98
97.46
86.86
94.58
99.96
93.04
36.33
4.2 EXPERIMENTAL SETUP
Datasets. We train VINE using the OpenImage dataset (Kuznetsova et al., 2020) resolution of 256 x 256. The training details are provided in Appendix F. For evaluation, we randomly sample 10,000 instances from the UltraEdit dataset (Zhao et al., 2024c), each containing source image, an editing prompt, and region mask. The images in UltraEdit dataset are photographs sourced from datasets such as COCO (Lin et al., 2014), Flickr (Young et al., 2014), and ShareGPT4V (Chen et al., 2023). Of these 10,000 samples, 1 1,000 are allocated for stochastic regeneration, another 1,000 for deterministic regeneration, and 1,000 for global editing. For local editing, 5,000 samples are designated for local editing. These consist of five sets, each containing 1,000 images, which are edited using mask sizes covering 10-20%, 20-30%, 30-40%, 40-50% and 50-60% of the total image area. Additionally, we include 1,000 samples for -mage-to-video generation and 1,000 for testing conventional distortion, thereby completing the total evaluation set.
Baselines. We compare VINE with eleven watermark baselines, all utilizing their officially released checkpoints. These baselines include MBRS (Jia et al., 2021), CIN (Ma et al., 2022), PIMoG (Fang et al., 2022), RivaGAN (Zhang al., 2019), SepMark (Wu et al., 2023), TrustMark (Bui et al., 2023), DWTDCT (AI-Haj. 2007), DWTDCTSVD (Navas et al., 2008), SSL (Fernandez et al., 2022), Ste- gaStamp (Tancik et al., 2020), and EditGuard (Zhang et al., 2024d). Although the baselines were trained at different fixed resolutions (as detailed in Appendix D), we apply resolution scaling (de- scribed in Section 3.3) to standardize all of them to uniform resolution of 512 x 512. This stan- dardization does not compromise their robustness, as demonstrated in Appendix D.3.
Metries. We evaluate the imperceptibilitty of watermarking models using standard metrics, including PSNR, SSIM, LPIPS (Zhang et al., 2018), and FID (Parmar et al., 2022). For watermark extraction, is essential to strictly control the false positive rate (FPR), as incorrectly labeling non- wattraarrdr images watermarked can be detrimental- concern often overlooked in previous studies. Neither high bit accuracy nor AUROC alone guarantees a high true positive rate (TPR) at a low FPR. A detailed discussion is provided in Appendix C. Thus, we primarily focus TPR @0.1 FPR and TPR @1 1 &FPR as our main metrics. Accordingly, both the watermarked and original images are fed into watermark decoders for evaluation. Additionally, we also provide bit accuracy and AUROC for reference. Note that all reported baseline bit accuracies do not include error correction methods, such as BCH (Bose& & Ray-Chaudhuri 1960), which can be applied all watermarking models.
4.3 BENCHMARKING RESULTS AND ANALYSIS
Table 1 summarizes the overall evaluation results. As discussed in Section 4.2, we report TPR @0.1 10.1000.FFPPPP 1&FPR as the primary metric, with additional metrics provided in Figure 5. Each reported TPR @0.1%FFFP F&PR value is averaged across a total of mx 1.000 images, where m represents the num- ber of difficulty levels for the specific image editing task. The quality petrics-PPNT SSIM, LPIPS, and FID are calculated for each pair of watermarked and input images and then averaged across
8

---

Published as a conference paper at ICLR 2025
1.00
1.00
1.0
1.0
TPR:00 1947PR
0.75
TPR@1
0.75
Bit Accuracy
0.8
0.8
0.50
0.50
0.25
0.25
0.6
0.6
0.00
0.00
60
100
140
180 220
60
100
140
180
220
100 Timestop
140
180
220
60
100
140 180 220
Noise Timestop
Noise Timestop
Noise
Noise Timestop
@
Stochsticc regenaration with VPscheculerr
1.00
1.00
1.0
TPR@0 19FPR
0.75
PPR@1
0.75
Bit Accuracy
AUROC
0.8
0.50
0.25
0.25
0.6
0.6
0.00
0.00
Text Guidance Scale
Text Guidance Scale
Text Guidunce Scale
Text Guidunce Scale
(b) Global editing with MagicBrush
1.00
1.00
1.0
1.0
TPR@00 15PPR
TPR@ IKPPR
0.75
Bit Accurac
0.8
AUROC
0.8
0.50
0.50
0.25
0.25
0.6
0.00
10-20%
20-30%
30-40%
40-509%
50-60%
10-20%
30-30%%
30 30-40%
40-50%
50-60%
20-30% 10-20%6
30 50-40%
40-50%
50-60%
10-20%%
20-30%6
30-40%
40-50%
50-60%
30
20-
Mask Ratio
Mask
Ratio
Mask Ratio
(c) Loral editing with UltraFdit
MBRS
PIMoG
SepMark
DWTDCT
SSL
EdiGuard
VINE-B
CIN
RiveGAN
TrustMark
DWIDCTSVD
StegaStamp
VINE-R
Figure 5: The performance of watermarking methods under (a) Stochastic regeneration, (b) Global editing, and (c) Local editing. Additional results are available in Figure 18.
all 10,000 image pairs. MBRS and StegaStamp perform well in image regeneration and local editing tasks; however, they have lower image quality. Qualitative comparison is provided Appendix Additionally, MBRS has a limited encoding capacity of only 30 bits. Although SepMark, PIMoG, and TrustMark strike a better balance between image quality and detection accuracy, their detec- tion accuracy remains unsatisfactory. In contrast, methods, VINE-B and VINE-R, offer the best trade-off. VINE-B provides superior image quality with slightly lower detection accuracy under im- age editing, while VINE-R delivers greater robustness by sacrificing some image quality. EditGuard is not designed for robust watermarking against image editing, as it is trained with mild degradation. Instead, it offers feature for tamper localization, enabling the identification of edited regions.
Figure illustrates the watermarking performance across various difficulty levels for different im- age editing methods. The evaluation results against representative editing models are displayed, while additional results are available in Appendix J. For image regeneration, both VINE-R and MBRS maintain high TPR (00.1%FF across various difficulty levels. VINE-B, StegaStamp, and PIMoG perform well when subjected to minor perturbations. It is important to note that stochastic regeneration with large noise perturbation steps can significantly alter the image, as shown in Ap- pendix G.2. Although SSL achieves higher bit accuracy and AUROC than TrustMark, it exhibits lower TPR @0.1 FPR.. Further investigation revealed that SSL has high FPR, often producing bit accuracy exceeding 0.7 for unwatermarked images. Therefore, bit accuracy and AUROC alone insufficient for evaluating watermarking performance.
For global editing and local editing, VINE-B, VINE-R, and StegaStamp achieve high TPR @0, 1&FRR across various classifier-fi guidance scales. Notably, we also use UltraEdit for global editing. which provides better alignment between the edited image and the editing instruc- tions compared to instruct-Pix2Pix and MagicBrush (a quantitative analysis of editing models is presented in Appendix G.3). However, methods that perform well for local editing with Ultraddit

---

Published as a conference paper at ICLR 2025
Table Ablation study examining the impact of key components on image regeneration and global editing. Each configuration builds upon the previous one, with changes highlighted in red.
Blurrng
Watemark Excoder
TPROIL1 1 (5)
Confa
PSNR
SSIM
L25P5
FID
Distersons
Baakkoone
Condition
Skip
Pretmuned
Finetnee
500
13er
Pic2iPx
Ultra
Contg
0:9828
Contg
Simple UNet
NA.
N.A.
2.12
31.34
0.9901
Conlgg
ContrrNa
12.66
0.3640
0.298
2.87
58.83
94.89
91.36
70,60
Conlig
Coul Adagter
36.76
0.0856
0.1022
0.53
50.86
94.76
92.58
70.68
Conng (-VINE-)) B)
SDXL Turbo
Gond. Adapoor
X
40.51
0.9954
0.829
0.05
91.03
99.25
96.33 10.30
10,00
Lonng (1 (VINE-K)
Gond. Adaptrr
12.36
11006
1.15
99.66
99.95
97.46
W6.86
Config H
Cood. Adapor
X
35.08
0.9812
0.0137
1.03
99.67
99.92
96.13
54.66
do not perform satisfactorily when applied to global editing using the same model, shown in Fig- ure 18(b). This suggests that global editing more significantly degrades watermarks. Image-to-video generation is not a form of traditional image editing, but are interested in whether watermarks can persist in the generated frames. As illustrated in Figure I 18(c). the overall detection rate is not high. Upon analyzing 12V generation in the frequency domain, we discovered that this process sig- nificantly reduces the intensity of nearly all patterns across all frequency bands, rendering them unobservable the human eye. We infer this because the generated video frames alter the image layout as objects or the camera move. In this case, the intensity of the watermarking patterns should be substantially increased, at least to levels exceeding those shown in Figure 7.
4.4 ABLATION STUDY
In this section, we showcase the effectiveness of our designs through extensive ablation study summarized in Table 2. We start with Config A, a baseline utilizing a simple UNet as the watermark encoder and incorporating only the common distortions outlined in Section 3. Building upon this, Config B introduces blurring distortions to the noise layer, which significantly enhances robustness against image editing but compromises image quality. Config C further refines Config B by using a straight- through estimator to fine-tune with Instruct-Pix2Pixx This enhances robustness, albeit at the cost of some image quality, Config replaces the UNet backbone with the pretrained SDXL- Turbo and integrates image and watermark conditions via ControlNet (Zhang et al., 2023), boosting robustness while degrading image quality due to conflicts from the additional branch. Config E substitutes ControlNet with condition adaptor, restoring image quality to the level comparable with Config B while maintaining the robustness of Config D. Config F (VINE-B) enhances Con- fig E by introducing skip connections and zero-convolution layers, further improving both image quality and robustness. Config G (VINE-R) fine-tunes Config F using a straight-through estimator with Instruct-Pix2Pix, which increases robustness but reduces image quality. Notably, compared to Config C, Config G leverages a larger model and a powerful generative prior, resulting in significant improvements in image quality and modest gains robustness. Finally. Config H trained with randomly initialized weights instead of pretrained ones while retaining all other settings from Con- fig G, leading to lower image quality (particularly on the FID metric) but no change in robustness.
5 CONCLUSION
In this work, we introduce W-Bench, the first comprehensive benchmark that incorporates four types of image editing powered by large-scale generative models to evaluate the robustness of watermark- ing models. Eleven representative watermarking methods are selected and tested on W-Bench. We demonstrate how image editing commonly affects the Fourier spectrum of the image and identify an effective and efficient surrogate to simulate these effects during training. Our model, VINE, achieves outstanding watermarking performance against various image editing techniques, outper- forming prior methods in both image quality and robustness. These results suggest that one-step pre-trained models can serve as strong and versatile backbones for watermarking, and that a power- ful generative prior enhances information embedding in more imperceptible and robust manner.
Limitations. While our method delivers exceptional performance against common image editing tasks powered by generative models, its effectiveness in 12V generation remains limited. Moreover, our model is larger than the baseline models, leading to increased memory requirements and slightly slower inference speeds, as detailed in Table
10

---

Published as a conference paper at ICLR 2025
ACKNOWLEDGMENTS
This research is supported by the National Research Foundation, Singapore and Infocomm Media Development Authority under its Trust Tech Funding Initiative. Any opinions, findings and conclu- sions or recommendations expressed this material are those of the author(s) and do not reflect the views of National Research Foundation, Singapore and Infocomm Media Development Authority.
REFERENCES
Ali AI-Haj Combined dwt-det digital image watermarking. Journal of computer science, 3(9):
740-746, 2007.
Bang An, Mucong Ding, Tahseen Rabbani, Aakriti Agrawal, Yuancheng Xu, Chenghao Deng, Sicheng Zhu, Abdirisak Mohamed, Yuxin Wen, Tom Goldstein, and Furong Huang. WAVES: Benchmarking the robustness of image watermarks. In Proceedings of the 41st International Conference on Machine Learning, pp. 1456-1492, 2024.
Omri Avrahami, Ohad Fried, and Dani Lischinski. Blended latent diffusion. ACM transactions on graphies (TOG), 110
Yoshua Bengio, Nicholas Léonard, and Aaron Courville. Estimating or propagating gradients through stochastic neurons for conditional computation. arXiv preprint arXiv: T0w::330..444 3432, 2013.
Andreas Blattmann, Tim Dockhorn, Sumith Kulal, Daniel Mendelevitch, Maciej Kilian, Dominik Lorenz, Yam Levi, Zion English, Vikram Voleti, Adam Letts, et al. Stable video diffusion: Scaling latent video diffusion models to large datasets. arXiv preprint arXi::231..15127, 2023.
Raj Chandra Bose and Dwijendra K Ray-Chaudhuri. On a class of error correcting binary group codes. Information and control, 3(1):68-79) 1960.
Tim Brooks, Aleksander Holynski, and Alexei A Efros. Instructpix2pix: Learning to follow image editing instructions. In Proceedings of the IEEF/CVE Conference on Computer Vision and Pattern Recognition, pp. 18392-18402, 2023.
Tu Bui, Shruti Agarwal, and John Collomosse. Trustmark: Universal watermarking for arbitrary resolution images. arXiv preprint arXiv:2311.18291 2023.
Huiwen Chang, Han Zhang, Jarred Barber, AJ Maschinot, Jose Lezama, Lu Jiang, Ming-Hsuan Yang, Kevin Murphy, William T Freeman, Michael Rubinstein, et al. Muse: Text-to-image gen- eration via masked generative transformers. arXiv preprint vxXiv2331.00000 2023.
Lin Chen, Jisong Li, Xiaoyi Dong, Pan Zhang, Conghui He, Jiaqi Wang, Feng Zhao, and Dahua Lin. Sharegpt4v: Improving large multi-modal models with better captions. arXiv preprint arXiv:2311.112793, 2023.
Weitong Chen and Yuheng Li. Rowsformer: A robust watermarking framework with swin trans- former for enhanced geometric attack resilience. arXiv preprint arXiv:2409. 14829, 2024.
Xi Chen, Lianghua Huang, Yu Liu, Yujun Shen, Deli Zhao, and Hengshuang Zhao. Anydoor: Zero- shot object-level image customization. In Proceedings of the IEEE/CVF Conference on Computer Vision and Paltern Recognition, pp. 6593-6602, 2024.
Hai Ci, Pei Yang, Yiren Song, and Mike Zheng Shou. Ringid: Rethinking tree-ring watermarking for enhanced multi-key identification. arXiv preprint arXiv:2404. 1405,, 2024.
Ingemar Cox, Matthew Miller, Jeffrey Bloom, Jessica Fridrich, and Ton Kalker. Digital watermark- ing and steganography. Morgan kaufmann, 2007.
Yingqian Cui, Jie Ren, Han Xu, Pengfei He, Hui Liu, Lichao Sun. Yue Xing, and Jiliang Tang. Diffusionshield: watermark for copyright protection against generative diffusion models. arXiv preprint arXiv:2306.0466 2023.
11

---

Published as a conference paper at ICLR 2025
Ming Ding, Wendi Zheng, Wenyi Hong, and Jie Tang. Cogview2: Faster and better text-to-image generation via hierarchical transformers. Advances in Neural Information Processing Systems, 35:16890-16902. 2022.
Patrick Esser, Sumith Kulal, Andreas Blattmann, Rahim Entezari, Jonas Müller, Harry Saini, Yam Levi, Dominik Lorenz, Axel Sauer, Frederic Boesel, et al. Scaling rectified flow transformers for high-resolution image synthesis. In Forty-first International Conference on Machine Learning. 2024.
Han Fang, Zhaoyang Jia, Zehua Ma, Ee-Chien Chang, and Weiming Zhang. Pimog: An effective screen-shooting noise-layer simulation for deep-learning based watermarking network. In Pro- ceedings of the 30th ACM international conference on multimedia, pp. 2267-2275, 2022.
Han Fang, Yupeng Qiu, Kejiang Chen, Jiyi Zhang, Weiming Zhang, and Ee-Chier Chang. Flow- based robust watermarking with invertible noise layer for black-box distortions. In Proceedings of the AAAI conference on artificial intelligence, volume 37, pp. 5054-5061, 2023.
Pierre Femaandez, Alexandre Sablayrolles, Teddy Furon, Hervé Jégou, and Matthijs Douze. Water- marking images in self-supervised latent spaces. In IEEE International Conference on Acoustics, Speech and Signal Processing (ICASSP). IEFE, 2022.
Pierre Fernandez, Guillaume Couairon, Hervé Jégou, Matthijs Douze, and Teddy Furon. The sta- ble signature: Rooting watermarks in latent diffusion models. In Proceedings of the TEEF/CVF International Conference on Computer Vision, pp. 18466-224777 2023.
Pierre Fernandez, Hady Elsahar, Zeki Yalniz, and Alexandre Mourachko. Video seal: Open and efficient video watermarking, arXiv preprint arXiv:2412.09499. 2024.
Tsu-Jui Fu, Wenze Hu, Xianzhi Du, William Yang Wang. Yinfei Yang, and Zhe Gan. Guid- ing instruction-based image editing via multimodal large language models. arXiv preprint arXiv:2309.17102 2023.
Rohit Gandikota, Joanna Materzynska, Jaden Fiotto- Kaufman, and David Bau. Erasing concepts from diffusion models. arXiv preprint arXiv:2303.07345 2023.
Daiheng Gao, Shilin Lu, Shaw Walters, Wenbo Zhou, Jiaming Chu, Jie Zhang, Bang Zhang, Mengxi Jia, Jian Zhao, Zhaoxin Fan, et al. Eraseanything: Enabling concept erasure in rectified flow transformers. arXiv preprint arXiv:2412.20413, 2024.
Amir Hertz, Ron Mokady, Jay Tenenbaum, Kfir Aberman, Yael Pritch, and Daniel Cohen-Or. Prompt-to-prompl image editing with cross attention control. arXiv preprint arXiv:2208.0112 01626, 2022.
Jonathan Ho and Tim Salimans. arXiv:2207. 12598, 2022.
Classifier-free diffusion guidance.
arXiv preprint
Jonathan Ho, Ajay Jain, and Pieter Abbeel. Denoising diffusion probabilistic models. Advances in Neural Information Processing Systems, 33:6840-688 6851, 2020.
Runyi Hu, Jie Zhang, Tianeei Zhang, and Jiwei Li. Robust-wide: Robust watermarking against instruction-driven image editing. arXiv preprint 2rXiv:2402.122688 2024.
Yaosi Hu, Chong Luo, and Zhenzhong Chen. Make move: Controllable image-to-videeo generation with text descriptions. In Proceedings of the IEEF/CVF Conference Computer Vision and Pattern Recognition (CVPR), 2022.
Zhaoyang Jia, Han Fang, and Weiming Zhang. Mbrs: Enhancing robustness of dnn-based water- marking by mini-batch of real and simulated jpeg compression. In Proceedings of the 29th ACM international conference on multimedia, pp. 41-49, 2021.
Tero Karras, Miika Aittala, Timo Aila, and Samuli Laine. Elucidating the design space of diffusion- based generative models. Advances in neural information processing systems, 35:26565 -65777, 2022.
12

---

Published as a conference paper at ICLR 2025
Gwanghyun Kim, Taesung Kwon, and Jong Chul Ye. Diffusionclip: Text-guided diffusion models for robust image manipulation. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR), pp. 2426-2435 June 2022.
Varsha Kishore, Xiangyu Chen, Yan Wang, Boyi Li, and Kilian Q Weinberger. Fixed neural net- work steganography: Train the images, not the network. In International Conference Learning Representations, 2021.
Alina Kuznetsova, Hassan Rom, Neil Alldrin, Jasper Uijlings, Ivan Krasin, Jordi Pont-Tused Shahab Kamali, Stefan Popov, Matteo Malloci, Alexander Kolesnikov, Tom Duerig, and Vittorio Ferrari. The open images dataset v4: Unified image classification, object detection, and visual relationship detection at scale. IJC,, 2020.
Jinmin Li, Kuofeng Gao, Yang Bai, Jingyun Zhang, and Shu-Tap Tao Xia. Video watermarking: Safeguarding your video from (unauthorized) annotations by video-based llms. arXiv preprint arXiv:2407.02411 2024.
Tsung-Yi Yi Lin, Michael Maire, Serge Belongie, James Hays, Pietro Perona, Deva Ramanan, Piotr Dollár, and C Lawrence Zitnick. Microsoft coco: Common objects in context. In Computer Vision-ECCV 2014: 13th European Conference, Zurich, Switzrlannd, September 6- 12, 2014, Pro- ceedings, Part V 13, pp. 740-755. Springer, 2014.
Yaron Lipman, Ricky TQ Chen, Heli Ben-Hamu, Maximilian Nickel, and Matt Le. Flow matching for generative modeling. arXiv preprint 2Xix:2210.02747, 2022.
Xingchao Liu, Chengyue Gong, and Qiang Liu. Flow straight and fast: Learning to generate and transfer data with rectified flow. arXiv preprint arXiv:2209.030033 2022a.
Yugeng Liu, Zheng Li, Michael Backes, Yun Shen, and Yang Zhang. Watermarking diffusion model. arXiv preprint ar 2tt.::23555/22222... 2023.
Zhuang Liu, Hanzi Mao, Chao-Yuse Wu, Christoph Feichtenhofer, Trevor Darrell, and Saining Xie. A convnet for the 2020s. In Proceedings of the IEEE/CVF conference on computer vision and pattern recognition, pp. 11976-11986, 2022b.
Cheng Lu, Yuhao Zhou, Fan Bao, Jianfei Chen, Chongxuan Li, and Jun Zhu. Dpm-solver: A fast ode solver for diffusion probabilistic model sampling in around 10 steps. arXiv preprint arXiv:2206.00 00927, 2022a.
Cheng Lu, Yuhao Zhou, Fan Bao, Jianfei Chen, Chongxuan Li, and Jun Zhu Dpm-solver++: Fast solver for guided sampling of diffusion probabilistic models. arXiv preprint arX0v:2211.01095, 2022b.
Shilin Lu, Yanzhu Liu, and Adams Wai-Kin Kong. Tf-icon: Diffusion-based training-free cross- domain image composition. In Proceedings of the IEEE/CVF International Conference on Com- puter Vision, pp.
2023.
Shilin Lu, Zilan Wang, Leyang Li, Yanzhu Liu, and Adams Wai-Kin Kong. Mace: Mass concept erasure in diffusion models. In Proceedings of the IEEE/CVF Conference Computer Vision and Puttern Recognition, pp. 6430-6440, 2024.
Ting Luo, Jun Wu, Zhouyan He, Haiyong Xu, Gangyi Jiang, and Chin-Chen Chang. Wformer: A transformer- based soft fusion model for robust image watermarking. IEEE Transactions on Emerging Topics in Computational Intelligence, 2024.
Xiyang Luo, Ruohan Zhan, Huiwen Chang, Feng Yang, and Peyman Milanfar. Distortion agnostic deep watermarking. In Proceedings of the IEEE/CVF conference computer vision and pattern recognition, pp. 13548-13557, 2020.
Rui Ma, Mengxi Guo, Yi Hou, Fan Yang, Yuan Li, Huizhu Jia, and Xiaodong Xie. Towards blind watermarking: Combining invertible and non-invertible mechanisms. Proceedings of the 30th ACM International Conference on Multimedia, pp. 1532-1542, 2022.
13

---

Published as a conference paper at ICLR 2025
Chenlin Meng, Yutong He, Yang Song, Jiaming Song, Jiajun Wu, Jun- Yan Zhu, and Stefano Ermon. Sdedit: Guided image synthesis and editing with stochastic differential equations. arXiv preprint arXhv:2108.01073, 2021.
Zheling Meng, Bo Peng, and Jing Dong. Latent watermark: Inject and detect watermarks in latent diffusion space. arXiv preprint
2024.
Ron Mokady, Amir Hertz, Kfir Aberman, Yael Pritch, and Daniel Cohen-Or. Null-text inversion for editing real images using guided diffusion models. arXiv preprint arXiv:2211.09794 2022.
Chong Mou, Xintao Wang. Jiechong Song, Ying Shan, and Jian Zhang. Dragondiffusion: Enabling drag-style manipulation on diffusion models. arXiv preprint ar arXiv:2307.024211 2023.
Chong Mou, Xintao Wang, Lianghnn Xie, Yanze Wu, Jian Zhang. Zhongang Qi, and Ying Shan. T2i-adapter: Learning adapters to dig out more controllable ability for text-lo-image diffusion models. In Proceedings of the AAAI Conference Artificial Intelligence, volume 38, pp. 4296 4304, 2024.
KA Navas, Mathews Cheriyan Ajay, M Lekshmi, Tampy S Archana, and M Sasikumar. Dwt-det-svd based watermarking. In 2008 3rd international conference on communication systems software and middleware and workshops (COMSWARE'0S), pp. 271-274 IEEE, 2008
Alex Nichol, Prafulla Dhariwal, Aditya Ramesh, Pranav Shyam, Pamela Mishkin, Bob McGrew, Ilya Sutskever, and Mark Chen. Glide: Towards photorealistic image generation and editing with text-guided diffusion models. arXiv preprint 12.::2/22.1000 12.14111, 2021.
Weili Nie, Brandon Guo, Yujia Huang. Chaowei Xiao, Arash Vahdat, and Anima Anandkumar. Diffusion models for adversarial purification. arXiv preprint 1xxiv:2055.07466 2022.
Minzhou Pan, Yi Zeng, Xue Lin, Ning Yu, Cho-Jui Hsieh, Peter Henderson, and Ruoxi Jía. Jigmark: A black-box approach for enhancing image watermarks against diffusion model edits. arXiv preprint Xww.::22440000200,, 2024.
Xingang Pan, Ayush Tewari, Thomas Leimkühler, Lingjie Liu, Abhimitra Mcka, and Christian Theobalt. Drag your gan: Interactive point- based manipulation on the generative image mani- fold. In ACM SIGGRAPH 2023 Conference Proceedings, 2023.
Gaurav Parmar, Richard Zhang, and Jun-Yan Yan Zhu. On aliased resizing and surprising subtleties in gan evaluation. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pp. 11410-11420 2022.
Gaurav Parmar, Taesung Park, Srinivasa Narasimhan, and Jun-Yan Zhu. One-step image translation with text-to-image models. arXiv preprint (xXi:2443.112336 2024.
William Peebles and Saining Xie. Scalable diffusion models with transformers. In Proceedings of the IEEE/CVF International Conference on Computer Vision, pp. 4195 4205, 2023.
Long Peng, Yang Cao, Renjing Pei, Wenbo Li, Jiaming Guo, Xueyang Fu, Yang Wang, and Zheng- Jun Zha. Efficient real-world image super-resolution via adaptive directional gradient convolution. arXiv preprint arXiv:2405.0r7 0000220 2024a.
Long Peng, Yang Cao, Yuejin Sun, and Yang Wang. Lightweight adaptive feature de-drifting for compressed image classification. IEEE Transactions on Multimedia, 2024b.
Long Peng, Wenbo Li, Renjing Pei, Jingjing Ren, Yang Wang, Yang Cao, and Zueng-Jun Zha. To- wards realistic data generation for real-world super-resolution. arXiv preprint a7Xiv:2406.07255, 2024c.
Aditya Ramesh, Prafulla Dhariwal, Alex Nichol, Casey Chu, and Mark Chen. Hierarchical text- conditional image generation with clip latents. arXiv preprint 2XXi:2204400625. 1(2):3, 2022.
Yan Ren, Shilin Lu, and Adams Wai-Kin Kong. All that glitters is not gold: Key-secured 3d secrets within 3d gaussian splatting. arXiv preprint 19X1v:2503.07191, 2025.
14

---

Published as a conference paper at ICLR 2025
Ahmad Rezaci, Mohammad Akbari, Saeed Ranjbar Alvar, Arezou Fatemi, and Yong Zhang. Lawa: Using latent space for in-generation image watermarking, arXiv preprint arXiv:2408.05868, 2024.
Robin Rombach, Andreas Blattmann, Dominik Lorenz, Patrick Esser, and Bjöm Ommer. High- resolution image synthesis with latent diffusion models. In Proceedings of the IEEE/CVF confer- ence on computer vision and pattern recognition, pp. 10684-10695, 2022.
Nataniel Ruiz, Yuanzhen Li, Varun Jampani, Yael Pritch, Michael Rubinstein, and Kfir Aberman. Dreambooth: Fine tuning text-to-image diffusion models for subject-driver generation. In Pro- ceedings of the IEEE/CVF conference computer vision and pattern recognition, pp. 22500- 22510, 2023.
Chitwan Saharia, William Chan, Saurabh Saxena, Lala Li, Jay Whang, Emily L Denton, Kamyar Ghasemipour, Raphael Gontijo Lopes, Bureu Karagol Ayan, Tim Salimans, et al. Photorealistic text-to-image diffusion models with deep language understanding. Advances in Neural Informa- tion Processing Systems, 35:36479-36494, 2022.
Hadi Salman, Alaa Khaddaj, Guillaume Leclere, Andrew Ilyas, and Aleksander Madry. Raising the cost of malicious ai-powered image editing. arXiv preprint arXiv:2302.06588 2023.
Axel Sauer, Dominik Lorenz, Andreas Blattmann, and Robin Rombach. Adversarial diffusion dis- tillation. arXiv preprint arXiv:2311.17044 2023.
Yujun Shi, Chuhui Xue, Jun Hao Liew, Jiachun Pan, Hanshu Yan, Wenqing Zhang, Vincent YF Tan, and Song Bai. Dragdiffusion: Harnessing diffusion models for interactive point- image edit- ing. In Proceedings of the IEEE/CVF Conference Computer Vision and Pattern Recognition, pp. 8839-8849, 2024.
Jiaming Song. Chenlin Meng, and Stefano Ermon. Denoising diffusion implicit models. arXiv preprint arXiv:2010.02500 2020a.
Yang Song and Stefano Ermon. Generative modeling by estimating gradients of the data distribution. Advances in neural information processing systems, 32, 2019.
Yang Song. Jascha Sohl-Dicksted Diederik P Kingma, Abhishek Kumar, Stefano Ermon, and Ben Poole. Score-based generative modeling through stochastic differential equations. arXiv preprint arXiv:2011.13455 2020b.
Matthew Tancik, Ben Mildenhall, and Ren Ng. Stegastamp: Invisible hyperlinks physical pho- tographs. In Proceedings of the IEEE/CVF conference computer vision and pattern recogni- tion, pp. 2117-2126, 2020.
Narek Tumanyan, Michal Geyer, Shai Bagon, and Tali Dekel. Plug-and-play diffusion features for text-driven image-to to-image translation. In Proceedings of the IEEE/CVF Conference on Com- puter Vision and Pattern Recognition (CVPR), pp. 1921-1930, June 2023.
Bram Wallace, Akash Gokul, and Nikhil Naik. Edict: Exact diffusion inversion via coupled trans- formations. arXiv preprint arXiv:2211.12444 2022.
Su Wang, Chitwan Saharia, Ceslee Montgomery, Jordi Tuset, Shai Noy, Stefano Pellegrini, Ya- sumasa Onoe, Sarah Laszlo, David J. Fleet, Radu Soricut, Jason Baldridge, Mohammad Norouzi, Peter Anderson, and William Chan. Imagen editor and editbench: Advancing and evaluating text- guided image inpainting. In Proceedings of the IEEF/CVF Conference on Computer Vision and Pattern Recognition (CVPR), pp. 18359-18369, June 2023.
Yanghao Wang and Long Chen. Improving irftusion-basedd data augmentation with inversion spher- ical interpolation. arXiv preprint arXiv:2408. 16266, 2024.
Yuxin Wen, John Kirchenbauer, Jonas Geiping, and Tom Goldstein. Tree-ring watermarks: Fin- gerprints for diffusion images that are invisible and robust. arXiv preprint arXiv:2305.20030 2023.
15

---

Published as a conference paper at ICLR 2025
Xiaoshuai Wu, Xin Liao, and Bo Ou. Sepmark: Deep separable watermarking for unified source tracing and deepfake detection. In Proceedings of the 31st ACM International Conference on Multimedia, pp. 1190-1201, 2023.
Cheng Xiong, Chuan Qin, Guorui Feng, and Xinpeng Zhang. Flexible and secure watermarking for latent diffusion model. In Proceedings of the st ACM International Conference on Multimedia, pp. 1668-1676, 2023.
Binxin Yang. Shuyang Gu, Bo Zhang, Ting Zhang, Xuejin Chen, Xiaoyan Sun, Dong Chen, and Fang Wen. Paint by example: Exemplar-baset image editing with diffusion models. In Pro- ceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pp. 18381- 18391, 2023.
Zijin Yang. Kai Zeng, Kejiang Chen, Han Fang, Weiming Zhang, and Nenghai Yu. Gaussian shad- ing: Provable performance-lossler image watermarking for diffusion models. In Proceedings of the IEEF/CVF Conference on Computer Vision and Puttern Recognition, pp. 12162-12171, 2024.
Peter Young, Alice Lai, Micah Hodosh, and Julia Hockemmaier. From image descriptions to visual denotations: New similarity metries for semantic inference over event descriptions. Transactions of the Association for Computational Linguistics, 2:67-78, 2014.
Jiahui Yu, Yuanzhong Xu, Jing Yu Koh, Thang Luong, Gunjan Baid, Zirui Wang, Vijay Vasudevan, Alexander Ku, Yinfei Yang. Burcu Karagol Ayan, et al. Scaling autoregressive models for content- rich text-to-image generation. arXiv preprini ar 2rv: 10789, 2022.
Hangjie Yuan, Shiwei Zhang, Xiang Wang, Yujie Wei, Tao Feng, Yining Pan, Yingya Zhang, Zi- wei Liu, Samuel Albanie, and Dong Ni. Instructvideo: instructing video diffusion models with human feedback. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pp.
2024.
Ziqi Zeng, Chen Zhao, Weiling Cai, and Chenyu Dong. Semantic-guided adversarial diffusion model for self-supervised shadow removal. arXiv preprint arXiv:2407.01 104, 2024.
Chaoning Zhang, Adil Karjauv, Philipp Benz, and In So Kweon. Towards robust deep hiding under non-differentiable distortions for practical blind watermarking. In Proceedings of the 29th ACM international conference on multimedia, pp. 5158-51111 51666,6661100 2021.
Guokai Zhang, Lanjun Wang, Yuting Su, and An-An Liu. A training-free plug-and-play watermark framework for stable diffusion. arXiv preprint arXiv:2404.06007 2024a.
Kai Zhang, Lingbo Mo, Wenhu Chen, Huan Sun, and Yu Su. Magicbrush: A manually annotated dataset for instruction-guii guidedd image editing. Advances in Neural Information Processing Systems, 36, 2024b.
Kevin Alex Zhang, Lei Xu, Alfredo Cuesta-Infante and Kalyan Veeramachaneni. Robust invisible video watermarking with attention. arXiv preprint arXiv:1909.0128: 2019.
Lymin Zhang, Anyi Rao, and Maneesh Agrawala. Adding conditional control to text-to-image diffusion models. In Proceedings the IEEE/CVF International Conference on Computer Vision, pp. 3836-3847, 2023.
Richard Zhang, Phillip Isola, Alexei A Efros, Eli Shechtman, and Oliver Wang. The unreasonable effectiveness of deep features as a perceptual metric. In Proceedings of the IEEE conference on computer vision and pattern recognition, pp. 586-595, 2018.
Shu Zhang, Xinyi Yang, Yihao Feng, Can Qin, Chia-Chih Chen, Ning Yu, Zeyuan Chen, Huan Wang, Silvio Savarese, Stefano Ermon, et al. Hive; Harnessing human feedback for instructional visual editing. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern 2024c.
Recognition, pp.
Xuanyu Zhang, Runyi Li, Jiwen Yu, Youmin Xu, Weiqi Li, and Jian Zhang. Editguard: Versatile image watermarking for tamper localization and copyright protection. In Proceedings of the IEFF/CVF Conference Computer Vision and Pattern Recognition, pp. 11964-11977 2024d.
16

---

Published as a conference paper at ICLR 2025
Chen Zhao, Weiling Cai, Chenyu Dong, and Chengwei Hu. Wavelet-based fourier information interaction with frequency diffusion adjustment for underwater image restoration. arXiv preprint arXiv:2311.1684,, 2023a.
Chen Zhao, Weiling Cai, Chengwei Hu, and Zheng Yuan. Cycle contrastive adversarial learning with structural consistency for unsupervised high-quality image deraining transformer. Neural Networks, pp. 106428, 2024a.
Chen Zhao, Chenyu Dong, and Weiling Cai. Learning physical-aware diffusion model based on transformer for underwater image enhancement. arXiv preprint arXiv:2403.01497, 2024b.
Haozhe Zhao, Xiaojian Ma, Liang Chen, Shuzheng Si, Rujie Wu, Kaikai An, Peiyu Yu, Minjia Zhang, Qing Li, and Baobao Chang. Ultraedit: Instruction-based fine-grained image editing at scale. arXiv preprint (eXiv:2407.02280 2024c.
Xuandong Zhao, Kexun Zhang. Zihao Su, Saastha Vasan, Ilya Grishchenko, Christopher Kruegel, Giovanni Vigna, Yu-Xiang Wang, and Lei Li. Invisible image watermarks are provably removable using generative ai. arXiv preprint urXiv:2306.01955 2023b.
Yunqing Zhao, Tianyu Pang, Chao Du, Xiao Yang. Ngai-Man Cheung, and Min Lin. recipe for watermarking difffusion models. arXiv preprint 1XX1:2303310113. 2023c.
Dewei Zhou, Zongxin Yang, and Yi Yang. Pyramid diffusion models for low-light image enhance- ment. arXiv preprint arXiv:2305. 10028, 2023.
Dewei Zhou, You Li, Fan Ma, Zongxin Yang, and Yi Yang. Mige: Multi-instance generation con- troller for text-to-image synthesis. arXiv preprint Xxxv:2402.05408, 2024a.
Dewei Zhou, You Li, Fan Ma, Zongxin Yang, and Yi Yang. Migc++: Advanced multi-instance generation controller for image synthesis. arXiv preprint arXiv:2407.02329 2024b.
Dewei Zhou, Ji Xie, Zongxin Yang, and Yi Yang. 3dis: Depth-driven decoupled instance synthesis for text-to-image generation. arXiv preprint arXiv:2410. /2669, 2024c.
J Zhu. Hidden: hiding data with deep networks. arXiv preprint
2018.
Luyang Zhu, Dawei Yang, Tyler Zhu, Fitsum Reda, William Chan, Chitwan Saharia, Mohammad Norouzi, and Ira Kemelmacchrr-Shizzrman.. Tryondiffusion: tale two unets. Proceedings of the IEEE/CVF Conference Computer Vision and Pattern Recognition (CVPR), pp. 4606- 4615, June 2023.
Yuanzhi Zhu, Ruiqing Wang. Shilin Lu, Junnan Li, Hanshu Yan, and Kai Zhang. Oftsr: One- step flow for image super-resolution with tunable realism trade-offs. arXiv preprint arXiv:2412.09466, 2024.
Junhao Zhuang. Yanhong Zeng, Wenran Liu, Chun Yuan, and Kai Chen. A task is worth one word: Learning with task prompts for high-quality versatile image inpainting. 2023.
17

---

Published as a conference paper at ICLR 2025
Appendix
Table of Contents
A Related Work
19
A.1 In-generation image watermarking
19
A.2 Generative model-based image editing
19
B Watermarking Frequency Patterns
C Statistical Test
22
D Resolution Scaling
23
D.1 Method
23
D.2 Impact on watermarked image quality
23
D.3 Impact on robustness against distortions
23
E Condition Adapter Architecture
24
F Implementation Details
24
F.1 Pre-training
24
F2 Fine-tuning
24
Analysis of Image Editing
27
Rationale Image Editing Selection
................................
27
G.2 Image regeneration
................................
27
G.3 Global editing and local editing
27
G.4 Image-to-video generation
30
H Inference Speed and GPU Memory Evaluation
30
Qualitative Comparison
30
Additional Benchmarking Results
30
18

---

Published as a conference paper at ICLR 2025
(a) Original Real Image
(b) Tree Ring (W Watermarked Real Image)
(c) RingID (Watermarked Real Image)
(d) G Gaussian Shading (Watermarked Real Image)
Figure 6: Comparison of Tree Ring (Wen al., 2023), RinglI (Ci al., 2024), and Gaussian Shading (Yang et al., 2024) methods for embedding watermarks in real images. Each real image is first inverted into noise using 50-step image inversion process before the watermark is injected.
A RELATED WORK
A.1 IN-GENERATION IMAGE WATERMARKING
Another line of research involves watermarking generated images by altering the generation process fine-tuning the generative models. These methods (Cui al., 2023; Ci et al., 2024; Fermandez et al., 2023; Liu et al., 2023; Meng et al., 2024; Rezaei et al., 2024; Wen et al., 2023; Xiong et al., 2023; Yang et al., 2024; Zhao al., 2023c; Zhang al., 2024a), also known in-generation image watermarking, aim to facilitate the detection of Al-generated content by inherently emhedding a watermark during image generation. These methods can also help protect the copyright of the gen- crated content. However, since in-generation watermarking can only be applied to generated images, real ones, and this study focuses on protecting copyright and intellectual property in real-world scenarios, these techniques are not included in our benchmark. Nonetheless, it is important to note that our proposed methods could also enhance the robustness of in-generation watermarks against image editing.
Figure shows the results of applying in-generation watermarking methods combined with image inversion techniques to embed watermarks in real images. Specifically, we applied DDIM/DPM inversion methods to extract initial noises from real images, added watermarks using three in- generation watermarking techniques-Tres Tree Ring (Wen et al., 2023), RingID (Ci al., 2024), and Gaussian Shading (Yang et al., 2024) and then inverted the noise back to produce the watermarked image. The resulting image differed significantly from the original, thereby undermining the pho- tographer's 's intent to protect their work.
A.2 GENERATIVE MODEL-BASED IMAGE EDITING
Recent and significant advancements text-to-inne taatto--iageeeeee generative models (Chang et al., 2023; Ding et al., 2022; Nichol et al., 2021; Ramesh et al., 2022; Rombach al., 2022: Saharia et al., 2022; Yu et al., 2022; Peebles & Xie, 2023; Esser et al., 2024) have enhanced numerous applications (Avra- hami et al., 2023; Ruiz al., 2023; Hertz al., 2022; Kim et al., 2022; Tumanyan et al., 2023;
19

---

Published as a conference paper at ICLR 2025
MBRS
CIN
PIMoG
RaaGAN
SepMark
DWIDCTSVD
SSL
SlegaStamp
TrustMakk
EdltGuard
VINE-B
VINE-R
IF (x) F (ar,))
Figure 7: Frequency pattern visualizations for each watermarking method. Each subfigure displays the absolute difference between the Fourier spectrum F(-) of the watermarked image z. and the original image 2., i.e., [F( - F-x.,)l- The DWTDCT method is excluded because it closely resembles DWTDCTSVD and their pattern intensity is too weak be discerned the uniform scale. Please zoom in for a closer look.
Zhang al., 2023; Mou al., 2023; Shi et al., 2024; Zhu et al., 2023; Zhou al., 2023; 2024a; Lu
et al., 2023; 2024; Zhao et al., 2023a; 2024a;b; Wang & Chen, 2024; Gandikota et al., 2023; Parmar al., 2024; Zhou et al., 2024b;c; Zeng al., 2024; Peng al., 2024b;a;e; Gao al., 2024; Zhu et al., 2024). In this study, we focus on real image editing, which allows users to freely modify ac- tual photographs, producing highly realistic results. Typically, the inputs for image editing include an image and various conditions that help users accurately describe their desired changes. These conditions can encompass text prompts using natural language to specify the edits (Brooks al., 2023; Zhang et al., 2024c; Fu et al., 2023; Zhang et al., 2024b), region masks to designate areas modification (Zhao et al., 2024c; Zhuang et al., 2023; Wang et al., 2023), additional images to provide desired styles objects (Chen et al., 2024; Lu et al., 2023; Yang et al., 2023), and drag points (Pan et al., 2023; Shi et al., 2024; Mou et al., 2023) that enable users to interactively move specific points in the image to target positions.
We broadly categorize image editing into two types: local editing and global editing. Local editing involves modifying only specific region of an image while keeping the other areas unchanged. In contrast, global editing modifies the entire image, though certain changes may occur unintention- ally due the nature of generative models, rather than users' intent. These editing methods compromise embedded watermarks, potentially undermining copyright protection. Note that we do not include drag-based editing methods (Pan al., 2023; Shi et al., 2024; Mou al., 2023) in benchmark. This exclusion is due to the lengthy optimization times required to edit single image using these methods and the limited availability of datasets that provide valid drag points. Extending the benchmark to include drag-based methods presents potential direction for future research.
B WATERMARKING FREQUENCY PATTERNS
In this analysis, we examine each watermarking method within the frequency domain to understand how they alter the frequency spectrum of input images. Specifically, we calculate the absolute dif-
20

---

Published as a conference paper at ICLR 2025
MERSS
CIN
PIMoG
RivaGAN
MIRS
CIN
PIMoG
RivaGAN
MepMark
DW IUCTSVD
SlegaStamp
SrpMark
SlegaStamp
TrustMark
EditGuare
VINE-B
VINE-R
TrustMark
Editti
VINE-B
VINE-R
The impact global editing (Pix watermarks
The impact determnnistic regeneration watermarks
MBRS
CIN
PIMoG
RivaGAN
MBRS
CIN
PIMcG
RivaGAN
SrpMark
DW TDCTSVD
SSI
SleguStmp
SupMark
TDCTSVD
SSL
SteppSamp
TrustMark
uard (c) The impact of local editing (UltraEdit) on wa watermarks lss
VINE-B
VINE-R
TrustMark
EdiG ward
VINE-B
VINE-R
(d) The impact of stochastic regeneration on watermarks
JF (e (xxw)
(c (sx)))
10
Figure 8: Impact of different editing methods on the frequency patterns of various watermarks. Each subfigure, analogous to Figure 3, displays the absolute difference between the Fourier spectrum F(.) of the edited watermarked image c( and the original image c c(z.), i.e., }F((((ww) F(c(x.)) to evaluate how the watermark patterns are altered by the editing process. The frequency patterns of VINE-R, VINE-B, MBRS, and StegaStamp are less affected compared to their original patterns (shown in Figure 7) than those of other watermarking methods. Please zoom in for a closer look.
ference between the Fourier spectrum F(-) of the watermarked image Tw and the original image x as [ - F(x,)), and then average this metric over 1,000 pairs of watermarked and original images. Figure 7 presents the results
logarithmic scale.
Interestingly, aside from our method, the top four watermarking methods that demonstrate ro- bustness against image editing in certain scenarios (as illustrated Figure 1)-namely Ste- gaStamp, MBRS, SepMark, and PIMoG-all exhibit prominent patterns in the low-frequency bands, accompanied by a cross-shaped high-intensity pattern. Among these, StegaStamp shows the strongest pattern intensity. This cross pattern is also part of the low-frequency spectrum, as the Y-axis represents zero frequency the X-direction, and the X-axis represents zero frequency in the Y-direction. Although CIN and TrustMark also focus their influence on the low-frequency bands, their robustness remains relatively low. We infer that this may be related to the absence of the cross- shaped pattern and the lower intensity of their patterns.
These patterns support our conclusion in Section 3.1: the more a watermark's impact con- centrated in the low-frequency bands of the spectrum, the more robust it is against image editing. Although the model trained using our method, VINE, exhibits less pronounced influence along the X and Y axes compared StegaStamp. displays highly dense patterns near these axes, which we infer contribute to its enhanced robustness. Additionally, compared to VINE-B, VINE-R R shows higher brightness the central region, further increasing its robustness.
21

---

Published as a conference paper at ICLR 2025
Figure 8 demonstrates the effect of various editing methods on different watermark patterns within the frequency domain. As illustrated, the frequency patterns of VINE-R, VINE-B, MBRS, and Ste- gaStamp are less affected compared to their original patterns (shown in Figure 7) than those of other watermarking methods. However, it challenging to isolate the effects on low-, mid-, and high- frequency bands when directly observing the watermarks.
Note that this finding is a byproduct of our design rather than a deliberate motivation of it. Our two key design elements (surrogate attack & generative prior adaptation) based on the observations: (1) Image editing and image blurring exhibit similar frequency characteristies. (2) Image watermark- ing can be viewed as a form of conditional generation, where a generative prior can enhance image quality by making watermarks less visible. Regarding the intriguing finding- the robustness of our watermarking model against image editing being highly positively correlated with pattern intensity in the low-frequency region-this emerged from our training process rather than driving our design decisions. This finding aligns well with our results in Section 3.1, which show that image editing affects patterns in the high-frequency region more than those in the low- low-frequency region.
C STATISTICAL TEST
Let w E {0, 11 be the k-bit ground-truth watermark. The watermark w' extracted from water- marked image The is compared with the ground-truth w for detection. The detection statistical test relies on the number of matching bits M (w,w"), w'): If
M (ww w') 2 T, where T E (0,1,2, .k},
(4)
then the image is flagged as watermarked. Formally, we test the statistical hypothesis H1: 'æ: contains the watermark w against the null hypothesis Ho: 'æ does not contain the watermark w'. Under Ho (i.e., for original images), if the extracted bits w - {w1, w/z ... wcg (where w/ is the i-th extracted bit) from model are independent and identically distributed (i..d.) Bernoulii random variables with the matching probability Po. then M (ww w') follows a binomial distribution with parameters (k, Po).
This assumption is verified by Fernandez et al. (2023).
The false positive rate (FPR) the probability that M(w, w²) takes a value bigger than the threshold under the null hypothesis Ho. It is obtained from the CDF of the binomial distribution, and closed-form can written with the regularized incomplete beta function (a b) (Fernandez et al., 2023):
FPR(T) = (M(w, w') HHH)
= Σ P''(L 1
(
p/ -po) Lp. (T 1, -
(5)
where under Ho (i.e., images without the watermark w), should ideally be close to 0.5 to mini- mize the risk of false positive detection.
Similarly, the true positive rate (TPR) represents the probability that the number of matching bits exceeds the threshold 7 under H1, where the image contains the watermark. Thus, the TPR can be calculated by:
1 (4) (1) p=o = (T + 7),
TPR P (M w') H1) = Σ 1=++
(6)
where under H₃ (i.e., images with the watermark w), Pw should ideally be high enough (e.g., ex- ceeding 0.8) ensure the effectiveness of a watermarking model.
To further demonstrate that neither high bit accuracy nor AUROC alone guarantees a high TPR at a low FPR, consider the following example. Suppose we have 100-bit watermarking model with a threshold 5 of 70 to determine whether an image contains watermark w.. If the model extracts bits from watermarked images with a matching probability p., = 0.8 and from original images with matching probability Po 0.5, the resulting FPR would be 1.6 x 10-5 and the TPR would be 0.99. In this scenario, even though the bit accuracy for watermarked images is not exceptionally high (e.g., below 0.9), the model still achieves high TPR at very low FPR. In contrast, if another model has Pa: = 0.9 and P, 0.7, achieving the same FPR would require setting the threshold r to 87. Under these conditions, the TPR would only be 0.8. This example demonstrates that high bit
22

---

Published as a conference paper at ICLR 2025
accuracy for watermarked images does not necessarily a high TPR when maintaining a low FPR. Therefore, relying solely on bit accuracy or AUROC may not be sufficient for achieving the desired performance in watermark detection.
D RESOLUTION SCALING
D.1 METHOD
Bui et al. (2023) propose a method to adapt any watermarking model to handle arbitrary resolutions, as presented in Algorithm 1. This approach preserves the quality of the watermarked images and maintains or even improves their robustness against the image transformations that the models can inherently handle at their native resolution. In our experiments, we apply this resolution scaling method to all methods, enabling them to operate at a uniform resolution of 512x512, which is compatible with image editing models.
Algorithm Resolution scaling
I: Input: Input image binary watermark w
2: Output: Watermarked image æw
Model: Watermark Encoder E-) trained on the resolution u x
4:
Size(x:.)
5: æ. - 1..127.5 1// normalize to range [-1, 1]
6: x, - interpolate(2... (u,v))
7: + Elx'c) x // residual image
8: interpolate(r' (h,
Ty clamp(ær. + + 1)
10: Tw f- aw x 127.5 + 127.5
D.2 IMPACT ON WATERMARKED IMAGE QUALITY
Among the evaluated methods, MBRS (Jia et al., 2021), CIN (Ma et al., 2022), PIMoG (Fang et al., 2022), SepMark (Wu et al., 2023), StegaStamp (Tancik al., 2020), TrustMark (Bui et al., 2023), VINE-B, and VINE-R are trained at resolutions lower than x12x512, necessitating resolution scal- ing during the encoding process. Table 3 presents the watermarked image quality their original training resolutions, enabling comparison with their performance after resolution scaling. It is ob- served that, in terms of image quality, most methods show slight improvement in PSNR, SSIM, and FID after resolution scaling, while exhibiting slight increase in LPIPS.
Table 3: Comparison of watermarking performance, evaluating both image quality of the water- marked images and detection accuracy under normal conditions (no distortion or editing applied) at the original training resolution. The best value each column highlighted in bold, and the second best value is underlined.
Method
Resolution
Capacity
PSNR
SSIM
LPIPS
FID
@PR@0.1 S&PP (%)
MBRS al., 2021)
128 128
25.14
0.0821
13.51
100.0
CIN (Ma et al., 2022)
128 128
30
41.70
0.9812
0.0011
2.20
100.0
PIMoG (Fang al., 2022)
128 128
30
37.54
0.9814
0.0140
2.97
100.0
SepMark (Wu
2023)
128 128
35.50
0.9648
0.0116
2.95
100.0
StegaStamp (Tancik al. 2020)
400 400
100
29.33
0.8992
0.1018
8.29
100.0
TrustMark (Bui et al., 2023)
256 256
100
40.94
0.9819
0.0015
1.04
100.0
VINE-Bace Base
256 256
100
40.22
0.9961
0.0022
0.10
100.0
VINE-Robuse
256 256
100
37.07
0,9942
0.0048
0.19
100.0
D.3 IMPACT ON ROBUSTNESS AGAINST DISTORTIONS
Figure demonstrates the robustness of the evaluated watermarking methods against classical trans- mission distortions resolution of 512x512 pixels. In contrast, Figure 10 examines watermarking methods- methods--incluing MBRS, CIN, PIMoG, SepMark, StegaStamp. TrustMark, VINE-B, and VINE- R that originally trained resolutions lower than 512x512 pixels by evaluating them their
23

---

Published as a conference paper at ICLR 2025
respective training resolutions. This comparison helps determine whether scaling the resolution af- fects their inherent robustness.
The results indicate that inherent robustness is either unaffected or even enhanced. This occurs because, for the same level of distortion, larger images experience comparatively less impact. This phenomenon is particularly evident with Gaussian blurring. At resolution of 512x512 pixels, MBRS, PIMoG, SepMark, CIN, and TrustMark can withstand Gaussian blurring with a kernel size of 5 (see Figure 9a)). However, their original resolutions of 128x 128 or 256 pixels, kernel size of 5 has more significant impact compared to the 512x512 resolution, resulting in poorer performance (see Figure 10(a)). is important to note that the kernel size range on the x-axis in Figure 10 is halved compared to Figure 9 because the image resolution is reduced by half or more, resulting in larger kernel sizes that cause excessive blurring.
Although comparing different methods at their original training resolutions is somewhat unfair due to their varying training resolutions, the results demonstrate that resolution scaling does not compro- mise the robustness of these watermarking methods and can sometimes even enhance it. For other types of attacks, the difficulty levels remain consistent across different resolutions. Additionally, scaling the resolution significantly improves robustness against JPEG compression while maintain- ing robustness against brightness adjustments, contrast modifications, and Gaussian noise.
Another noteworthy observation is that, in Figure (a) (i.e., at the 512x 512 resolution), the methods that exhibit strong robustness against Gaussian blurring also demonstrate robustness against image editing. This finding corroborates conclusions in Section 3.1, the characteristics of image editing in the frequency domain are similar to those of blurring distortions.
E CONDITION ADAPTER ARCHITECTURE
Figure 11 showcases the condition adaptor architecture within our watermark encoder (Figure 4). This architecture consists of multiple fully connected and convolutional layers, each followed by ReLU activation layer.
F IMPLEMENTATION DETAILS
F.1 PRE-TRAINING
The complete training objective is detailed in Section 3.3. To train VINE-B, we initially prioritize the watermark extraction loss by setting a to 10 and each of SMSE. 3 and BGAN to 0.01. To preserve the generative prior, the UNet and VAE decoder of the SDXL-Turbo, along with the additional zero-convolution layers, are kept frozen. Once the bit accuracy exceeds 0.85, we proceed to second stage by unfreezing all parameters for further training. At this stage. the loss weighting factors are adjusted to a = 1.5. SMSE = 2.0, ÔLPIPS = 1.5, and AGAN = 0.5. In both stages, we employ the Adam optimizer with learning rate of 1 10-4 and batch size of 112, training on the entire OpenImage dataset (Kuznetsova et al., 2020) at a resolution of 256x256 pixels. We apply transformations that randomly select either random cropping or resizing, followed by center cropping. VINE-B is trained on 8XNVIDIA A100-80GB GPUs for 111k iterations.
F.2 FINE-TUNING
VINE-R obtained by further fine-tuning VINE-B on the Instruct-Pix2Pix dataset (Brooks et al., 2023). During this fine-tuning stage, we reduce the learning rate to 5e-6 and adjust the batch size to 80, while keeping the weighting factors for different loss terms the same as in the second stage. Watermarked images are edited using Instruct-Pix2Pix with text prompts and 25 denoising steps. Although the quality of images edited with 25 steps is not as high as those edited with 50 steps, it re- mains satisfactory and effectively doubles the fine-tuning speed. Gradients are then backpropagated using a traight-througe estimator (Bengio et al., 2013). VINE-R is fine-tuned using 8xNVIDIA A A100-80GB over 80k iterations.
24

---

Published as a conference paper at ICLR 2025
1,00
1,00
1.0
1.0
TPR@0 1%PPP
0.75
TPR@I%FPP
0.75
Accuracy
0.8
AUROC
0.50
0.50
0.25
0.25
0.6
0.00
0.00
Blurring Kernel Size
Blurring Kernel Size
Blurring Kernel Size
Blurring Kernel Size
(a) Gaussian Blurring
1,00
1.00
TPR@0, 194FPR
0.75
TPR@:14FPR
0.75
Bit Accuracy
0.8
AUROC
0.8
0.50
0.50
0.6
0.25
0.25
0.6
0.00
0.00
1.2
1.4
1.6
188
2.0
1.2
1.4
1.6
188
2.0
1.2
1.4
1.6
1.8
2.0
1.2
1.4
1.6
L88
2.0
Brightness Factor
Brightness
Brightness Factor
Brightness Factor
Brightness A ddjuttments
TPR@0 194FPR
0.75
PGPRR
0.75
Bit Accuracy
0.8
AUROC
0.8
0.50
0.50
0.6
0.25
0.6
0.4
0.00
0.00
1.2
1.4
1.6
1.8
2.0
1.2
1.4
1.6
1.8
2.0
1.2
1.4
1.6
1.8
2.0
1.2
1.4
1.6
L88
2.0
Contrast Factor
Contrast Factor
Contrast Factor
Contrast
(c) Contrast Modifications
1.00
1.00
1.0
1.0
TPR@0 194FRR
0.75
(PR-@1%/FP))
0.75
Bit Accuracy
0.8
AUROC
0.8
0.50
0.50
0.6
0.6
0.00
0.00
0.02
0.04
0.06
0.08 0.10
0.02
0.06 0.08 0.10 Standard Deviation
0.04
0.02 0.04 0,06 0.08 0.10 Stundard Deviation
0.02
0.04 0,06 0.08 0,10
Standard Devistion
Stundard Deviation
(d) Gaussian Noise
1.00
1.00
1.0
1.0
TPR@0 19FPR
0.75
TPR 1PRR 1MFPR
0.75
Bit Accuracy
0.8
AUROC
0.8
0.50
0.50
0.6
0.4
0.00
0.00
10
25
40
70
10
25
40
55
10
25
40
55
70
10
55
70
Compression Factor
JPEG
Compression Factor
JPEG
Compression Factor
JPEG Compression Factor
[PEG Compression
SepMark
DWTDCT
EditGuard VINE-R
CIN
RivaGAN
Trustark
DWTDCTSVD
StegaStamp
Figure 9: Performance of watermarking methods resolution of 512x512 pixels under (a) Gaus- sian blurring, (b) brightness adjustments, (c) contrast modifications, (d) Gaussian noise, and (c) JPEG compression.
25

---

Published as a conference paper at ICLR 2025
1.00
1,00
1.0
1.0
TRRQO 15.PR
0.75
TPR@ 1%APPR
0.75
Bit Accuracy
0.8
AUROC
0.8
0.50
0.50
0.25
0.25
0.6
0.6
0.00
0.00
3
2
Blurring
Blurring Kernel Size
Blurring Size
Blurring Kernel Size
Gaussian Blurring
1.00
1.00
1,000
TPR 1&PPR
[PR@115FPR
0.975
0.99
AUROC
0.98
0.999
0.950
0.98
0.925
0.96
1.2
1.4
1.6
1.8
2.0
1.2
1.4
1.6
1.8
2.0
1.2
1.4
1.6
1.8
2.0
1.2
1.4
1.6
1.8
2.0
Brightness Factor
Brightness
Brightness
Brightness
(b) Brightness djustments
1,000
1.000
1.00
1,0000
TPR000 1&PPR
0.998
TPR 1PARRR
Bit Accuracy
0.996
0.999
0.98
AUROC
0.9999
0.998
0.96
0.9998
0.997
1.2
1.4
1.6
1.8
2.0
1.2
1.4
1.6
1.8
2.0
1.2
1.4
1.6
1.8
2.0
1.2
1.4
1.6
1.8
2.0
Contrast Factor
Contrast Factor
Contrast Factor
Factor
(c) Contrast Modifications
1.0
1.0
1.00
TPR@00 1%FPR
TPR@1%FPR
Bit Accuracy
0.9
AUROC
0.4
0.8
0.96
0.2
0.7
0.02
0.04
0.06
0.08 0.10
0.02
0.06 0.08 0.10 Standard Deviation
0.04
0.02
0.04
0.06 0.08 0.10
0.02
0.06 0.08 0.10 Standard Deviation
0.04
Standard Deviation
Standard Deviation
(d) Gaussian Noise
1.00
TPR@0, 195FRR
0.75
[PR@11PFPP
0.75
Bii Accuracy
0.9
AUROC
0.8
0.50
0.50
0.8
0.25
0.25
0.7
0.6
0.00
0.00
10
25
40
$5
70
10
25
40
55
70
10
25
40
55
70
10
25
40
55
70
JPEG Compression Factor
JPEG
Compression Factor
JPEG
Compression Factor
JPEG
Compression Factor
[P) Compression
MBRS
-
CIN
PIMoG
SepMark
Trustark
StepeStserp
VINE-R
VINE-B
Figure 10: Assessment of watermarking methods at their respective training resolutions under the following conditions: (a) Gaussian blurring, (b) brightness adjustments, (c) contrast modifications, (d) Gaussian noise, and (e) JPEG compression. Training resolutions: MBRS, CIN, PIMoG, and SepMark were trained at 128x 128 pixels; TrustMark, VINE-B, and VINE-R 256x256 pixels; and StegaStamp at x00 pixels.
26

---

Published as a conference paper at ICLR 2025
100-bit Watermak
R Reshape
FC
FC 2
Upsample
[B. 100]
[B, 64, 64]
Ingut Image
[B, 256, 256]
[B, 64
64)4
Concatsnation
256, 256]
Conv 2
Conv 1
[0, 3, 256, 256]
[B, 6, 256, 256]
[B, 256, 256]
AonditionAdaptor
Figure 11: Architecture of the condition adaptor in Figure 4. Each fully connected and convolutional layer is followed by an activation layer.
G ANALYSIS OF IMAGE EDITING
G.1 RATIONALE FOR IMAGE EDITING SELECTION
Image regeneration, global editing, local editing, and image-to-viden generation cover the majority of editing needs. Image editing can be broadly divided into global and local categories, as user edits typically affect either the entire image specific parts of it.
Global editing involves altering most of image's 's pixels while maintaining its overall layout, com- ponents, or semantics. Techniques such style transfer, cartoonization, image translation, and scene transformation fall under this category and produce similar effects. For example, using prompts like 'turn it into Van Gogh style' or "convert it into sketchy painting" in image editing model can effectively achieve style transfer.
Local editing, the other hand, refers to modifications applied to specific elements, semantics, or regions within an image. This category includes image inpainting, image composition, object manipulation, attribute manipulation, and so forth.
While image regeneration and image-to-vide -vide generation are not strictly considered forms of image editing, they can be used create similar digital content while removing watermarks, thereby posing a threat to copyright protection. For this reason, we have included them in our benchmark.
G.2 IMAGE REGENERATION
In this study, we assess the reconstruction quality of image regeneration across various difficulty lev- els. As illustrated in Figure 12, increasing the difficulty level-by either raising the noise timestep in stochastic regeneration or decreasing the sampling step in deterministic ingenerationnddgraale the reconstruction quality. Figure presents several examples. The regenerated images are perceptu- ally similar to the original images. However, as the difficulty level increases, stochastic regeneration tends to introduce more hallucinated details into the original image, whereas deterministic regenera- tion tends to smooth out the original images. Both approaches can degrade the embedded watermark, thereby posing challenges to copyright protection. Our method effectively embeds and detects wa- termarks even under extremely challenging difficulty levels.
G.3 GLOBAL EDITING AND LOCAL EDITING
Here, assess the editing quality of various global editing models using three metrics: CLIPatn dits CLIP out- and CLIP img- CLIP dir evaluates whether the edits correspond to the modifications specified by the editing prompt, which represents the difference between the captions of the source and target
27

---

Published as a conference paper at ICLR 2025
29
PSNR
PSNR
28
24
27
26
Noise Timestep
Sampling Step
(a) Stochastic Regeneration
(b) Deterministic Regeneration
Figure 12: The reconstruction quality of (a) stochastic regeneration and (b) deterministic regenera- tion. The PSNR is calculated by comparing the regenerated image to the original image.
Stochastic Regeneration (Notse Timestep)
Detemninistic Regenecation (Sampling Stap)
Original
80
100
140
180
220
45
35
15
Figure 13: The reconstruction quality of stochastic regeneration and deterministic regeneration. Please zoom in for a closer look.
images. This metric is calculated by measuring the cosine similarity between the difference in CLIP image embeddings of the source and edited images and the difference in CLIP text embeddings of the source and target captions. CLIP measures the alignment the edited image with the target caption by calculating the cosine similarity between the CLIP text embeddings of the target caption and the CLIP image embeddings of the edited images. Meanwhile, CLIP img assesses content preservation by evaluating the cosine similarity between the CLIP image embeddings of the source and edited images. Table 4 presents a comparison of editing results from different editing models applied to unwatermarked images the first row. Each editing model employs an image guidance scale of 1.5 and text guidance scale of 7. Within these settings, UltraEdit most effectively aligns the edited image with the editing prompt, while MagicBrush excels at preserving the image layout.
Since text-driven image editing is more sensitive than image regeneration, we investigated whether watermarking the input image affects editing quality. The results, presented in Table 4, show that editing quality remains largely intact with only minor fluctuations. If the watermark degrades the image quality, it can slightly impact editing performance in terms of both text alignment and content preservation. Figure 14 shows several examples. Similarly, the evaluation results for local editing models are presented in Table and Figure 15. UltraEdit also demonstrates superior editing quality for local edits, excelling both text-image alignment and image content preservation.
28

---

Published as a conference paper at ICLR 2025
Table 4: Comparison of editing quality for different global editing methods and the effect of different watermarks on image editing outcomes. All models use an image guidance scale of 1.5 and a text guidance scale of? 7.
Pix2Pct-Pix2Px
Ulraaddit
MagicBrush
Method
CLIPa
CLIPa.
CLIP
CLIPa,
CLIP..
CLIPa
Upwatermarked Image
0.2693
0.7283
0.2732
0.3230
0.7268
0.3008
0.3025
0.7913
0.2930
MBRS (Jia et 2021)
0.2494
0.7385
0.2733
0.2919
0.6654
0.2891
0.2857
0.7816
0.2929
CIN (Ma
0.2625
0.7232
0.2729
0.3152
0.7111
0.3010
0.2949
0.7841
0.2928
(Fang et
0.3010
RivaGAN (Zhang et all.20201111 2019)
0.2647
0.7317
0.2721
0.3168
0.7133
0.500
0.3020
0.794X
0.2930
SepMark (Wu 2023)
0.2659
0.7292
0.2743
0.3145
0.7181
0.5002
0.2975
0.7891
0.2936
DWTDCT
0.2644
0.2934
DWTDCDDVD (Navas et al., 2008)
0.258]
0.7220
0.2751
0.3115
0.7118
0,3004
0.2869
0.7793
0.2939
SSL (Femandez et al, 2022)
0.2583
0.7218
0.2752
0.3093
0.7065
0,3019
0.2896
0.7780
0.2911
StegaStump (Tancik 2020)
0.2436
0.6826
0.2697
0.2904
0.6886
0.5007
0.2663
0.7512
0.2944
0.2634
EditGuard (Zhang al., 2024c)
0.2722
0.7045
0.2722
0.3155
0.7170
0.5021
0.2882
0.7708
0.2940
VINE-Hon Hase-Haee
0.2745
0.7260
0.2743
0.3186
0.7189
0.2996
0.2977
0.7889
0.2931
VINE-Robest
0.2624
0.7248
0.3176
0.3001
0.7953
0.2940
Table Comparison editing quality for different local editing methods and the effect of different watermarks on image editing outcomes. All models use an image guidance scale of 1.5 and a text guidance scale 7.
ControlNeetImpuininng
UltraEdit
Method
CL.PPa
CLIPas f
CLIP
CLIPar
CLIPang f
CLIP
Unwatermarked Image
0.1983
0.7076
0.2589
0.2778
0.7519
0.2917
MBRS (Jia al., 2021)
0.1846
0.7058
0.2588
0,2657
0.7175
0.2913
CIN (Ma et al., 2022)
0.1966
0.7042
0.2613
0.2745
0.7389
0.2922
PIMoG (Fang al., 2022)
0.1828
0.6909
0.2600
0,2578
0.7371
0.2920
RivaGAN (Zhang al., 2019)
0.1975
0.7117
0,2612
0.2748
0.7469
0.2937
SepMark (Wu ct al., 2023)
0.1932
0.7126
0,2582
0,2716
0.7588
0.2921
DWTDCT (Al-Haj, 2007)
0.1982
0.7197
0.2602
0.2776
0.7558
0.2924
DWTDCTSVD (Navas et al.,, 2008)
0.1922
0.6995
0,2608
0,2705
0.7469
0.2940
SSL (Fernandez
2022)
StegnStump (Tancik et al., 2020)
0.1752
0.6684
0,2606
0.2439
0.7246
0.2919
TrustMark (Bui et al., 2023)
0.1959
0.7001
0.2594
0.2728
0.7451
0.2919
EditGuard (Zhang 2024d)
0.1921
0.6944
0,2606
0.2696
0.7392
0.2923
VINE-Basc
0.1953
0.7023
0.2591
0.2726
0.7494
0.2906
VINE-Robust
0.1951
0.7030
0.2591
0,2710
0.7475
0.2909
Table 6: Comparison of watermarking performance terms of detection accuracy on image-to-video generation with MAGE+. TPR @0.1 9PPR is averaged over 1,000 videos.
TPR I&FR (%)
Method
Frame 2
Frame 4
Frame
Frame 8
Frame 10
Average
MBRS (Jia et al., 2021)
89.57
88.67
87.45
86.51
84.42
87.32
CIN (Ma et al., 2022)
45.92
44.78
43.21
42.17
40.71
43.36
PIMoG (Fang et al., 2022)
78.23
76.99
75.72
74.91
73.12
75.79
RivaGAN (Zhang al., 2019)
56.87
$3.21
52.14
$1.01
$3.61
SepMark (Wu et al., 2023)
63.45
62.15
61.03
60.89
59.24
61.35
DWTDCT (AI-Haj, 2007)
30.57
29.51
28.89
27.72
26.87
28.71
DWTDCTSVD (Navas et al., 2008)
38.56
38.54
37.12
36.81
35.74
37.35
SSL (Fermandez et al., 2022)
81.21
78.99
77.18
76.12
78.89
SleguStump (Tancik al., 2020)
91.25
90.34
89.12
88.67
87.33
89.34
TrustMark (Bui al.. 2023)
90.35
90.12
89.45
87.69
86.13
88.75
EditGuard (Zhang et al., 2024d)
42.57
41.46
40.55
39.91
38.17
40.53
VINE-Base
92.22
91.35
90.74
89.12
88.01
90.29
TINE-Robust
93.14
92.88
91.32
90.27
89.12
91.35
29

---

Published as a conference paper at ICLR 2025
G.4 IMAGE-TO-VIDEO GENERATION
Figure 16 presents the results of image-to-video generation applied to watermarked images using various watermarking methods. The presence of watermarks does perceptually affect the image- to-video generation.
Additionally, we add watermarks 1,000 images from the CATER-GEN-VE dataset Hu (2022) and use the MAGE+ model Hu et al. (2022) to perform text-image-to-vide (TI2V) generation, producing 10-frame videos. For watermark detection, we analyze frames 2, 4, 6, 8, and 10. The average detection accuracies across 1,000 videos are presented in Table 6.
H INFERENCE SPEED AND GPU MEMORY EVALUATION
We evaluate the inference speed and GPU memory usage of watermarking methods on an NVIDIA Quadro RTX6000 GPU. The results are averaged over 1,000 images. SSL employs instance-based iterative optimization, resulting in longer processing times. EditGuard utilizes an inverse neural net- work encode secret images and bits simultaneously, thereby also requiring additional running time. Although our model demands more GPU memory and longer inference times, these require- ments remain within acceptable ranges.
Table 7: Comparison of watermarking methods based on running time per single image and GPU memory usage. The results averaged over 1,000 images. Since the implementations employed for DWTDCT, DWTDCTSVD, and RivaGAN support CPUs exclusively, they have been omitted from the comparison.
Method
Running Time per Image (s) GPU Memory Usage (MB)
MBRS (Jia et al., 2021)
0.0053
938
CIN (Ma et al., 2022)
0.0741
2944
PIMoG (Fang et al., 2022)
0.0212
RivaGAN (Zhang et al., 2019)
SepMark (Wu et al., 2023)
0.0109
DWTDCT (Al-Haj. 2007)
DWTDCTSVD (Navas et al., 2008)
SSL (Fernandez al., 2022)
2.1938
1072
SteguStamp (Tancik al., 2020)
0.0672
1984
TrustMark (Bui al., 2023)
0.0705
648
EditGuard (Zhang al., 2024d)
0.2423
1638
VINE
0.0795
I QUALITATIVE COMPARISON
Figure 17 showcases qualitative examples of 512x512 images encoded using the watermarking methods evaluated in this study. The residuals are calculated by normalizing the absolute difference [ww x For a more detailed examination, please zoom in on the images. It can be observed that the images watermarked by MBRS and PIMoG exhibit slight color distortions, whereas the StegaStamp watermarked images display black artifacts. Other methods produce watermarked images that, to the human eye, appear identical the original images.
ADDITIONAL BENCHMARKING RESULTS
Additional benchmarking results are presented in Figure 18, including deterministic regeneration with DPM-Solver, global editing with UltraEdit, global editing with Instruct-Pix2Pix. local editing with ControlNet-Inpaintingg and image-to-video generation with Stable Video Diffusion.
30

---

Published as a conference paper at ICLR 2025
Prompt: Turn the rain into a dazzling display Ereworks
Premuee Transferm toe grassy field into snawy winter wooderland
Unedited
Utrakdit
Instract-Pixcee Pix22xx
MagicBrush
Unedited
Ultrabdit
Instrud- Pixapix
MagicBrusi
Unootemee ledt
MIRES
GIN
PINDG
ROSCANN
SySPkrk
PAVITICTSVV
TrustWeek
VINE-I
VINE-R
Figure 14: Different watermarks have minimal impact the image global editing outcomes, result- ing in only slight changes.
31

---

Published as a conference paper at ICLR 2025
Prompt: Add cotortul acound sign
Pronugt pizza burger
Unedittd
UltraEdit
ControlNet
Unedited
Mask
UltraBdit
ControlNet
Unento
TOP
STOP
MERS
TTP
STOP
STOP
STOP
CIN
2 Falt
PNG
STOP
STOP
RADGAN
STOP
STOP
Seghtark
TOP
STOP
DAVIDCTSVD
STP
STOP
STOP
STOP
SegeSkoop
POP
STOP
22
TredDbakk
STOP
STOP
STOP
STOP
VINE-B
STOP
STOP
VINE-R
STOP
STOP
Figure Different watermarks have minimal impact on the image local editing outcomes, resulting in only slight changes.
32

---

Published as a conference paper at ICLR 2025
Unedittd
Trame?
Frame 9
Frame 11
Frame
Frame 15
Frame 17
Frame
NHBS
CIN
MINK
ROMDAN
Sephkekk
FORN PollCCusedd Suaerd
VINE-R
VINE-I
Figure 16: Different watermarks have little effect on image-to-video generation, leading to only minor changes.
33

---

Published as a conference paper at ICLR 2025
Original
Watermortod
Enbagged W Watermarked
Riediral
Enbrged
Rusidad
Original
Water Watemarrked
Water marlled
Redital
Realual
Figure 17: Qualitative comparison of the evaluated watermarking methods. The 'Enlarged from Watermark' column displays magnified 40 x 40 central region of the watermarked images, while the 'Enlarged from Residual' column shows magnified 40 x 40 central region of the residual images. Please zoom in for closer examination.
34

---

Published as a conference paper at ICLR 2025
1.00
1.00
1.0
1.0
TPR@0 1aPPR
0.75
[PRG119PPR
0.75
Bit Accurucy
0.8
AUROC
0.8
0.50
0.50
0.6
0.25
0.25
0.6
0.4
0.00
0.00
15
25
35
45
15
25
35
45
15
25
35
45
15
25
35
45
Sampling Step
Sampling Step
Sampling Step
Sampling Step
(a) Deterministic regeneration with DPM-Solver
1.00
1.0
TPR.000 156FPR
0.75
0.75
Bit Accuracy
0.8
0.50
0.50
0.7
AUROC
0.8
0.25
0.25
0.6
0.6
0.00
0.00
0.5
5
6
Text Guidance Scale
Text Guidance Scale
Text Guidance Scale
Text Guidance Scale
Global editing with UltraEdit
1.00
1.00
1.0
1.0
TPRQ0 196PRR
0.75
TPRG119PPP
0.75
Bit Accuracy
0.8
AUROC
0.8
0.50
0.50
0.25
0.25
0.6
0.6
0.00
0.00
5
6
5
6
Text Guidance Scale
Text Guidance Scale
Text Guidance Scale
Text Guidance Scale
(c) Global editing with Instruct-Piv2Pix
1.00
1.00
1.0
1.0
TPR:00 1968PR
0.75
TRR@15FPH
0.75
Accuracy
0.8
AUROC
0.8
0.50
0.50
0.25
0.25
0.6
0.6
0.00
0.00
10-20%
20-30%
41%
40-50%
50-60%
10-20%
20%30%
30 30-40%
40-50%
50-60%
10-21%
20-3096
30-40%
40-5006
50-600%
10-20%
20-31%%
30-41%
40-50%
50-006
30
30
Mask Ratio
Musk Ratio
Ratio
Mask Rutio
(d) L Local editing with ControlNet-Impaintta
0.8
0.6
TPR 1&FPR
TPR@)MAPPR
0.6
Bit Accuracy
0.7
AUROC
0.8
0.4
0.4
0.6
0.2
0.2
0.6
0.0
0.0
0.5
5
7
9
11
13
15
17
19
11
13
15
17
19
5
7
9
11
13
15
17
19
11
13
15
17 19
Frame Index
Frame
Frame Index
Frame Index
(e) Image-to-video generation with Stable Video Diffusion
MBRS CIN
PIMoG
SepMark
DWTICT
SSL
EdirGuard
VINE-B
RivGGAN
TrantMark
DWIDCTSVD
StegaStump
VINE-R
Figure 18: The performance of watermarking methods under (a) Deterministic regeneration with DPM-Solver, (b) Global editing with UltraEdit, (c) Global editing with Instruct- Pixtuuct (d) Local editing with ControlNet- Inpainting,. and (e) Image-to-video generation with Stable Video Diffusion.
35


Reviews:
[{"review_id": "1PbjBoz1aF", "reviewer": "Reviewer_3J7W", "summary": "This paper presents VINE, a watermarking method designed to withstand various image editing techniques enabled by advanced generative models. It also introduces W-Bench, a benchmark that evaluates watermark robustness against multiple types of edits, making it a valuable resource for watermarking research.", "questions": "See weakness.", "limitations": "", "rating": 6, "confidence": 2, "soundness": 2, "presentation": 3, "contribution": 2, "strengths": "- The paper is clearly written and organized, with effective figures explaining both W-Bench and VINE.\n\n- The paper provides rigorous evaluations, testing VINE and eleven other watermarking models on diverse editing techniques.", "weaknesses": "- EditGuard is primarily designed for editing detection, not robust watermarking, and it was not tested with its most robust configuration. This impacts the fairness of the evaluation, as EditGuard’s focus and strengths differ from VINE’s intended use.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "elEOZ8FRbN", "reviewer": "Reviewer_QuDW", "summary": "This paper introduces W-Bench, the first comprehensive benchmark designed to evaluate the robustness of watermarking methods against a wide range of image editing techniques, including image regeneration, global editing, local editing, and image-to-video generation. Authors reveal that image editing and blurring distortion predominantly remove watermarking patterns in high-frequency bands, while those in low-frequency bands remain less affected. Based on this, distortions are used as surrogate attacks to overcome the challenges of using T2I models during training and to enhance the robustness of the watermark. The authors approach the watermark encoder as a conditional generative model and introduce two techniques to adapt SDXL-Turbo, a pretrained one-step T2I model, for the watermarking task. Experimental results demonstrate that VINE is robust against multiple image editing methods while maintaining high image quality.", "questions": "1. Although the watermarking against Image Editing is interesting and novel, I cannot get the value of this task. Can you elaborate the perspective of this task?\n2. The author hypothesizes that a powerful generative prior can facilitate embedding information more invisibly while enhancing robustness (Line 249). Why hypothesize that? What are the assumptions based on?\n3. What is the purpose of finetuning VINE-B to VINE-R using Instruct-Pix2Pix? (Line 323)\n4. Why is the resolution not unified? (Line 1042) \n5. Is VINE only work on the Image Editing task? What about other common watermarking tasks?", "limitations": "", "rating": 6, "confidence": 4, "soundness": 3, "presentation": 3, "contribution": 3, "strengths": "1.\tThe proposed method is easy yet effective. The combination of different losses is reasonable.\n2.\tThe validation of watermarking patterns in high-frequency bands after image editing and blurring is solid.\n3.\tThe experimental results show the proposed watermarking method is robust enough against multiple image editing methods.", "weaknesses": "1.\tThis paper lacks the validation of hypotheses in Line 249.\n2.\tThe task of watermarking against Image Editing seems worthless.\n3.\tThe watermarking pattern existing in high-frequency bands after image blurring is not a new discovery. However, the author spends too much text on it.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "Jd4XHxibqR", "reviewer": "Reviewer_swi8", "summary": "This paper introduces a new evaluation benchmark, W-Bench, designed to test the robustness of image watermarking methods under image editing supported by large-scale generative models. W-Bench includes image regeneration, global editing, local editing, and image-to-video generation. The authors also propose VINE, a watermarking method utilizing generative priors to enhance the robustness and visual quality of watermark embedding. Experiments show that VINE outperforms existing watermarking methods across various image editing techniques.", "questions": "1. I have doubts about the results in Figure 5(a). The experimental results show that 250-step noise in image regeneration can significantly disrupt the watermark（bit acc). Does this mean that global image editing (e.g., SDedit, prompt2prompt) with 250 steps can also completely remove the watermark? If so, I believe this result does not demonstrate robustness, as global image editing often uses even more denoising steps.", "limitations": "", "rating": 6, "confidence": 4, "soundness": 2, "presentation": 3, "contribution": 3, "strengths": "1. Comprehensive Evaluation Framework: W-Bench covers a variety of image editing techniques, providing a comprehensive platform for assessing the robustness of watermarking methods.\n\n2. Innovative Use of Generative Priors: VINE embeds watermarks by adapting pretrained large-scale generative models, making the embedding more imperceptible and robust.\n\n3. This task is innovative, focusing on watermarking that is robust against image editing methods.", "weaknesses": "TreeRing, Gaussian Shading, and RingID, which add watermarks in the frequency domain of the initial noise, are generally considered robust against image editing (e.g., prompt2prompt) and regeneration. This paper lacks this crucial comparison. If these methods are also robust to image editing, the contribution of this paper may be diminished.\n\nReference:\n1. Tree-ring watermarks: Fingerprints for diffusion images that are invisible and robust\n2. Ringid: Rethinking tree-ring watermarking for enhanced multi-key identification\n3. Gaussian Shading: Provable Performance-Lossless Image Watermarking for Diffusion Models", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "ZU41k7aeid", "reviewer": "Reviewer_biAS", "summary": "This paper introduces an image watermarking benchmark, specifically aiming to evaluate the watermark robustness against four image editing methods. In addition, an image watermarking that is robust against image editing is proposed.", "questions": "1. What is the reason for choosing only these four types of image editing methods (image regeneration, global editing, local editing, and image-to-video generation) to evaluate the image watermarking robustness, against image editing?  \n2. What is the motivation for using SDXL-Turbo as the generative prior for watermark encoding? If it is just to avoid multi-step sampling, there should be lots of one-step generative models to choose from, for example, the SDXS [2]. \n\n[2] Song, Yuda, Zehao Sun, and Xuanwu Yin. \"SDXS: Real-Time One-Step Latent Diffusion Models with Image Conditions.\" arXiv preprint arXiv:2403.16627 (2024).", "limitations": "", "rating": 8, "confidence": 3, "soundness": 3, "presentation": 3, "contribution": 3, "strengths": "1. This paper focuses on the image watermark robustness against image editing, which is important but has rarely been explored.\n2. The proposed benchmark includes different types of image editing approaches, rendering it comprehensive to some extent.\n3. The proposed SDXL-Turbo-based robust image watermarking method is novel, and the experiments demonstrate its effectiveness.\n4. The paper is overall well-written.", "weaknesses": "1. The benchmark only considers four types of image editing methods (image regeneration, global editing, local editing, and image-to-video generation). Other image editing methods such as style transfer are not considered.\n2. Only one image-to-video generation method is included in the benchmark. The robustness against other image-to-video generation methods such as [1] is not evaluated.\n\n\n[1] Hu, Yaosi, Chong Luo, and Zhenzhong Chen. \"Make it move: controllable image-to-video generation with text descriptions.\" Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition. 2022.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "KfCwYdW7sP", "reviewer": "Reviewer_CgKQ", "summary": "The paper evaluates eleven watermarking methods against prevalent image editing techniques and demonstrates that most methods fail to detect watermarks after such edits. It also introduces a watermarking model based on SDXL-Turbo, which exhibits high robustness against these editing methods while maintaining high image quality.", "questions": "1.Figure 6 in the appendix shows that VINE exhibits higher brightness in the central region, providing evidence for why the proposed watermarking method demonstrates strong robustness against image editing. If the author can thoroughly elucidate the principles underlying this phenomenon, it may address the previously mentioned issue of \"a disconnect between the author's analysis of watermark robustness and the design of the watermark model.\"\n\n2.The experimental results demonstrate that the proposed watermarking method, VINE, significantly enhances robustness against various image editing techniques. Has the author considered using representative image editing as an attack template, incorporating the associated attack loss as one of the objective functions during the training phase? Alternatively, how might integrating the specific effects of image editing on watermarks into the design of the watermarking model influence the results of the watermarking algorithm?\n\n3. In the experimental section, some of the differences between the subjective experimental results are difficult to discern visually. The author could consider selecting a subset of images and enlarging specific regions to facilitate reader comprehension.", "limitations": "", "rating": 6, "confidence": 4, "soundness": 2, "presentation": 3, "contribution": 2, "strengths": "The paper presents the first holistic benchmark that incorporates four types of image editing techniques to assess the robustness of watermarking methods. This is significant for evaluating the robustness of future watermarking methods, as it helps to promote the standardization and comprehensiveness of robustness assessments. By addressing a critical gap in evaluating watermark resilience against sophisticated transformations enabled by modern generative models, this work encourages researchers in the field of image watermarking to focus on the robustness of their methods against emerging image editing technologies, including image regeneration, global editing, local editing, and image-to-video generation. Overall, the paper is clearly articulated and well-supported.", "weaknesses": "1. The paper explains the reasons behind the watermarking algorithm's resistance to image editing from the perspective of the frequency domain. It notes that the watermarking methods exhibiting high robustness against image editing in certain scenarios display prominent patterns in the low-frequency bands, which aligns with the general understanding of watermark robustness. However, the paper primarily focuses on the robustness of watermarking methods against image editing techniques based on generative models. Therefore, summarizing the unique effects of such image editing techniques on the watermark is more meaningful.\n2. We observe that the proposed watermarking method, VINE, shows higher brightness in the central region of the frequency domain, which corresponds to the author's analysis of watermark robustness. However, the paper does not clarify why this watermarking model based on SDXL-Turbo exhibits such characteristics, leading to the author's specific design of the watermark algorithm. In other words, there seems to be a disconnect between the author's analysis of watermark robustness and the design of the watermark model.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}]

Author rebuttal:

Decision: Accept (Poster)