THE SELF-RE-WATERMARKING TRAP: FROM EXPLOIT TO RESILIENCE
Authors: Vithurabiman Senthuran
Yong Xiang
Iynkaran Natgunanathan
Uthayasanker Thayasivam
Venue: ICLR 2026 Poster (2026)
Keywords: watemarking
deep learning
AI Security
Re-Watermarking
attack
Primary area: alignment, fairness, safety, privacy, and societal considerations

Abstract: Watermarking has been widely used for copyright protection of digital images. Deep learning-based (DL) watermarking systems have recently emerged as more effective than traditional methods, offering improved fidelity and resilience against attacks. Among the various threats to DL watermarking systems, self-re-watermarking attacks represent a critical and underexplored challenge. In such attacks, the same encoder is maliciously reused to embed a new message into an already watermarked image. This process effectively prevents the original decoder from retrieving the original watermark without introducing perceptual artifacts. In this work, we make two key contributions. First, we introduce the self-re-watermarking threat model as a novel attack vector and demonstrate that existing state-of-the-art watermarking methods consistently fail under such attacks. Second, we develop a self-aware watermarking framework to defend against this threat. Our key insight for mitigating this risk is to limit the sensitivity of the watermarking models to the inputs, thereby resisting re-embedding of new watermarks. To achieve this, we propose a self-aware deep watermarking framework that extends Lipschitz constraints to the watermarking process, regulating encoder–decoder sensitivity in a principled manner. In addition, the framework incorporates re-watermarking adversarial training, which further constrains sensitivity to distortions arising from re-embedding. The proposed method provides theoretical bounds on message recoverability under malicious encoder based re-watermarking and demonstrates strong empirical robustness against diverse scenarios of re-watermarking attempts. Moreover, it maintains high visual fidelity and demonstrates competitive robustness against common image processing distortions compared to state-of-the-art watermarking methods. This work establishes a robust defense against both standard distortions and self-re-watermarking attacks. Code available at https://github.com/SVithurabiman/SRW.

Published as a conference paper at ICLR 2026
THE SELF-RE- WANTRRRKWTERN TRAP: FROM Ex- PLOIT TO RESILIENCE
Vithurabiman Senthuran', Yong Jynkarrn Natgunanathan' & Uthayasanker Thayasivam' DDeainn University. UUniversity of Moratuwa {v. senthuunn,,, yong.xiang xiang, lynkaran in edu.au, rtuthayalcse. meree.rr.acc...
ABSTRACT
Watermarking has been widely used for copyright protection digital im- ages. Deep learning- based (DL) watermarking systems have recently emerged more effective than traditional methods, offering improved fidelity and resilience against attacks. Among the various threats DI watermarking systems, self-re- watermarking attacks represent a critical and underexplored challenge. In such attacks, the same encoder is maliciously reused embed new message into an already watermarked image. This process effectively prevents the original de- coder from retrieving the original watermark without introducing perceptual arti- facts. In this work, we make two key contributions. First, we introduce the self- re-watermarking threat model as novel attack vector and demonstrate that ex- isting state-of-the-ane watermarking methods consistently fail under such attacks. Second, we develop self-aware watermarking framework to defend against this threat. Our key insight for mitigating this risk is to limit the sensitivity of the watermarking models to the inputs, thereby resisting re-embedding of new wa- termarks. To achieve this, propose self-aware deep watermarking frame- work that extends Lipschitz constraints to the watermarking process, regulating incoer-decoode sensitivity in principled manner. In addition, the framework incorporates re-watermarking adversarial training, which further constrains sen- sitivity to distortions arising from re-embedding. The proposed method provides theoretical bounds on message recoverability under malicious encoder based re- watermarking and demonstrates strong empirical robustness against diverse sce- narios of re-watermarking attempts. Moreover, it maintains high visual fidelity and demonstrates competitive robustness against common image processing dis- tortions compared to ttat-oof-the-ar watermarking methods. This work estab- lishes a robust defense against both standard distortions and self-re- wateraaring attacks. Code available at lntlttp:: //tithubbttttttt com/ SVit hww hww.bimannnnn /SRi SRW
INTRODUCTION
Digital image watermarking plays a crucial role in preserving ownership and copyright protection for visual content distributed across digital platforms (Jia al. [021] Tancik et al., [0200] Luo al., 2024). While modern deep learning (DL) based watermarking methods often outperform classical methods terms of robustness and imperceptibility, they still remain vulnerable adversarial tacks (Wang et al. 2021 Kinakh et al., 2024). One such threat is the re-watermarking attack, where an adversary embeds a new watermark into an already watermarked image, potentially causing the respective decoder to recover the second watermark instead of the original one. This attack transfers the ownership an attacker, effectively allowing them to claim the image as their own and actively undermining the credibility of the watermarking systems.
Re- we-watermarkingg attacks image watermarking systems can be broadly categorized into two types: (1) cross-model re-watermarking, where different watermarking model embeds new message into an already watermarked image (Chen et al. 2024b] Padhi et al., 2024a); and (2) self-re- watermarking, where the same encoder is directly reused to embed
message. In cross-model re- w-tttrrarrkingg different embedding patterns between models typically allow both the original and the new watermarks be independently recovered. This makes such attacks detectable through

---

Published as a conference paper at ICLR 2026
multi-decoder inconsistencies (Please refer to Appendix A for further details). In contrast, self- overwriting poses a more severe threat. Since the same encoder is applied to an already watermarked image using the identical learned embedding function, it results in the removal of the original mes- sage, rendering it irretrievable. Such an attack hijacks the model's own logic to overwrite ownership without leaving detectable artifacts.
To investigate the severity of this threat, we conducted an empirical study on state-of-the-an deep watermarking models in the literature (Huang al. 2023 Zhu et al. 2018; Fernandez et al. [0222] Jia el al. 2021] Luo et al. 2024] Lu et al. 2025) and found that they consistently fail under self- overwriting attacks. This exposes a systemic vulnerability current designs that highlights the need for deeper analysis. Most recent deep learning- -bsed watermarking approaches predominantly lever- age encoder-decoder architectures trained to optimize for imperceptibility and robustness against common image processing distortions. However, these methods implicitly assume single-use em- bedding and do not account for repeated watermarking. While prior works have studied adversarial robustness for watermarking systems in the context of copyright protection (Chen et al.) 2024a Padhi et al. 2024a| Singh et al., 2024 Liu et al. 2022). to the best of our knowledge, none address the self-re-watermat watermarking attack wherein the encoder is reused maliciously watermarked content to re-embed a new watermark. To defend against celf-re-watermarkin
attacks, the system must detect unauthorized overwriting and reliably recover the original watermark, ensuring ownership cannot be hijacked. Addressing this gap is critical for maintaining the integrity and trustworthiness of watermarking systems.
This work focuses on defending against a white-box adversary who has full access to the water- marking model, as these models cannot be assumed remain protected indefinitely. Such access may result from model leakage, sharing, or reverse engineering. This scenario is particularly con- cerning because image owners may continue using the watermarking system without realizing that the model has been compromised. Even if the leaked model is later discarded, previously water- marked images remain vulnerable. Our motivation is further supported by recent research on model extraction (Rakin et al.] [2022] Hu & Pang. 202T) and real-world model leakage incidents, such as the LLaMA case (Vincent 2023). To this end, we propose a self-aware deep watermarking system designed to recover original messages even under self-overwriting. Our key insight is to develop architecture (Cisse et al.,
proactive watermarking framework that leverages a copsscitzz-consrriiii 2017) to ensure reliable recovery of the original message even from overwritten images. WWe demon- strate that integrating these constraints directly into watermarking architectures offers a practical and effective approach enhancing robustness against self-overwriting. This constraint ensures ro- bustness to structured distortions introduced by re-embedding. To comprehensively defend against white-box adversaries capable of crafting targeted perturbations to mislead the decoder, we also employ adversarial training restricted to small pixel-level changes. By jointly enforcing bounded sensitivity and adversarial robustness in the system, our framework effectively resists both self- overwriting and norm- born-buunded re- we-watemarrking attacks, preserving message fidelity and invalidat- ing unauthorized re-use of the model. Although Lipschitz constraints have been studied previously in deep learning, integrating them into a watermarking system limits the encoder's 's capacity to pre- serve visual fidelity and prevents the decoder from maintaining sufficient robustness. To address this, implement adaptive losswweig strategies that simultaneously preserve fidelity, enhance robustness against
attacks, and protect against ralf-re-watermarkin
The major contributions of this study can be summarized as follows:
Introduces the sell-re- watermarkrrnnnggggg threat model in image watermarking, where the encoder is reused to embed new message into an already watermarked image. Systematic experiments show that existing deep watermarking systems fail under this attack, revealing a significant vulnerability.
Presents novel watermarking framework built on Lipschitz-conssrained coder-decoder architecture, enhanced with re-watermarking adversarial training and adap- tive loss weighting. This design jointly optimizes fidelity and robustness, addressing both overwrite attacks and common proage-processing distortions within a unified objective.
Formally analyzes the system's 's bit-error rate under encoder. The work offers a theoretical bound for this attack class and complements it with extensive empirical evaluations to assess the system's 's robustness under overwriting and various prage-proc attacks.
using the same
2

---

Published as a conference paper at ICLR 2026
2
RELATED WORK
To contextualize our study, this section reviews two core areas: advances in deep Barning-based watermarking and the evolving adversarial threats and countermeasures.
2.1 DL BASED IMAGE WATERMARKING
Deep learning has become central to image watermarking, enabling models to balance impercepti- bility and robustness. Early work by Baluja al. (Baluja (017)) proved the feasibility of DL-based steganography, while HiDDeN (Zhu et al. 2018) introduced differentiable noise layers to simulate distortions such cropping and compression. To address non-differentiable unknown distortions, Luo et al.
2020) proposed a distortion-agnostic framework with adversarial training, and MBRS (Jia et 2021> further improved robustness to JPEG by mixing real and simulated codecs. Other advances include ARWGAN (Huang et al. 2023). which applied attention-basee fusion, and Fer- nandez al. (Fernandez 2022). who used self-supervised learning with DINO (Caron al.) 2021] to target semantically meaningful regions, although such methods remain vulnerable to crop- ping. Transformer-based designs such as WFormer (Luo et al., 2024) and security-focused schemes like GANMarked (Singh et al. 2024) improved robustness and key protection, yet struggled against forgery or adaptive attacks. Recently, Lu et al. (2025) developed VINE to address vulnerabilities in watermarking against large-scale text-to-image models.
2.2 ADVERSARIAT. ATTACKS IN DI BASED IMAGE WATERMARKING
DL watermarking faces adversarial threats beyond removal attacks (Zhao et al. 2024 An al., 2024]. A critical yet underexplored risk is seff-re-watermarkinng where an attacker reuses the en- coder to embed conflicting message into watermarked image, creating false ownership claims. Kinakh et al. (2024) showed that self-supervised methods are prone to unauthorized transfer, while Jorgery-based strategies (Hu et al.) (005) can fabricate counterfeit ownership. These studies demon- strate how adversarial pressure watermarking systems is expanding in sophistication.
Some studies have focused on defending against particular classes of adversarial attacks. For in- stance, diffusson-based schemes (Zhu et al. 2024) embed adversarial watermarks to obstruct genera- tive imitations. Recent dual watermarking efforts (Padhi al. 2024b) attempt to resist model style- transfer attacks. Other approaches target overwriting, such high- sighffreuueccy embedding (Chen) ct al. 2024b) or dual-watermarking (Padhi et al. 2024a). but their scope is narrow. Overall, robust countermeasures against self-re-we watermarking remain absent. Building on this gap, propose framework that reduces model sensitivity to input changes, preserving robustness to standard distor- tions while resisting adversarial overwriting.
THREAT MODEL: SELF-RE- WATERMARKING SELFFRE--WTTRRAAARNN ADVERSARY
In this section, we first define the problem setup, the adversary's capabilities and objectives, and then proceed to the attack mechanisms.
3.1 PROBLEM SETUP AND NOTATIONS
This work considers a woxte-box adversary that has full access to the encoder E and decoder D. The Encoder takes normalized real image x E X and bipolar messages m E M to produce Meanwhile, the Decoder takes F X and produces logits Z e IR which can be mapped to bit values.
17 11 watermarked images Ta E X, where X' C [-1, xxxx3 and M = {-1,
3.2 ADVERSARIAL CAPABILITIES
We consider a white-box adversary with full access to the model parameters and training proce- dure, and resources to develop and train watermarking models of comparable complexity. Such an adversary can launch three types of attacks. First, through Encoder- Based Self- Re-Watermarking (Osew). the adversary directly reuse the encoder embed new message into already wa-
3

---

Published as a conference paper at ICLR 2026
termarked image. Second, using Gradient-Based Adversarial Attack (OGBA), the adversary lever- ages the decoder's s gradients to generate a perturbation bounded by a maximum allowable pixel change that, when added to the watermarked image, compels the decoder to output target message. Finally, with Model Replication- Basod Overwrite Attack (OMR), the adversary exploits knowl- edge of the training algorithm and loss functions train surrogate watermarking model, enabling them to embed a new watermark and overwrite the original one without requiring access to the original model parameters training data.
3.3 ADVERSARIAL OBJECTIVES
In the context of these attack strategies, adversaries generally pursue two primary objectives. First, they aim to overwrite the original message, such that the decoder produces a target message. Second, these modifications often constrained by perceptual fidelity, requiring that the watermarked image remains perceptually similar to the original watermarked image.
3.4 THE SELF OVERWRITING ATTACK
As the adversary has access to the encoder model and its parameters, they can directly embed an ad- versarial watermark m' M into an already watermarked image Two. resulting in re-watermarked image zwo E X. Formally, the process can be expressed
Tass (Osnw(Fles) m); m²) F(I,,,m)) where m' # m.
3.5 GRADIENT BASED ADVERSARIAL OVERWRITING
Beyond maliciously reusing the encoder, we also consider powerful adversary who is capable of creating a subtle perturbation & to fool the decoder while maintaining high visual fidelity. To achieve this, formulate this attack an iterative Projected Gradient Descent (PGD) optimization (Madry) ctt al., 2017). At each iteration, the adversary updates the adversarial image, Zadv. to minimize the decoder's binary cross-entropy with the target message my M, projecting the perturbation onto an loo- -norm ball of radius e and clipping to valid pixel ranges. The detailed algorithmic procedure given in Algorithm Formally, this attack can be described as follows
Fade (F E(x, m)
(2)
Algorithm PGD Self-Overwrite Attack
Require:
1: Watermarked image xw E [_11,]]xCCHHMI Target message bits my E (0, Decoder
function D, Maximum perturbation Step size a, Number of iterations T
Ensure: Adversarial image Tadv
2: Initialize Fado & Fa:
3: for i = 1 to T do
4:
Compute logits: Z (xFadv) Compute loss:
5:
L = BCEWWihL 7, mg)
6:
Compute gradient: <- V
7:
Gradient descent step with sign: Fadv +- Fado sign(g))
8:
Project perturbation back to fox ball: ô t- clip(xado - Jw -E,
9: Clamp to valid image range: Fadu +- clip(x,, 1,
10: end for
11: return Fadv
4

---

Published as a conference paper at ICLR 2026
4 PROPOSED METHODOLOGY
This section proposes a principled approach resist watteranatnr attacks in watermarking systems by jointly optimizing fidelity, nominal recovery, and robustness.
4.1 MODEL. ARCHITECTURE
The proposed architecture designed to be sufficiently expressive to embed messages within im- ages while preserving their fidelity. Furthermore, it is carefully structured to ensure robustness against self-overwriting attacks through Re- Re-Watermarking Adversarial Training, thereby enabling reliable message extraction, even after the following key components:
The proposed architecture comprises
We adopt U-Net architecture (Ronneberger al. 2013), a widely used design in water- marking algorithms, to evaluate how bounded sensitivity can be adapted to such architectures. To support multi-scale feature extraction, we incorporate an auxiliary ResNet-50 backbone (He al. 2016). The imput to the encoder is constructed by concatenating the cover image E 2 with the message m {-1, 13 Prior concatenation, the message undergoes spatial expansion through spectrally normalized linear layers. This results in 4-channel tensor input.
Encoder:
The encoder consists of four downsampling blocks augmented with skip connections from inter- mediate ResNet layers. A bottleneck with spectral and group normalization connects to four up- sampling blocks with skip connections and ReLU activations. final spectrally normalized convolution produces residual image, which is added to the input image.
Decoder: The decoder is convolutional neural network that recovers the embedded message from the watermarked image. Each convolutional block comprises spectrally normalized convolutional layer with kernel size 3 3, followed by group normalization (with 4 groups) and a ReLU activation. Residual connection between the blocks, enhancing gradient flow and feature reuse. The final fully connected layer produces the final message logits.
To simulate real- world distortions, employ differentiable noise model composed of common image perturbations. At each training iteration, one perturbation is randomly sampled from pool that includes JPEG compression, Gaussian blur, dropout, cropout, cropping, horizon- tal, vertical flips, scaling, and rotation. Each selected operation is applied with randomly sampled parameters within plausible ranges.
Noise Model:
During inference, the watermarked image undergoes Gaussian blurring followed by suppression of low-magnitude values enhance the visual fidelity.
Post- Post-Processing Module:
4.2 TRAINING OBJECTIVE
The training objective is designed to meet three goals; preserving image fidelity, ensuring reliable nominal recovery of the embedded message, and maintaining robustness against self-overwriting attacks. To achieve this, the system optimizes composite loss with three components. First, the fidelity loss enforces the watermarked image remain visually consistent with the cover image. integrates both mean squared error and perceptual similarity term, measured via LPIPS (Zhang al. 2018), given by: Lna (1, Appips LPIPS(2,, (2r, Fwr)
Second, the nominal recovery loss ensures reliable message extraction under benign conditions:
Lre BCE(((a.)) ((m))
(4)
where the function ø maps m from its bipolar form to standard bit values. Third, the robustness loss is designed to enhance resilience against overwriting attacks. Specifically, it penalizes decod- ing errors when the system is confronted with ce-watemaareed images generated through malicious encoder reuse, as well as adversarially perturbed inputs obtained via gradient-based optimization. It given by:
Li BCE(D(zz.) ((m))
(5)
Thus, the full optimization problem can be formulated as:
min Er,m, [Ana Lua + Arec Liee + Xno Lrohl
(6)
5

---

Published as a conference paper at ICLR 2026
where 8g and 0p are the parameters of E and D respectively. And. Ace and Xoa can be adaptively changed using the nominal bit recovery and the bit recovery of the original message after adversarial training per Algorithm 2 in Appendix C
4.3 TRAINING PIPELINE
In this work, we construct a training pipeline that integrates noise modeling and adversarial simu- lations. During training, the encoder embeds binary message into the cover image produce watermarked image. This image is then optionally passed through a noise model simulating com- mon distortions described under Subsection 4.11 The decoder attempts to recover the embedded message from the (possibly distorted) watermarked image. Figure I illustrates our training pipeline.
PGD-baaed adversarial overwriting scenario is also simulated during training. This forces the model to learn robustness against adaptive prudient-based attacks. Additionally, to further enhance resilience, self-overwriting scenario simulated by feeding the watermarked image back into the encoder to mimic an adversary attempting to re-embed a new message top of the existing watermark. This encourages the model to maintain watermark integrity under repeated embedding attempts. Together, these training strategies ensure robustness against both gradient- based and self- overwriting ad adversarial manipulations. While these mechanisms offer strong empirical protection, the following section will formally analyze the system's 's robustness under malicious encoder reuse.
Fidelity Loss
Adversary' $
Watermark
Image
ENCODER
Watermarked Image
NOISE LAYER
Perturbed Wat Watermarked Image
W Watermark
Gradient
Advesary's Watermarked Image
Extracted W aatermak
Based
DECODER
Atlack
Self Re-
Watermarked Image
Nominal Recovery Loss
Robustness
Data Flow
Loss Calculation
Clean Setting
Attacked Setting
Figure 1: Overview of the training pipeline for the proposed system, illustrating both the standard watermarking process (black arrows) and the adversarial training loop (red arrows) used to ensure robustness against attacks.
4.4 LIPSCHITZ CONSTRAINTS AND ASSUMPTIONS
Decoder Lipschitzness There exists an upper bound Kn such that for all images æ 22 E X.
[((x,)) lox) S KD || - x2llo0
In practice, Kp can be a global constant (conservative) or a data- local estimate measured along the path from watermarked image T.. to re-watermarked image zw
[ - D loo
K
(8)
2. Positive clean margin. The minimum signed margin across all images and bits, which guarantees that every bit is correctly decoded in the absence of an overwrite:
Amin inf (, 0 where
( m) == D,E( (9)
This quantity measures the worst-case "safety buffer" for the decoder logits, i.e., the small- est distance of any bit logit from zero under clean conditions.
These assumptions facilitate feasible robustness analysis. In practice, they supported by archi- tectural constraints and training procedures. Supporting empirical evaluation of these quantities is detailed in Appendix B.4

---

Published as a conference paper at ICLR 2026
4.5 THEORETICAL ANALYSIS
This subsection analyzes the decoder's robustness to selfrrewwatermariingg deriving an error bound and theorem that upper-bounds the bit error (BER) between the decoded messages after watermarking and the original messages. Formal proofs are provided in Appendix B By defining the nominal decoder error Free = su Σ 1( sign (z, m)) * m4), the distortion introduced due to overwriting as 8. = F| Faa I the standard sign function as sign(-). and the
indicator function (condition), we can state the following theorem.
Theorem (BER upper bound). For given triplet (z, m') with overwrite Two, the bit error rate satisfies
1 BER(I, m, m') & I E (((,(z)))) S KDd + Evec-
(10)
In particular, if KD00 < Amin the overwriting process does not flip the bit, therefore
BER(I, m,,'), S Eroc-
(11)
Corollary (Local, data-dependent tightening). Replacing KD by the local, attack-path constant DD,uuc yields the tighter bound
L
BER(I, m, m')
& 1(A,(x, S DD doo) + Erec.
1 i=1
(12)
L
Corollary (Perfect recovery under margin condition). frer = O and KD 800 < Amn. then no bits flip under overwrite, and hence
BER(I, m. m²) 0, V(z,m,
(13)
5 EXPERIMENTAL SETTING
This section outlines the datasets, evaluation metrics, baselines, and implementation details used to validate the effectiveness of the proposed method. In our experiments, we consider
the following seven state-of-the-art studies: dwtDetSvd (Navas et al. (2008), HiDDeN (Zhu
al. 2018). MBRS (Tia al. 2021), SSL (Fernandez et al. 2022p. ARWGAN Huang al.
(2023 WFrrmer (Luo et al. 2024), and VINE al. 2025
5.1 TRAINING SETTING
We use a subset of the COCO Lataset[inn al. (2014) consisting of 20,000 training. 1,000 validation, and 3,000 testing images. All RGB images resized to 128 128 pixels and normalized with mean [0.5, 0.5, 0.5] and standard deviation [0.5, 0.5, 0.5]. Binary messages randomly sampled for watermarks. We set Atpips as 0.5, Training and experiments were conducted on dual-socket Intel Xeon E5-2670 system and RTX A4000 GPU. The Lipschitz constraint was enforced by applying spectral normalization all convolutional and linear layers in the models.
length L = 30 bits are
5.2 EVALUATION METRICS
The performance of the proposed watermarking method is evaluated in terms of imperceptibilityy reflecting the preservation of visual quality, and robustness, indicating the resilience of the embed- ded watermark to attacks and distortions. To assess imperceptibility. we report Peak Signal-to-Nove Noise Ratio (PSNR) and Structural Similarity Index Measure (SSIM) between cover and watermarked im- ages, where higher values indicate better visual quality, and PSNR above 30dB is generally con- sidered to reflect acceptable imperceptibilityy Zhang et al. (024);; Subhedar & Mankar (2020). For robustness evaluation, we measure three bit-accuracy metrics, computed per image and averaged over the test set: ACColcan evaluates message recovery under normal, non-adversarial conditions; ACC,av measures the accuracy between the decoder output and the adversarial target message after attacks such as self-overwriting or gradient- based perturbations; and ACC quantifies the simi- larity between the decoded message post-attack and the originally embedded watermark, indicating how well the original watermark withstands adversarial manipulations. Higher values of ACC,tean. ACC and ACCorg indicate better message recovery.

---

Published as a conference paper at ICLR 2026
5.3 RE-WATEMMARKING ÁTTACK ON EXISTING WORK
In this subsection, we investigate the vulnerability of existing deep learning- based watermarking models to self-re-waterde waatermrrrni attacks. To systematically evaluate the robustness of watermarking models under self-re- wettrrrrrmnnnnnngg we design a controlled experimental protocol consisting of three key scenarios as described under Subsection
5.2
ACCriaan
ACC,dv
ACCorio
Bit Accuracy
3.11
0.6
MBRS
HiDDeN
ARWGAN
SSL
WFormer
VINE
OURS
MBRS
HIDDeN
ARWGAN
SSL
VINE
OURS
MBRS
HIDDeN
ARWGAN
SSL
VINE
OURS
Figure 2: Bit accuracy under wett-rr-rrrmmiinngggg attacks using their respective encoders
To visually compare our proposed model with other learning based SOTA models under self-re- watermarking attacks, present scenario-wise box plots in Figure 2 The figure illustrates the distribution of bit accuracies over the test set, highlighting differences in overwrite robustness. High bit accuracy in the first two scenarios confirms effective watermark embedding and retrieval, while a low bit accuracy in the third scenario indicates successful erasure of the original watermark under self-overwrite attacks. Figure shows that all SOTA models fail under malicious encoder reuse, whereas the proposed model withstands the attack and successfully recovers the original watermark even after an adversary attempts to re-embed new one. Moreover, as shown in Appendix [ the re-watermarking process in our model visibly distorts the resulting image, preventing an ad adversary from gaining any advantage through iterative re- re-watermarking. Quantitatively, the average PSNR and SSIM between the watermarked and re- watermarked images are 10.21 dB and 0.66, respectively, indicating severe degradation. Figure provides an illustration of the cover, watermarked, and re- watermarked images.
Figure Cover, watermarked, and re-watermarked images generated by our model, respectively.
5.4 EMPIRICAL EVALUATION OF THE THEORETICAL BOUND
This section empirically analyzes the theoretical bound of the system when re-watermarked using our Encoder, as this represents the most challenging attack conditions. As per the bound, we com- pare the minimum per-bit clean margin Amin to the empirical Lipschitz-based theoretical lower bound Ko. to assess how well the bound reflects real-world behavior. It should be noted that this section analyzes only the most vulnerable bit, rather than all embedded bits. This evaluation ex- amines both the theoretical and practical robustness in the worst-case scenario, making the resulting bound conservative. Figure 4a illustrates the relationship between the minimum-marge bit Amin and the per- image overwrite bound Kpttoc actoss 3,000 images, along with the observed bit flips. Green points indicate bits correctly decoded after overwrite, while red points indicate flipped bits. As expected, all points above the line a
A Ami remain green, confirming that bits with
8

---

Published as a conference paper at ICLR 2026
margins exceeding the bound are reliably robust. Below this threshold, we observe mixture of green and red points.
Figure isoolttss only the flipped bits, which all fall below the K D. Amin line, i... inside the region where the theorem predicts potential vulnerability. This demonstrates that the theoretical bound provides conservative, yet informative, necessary condition for bit flips. The analysis shows that K D1 provides a conservative estimate for bit flips, while not all bits below the threshold actually flip. all observed flips oceur within this region, which is consistent with the theoretical bound. While the bound predicts potential vulnerability, the majority of these bits still survive, showing that the theoretical estimate is conservative yet valid. These observations confirm that the bound provides a useful, conservative estimate of robustness while the trained decoder shows added resilience against self-overwriting.
Unflipged
Flipped
Fllpped
Retenially walterable reyion
Relust region
Ku. Best
10
Koyter tor 6 Arir
10-
10
12
2
10
12
Ko
(a)
(b)
Figure 4: Scatter plot illustrating the relationship between Kp 5 and the minimum distance Amin for watermark embedding. Each point represents an image sample. Green points represent unflipped bits, and red points represent flipped bits. The dashed line indicates the theoretical bound.
5.5 ADVERSARIAL. ATTACK EVALUATION
This subsection evaluates the robustness of the system under advanced adversarial scenarios. As discussed Section 3.2, we assume an adversary capable of executing a PGD-based self-overwriting attack, implemented as detailed in Algorithm Unlike malicious encoder reuse, the PGD attack iteratively applies small perturbations to mislead the decoder to output the target watermark.
We simulate this attack using two configurations. The first, termed PGD = 0.007, and 50 iterations. The second, PGDstrong: is more aggressive, with e = 0.04, a = 0.01, and 100 iterations. Figures 5a and 5b illustrate the effectiveness of these attacks across several state-of-the-ar models, and demonstrate the robustness of the proposed model in preserving the watermark under both moderate and strong attack settings. The numerical values presented in Table T Further analysis of the perturbation budget (c), as detailed Appendix D.I reveals that the model's performance starts deteriorate the perturbation budget increases. However, when this happens, the resulting image quality drops below 30dB, causing noticeable degradation, which makes the resulting image less valuable for any potential adversary.
uses
0.03,
In addition, we consider an adversary who constructs a watermarking system using similar archi- tecture ours with a different dataset. In the first setting. the adversary uses the same losses as ours, denoted as Baseline Adversarial Model (BAM). In the second, the adversary omits the robust- ness loss, optimizing only for imperceptibility and accuracy, denoted as Ablated Model (AM). Visual quality and watermark extraction results of BAM and AM are reported in Appendix. D.2 The ability of our decoder to recover the original watermark after attacks by these adversarial models demon- strates remarkable performance. Specifically, it achieves 100% accuracy against BAM, irrespective of whether a post-process post-procsssing model used, and against AM with post-processing, while achieving 99% accuracy against AM without proceprrc.ssing This indicates that the proposed method consis- tently resists overwrite attempts. Furthermore, the encoder perceptually degrades re- re-watemmrrked images, preventing black box query-based API attacks from producing meaningful outputs.

---

Published as a conference paper at ICLR 2026
ACC
ACCoM
Bit Rccuray
MBRS
110ee
ARIGGN
SSi
Witmmar
VNN
OURS
HoDeN
55L
OURS
MBRS
HDDeN
ARRYGAN
SSL
Wioomor
VIN
DURS
MORSS
HDDIN
AHNNGNN
50L
WFomer
VIN
OURS
HODeN
VINE
DURS
HODWN
500
DURS
(a) Bit accuracy under PGD modemte attack (E 0.03,
(b) Bit accuracy under PGD attack (c = 0.04, a
= 0.007. 50 iterations).
0.01, 100 iterations).
Figure 5: Comparison of bit accuracy under moderate and strong PGD attacks. The proposed model
shows higher robustness compared to SOTA methods.
5.6 ROBUSTNESS TO NOISE AND DISTORTIONS
While our main goal is to defend against selfrre-watermarking attacks, the watermark must also remain retrievable under common image distortions. Therefore, we evaluated the proposed model's robustness against a standard set of such perturbations. As shown in Table [ the proposed model maintains exceptionally high robustness across all tested distortions. It achieves near-perfect bit recovery under Gaussian blur (99.66%), dropout (98.90%), cropout (98. 14%), cropping (9,,85%) and JPEG compression (95.06%). Visual metrics such PSNR (34.03 dB) and SSIM (0.97) confirm that the watermarked images are perceptually closer to the cover images. Further analysis on the robustness different pixel-wise and geometric distortions is available in Appendix F. These results indicate that the model's watermark embedding is robust to diverse transformations.
Table I: Comparison of the proposed model with SOTA baselines across visual quality, robustness to image processing, and robustness to adversarial overwrite attacks.
Studies
Visual Quality
ACCa (%)
ACC (%)
JPEG
Gaussian
Dropout
Cropout
Crop (3.5%
Self Re-embed
PGD
PGD
PSNR (dB)
SSIM
(50)
Blur (2.0)
(30%)
(30%)
Moderate
Strong
dwtDerSvd
28.57
0.94
99.97
99.41
54.36
85.40
51.29
50.00
N/A
N/A
Hidden
33.55
0.92
63.00
96.00
93.00
94.00
88.00
51.29
52.03
51.45
MBRS
35.84
0.89
91.97
100.00
99.96
99.98
92.68
50.34
63.51
51.26
SSLW
33.10
0.94
83.01
98.
88.11
79.66
50.73
49,90
49.81
ARWGAN
35.87
0.96
93.98
99.99
100.00
99.82
98.17
$1.94
50.68
50.73
WFORMER
33.50
0.91
99.14
100.00
100.00
100.00
98.70
50.02
88.64
80.
VINE
37.07
0.99
99.97
99.84
87.63
99.99
52.24
51.20
82.00
79.41
Proposed
34.03
0.97
95.06
99.66
98.90
98.14
99.85
100.00
99.95
99.37
CONCLUSION
This work introduces the seff-re-watermarking threat model, an overlooked but critical vulnerability image watermarking systems, where adversaries can reuse the encoder overwrite embedded watermarks without perceptible changes. We demonstrated that existing watermarking methods are highly vulnerable to such an attack. To mitigate this attack, we introduce robust watermarking framework that combines architectures with bounded sensitivity with re- re-watermarking adversarial training. Further, this work formally analyzes watermark recoverability and exhibits strong em- pirical resilience against both self-re-watermarking and norm-bounded re-watermarking attacks. In addition, it maintains high visual fidelity and robustness to standard pixel-wise and geometric distor- tions. A limitation of the current approach is that it focuses solely on self-re-wae we--watrmarkingg attacks. Extending our approach to defend against different classes of adversarial attacks concurrently is a key direction for future research.
10

---

Published as a conference paper at ICLR 2026
ACKNOWLEDGMENTS
This work was supported in part by Ausintelli Technology Pty Ltd.
REFERENCES
Bang An, Mucong Ding, Tahseen Rabbani, Aakriti Agrawal, Yuancheng Xu, Chenghao Deng, Sicheng Zhu, Abdirisak Mohamed, Yuxin Wen, Tom Goldstein, and Furong Huang. Waves: benchmarking the robustness of image watermarks. In Proceedings of the 41st International Conference on Machine Learning, ICML'24. JMLR.org, 2024.
Shumeet Baluja. Hiding images in plain sight: Deep steganography. In Ad- vances in Neural Information Processing Systems, volume 30. Curran Associates, Inc.,
2017. URL httppsss//.pocceeeagggs....eee cc/ppprr files/paper/2017/ File/ /ttp///cccc.cccaaaoa0//333333333
Mathilde Caron, Hugo Touvron, Ishan Misra, Hervé Jégou, Julien Mairal, Piotr Bojanowski, and Armand Joulin. Emerging properties self-supervised vision transformers. Proceedings of the International Conference Computer Vision (ICCV), 2021.
Feiyu Chen, Wei Lin, Ziquan Liu, and Antoni B. Chan. secure image watermarking framework with statistical guarantees via adversarial attacks secret key networks. In Computer Vision FCCV 2024: 18th European Conference, Milan, Italy, September 29-October 2024, Proceed- ings, Part XL. pp. 428-4488555 Berlin, Heidelberg, 2024a. Springer-Verlaee Verlag. ISBN 978-3-33-7370 24, URL https:/ http://wwwaaaeeeeaaa///////////a 5. doi: http:/ssseccceeeeaeeeeeeee http:/ppppppe//00..... pd
Huajie Chen, Tianqing Zhu, Chi Liu, Shui Yu, and Wanlei Zhou. High-Frequency Matters: At-
tack and Defense for Image-Processing Model Watermarking IEEE Transactions on Services
Computing, 17004): July 2024b. ISSN 1939-1374. doi: 10. 109100999002222244474444
URL htt.://://oo.l.eeeeccmmerrrroooo org. 109 002. 334447
Zihan Chen, Yi Liang, Jinyu Wang. Chong Wang, Feng Chen, and Jiaya Zhang. Universal watermark
vaccine: Universal adversarial perturbations for watermark protection. In Proceedings of the Computer Vision and Pattern Recognition Workshops (CVPRW), pp. 393-402. IEEE, 2023.
Moustapha Cisse, Piotr Bojanowski, Edouard Grave, Yann Dauphin, and Nicolas Usunier. Parseval networks: improving robustness to adversarial examples. Proceedings of the 34th International Conference on Machine Learning Volume 70, ICML' 17, pp. 854-863. JMLR.org. 2017.
Jia Deng, Wei Dong, Richard Socher, Li-Jia Li, Kai Li, and Li Fei-Fei. Imagenet: A large-scale hier- archical image database. In 2009 IEEE Conference on Computer Vision and Pattern Recognition, pp. 248 255. IEEE, 2009.
Pierre Fernandez, Alexandre Sablayrolles, Teddy Furon, Hervé Jégou, and Matthijs Douze. Wa- termarking images in self-supervised latent spaces. In 2022 IEEE International Conference on Acoustics, Speech and Signal Processing (ICASSP), pp. 3054-3058, 2022. doi: 10.1 ICASSP4392.2022.946655
Kaiming He, Xiangyu Zhang, Shaoqing Ren, and Jian Sun. Deep residual learning for image recog- nition. In 2016 IEEE Conference on Computer Vision and Patlern Recognition (CVPR), pp- 770-778, 2016.
doi: 10.1109/CVPR.201.990
H. Hu and J. Pang. Stealing machine learning models: Attacks and countermeasures for generative adversarial networks. In Proceedings of the Annual Computer Security Applications Conference (ACSAC 22/) Virtual Event, USA, 2021. ACM. doi: 10.1145/3485832.4445883 URL https: .idoiiorg//0. 00. 1141 345/84858355 32..8833.3348883 3485838
Yuepeng Hu, Zhengyuan Jiang, Moyang Guo, and Neil Zhenqiang Gong. A transfer attack image watermarks. In The Thirteenth International Conference on Learning Representations, 2025.

---

Published as a conference paper at ICLR 2026
Jiangtao Huang, Ting Luo, Li Li, Gaobo Yang, Haiyong Xu, and Chin-Chen Chang. Arwgan: Attention-guna guideed robust image watermarking model based on gan. JEEE Transactions on Instru- mentation and Measurement, 72:1-17, 2023. doi: 10.1109/TIM.20233288998
Mark J Huiskes and Michael S Lew. The mir flickr retrieval evaluation. In Proceedings of the 1st ACM international conference on Multimedia information retrieval, pp. 39-43. ACM, 2008.
Zhaoyang Jia, Han Fang, and Weiming Zhang. Mbrs: Enhancing robustness of dnn-based water- marking by mini-batch of real and simulated jpeg compression. In Proceedings of the 29th ACM International Conference on Mullimedia, MM '21, pp. 41-49, New York, NY, USA, 2021, Asso- ciation for Computing Machinery. ISBN 978 1480386517. doi: 10.1 011453477405.344552224 URI.
https:
popps://dos //oi orgg10............. 114 1145/155 77744.855344433
Vitaliy Kinakh, Brian Pulfer, Yury Belousov, Pierre Fernandez, Teddy Furon, and Slava Voloshynovskly. Evaluation of security of ml-based watermarking: Copy and removal attacks. In 2024 IEEE International Workshop on Information Forensics and Security (WIFS), pp. 1-6,
2024. doi: 11110///WF$6116002220 10.4..0810685
Tsung-Yi Yi Lin, Michael Maire, Serge Belongie, James Hays, Pietro Perona, Deva Ramanan, Piotr Dollár, and C. Lawrence Zitmick. Microsoft coco: Common objects in context. In Computer Vision - ECCV 2014, pp. 740-755, Cham, 2014. Springer International Publishing, ISBN 978-3- 319-10602-1.
Xinwei Liu, Jian Liu, Yang Bai, Jindong Gu, Tao Chen, Xiaojun Jia, and Xiaochun Cao. Watermark vaccine: Adversarial attacks to prevent watermark removal. In Shai Avidan, Gabriel Brostow, Moustapha Cissé, Giovanni Maria Farinella, and Tal Hassner (eds.), Computer Vision ECCV 2022, pp. 1-17, Cham, 2022. Springer Nature Switzerland. ISBN 978-3-031-19781-9.
Yepeng Liu, Yiren Song, Hai Ci, Yu Zhang, Haofan Wang, Mike Zheng Shou, and Yuheng Bu. Image watermarks removable using controllable regeneration from clean noise. In The Thirteenth International Conference on Learning Representations, 2025. URL https: wttp://ooommmmmmmxxxd-x-xx
//opereevew.
Ziwei Liu, Ping Luo, Xiaogang Wang, and Xiaoou Tang. Deep learning face attributes in the wild. In Proceedings of International Conference on Computer Vision (ICCV), December 2015.
Shilin Lu, Zihan Zhou, Jiayou Lu, Yuanzhi Zhu, and Adams Wai-Kin Kong. Robust watermarking using generative priors against image editing: From benchmarking to advances. In The Thirteenth International Conference on Learning Representations, 2025. URL httph: http::ttpt///ppeteee /ppprreviee.........
met//orummicn 608GCm8Wn
Ting Luo, Jun Wu, Zhouyan He, Haiyong Xu, Gangyi Jiang, and Chin-Cher Chang- Wformer: A transformer-based soft fusion model for robust image watermarking. IEEE Transactions on Emerging Topics in Computational Intelligence, 86):4179-4196, 2024. doi: 10.1109/TETCI 2024.3386916.
Xiyang Luo, Ruohan Zhan, Huiwen Chang, Feng Yang, and Peyman Milanfar. Distortion agnostic deep watermarking. In 2020 IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR), pp. 13545-13554, 2020. doi: 10.1009CCPP44460022200000 20200000...
Aleksander Madry, Aleksandar Makelov, Ludwig Schmidt, Dimitris Tsipras, and Adrian Vladu. Towards deep learning models resistant to adversarial attacks. 06 2017. doi: 10.48550/arXiv. 1706.06083.
K. A. Navas, Mathews Cheriyan Ajay, M. Lekshmi, Tampy S. Archana, and M. Sasikumar. Dwt- det-svd based watermarking. In 2008 3rd International Conference on Communication Systems Software and Middleware and Workshops (COMSWARE '08), pp. 271-274, 2008. doi: 10.1 N11SWA..0008.5544422
Sudev Kumar Padhi, Archana Tiwari, and Sk. Subidh Ali. Deep learning based dual watermarking for image copyright protection and authentication. IEEE Transactions on Artificial Intelligence, 5 (222)611166114 2024a. doi: 10. 109/TA11.024.3485511
12

---

Published as a conference paper at ICLR 2026
Sudev Kumar Padhi, Archana Tiwari, and Sk. Subidh Ali. Deep learning- based dual watermarking for image copyright protection and authentication. IEEE Transactions on Artificial Intelligence, (112))633-6145, 2024b. doi: 10.1 (0.1109/TAL2004444855555
Fabien A. P. Petitcolas, Ross J. Anderson, and Markus G. Kuhn. Attacks on copyright marking systems. In David Aucsmith (ed.), Information Hiding, pp. 218-238, Berlin, Heidelberg, 1998. Springer Berlin Heidelberg. ISBN 978-3-540-49380-8
Adnan Siraj Rakin, Md Hafizul Islam Chowdhuryy, Fan Yao, and Deliang Fan. Deepsteal: Advanced model extractions leveraging efficient weight stealing in memories. In 2022 IEEE Symposium on doi: 10. (0199//P4221..022.0002 98337733.
Security and Privacy (SP), pp. 1157-1174, 2022.
Olaf Ronneberger, Philipp Fischer, and Thomas Brox. U-net: Convolutional networks for biomed- ical image segmentation. In Nassir Navab, Joachim Homegger, William M. Wells, and Alejan- dro F. Frangi (eds.). Medical Image Computing and Compute--Asiisted Intervention MICCAI 2015, pp. 234-241, Cham, 2015. Springer International Publishing. ISBN 978-3-319-24574-4,
Himanshu Kumar Singh, Naman Baranwal, Kedar Nath Singh, and Amit Kumar Singh. Ganmarked: Using secure gan for information hiding in digital images. IEEE Transactions on Consumer Electronics, pp. 1-1, 2024. doi: 10.1109/TCE.20244440060
Mansi S. Subhedar and Vijay H. Mankar. Secure image steganography using framelet transform and bidiagonal svd. Multimedia Tools Appl., 79(3 18:1444::66688888 January 2020. ISSN 1380-7501.
doi: 1007/0 1042-019-08221-..
Matthew Tancik, Ben Mildenhall, and Ren Ng. Stegastamp: Invisible hyperlinks in physical pho- tographs. In 2020 IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR), pp. 2114-2123, 2020. doi: 10. 1109/CYPR4260002200.0000
James Vincent. Meta's powerful ai language model has leaked online what happens now?
The Verge, March 2023. URL https: //t::///wwwww www.wwwwwwwwwwwwwwwt.o com/
meta ai- Language model 1lama Leak-onninneeeeeeeeeeeeeeeeeeeee moseemmisusss misese Accessed: 2025-09-04.
Ruowei Wang, Chenguo Lin, Qijun Zhao, and Feiyu Zhu. Watermark faker: Towards forgery of digital image watermarking. In 2021 IEEE International Conference on Multimedia and Expo (ICME), pp. 1-6, 2021. doi: 10. 10.1009//5511 000.000.222.990 9.2244...
Lijun Zhang, Xiao Liu, Antoni Viros Martin, Cindy Xiong Bearfield, Yuriy Brun, and Hui Guan. Attack-resilient image watermarking using stable diffusion. In The Thirty-eighth Annual Confer- ence on Neural Information Processing Systems, 2024. URL httpt::tpp//.o / /ttt:pp:///peereeeee repieeeeview net//
Forum?id det.niideeoKKSuGGB
Richard Zhang, Phillip Isola, Alexei A. Efros, Eli Shechtman, and Oliver Wang. The unreasonable effectiveness of deep features as a perceptual metric. In 2018 IEEF/CVF Conference on Computer Vision and Pattern Recognition, pp. 586-595, 2018. doi: 10.1109/CVP..2018..00 800068.
Xuandong Zhao, Kexun Zhang, Zihao Su, Saastha Vasan, Ilya Grishchenko, Christopher Kruegel, Giovanni Vigna, Yu-X Yu-Xiang Wang, and Lei Li. Invisible image watermarks are provably removable using generative AI. In The Thirty-eighth Annual Conference on Neural Information Processing Systems, 2024. URL
ew net. fort//frmm? 2aapmmmddd777hfffyo
Jiren Zhu, Russell Kaplan, Justin Johnson, and Li Fei-Fei. Hidden: Hiding data with deep net- works. In Computer Vision - ECCV 2018: 15th European Conference, Munich, Germany, September 8- 8-14, 2018, Proceedings, Part XV, pp. 682 697, Berlin, Heidelberg, 2018. Springer- Verlag. ISBN 978-3-030-01266-3. 7/link. wwi.kk.sprnggr..... com wwtpthhrtppoo/e 1ttp:////...1100000----00000---0
doi: 10. 10.10007/97883-000-01266-- 40. URL https: 40
Peifei Zhu, Tsubasa Takahashi, and Hirokatsu Kataoka. Watermark-embeddee Adversarial Ex- amples for Copyright Protection against Diffusion Models In 2024 IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR), pp. 14420-244400 Los Alamitos, CA,
USA, June 2024. IEEE Computer Society. doi: 10. 110.0////CCY0P222222222022222220
URL
https:: doi.. http:://o...cooooeeeccccecee////
.224..2022....0000 02305
13

---

Published as a conference paper at ICLR 2026
APPENDIX
A ANALYSIS ON RE- WATERMARKING SCENARIOS
As outlined in the Introduction, re-watermarking can be divided into cross-model overwriting and wuffre-wwttrmmakking This section evaluates the effect of re-watermarking on four different base- lines. Figure ba shows AcCorig reflecting the ability of each decoder to recover the original water- mark after re-watermarking across the four baseline models. The diagonal accuracies, representing the seff-re-watermarking scenario, are noticeably low, with an average AcCorig of approximately 50%, which corresponds to random guessing. As shown the figure, this behavior is consistent across all models. In contrast, in most cross-model cases, the original message still be recovered by the respective decoders. In addition, Figure (6b illustrates the average PSNR between water- marked and re-watermarked images. The PSNR values, all above 30dB, indicate that the degra- dation is imperceptible. This further underscores the seriousness of self-re-watermarking attacks, the modifications visually unnoticeable and effectively prevent the original watermark from being recovered.
MBRS. MODEL
0.484
1.000
1,000
1,000
MDRS MODEL
21.171
35.249
31.521
32.007
Encoding Model
ARWGAN MODEL
3,800
6.512
3.7/9
0,771
Encoding Model
ARVGAN MODEL
31,
37.290
32.52/
35.080
HIDDEN_ MODEL
0.797
0.648
0.510
0.072
HIDGEN MODEL
MODENN
22.355
38.762
24.179
33.829
9,607
1.000
3.949
0.505
WFORMER
31.450
182
31,973
33,060
MORS MODEL
ARWASR MODEL
HIDDEN MODELL
WFROMERR MODEL
MORS MNOCLL
MENNSAN MODEL
HODOCH MOOCL
WTFOMMER MODEL
Ovenwnting Model
Overwriting Model
(a) Average Accwip of watermarks decoded from re- watermarked images
(b) Average PSNR (dB) between watermarked and re-
watermarked images
Figure 6: Analysis Overwriting Scenarios.
B PROOFS OF THEORETICAL RESULTS
B.1 PROBLEM SETUP AND NOTATION
Let:
X C [-1, be the space of normalized RGB images.
M = 12 the binary message space and M {-1, 13 bipolar version.
(condition)) denote the indicator function, equal to 1 if the condition true and 0 other- wise.
I|so denote the lo norm on images and vectors; unless otherwise stated, norms are loo.
m E M the original watermark and m' E M the adversary's 's target watermark.
æ the clean input image; Iw E X' the watermarked image with m; Fnd E X the overwritten image.
14

---

Published as a conference paper at ICLR 2026
Encoder (E).
E: R:Xx M M
Iw E(x, m).
(14)
Decoder (D).
D:X-R',
= = sign(D,(()) E (-1.1}.
(15)
(If a binary output is needed, use m.(x) = (x) +1 E {0, 1}.)
Overwrite distortion.
6x
| 20oloo
(16)
Clean logits and margins.
(x, m) (F( m)),
A,(x, my (x m)
(17)
Thus A, > 0 means bit i is correctly signed on with (signed) margin A..
Nominal decoder error.
Erec
sup
T. 1( (igg((((zr + m.)
(18)
2.m
1=1
The adversary can perform a self-re-watermmuking attack OSaW by overwriting an already watermarked image to produce x'y:
Self-Overniiting Attack
Tng Osaw (E(x, (E(r,m): E(z,,,')
where m' * ((m)
(19)
B.2 LIPSCHITZ CONSTRAINTS AND ASSUMPTIONS
1. Decoder Lipschitzness (analysis norm loo). There exists upper bound Kp such that for all æi, 22 E X.
D((x)) lo < KD ||= - x2|1,0
(20)
In practice, K can be global constant (conservative) or a data detandeenndent local estimate measured along the path from Fue Fnd!
[ID(xw))) (Iww)loo
KD
(21)
|| Fw lloo
2. Positive clean margin. The minimum signed margin across all images and bits, which guarantees that every bit is correctly decoded in the absence of an overwrite:
Amin = inf Ai m) > 0 2.W,
(22)
This quantity measures the worst-case "safety buffer" for the decoder logits, i.e., the small- est distance of any bit logit from zero under clean conditions.
In our watermarking framework, the assumptions of decoder Lipschitzness and positive clean mar- gins are incorporated and empirically enforced through architectural and training design. Spectral normalization all convolutional and linear layers of the models constrains the layer-wise operator norms, effectively bounding the decoder's sensitivity to input changes and supporting the Lipschitz assumption. Positive clean margins are encouraged by the binary cross-entropy loss for nominal recovery, adversarial robustness losses, and noise augmentations, which collectively push decoder logits away from zero under both clean and perturbed conditions. These mechanisms ensure that the assumptions hold empirically for the training and test distributions.
15

---

Published as a conference paper at ICLR 2026
B.3
THEORETICAL ANALYSIS
Lemma (Per-logit overwrite bound). For any (a, m, m') and Twr - (E((2, m()())
[I - -D(w))l S KD 000
(23)
Consequently, for each bit i,
Di(ww') - (iwww) S KDdx
(24)
Proof. As per assumption 1, the decoder D is KnsLipschitz with respect to the 6o0 norm. Then for any two inputs 21, 22 E X have
[1((1)) bx S KD|l=1 x2|100
The overwrite distortion was defined as
800 = 1: xwlloo
Therefore,
[D(x')) lloo S KDd
Since the foo norm of the decoder difference corresponds to the maximum per-bit logit deviation, this inequality implies that every logit changes by most K under overwriting.
Proposition 1 (Per- bit robust condition). Let A, m)) be the clean margin of bit i If
A > Kp &
then cannot flip under the overwrite, i.e.
sign (Di(zw)) sign (Di(Iw)) m
Proof. Write
D1(xw() = Di(Iw) te,
By Lemma I
the perturbation is bounded:
leil S KD doc.
Since the clean margin satisfies
m2 m,Di(Iw) = A, KD 600
we obtain
my D2(w) m: mm:(D((m)) + es) A, mce 2 A, leal 0
Hence, the bit i's sign remains unchanged under overwrite.
Theorem (BER upper bound). For a given triplet (æ, m, m') with overwrite aw', the error rate satisfies
L ((A m) S KD8x)) + Erec
BER(2, m,mmm m²) <
Σ
(25)
L
bit flips if In particular, if KD8 < A Amin then
BER(I, m') S Erec
(26)
Proof. Let
= Di(Iirr) - D.(I.w):
A = =mDD((In)
m; (arrr) 50
16

---

Published as a conference paper at ICLR 2026
Substituting gives
m, m,D,(Tw.) = mm,(Di(ww) + +e,) = =A + m,e
Thus, the flip condition is
A + m,e; 00
|esl A
By Lemma each logit deviation is bounded:
|es1 S KD d
Therefore, sufficient condition for a possible flip is
A KD 830
Counting all such bits in the worst case and adding the nominal clean emor rate yields the bound. If
KD 8. < Ami
then no additional flips can occur beyond nominal errors.
Corollary (Local, data-dependent tightening). Replacing Kn by the local, attack-path constant KD,ooo (Tw - Dw)) yields the tighter bound
BER(x, m. m') - I(AN(E S Koo 800) + Erec
1 L
(27)
i=1
Corollary (Perfect recovery under margin condition). If = and
KD d00
Amin
then no bits flip under overwrite, and hence
BER(Z, m, m') = 0 for all (x, m')
B.4 EMPIRICAL ESTIMATION OF KEY QUANTITIES
In this subsection, empirically estimated 8 Amin and Kp D. Joc validate the theoretical sumption. All quantities were measured in the ||- ||/ norm for consistency with the formal analysis. KDoo was computed per image defined in Equation 2T] This estimation of the key quantities of our system was done over 3000 sets of images when re-watermarked using our Encoder with the post-processing module. The distributions for Amia and Dioc are given in Figures 7a and 7b respectively. Table 2 summarizes key statistics for the evaluation of A,, K Kp. 800, and the nominal decoder error over the dataset of 3,000 images. For each metric, the 5th percentile, me- dian, and 95th percentile are reported in Table 2 The median margin Amin = 3.41 indicates that the original watermarks are embedded with a strong separation, while the median local Lipschitz constant K D,,u = 4.38 quantifies the typical sensitivity of the decoder to image perturbations. The average bit accuracy is near 100% after overwriting, as shown Figure 2 across the dataset. This demonstrates that the decoder reliably preserves the original message under watermarrnn conditions.
Table 2: Summary statistics (5th percentile, median, 95th percentile) for A,, KD dec, and Nom- inal Decoder Error.
Metric
5th Percentile
Median
95th Percentile
Amin
1,8535
3.4048
4.6087
K Dlee
3.0627
4.3764
5.9426
doc Erec
0.9999
1.000
1.000
0.000
0.000
0.000
C ADDITIONAL DETAILS ON EXPERIMENTAL SETTINGS
The value Appips was picked as 0.5, corresponding to empirical evaluation using trained models at various Atpips settings. The results with various Aipipe settings are given in Table 3 As per the Table, Alpips as 0.5 gives a good balance of visual fidelity and robustness. Moreover, the adaptive weight adjustment algorithm used during training is given in Algorithm
17

---

Published as a conference paper at ICLR 2026
350
300
300
250
250
Frequenty
Fequency
200
150
150
100
100
50
2
7
8
(a) Distribution of Amin over 3,000 images.
(b) Distribution of Kp,toc of the decoder.
Figure 7: Comparison of Amin and the empirical Lipschitz constant distributions.
Algorithm Adaptive Weight Adjustment
Epoch r, BER on clean decode ber dec, BER after overwrite ber over, optional previous weights prev_w, smoothing factor max epochs R Ensure: Updated weights w = (Aipips: Arecs )
Require:
1:
2: dec conf t- min bee_
0.2
ber_over .05
3: over .oof +- min
0.2
4: trans dec_conf + over over-conf
5: epoch.prog + min
R
6: 0,5 epoch.prog
+ 0.5 trans-ready
7: Define Alpipe (a) t- 4.0 5.5
8: Define Aree (a) <- 6.0 3.5 a
9: Define Arob (a) t 5.0 1.0
10: target.lpips +- Atpip((a)) (a:)
11: target.rec + Xvec
largel.rob Areat (a)
13: if prev_w is None then
prev + target
15: end if
for all l E (Mpppps: Aree, Arob) do
17: wik] t- prev_w + s) tar
18: end for
19: return
18

---

Published as a conference paper at ICLR 2026
Table 3: LPIPS validation results: Visual Quality and Robustness under different distortions.
Visual Quality
cCCelenn (%)
ALMPS
PSNR (dB)
SSIM
JPEG (50)
Gaussian Blur (2.0)
Dropout (30%)
Cropout (30%)
Crop (3.3%)
0.3
32.39
0.97
99.63
99,90
99.93
99. 99.88
99.61
0.5
34.03
0.97
95.06
99.66
98.90
98.14 14
99.85
0.7
39.51
0.99
88.08
99.15
99.48
99.53
92.06
C.I ADVERSARIAL SETUP
The PGD-based adversarial attack was scheduled using curriculum learning during training. Specif- ically, the perturbation budget (c) and step size (a) are adaptively adjusted training progresses. Before the start epoch, both values remain near zero to ensure stability; between the start and ramp epochs, and a increase linearly to their maximum values; and after the ramp phase, they are fixed at their predefined maxima. The maximum perturbation budget was set to e 0.05, and the maximum step size was set to 0.009. The number of iterations was fixed at 50 to balance computational cost with providing the model sufficient exposure to a reasonable attack strength during training. This gradual schedule enables the model adapt progressively stronger attacks while maintain- ing training stability.
C.2 SOURCE REPOSITORIES OF EVALUATED MODELS
The SOTA models along with the weights evaluated in this work obtained from the repositories provided by the respective authors and used under their default configurations:
1. HiDDeN:
2. MBRS: httpppppp//..thb.oooo///u/t////
3. Stttte//sstttuu.ooo//cccoooeeeep
4. AWWGG///itta////ttt.t..o///////a
5. //F.Luu/E....p/////tttoooooooaaa ooa.aa/gggg.ooooooooooeeeeee
6. VMt.:httppss/gghhhh..ooo///111:/
D PERFORMANCE AGAINST ADVERSARIAL SELF-RE- WATERMARKING
D.1 FURTHER ANALYSIS ON PERTURBATION BUDGET (c) FOR THE PGD ATTACK
We selected the perturbation budget for the PGD-based attack such that the attacked image main- tains minimum PSNR of 30 dB relative the original watermarked image, corresponding the threshold for acceptable paperceptibilityySubheeh termine this, we empirically evaluated the PSNR of the watermarked images under attacks with varying values of We then identified the values of for which at least 90% of the attacked images had PSNR above 30 dB. From this subset, we chose the maximum e assess the robustness of our watermarking model against PGD-based attacks. The 10th percentile PSNR function of is shown in Figure Sal
& Mankar 2020 Zhang et al. 2024). To de-
Figure shows the bit accuracy under the PGD-based attack for varying values of the perturbation budget& 6. As exceeds 0.05, the model's performance begins deteriorate and the bit accuracy decreases. Although increasing allows the adversary attempt stronger perturbations, the original watermark remains partially recoverable, and the adversary unable to fully embed the adversarial watermark.
D.2 ADVERSARIAL MODEL
We trained two adversarial models on the MIRFLICKR dataset using a learning rate of 0.01. The models differ in their of the robustness loss:
Baseline Adversarial Model (BAM): Trained with the full algorithm, including the ro- bustness loss term.
19

---

Published as a conference paper at ICLR 2026
32.0
percentlle PSNA (dB)
31.5
1.0
31.0
Mcan Bit Accuracy
0.8
30.5
0.6
30.0
29.5
0.4
29.0
0.2
ACCav
23.5
0.0
0.01
0.02
0.03
0.04
0.05
0.06
0.01
0.02
0.03
0.04
0.05
0.06
(a) 10th percentile PSNR PGD perturbation bud- get (c). dashed line indicates the 30 threshold used to select e.
(b) Bit accuracy of original (AC (ACCorig) and adversar- watermark (ACC.av) under PGD attack for vary- ing c.
Figure 8: Comparison of PSNR and watermark bit accuracy under varying PGD perturbation bud- gets.
Ablated Model (AM): Trained using the same algorithm, but with the robustness loss component removed.
Table repporss the decoder's ability to recover the original watermark after attacks from each adver- sarial model.
Table 4: ACCorig of the proposed model after attacking with different overwriting models
Overwriting Model
ACCorig
Algorithm
Post Processing
BAM
1.00
BAM
X
1.00
AM
1.00
AM
X
0.99
The performance comparison these models, including visual quality and the ability to recover is presented in Table
watermarkl (W1) both before and after
Table 5: The performance of the developed adversarial models in terms of visual quality and message recoverability.
Adversarial Model
Visual Quality
Bit Accuracy
Model
Postprocess
PSNR
SSIM
ACC
ACCorig
BAM
34.60
0.97
1.00
1.00
BAM
X
33.00
0.97
1.00
1.00
AM
V
41.81
0.99
1.00
0.50
AM
X
38.96
0.98
1.00
0.59
E MULTI-STAGE RE-WATERMARKING ATTACK
This section extends the discussion beyond direct malicious use of the watermarking models by evaluating an adversary capable performing multistage re-watermarking attacks. While our work in watermarking focuses direct malicious re-use of encoders, real-world adversaries may attempt more sophisticated strategics, such as attacking watermarked images with pracc--rocessing attacks sophisticated removal attacks and subsequently re-embedding
Although multi-stage
20

---

Published as a conference paper at ICLR 2026
overwriting. in which the original watermark is first attempted to be removed and new bedded, does not strictly fall under the standard Encoder- Bncoder-BBased Self-Re- Watermarking attack, represents a realistic adversary strategy. In this section, go beyond our adversarial scope by ex- ploring such multi-stage removal and re-watermarking scenarios. This allows us to assess not only whether watermarks can be overwritten but also whether subtle cues remain that enable ownership verification even under complex adversarial manipulations.
E. ANALYSIS ON IMAGE PROCESSING ATTACKS FOLLOWED BY RE- WATERMARKING
This subsection evaluates the effect of applying multiple image noise operations followed by re- watermarking. We analyze the robustness of our model under a range of image processing attacks, and the results are reported in Table The findings show that our model remains robust under these attacks, followed by self-rewe rewatermarkiing
Image Processing Attack
ACCorie
JPHG(80)
95.09
Gaussian Blur (1.0)
99.99
Cropout (10%)
96.07
Dropout (10%)
99.96
Gaussian Noise (1.0)
100.00
Histogram Equalization
99.88
Crop (3.5%)
99.98
Rotate (10")
94.33
Horizontal Flip
99.53
Vertical Flip
99.45
Table Analysis on various inage-proeessing attacks followed by seff-re-watermarking
E.2 ANALYSIS ON WATERMARK REMOVAL AND RE-WATERMARKING
In this scenario, an adversary first attempts to completely remove the watermark and then re-embeds a new watermark using the same encoder. We empirically evaluated this scenario using CtrlRegen+ (Liu et al., 2025), state-of-the-art method that demonstrates strong performance for removal at- tack under both low and high-perturbation watermark settings. The method controls the amount of removal by adjusting the step size. We evaluated
model at step sizes of 0.3, 0.5, and 0.7. The corresponding results are presented in Table [ The results indicate that overwriting can in- deed be successful after the watermark is removed. However, the visual quality of the resulting images degraded, as evidenced by lower PSNR and SSIM between the watermarked images and the genoved-and-re-wateen watermarked images. Figure illlustrate that although the semantic informa- tion is preserved, the attacked images are blurred and lose color consistency compared with the watermarked images. This is also highlighted by low SSIM scores. Tigure the watermarked images with the attacked images at different step sizes (0.3, 0.5, 0.7). The removal of the watermark also leaves behind faintly colored artifacts in the center of the image. This suggests that even the watermark is removed and re-embedded, the original owner can still detect perceptual changes, providing mechanism to assess whether the content has been altered.
It is important to note that the current study primarily focuses on the direct malicious re-use of en- coders for halfere-watrr attacks. The model's performance under more complex multi-step adversarial scenarios, involving removal followed by re-embedding, is not fully explored. Neverthe- less, our preliminary evaluation demonstrates that perceptual degradation in such cases provides an additional cue for ownership verification. Our future work will focus exploring strategies to mit- igate multi-step re- watermarna processes, such as adversarial removal followed by re-embedding of the watermark.
21

---

Published as a conference paper at ICLR 2026
Figure 9: The effect of removal attack on watermarked images. The watermarked image is shown at the top. The attacked images corresponding to step sizes 0.3, 0.5, and 0.7 are displayed in rows 2, 3, and 4, respectively. Please zoom in for closer look.
22

---

Published as a conference paper at ICLR 2026
Table 7: Performance metrics at different steps of removal attack
Step
ACCadv(%)
ACCorig (%)
PSNR
SSIM
0.3
78.34
68. 68.11
23.27
0.72
0.5
87.41
0.65 56.97
21.85
0.7
90.83
53.00
20.50
0.59
F ADDITIONAL EXPERIMENTS
F.1 EVALUATION ROBUSTNESS AGAINST IMAGE PROCESSING ATTACKS
To complement this quantitative analysis, Figure T0 presents box plots of bit accuracy distribu- tions under pixel-wise distortions (e.g., Gaussian noise, salt-and-pepper noise), while Figure TT illustrates performance under geometric attacks (e.g.. StirMark-style elastic deformation (Petitcolas et al. 1998), rotation, flipping, and scaling). The proposed model consistently shows low vartance across the test images, underscoring its stability under real-world perturbations.
1.0
0.9
Bit Accuracy
JPEG(50)
Gauss. Blur(2.0)
Drapout( 300%
Med Blur(7)
Salt&Pepper( 3)
Gauss. Noise(S)
Saturation 8)
Hue(0.1)
Sharpening( 150)
Contr.Ad]. (1.2)
VCorrection(0..3 ()
HPF&SSarpentO..5 0.55)
UniformBlur(7)
Hist.
Brightness(1.55
ColorRedu.(32
Laplacian Removal(1
yCorrection(122
Attack Type
Figure 10: Bit accuracy distribution under pixel-wise distortions.
To further contextualize the robustness of the proposed model, we compared its performance against baseline model that uses the same architecture but without spectral normalization. As shown in Figure [2] the proposed method consistently outperforms the baseline across varying intensities of JPEG compression, Gaussian blur, dropout, and cropping. The baseline exhibits marked decline in accuracy as distortion severity increases, particularly under aggressive cropping and dropout. In contrast, the spectrally normalized model maintains stable performance under these conditions. This comparison reinforces the practical effectiveness of the proposed design in maintaining watermark integrity under diverse and challenging conditions. Further, Figures 10 and IT] demonstrate that the proposed model achieves higher median bit accuracy and exhibits significantly lower variance under different pixelwise and geometric perturbations.
Furthermore, the proposed model is evaluated on additional benchmark datasets, CelebA (Liu et al., 2013). MIRFLICKR-IM (Huiskes Lew] 2008), and ImageNet (Deng al. 2009), to assess its generalizability. For each dataset, 3,000 images were randomly sampled. The visual quality of the outputs and the model's robustness against commonly studied image processing attacks are sum- marized in Table 8 The proposed model achieves consistently high visual quality across multiple datasets, with PSNR around 33-34 dB and SSIM near 0.97. also demonstrates strong robust- to various distortions, maintaining under Gaussian blur, dropout, cropout, and small cropping, highlighting its generalizability across diverse image distributions.
94% accuracy under JPEG compression and over 99%
23

---

Published as a conference paper at ICLR 2026
1.00
0.95
Bit Accuracy
0.90
0.85
0.80
0.75
Cropout(30%)
Cropt3.5% (35%)
Rotate(10")
HFlip
VFiip
Scale(0.8) 8)
Scale(1.2)
ElasticDeform. (5.2)
RowGColDeeete(22.2
Resizet/Resample(O.3
Attack Type
Figure 11: Bit accuracy distribution under geometric distortions.
Table Visual Quality and Robustness (%) across Datasets.
Studies
Visual Quality
ACCoton (%)
ACCorig
JPEG
Gaussian
Dropout
Cropout
Crop
Self
PGD
PGD
PSNR (dB)
(50)
Blur (2.0)
(30%)
(30%)
(3.5%)
Re-embed
Moderate
Strong
COCO
34.03
0.97
95.06
99.66
98.90
98.14
99.85
100.00
99.95
99.37
MIRFLICKR
33.48
0.96
94.46
99.48
98.81
97.75
99.68
100.00
99.76
98.85
CELEBA
34.55
0.96
95.17
99.74
98.57
97.95
99.91
99.87
99.23
99.10
ImageNet
33.65
0.97
94.65
99.58
98.71
97.73
99.80
100.00
99.81
99.09
24

---

Published as a conference paper at ICLR 2026
1.0
0.9
0.9
8it Accuracy
Accuracy
0.8
0.8
0.6
Baseline
Baseline
Proposad
Proposed
0.5
0.5
70
0.5
1.0
1.5
Quality
JPEG
(b) Gaussian Blur
0.9
Bi Accurary
Accuracy
0.8
0.8
0.7
Baseline Proposed
Base
Proposed
0.5
20
30
40
50
Drapout Percentage
Crop Percentage
(c) Dropout
(d) Crop
0.9
0.8
Bit
0.7
Proposed
0.5
10
20
30
40
Cropout Percentage
(c) Cropout
Figure 12: Robustness evaluation under different distortions. (a) JPEG compression. (b) Gaussian
blur. (c) Dropout. (d) Crop. (e) Cropout.
25

---

Published as a conference paper at ICLR 2026
F.2 RESOURCE UTILIZATION
Table presents a comparison of FLOPs and trainable parameters across several deep learning- based watermarking models. Despite the high parameter count (37.09M) from fully connected (FC) layers used for message up- and downsampling. the model's ss computational cost remains low (7.73 GFLOPs), since most FLOPs are incurred by convolutions over spatial feature maps rather than the low-dimensional FC operations. Although training may take longer, the model provides fast infer- ence and strong watermarking performance. Experimental analysis shows that encoding is achieved at 43.97 images per second, while decoding reaches 607.54 images per second under normal load conditions.
Table 9: Resource Utilization
MODEL
FLOPS (G)
Trainable Parameters (M)
HiDDeN
6.72
0.41
MBRS
13.35
5.80
ARWGAN
24.22
2.30
WFORMER
14.83
1.72
OURS
7.73
37.09
F.3 SCALABILITY TO HIGHER RESOLUTIONS
We further evaluated the proposed architecture using higher image resolution and payload size, set- ting the image dimensions to 256 x 256 and the payload to 64 bits. The empirical evaluation shows that the model's performance remains consistent with that of the 128 x 128, 30-bit configuration, thereby confirming the scalability of the proposed approach. The average visual quality was as- sessed using PSNR (32.72 dB) and SSIM (0.98). In addition, the model demonstrates the ability to withstand self-overwriting when the same encoder is used, ensuring reliable recovery of the original message even if it is overwritten. Furthermore, analysis under PGD attacks revealed that 99. 99.94% of the original message could be recovered at the moderate level, and 99,86% at the strong level. A detailed robustness evaluation against common image processing attacks is provided in Table 10
Table 10: Robustness performance comparison
JPEG
Gaussian Blur (2.0)
Dropout
Cropout
Crop
(50)
(30%)
(30 %
(3.5 %
99.06
99.78
96.28
98.24
97.63
F.4 CROSS MODEL RE- WATERMARKING
In this subsection, we analyze the robustness our system to withstand cross-model overwriting. Table I1 reports Accorg after the images encoded by different watermarking models. The results indicate that the original watermark can be effectively recovered by our model even under cross- model overwriting.
Model
ACC
SSL
100.00
WFORMER
99.35
HiDDeN
99.23
MBRS
99.52
ARWGAN
99.23
VINE
100.00
Table 11: Robustness of our model to cross-model overwrites
26

---

Published as a conference paper at ICLR 2026
F.5 ABLATION STUDY
In this subsection, we evaluate the impact of the post-processing module as well as the contribution of spectral normalization in the proposed system. We assess model performance both in terms of visual quality and the decoder's ability to recover the embedded watermark under benign and attacked scenarios. The quantitative results are summarized in Table The model trained without spectral normalization can successfully recover the original watermark after an adversarial attack, but fails do so under self-re- watermarking. This further confirms that spectral constraints enhance robustness and validate our design choices.
Table 12: Ablation Study Results
Visual Quality
ACCuri Affer moderate PGD
Model
PSNR
SSIM
ACCaeun
After SelrOw
Affer strong PGD
Proposed
34.03
0.97
100.00
100.0
99.95
99.37
Proposed w/o Post Processing
31.82
0.96
100.00
100.00
100.00
99,99
Proposed wlo Spectral Norm
30.40
0.94
99.90
76.33
99.57
98.90
Table 12 illustrates that although the post-processing module reduces message recoverability by very small margin, it provides boost in visual quality. This suggests that the decision to use the auxiliary post-processing module depends the scenario in which the watermarked images are used. can be enabled for fidelity focused applications where visual quality paramount and can be disabled for security focused applications where robustness and forensic recoverability are required.
G ANALYSIS ON THE BEHAVIOR OF THE SYSTEM
In this section, analyze the distortion that occurs when the Encoder attempts to apply watermark to an image that has already been watermarked. Fast Fourier Transform (FFT) analysis reveals that such re- watermarking introduces significant high greeffreyency artifacts, indicating substantial distor- tion. Similarly, pixel intensity histograms show shift in the distribution toward brighter regions, re- flecting altered image characteristics. This behavior is direct consequence of the training pipeline, which uses asymmetric optimization where the Encoder is guided by a Fidelity Loss to ensure the initial watermark remains imperceptible, while the visual quality of the re-watermarked image is not optimized. Instead, the re- reteerrmarreed image is treated as adversarial case, with only the Decoder being optimized via a Robustness Loss to successfully recover the original message from heavily distorted image.
The images presented Figures
1 and 14 serve as illustrative examples of this phenomenon.
H EXTENDED RELATED WORK
To contextualize our study, this section reviews areas: advances in deep learning-based watermarking and the evolving adversarial threats and countermeasures.
H.1 DL BASED IMAGE WATERMARKING
Deep learning has become central image watermarking, enabling models learn optimal trade- offs between imperceptibility and robustness. Early approaches, such as Baluja et al. (Baluja 2017).
demonstrated the feasibility of steganography using DL, while HiDDeN (Zhu et al. 2018 intro- duced differentiable noise layers during training to simulate distortions like cropping, compression,
and blurring. To address non-differentiable or unknown distortions, Luo et al. (Luo al.) 2020)
proposed a distortion-agnostt framework using adversarial training and channel coding. MBRS
JJi et al. 202I) further improved robustness to JPEG compression by incorporating both real and simulated codecs into the training loop. Other advances, such as ARWGAN (Huang et al. 2023) employed attention- cost. Fernandez et al. (Fernandez et al. 2022) applied self- self-super learning with DINO (Caron (et al. 202I) to embed watermarks in semantically meaningful regions, improving removal and syn- chronization resistance, but being vulnerable cropping.
feature fusion to improve robustness, though often at high computational
27

---

Published as a conference paper at ICLR 2026
Figure 13: Comparison of the frequency components of the cover, watermarked, and re-watermarked images.
Cover Image Watermarked Re-Watermarked
500
400
Frequency
300
200
100
0
50
100
150
200
250
Pixel Intensity
Figure 14: Histogram illustrating the distribution of pixels the cover, watermarked, and re- watermarked images. All three exhibit similar overall pattern, although the re- weterrmmarked image shows a noticeable shift toward brighter pixel values.
28

---

Published as a conference paper at ICLR 2026
WFormer (Luo al. 2024 leveraged Transformer-based encoding and soft fusion to improve bustness and imperceptibility across standard distortions, but did not address adversarial or security- focused threats. Although VINE (Lu et al. 2025) developed robust model against image editing, the systematic vulnerability of self-re-watermrrking still remains. GANMarked (Singh et al. 2024) tackled security via key-hased protection layers, offering some protection against unauthorized traction, but showing limited resilience to compression and forgery. Some recent dual watermarking methods (Padhi al. 2024b) and adversarially trained visible watermarks attempt to counter model style-transfer attacks but lack robustness under encoder reuse. In contrast, VINE(Lu et al., 2025) focuses on addressing the specific vulnerabilities introduced by large-scale text-to- rext-to-image models by utilizing a powerful generative prior and frequency-based surrogate attacks to embed watermarks that are resistant to common image editing techniques.
Despite recent progress, a key vulnerabilityy remains underexplored: self-re-watermarkingg where the same encoder is maliciously reused to embed a new message into watermarked image. Most existing systems lack mechanisms to detect or resist such attacks due to open encoding pipelines. This highlights the need to shift focus from decoder-side defenses to encoder-level robustness against overwriting.
H.2 ADVERSARIAL ATTACKS IN DL BASED IMAGE WATERMARKING
Deep learning-based image watermarking systems face a range of adversarial threats that aim to compromise their security guarantees. significant yet underexplored risk relffre-watrmmarkinn. where an adversary reuses the encoder to embed new message into an already watermarked image. Unlike removal attacks (Zhao et al. 2024, An et al.) 2024), which attempt to erase the embedded watermark and thus invalidate ownership, re- watermarking introduces a conflicting ownership claim, fundamentally undermining the reliability of watermark -based provenance.
Kinakh et al. (2024) highlighted related risks by demonstrating that self-supervised watermarking techniques are prone to unauthorized transfer, suggesting the availability of model-related informa- tion itself potent attack vector. Further, existing literature has documented other adversarial vectors against watermarking systems. Forgery- threats (Hu et al., 2025) generate counterfeit ownership claims. These studies collectively underscore that adversarial pressure on watermarking systems is expanding in scope and sophistication.
Defensive strategies have been proposed to mitigate watermarking threats. For example, diffusion- based approaches (Zhu et al.] (024) introduce adversarial examples containing personalized water- marks obstruct unauthorized imitation by generative models. In addition, frameworks such as Watermark Vaccine (Liu et al. 2022) and Universal Watermark Vaccine (Chen et al. 2023) lever- age adversarial learning immunize models against the removal of visible watermarks. However, while much of this work focuses on defenses against removal attacks of visible watermarks, rel- atively little attention has been paid to defenses against overwriting attacks. Among these, [Chen et al. (2024b) designed scheme resistant to model-based overwriting, but its generalization beyond that scenario is limited. Padhi al. (2024a) proposed natermaitnmn method that provides robustness against surrogate overwriting attacks. Despite these efforts, robust countermeasures to selffre-watermarking remain largely absent.
Building on this analysis, we identify seff-re-watermarking as a critical yet overlooked vulnerability in existing watermarking systems. To directly address this gap, we propose a proactive framework that limits the model's sensitivity to input changes. This helps the developed models to defend against self-overwriting while preserving robustness against conventional image processing attacks. In doing so, approach broadens the scope of watermarking defense beyond removal-centric strategies and establishes resilience against the emerging threat of adversarial re- re-watermarking.
29

---

Published as a conference paper at ICLR 2026
I ADDITIONAL QUALITATIVE RESULTS
This section presents visual examples of the original watermarked images alongside their re- watermarked versions. These comparisons illustrate how the proposed method preserves the em- bedded message and maintains image quality even under self-overwriting attacks.
Figure 15: Qualitative Results: First column shows the original images, second column shows the watermarked images, third column shows the re-watermarked images, and the fourth column shows the difference between watermarked and re- watermarkke images.
LARGE LANGUAGE MODEL USAGE
Large language models were used solely to lightly polish the writing and improve grammar; they not used for generating ideas.
30


Reviews:
[{"review_id": "4bXSSfqNFv", "reviewer": "Reviewer_RuQL", "summary": "This paper introduce a novel deep watermarking framework to defend against this self-re-watermarking attacks.  This attack involves the use of the same encoder to embed a different message into an image that has already been watermarked, which renders the original watermark irretrievable.  Their approach combines Lipschitz constraints on the encoder-decoder sensitivity and re-watermarking adversarial training to limit model sensitivity to input distortions caused by re-embedding. Empirical results demonstrate the new framework’s robustness against self-re-watermarking and various image distortions while maintaining high visual fidelity.", "questions": "Please refer to weaknesses.", "limitations": "", "rating": 6, "confidence": 3, "soundness": 3, "presentation": 3, "contribution": 2, "strengths": "1. This paper proposes an innovative solution to address self-re-watermarking attacks. The integration of Lipschitz constraints and adversarial training provides a principled solution, supported by theoretical guarantees. \n2. The experiments are thorough and well-designed. they evaluate performance across multiple SOTA baselines, diverse attack scenarios  and standard image distortions. The results consistently show superior robustness while maintaining high visual fidelity.", "weaknesses": "1. Self-re-watermarking attacks appear to be resistible through engineered approaches. For instance, one could first verify whether an image has already been embeded watermark (based on decoder perplexity or by training a classifier). If watermarked, the watermark would not be re-embedded during subsequent attempts. Therefore, what advantages does this method offer compared to such approaches?\n2. The paper does not analyze composite distortion attacks, such as performing various noise attacks followed by self-re-watermarking.\n3. Appendix G demonstrates that re-watermarking results in a significant deterioration of image visual quality, yet the paper does not appear to analyze why this occurs. Furthermore, based on the cases presented in Appendix G, the new artifacts introduced after re-watermarking seem largely similar. Does this indicate limitations in the method?", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "w8E4DZHkSr", "reviewer": "Reviewer_QCmH", "summary": "The paper introduces a threat model called self-re-watermarking, where an attacker reuses the same encoder that embeds a new message into an already watermarked image. This can hijack ownership by making the decoder recover the attacker’s message.\nExperiments demonstrate that existing deep watermarking systems fail under such an attack. They propose a defense solution with Lipschitz constraints to preserve the original watermark.", "questions": "Can you add the framework and visualization results into the main paper for better readability?", "limitations": "", "rating": 4, "confidence": 4, "soundness": 2, "presentation": 3, "contribution": 2, "strengths": "1. The paper is well-structured, with a clear progression. \n2. They apply Lipschitz constraints to watermarking and directly training against self-overwriting is reasonable and practically motivated.\nUsing a composite loss that explicitly accounts for overwrite scenarios is aligned with the threat model.\n3. The paper compares against several well-known watermarking methods (HiDDeN, MBRS, etc).", "weaknesses": "1. Cross-model overwriting is more frequent than self-re watermarking for attackers to do in many real-world settings. Protectors , leaking the encoder is not accepted in practical applications. Protectors usually do not use the encoder after it leaks. The motivation or task setting is not reasonable. \n2. The defense mechanisms (Lipschitz awareness) are known techniques for bounding sensitivity; the novelty lies more in applying them to watermarking. This is fine but it means the new contribution is primarily the threat framing and integration, not a fundamentally new robustness technique.\n3. All experiments use 128×128 images and 30-bit payloads. Many watermarking applications use higher resolutions (e.g., 256–1024) and variable payload sizes (32–100+ bits). \n4. The boxplot can be refined for better visibility, such as setting different intervals for each sub-figure in Fig. 1.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "EaCS2cQzlq", "reviewer": "Reviewer_bosH", "summary": "This paper introduces the self-re-watermarking threat model, where an attacker can reuse the watermark encoder to embed a second watermark into an already watermarked image. The authors demonstrate that existing Encoder-Decoder-based watermarking methods are not robust against this type of attack and often recover the second watermark instead of the original one. To solve this problem, the paper presents a methodology that combines Lipschitz continuity and adversarial training to limit the effect of re-watermarking attacks. They evaluate this approach against both a simple self-re-watermarking attack and a gradient-based re-watermarking attack.", "questions": "Questions:\n1. I am struggling to rationalize how, with your method, the decoder is sensitive enough to embed a watermark, but not sensitive enough to re-watermark an already watermarked image. Did you look at the delta-K plot when comparing x and x_w? For this to work, it would need most points below the y = x line. However, if so, what makes watermarking the first time and re-watermarking so intrinsically different?\n2. In Section 5.4, you claim to evaluate the worst-case scenario, but use the local K bound rather than the global bound. Did you look at the global bound, and if so, did you find any meaningful difference?\n3. Did you study re-watermarking with a different watermarking scheme than the original watermark? \n4. This last question is both a question and a suggestion. Did you study how your methodology affects the performance of removal and forgery attacks? Intuitively, your GBA attack behaves similarly to an adaptive removal attack if one sets the target to be random bits, similar to [1]. \n\nSuggestions:\n1. The training objective and pipeline could be combined and shortened, with the lengthy description of the loss replaced with an equation. Also, Section 4.2 does not convey any meaningful information beyond what was already said earlier and could be removed.\n2. I think having Sections 3.3 and 3.4 come before Sections 3.1 and 3.2 would improve readability and clarity, making the paper feel less redundant.\n\nTypos:\n1. Line 89, no colon after follows and a trailing period after the bullet point.\n2. The word “based” in line 252 does not make sense to me.\n3. Line 442-443, there is a space missing after the period at the end of the sentence.\n\n[1] Lukas, Nils, et al. \"Leveraging optimization for adaptive attacks on image watermarks.\" arXiv preprint arXiv:2309.16952 (2023).", "limitations": "", "rating": 8, "confidence": 3, "soundness": 4, "presentation": 3, "contribution": 4, "strengths": "1. Novel threat model and contributions. It is akin to performing both a removal attack on the existing watermark and a forgery to add a new watermark.\n2. Empirically and theoretically motivated.\n3. Good results.", "weaknesses": "1. I did not find major weaknesses with the paper; using a second dataset for the experiments to show that the phenomenon is not dataset-dependent could be valuable.\n2. The notation should be included in the main paper rather than the appendix. The paper should be readable without the appendix, which is not the case without the notation.\n3. The writing could be improved. There is some redundancy in the writing that, if removed, could free enough space to include the notation in the paper. I provide more detail in the suggestions.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}]

Author rebuttal:

Decision: Accept (Poster)