Lightweight-Mark: Rethinking Deep Learning-Based Watermarking
Authors: Yupeng Qiu
Han Fang
Ee-Chien Chang
Venue: ICML 2025 poster (2025)
Keywords: computer vision
deep learning-based watermarking
Primary area: deep_learning

Abstract: Deep learning-based watermarking models play a crucial role in copyright protection across various applications. However, many high-performance models are limited in practical deployment due to their large number of parameters. Meanwhile, the robustness and invisibility performance of existing lightweight models are unsatisfactory. This presents a pressing need for a watermarking model that combines lightweight capacity with satisfactory performance. Our research identifies a key reason that limits the performance of existing watermarking frameworks: a mismatch between commonly used decoding losses (e.g., mean squared error and binary cross-entropy loss) and the actual decoding goal, leading to parameter redundancy. We propose two innovative solutions: (1) Decoding-oriented surrogate loss (DO), which redesigns the loss function to mitigate the influence of decoding-irrelevant optimization directions; and (2) Detachable projection head (PH), which incorporates a detachable redundant module during training to handle these irrelevant directions and is discarded during inference. Additionally, we propose a novel watermarking framework comprising five submodules, allowing for independent parameter reduction in each component. Our proposed model achieves better efficiency, invisibility, and robustness while utilizing only 2.2\% of the parameters compared to the state-of-the-art frameworks. By improving efficiency while maintaining robust copyright protection, our model is well suited for practical applications in resource-constrained environments. The DO and PH methods are designed to be plug-and-play, facilitating seamless integration into future lightweight models.

Lightweight-Mark:
Rethinking Deep Learning-
Watermarking
Yupeng Qiu
Han Fang
Ee-Chien Chang'
Abstract
1. Introduction
Digital watermarking is crucial for protecting the copyright of various digital assets, including images, videos, and 3D content. Typically, digital watermarking involves two main tasks: information hiding and extraction. In this process, digital media owners conceal secret information within the digital media, which can later be extracted to authenticate copyright ownership. In this process, two crucial properties need to be considered: 1) invisibility, which requires that the visual quality of the digital media does not significantly degrade after embedding secret information, and 2) robust- ness, which ensures that even when watermarked digital media encounter various distortions, the embedded informa- tion can be accurately extracted (Wan et al., 2022; Singh, 2023).
Deep sarming-based watermarking models play a crucial role in copyright protection across various applications. However, many righ-performance models are limited in practical deployment due to their large number of parameters. Meanwhile, the robustness and invisibility performance of existing lightweight models are unsatisfactory. This presents pressing need for watermarking model that combines lightweight capacity with satisfactory performance. Our research identi- fies a key reason that limits the performance of existing watermarking frameworks: a mismatch between commonly used decoding losses (e.g.. mean squared error and binary cross-entropy loss) and the actual decoding goal, leading to parame- ter redundancy. We propose two innovative solu- tions: (1) Decoding-orienter surrogate loss (DO), which redesigns the loss function to mitigate the influence of iecoding-irrelevant optimization di- rections; and (2) Detachable projection head (PH), which incorporates detachable redundant mod- ule during training to handle these irrelevant direc- tions and is discarded during inference. Addition- ally, we propose a novel watermarking framework comprising five submodules, allowing for inde- pendent parameter reduction in each component. Our proposed model achieves better efficiency, in- visibility, and robustness while utilizing only 2.2% of the parameters compared to the state-of-the of-the-ar art frameworks. By improving efficiency while main- taining robust copyright protection, our model is well suited for practical applications in resource- constrained environments. The DO and PH meth- ods are designed to be plug-and-plan facilitating seamless integration into future lightweight mod- els.
In recent years, with the development deep learning, many deep learning- based watermarking models have emerged, which utilize complex architectures improve performance (Liu et al., 2019; Zhang et al., 2021; Jia et al., 2021; Ma et al., 2022; Fang et al., 2023). However, these nigh-performance models often come with a large number of parameters and huge computational demands, limiting their practical de- ployment. As a result, fields such as diffusion models (Fer- nandez et al., 2023; Zhao et al., 2023b) and Neural Radiance Fields (NeRF) (Luo et al., 2023; Jang et al., 2024) have cho- sen to adopt lightweight watermarking models like HiDDeN (Zhu et al., 2018) for copyright protection, as their back- bone models are already large and computationally intensive. Although lightweight models are easy to deploy, they of- ten sacrifice robustness. This limitation impedes effective and efficient copyright protection in numerous fields, espe- cially where computational resources are limited, highlight- ing urgent need for watermarking models that combine lightweight capacity with satisfactory performance.
This paper aims to design and train a lightweight water- marking model with state-of-the-ar performance. To un- derstand the potential reasons limiting the performance of lightweight watermarking models, we investigate the de- coding process. For the decoding task, accuracy serves prevalent evaluation metric. However, the straightfor- ward empirical risk mininization (ERM) formulation for accuracy includes minimizing the 0-1 loss, which is com- putationally intractable. Consequently, researchers resort
"Corresponding Author. 'National University of Singapore. Correspondence to: Han Fang <fanghan @ eus...u..g)>
Proceedings of the ndnd International Conference Machine Learning. Vancouver, Canada. PMLR 267, 2025. Copyright 2025 by the author(s).

---

Lightweight-Mark: Rethinking Deep Learning-Basee Watermarking
to differentiable losses (e.g., mean squared error or binary cross-entropy loss) as tractable surrogate losses, transform- ing the decoding task into reconstruction task (Zhu et al., 2018; Liu et al., 2019; Zhang et al., 2021; Jia et al., 2021; Ma et al., 2022; Fang et al., 2023). The feasibility of op- timization comes at the expense of model efficiency. Our observation reveals a mismatch between the actual decod- ing goal and the optimization objectives of the commonly used decoding losses. By dissecting the decoding losses into deflation, inflation, and regularization losses, we iden- tify that decoding accuracy depends primarily on the de- flation loss. However, inflation and regularization losses, while stabilizing training, inevitably consume model pa- rameters, negatively affecting the efficiency of lightweight models. To address this issue, we propose two methods. For the first method, we append an additional projection mod- ule to the lightweight model during training. This module manages deconding-irelevant optimization directions and is discarded during inference. In the other approach, we pro- pose a new surrogate loss to mitigate the negative impact of decoding-irreleeve optimization directions while ensuring stable training.
periments demonstrate the superiority of our approach over existing models in terms of invisibility, robustness, and effi- ciency.
2. Related Works and Preliminaries
2.1. Related Works
Image Watermarking Digital watermarking (Van Schyn- del et al., 1994) is widely used to protect copyrights and trace the origins of unauthorized copies. Invisibility and robustness crucial properties of digital watermarks. In pursuit of balancing invisibility and robustness, traditional digital watermarking algorithms often embed watermarks in mid-frequency domain coefficients. The commonly used do- mains include the discrete cosine transform (DCT) domain (Ahmidi & Safabakhsh, 2004), the discrete wavelet trans- form (DWT) domain (Daren et al., 2001), and the discrete Fourier transform (DFT) domain (Hamidi et al., 2018). With the advancement of deep learning techniques, deep learning- based watermarking models have received increasing at- tention for achieving a better trade-off between invisibility and robustness. The first deep learning- based watermarking model was introduced by Kandi et al. (2017), demonstrating the feasibility of using autoencoder convolutional neural net- works (CNN) for watermarking tasks. Subsequently, Zhu et al. (2018) proposed the Encoder-NoiseLayy -oseeaay-eaaeee Decoder (END) framework, pioneering end-to-end training and in- corporating a noise layer to enhance robustness against vari- ous distortions. Jia et al. (2021) introduced the Mini- Bai-h of Simulated and Real Jpeg compression (MBRS) training method and advanced Squeeze and-Excitation (SE) blocks (Hu et al., 2018) to improve robustness against JPEG com- pression. Ma et al. (2022) developed the Combining In- vertible and Non-invertiin Mechanisms (CIN), leveraging invertible neural networks for embedding and extraction, significantly improving invisibility and robustness. Fang et al. (2023) proposed the Flow-based Invertible Network (FIN), which explored the use of invertible structures as differentiable simulators for both white-box and black-box distortions, surpassing many state-of-the -he-tttttt END- wa- termarking models. However, in pursuit of better invisibility and robustness, the watermarking models have become big- ger, with increased computational complexity.
Moreover, previous works typically treat encoders and de- coders basic design units and often lack detailed cate- gorization of internal functions. This makes it challenging to conduct fine-grained ablation studies. To address this problem, we propose to subdivide encoders and decoders into smaller functional units and, for the first time, summa- rize a new deep watermarking framework consisting of five modules. We construct a lightweight watermarking model within this new framework using only transposed convolu- tion and convolution layers. Experimental results reveal that certain modules are crucial when facing specific distortions while contributing minimally to other distortions. This in- sight allows us to selectively remove non-essential modules, further compressing the model with minimal performance degradation.
The main contributions of this paper are summarized as fol- lows: 1) We are the first to identify the mismatch between the optimization objectives of the commonly used decoding losses (e.g., mean squared error and binary cross-entropy loss) and the actual decoding goal. Ablation studies confirm the presence and impact of this mismatch. 2) We propose the detachable projection head (PH) and decoding-orrenteed surrogate loss (DO) to mitigate the negative impact of irrele- vant optimization directions, enabling lightweight models to achieve state-of-the-art performance. 3) We introduce tine- grained deep watermarking framework with five modules. Our experiments analyze the roles of different modules un- der various distortions, enabling further model compression with minimal performance loss. 4) Our lightweight model will see broader application in other fields, especially where computational resources are constrained. 5) Extensive ex-
Knowledge Distillation Recently, deep learning has achieved significant success in many fields. These substan- tial advancements are mainly due to the massive number of model parameters. Although large-scale models exhibit bet- ter performance, the massive storage requirements and high computational complexity hinder their further deployment. Therefore, knowledge distillation (KD) has received signifi- cant attention, which aims to distill knowledge from a larger model (teacher model) into a smaller model (student model)
2

---

Lightweight-Mark: Rethinking Deep Learning- Watermarking
to achieve model compression (Hinton al., 2015; Kim et al., 2018; Mirzadeh al., 2020; Zhao et al., 2022). Al- though knowledge distillation has been successfully applied in various applications such as visual recognition, speech recognition, and natural language processing, the theoretical understanding of knowledge distillation is limited (Cho & Hariharan, 2019; Cheng et al., 2020), and the reasons for its success are not fully clear. Moreover, when there is a signif- icant difference in model architecture or size between the student model and the teacher model, this model capacity gap can degrade knowledge transfer (Mirzadeh et al., 2020; Gao et al., 2021). This implies that typically, the student model performs inferior to the teacher model. Therefore, obtaining a lightweight model with state-of-the-ar perfor- mance through knowledge distillation is challenging.
The Gap between Two Objectives As metric for mea- suring robustness, decoding error is straightforward. How- ever, minimizing Equation (I) using deep learning models is computationally intractable since it cannot be optimized by the gradient descent algorithm. Therefore, researchers mini- mize a differentiable surrogate loss to address this challenge. Typically, this chosen surrogate loss serves as an upper bound for the decoding error, and Bartlett et al. (2006) en- sured that minimizing this differentiable upper bound helps to reduce the decoding error. A commonly used surrogate loss is the mean squared error (MSE) loss, which can be represented as follows. For more detailed analysis of the binary cross-entropy loss (BCE), please refer to Appendix A.2.
1
L (I(() - Mi)²
MSE (g( M)
(2)
2.2. Preliminaries
This paper defines several key notions for clar- ity and consistency in subsequent discussions. The water- mark, denoted as M E {-1,1) and the extracted wa- termark, denoted Mex IR are both represented message sequences of length L. The cover image Ten, water- marked image Iw. and noised watermarked image Iuo are all RGB images that belong to RCxW* where W and H denote the width and height, respectively. .M C 1), and Mex S TR,,, denoted as the support of M and Mex. Teo. Iw. and Ino C RCCx xH, denoted as the support of loo. Iw. and Ino. Denote by f (M, + Iw the informa- tion hiding function, which embeds a secret message into a cover image. Denote by Ino - MMxx the informa- tion extraction function, which extracts a secret message from a noised watermarked image. These two functions are parameterized by deep neural networks. The indicator function 1 [evvent,, also known as the 0-1 loss, denotes an indicator function that outputs if event happens and O otherwise. Lvisual (Leo, ) MSE (Leo, Iw) is the visual loss used to ensure visual quality, whose goal is to make the watermarked image closely resemble the cover image.
Notations
However, minimizing the MSE loss does not perfectly match the objective of reducing the decoding error. To better un- derstand the impact of this gap on model performance, we dissect the MSE loss into seven components:
1 M)
MSE (g(Ino),
E
(Lo)
L
Exogularization
In
+ 2 ge ( (nn) -22
gr (Io))
Linctation
Low
Lww
L
2 (noo) -2
- 9o (Ln)) ) + > 9 gi(Lno) +L
(3)
1=1
Eetettation
The proof of Equation (3) is in Appendix A.I.
According to whether g: (Ino)) is correctly decoded (i.e., 9. (Nno) M₁ 0 O), we divide g(Tno) into two parts with lengths Lw and Ln- Additionally,
Robustness (accuracy) In the information extraction stage, the decoder g obtains the extracted watermark Mex from a noised watermarked image Ino. Researchers usually use accuracy or decoding error characterize the decoder's robustness. Maximizing accuracy is equivalent to minimiz- ing the decoding error. The decoding error can be defined as follows:
also divide ge(Tna) based on its sign (i.e., gi (Ino) > 0) into two parts with lengths L and L The symbols "W" and "R" represent "Wrong" and "Right", respectively, while "+" and "_" denote the positive and negative signs of g: (Tuo), respectiell.. The combination of "W(R)" and "+(-)" represents the parts of g(nno) that simultaneously satisfy both conditions.
The objective of penalizing incorrectly decoding bits is com- pletely allocated to the last three terms of Equation (3). To minimize the MSE loss, these three positive terms will con- verge to O. Thus, we named them as the error deflation loss Ldeflation- Minimizing Ldeflation by always outputting 0 for any input a shortcut that may lead to model collapse,
1 i
Error (1((n)),M))) = EE
Σ
(oo
M2 < <0}
1=1
Here (-) and M, denote the 7th bit in g(.) and M.
3

---

Lightweight-Mark: Rethinking Deep Learning-Basel Watermarking
Deep Learning-based Watermarking Framework
Encoder
module
Decoder
Noise Layer
FF module
NWIP module
ME module
Materarkaa
Waterwrledd Image Aee
Figure 1. The proposed deep learning-based framework comprises five modules. The encoder includes the image preprocessing (IP) module, the message preprocessing (MP) module, and the feature fusion (FF) module. The decnder contains the noised watermarked image preprocessing (NWIP) module and message extraction (ME) module. noise layer also introduced between the encoder decoder distort the watermarked image into noised version.
making it impossible decide whether the output cor- rect not. The two terms of Liuflation are both composed of correctly decoded parts ( (-))(-)). Minimizing Linflation does not directly reduce the decoding error; its primary function is to push correctly decoded gs (nno) away from the classification boundary O, thus preventing model collapse. The final term, Eregularizations also acts on the correctly de- coded parts and serves complement to Lintlation- It prevents unbounded growth of correctly decoded (, potentially leading to model output explosion. Among the three optimization directions, only Ldetlation directly con- tributes to the goal of the information extraction task. While Cintlation and Cregularization within the MSE loss only play positive role in stabilizing the training process, these ad- ditional optimization directions, inevitably occupy some model parameters, particularly limiting the performance of lightweight models.
the model's parameter size, resulting in a lightweight model that can still decode correctly. The projection head's main function normalization when considered separately from the backbone model. This means projecting the outputs of the backbone model into their corresponding label values. During training, the projection head does not care about the magnitude of the backbone model's ' outputs but requires these outputs to be distinguishable. If the backbone model's outputs are indistinguishable, the projection head cannot correctly project them, making it impossible to minimize the MSE loss. Therefore, when using MSE loss optimize the overall model, the MSE loss forces the projection head's outputs to be more accurate to their label values. In turn, the projection head forces the backbone model's outputs to more distinguishable by their label values, aligning well with the decoding goal. detailed presentation of the distri- butions of the decoded messages from both the backbone model and the projection head is available in Appendix D.9.
3. Methodology
The projection head consists of four identical projection blocks, and the structure of each projection block is shown in Appendix D.I. For the jth block, the input is M and the corresponding output is Mi+t1 which can be formulated as follows. The training and inference procedures of the detachable projection head method are illustrated in Fig. 2. More details can be found Appendix
In this section, we first address the limitations of the surro- gate loss identified in Section 2.2 from two perspectives to further explore the potential of lightweight models. Then, we introduce the roles of the five modules in the proposed new deep watermarking framework and illustrate the struc- ture a lightweight watermarking model built on this frame- work.
Mi+1 1
A, (M (Mppx) @ M + B, (M
(4)
3.1. Mitigate the Gap between Two Objectives
Detachable Projection Head this method, we continue use the MSE loss, which ensures the stability of the model during training. However, during the training phase, in- troduce additional Detachable Projection Head handle the redundant optimization directions that are unrelated to the decoding objective in the MSE loss. During inference, this Detachable Projection Head can be discarded to reduce
where @ denotes the dot product operation, and and B deep learning models. The total loss function LPH can be represented as follows:
LPH PH Lvisual X AP MSE (Mpex M)
(5)
Here, AP and AP are weights to balance the trade-off between invisibility and robustness.

---

Lightweight-Mark: Rethinking Deep Learning-Basse Based Watermarking
The Decoding Process of Detachable Projection Head Method
Training
Decoder
Projection Head
module
module
mi
Extracted Watermerk
Inferencing
Decoder
NWIP module
ME module
Estradedd
Nahed Watermarked Iuage
Figure The decoding process of detachable projection head method.
Oriented Surrogate Loss In this method, we refrain from using additional modules to stabilize training. Instead, we opt to mitigate the impact of irrelevant optimiza- tion directions from the MSE loss (for the implementation of BCE loss, please refer Appendix D.2). Ldetlation is directly responsible for reducing the decoding error by pe- nalizing incorrectly decoded bits. The deflation loss in this method is adapted from Ldellation in Equation (3), which is formulated as follows:
the deep watermarking model. Linttation in our method can be formulated as follows:
R n
Linflation (g(4no),
-
g. (.(nn))
Σ
ge ge(Inn)
Lw
The total loss function Lno can be represented as follows:
Ldeflation (9(4no), M) - 7 Σ gi(nn)) Σ Ti (no))
LDO -p
1 Livisnal > (Laeflatioo + Linflaation (8)
(6)
Here, XPO and Xpo weights balance the trade-off between invisibility and robustness.
We address the limitation in Liuflation by introducing a hy- perparameter e, named "safe distance".. This hyperparam- eter aims to mitigate the redundant impact of Linftation on the model and prevent output collapse. We recognize that Lintlation encourages correctly decoded bits close the de- cision boundary to move further away. However, lacks definition of "far enough", resulting in broad influence on all correctly decoded bits, including those already suf- ficiently far from the boundary. To address this issue, we define "safe distance" c. Only correctly decoded bits within a distance e from the decision boundary are consid- ered. Correctly decoded bits already more than away from the boundary are not subject to additional restrictions.
3.2. Proposed Framework
To delve deeper into the encoder and decoder, propose novel deep dearning-based watermarking framework com- posed of five modules, shown in Fig. 1. These modules provide a clearer functional division of the encoder and decoder, which has helped us find an efficient parameter allocation method when facing different distortions. divide the encoder into three parts: 1) The image prepro- cessing (IP) module, which aims to extract features from the original image comprehensively, facilitating subsequent feature fusion, such as the SE block (Hu et al., 2018) in MBRS (Jia et al., 2021) and De-END (Fang et al., 2022), or transforms image features into the frequency domain to enhance robustness, as seen CIN (Ma et al., 2022) using the Haar transform. The message preprocessing
By limiting the influence of Linflation to correctly decoded bits near the decision boundary, this approach reduces the unnecessary penalization of the model and prevents output collapse. Introducing the concept of a safe distance ensures the training stability while enhancing the performance of
5

---

Lightweight-Mark: Rethinking Deep Learning- Based Watermarking
(MP) module's primary task is generate message features that align in shape with the image features generated by the image preprocessing module. HiDDeN (Zhu et al., 2018) employs non-deep learning method by directly duplicating the messages. On the other hand, MBRS (Jia et al., 2021) and CIN (Ma et al., 2022) utilize deep learning methods based on transposed convolution layers. 3) The feature fusion (FF) module integrates the message features and image features to produce the final watermarked images. StegaStamps (Tancik et al., 2020) adopts UNet-like model for multi-scale feature fusion, while CIN (Ma et al., 2022) and FIN (Fang et al., 2023) employ multiple invertible neu- ral blocks for deep feature coupling. We divide the decoder into two parts: 4) The noised watermarked image prepro- cessing (NWIP) module is the first module directly facing the noise layer. Its role is to mitigate the impact of dis- tortions on the watermarked image and perform the initial extraction of message features from the noised watermarked images. 5) The message extraction (ME) module is used to further extract the messages from the preprocessed fea- tures and reshape them to match the shape of the messages. In previous decoder architectures, these two modules were often deeply coupled, requiring uniform dimensions for the intermediate features. By decoupling, we can investigate the roles of these five modules separately and selectively re- move non-essential modules to further compress the model. More detailed ablation experiments and analyses of the indi- vidual modules' impact on model performance are provided in Appendix D.3.
4.1. Model Size and Computational Complexity
To reduce the number of parameters and computational complexity, our proposed lightweight model only uses basic transposed convolution and convolution layers. The detailed model structure can be found in Appendix B.
Table I. Comparison parameter size and FLOPs with SOTA models. "Enc." and "Dec." denote the Encoder and Decoder, respectively. "Size (M)" refers to the number of parameters in millions (M), while "FLOPs (G)" indicates the computational com-
plexity in billions of floating point operations (GigaFLOPs).
Size (M)
FLOPs (G)
Method
Enc.
Dec.
Total
Enc.
Dec.
Total
CIN
7.25
36.01
36,01
16.56
17.91
34.47
MBRS
0.56
20.24
20.80
8.38
6.77
15.15
FIN
0.75
0.75
0.75
1.78
1.78
3.56
HiDDeN
0.19
0.27
0.45
3.10
4.29
7.39
Proposed
0.009
0.007
0.016
0.15
0.07
0.22
Model Size reduces the number of parameters compared state-of-the- art (SOTA) models, as shown in Table 1. Specifically, our model uses only 0.009M parameters for the encoder and 0.007M parameters for the decoder, resulting in total of 0.016M parameters. This is a substantial reduction com- pared to the other models: CIN (36.01M), MBRS (20.80M), FIN (0. (0.75M), and HiDDeN (0.45M). This drastic reduction in model size makes our model highly efficient in terms of storage requirements. The compact size is especially benefi- cial for deployment in resource- cesource-constrained environments such as mobile devices and embedded systems.
The proposed lightweight model significantly
4. Experiments
In this section, we demonstrate the significant reductions in model size and computational complexity achieved by our proposed lightweight model compared to previous works. Additionally, we validate the effectiveness of our proposed PH and DO methods in improving the model's invisibility and robustness. In practice, during training, we employ a Combined Noise technique, where the model is exposed to random noise layer in each mini-batch. This enables the model to learn robustness to multiple types of distortions at the same time. Additionally, during evaluation, we assess the model's s robustness separately under different noise lay- ers to demonstrate its general robustness. The Combined Noise Layer incorporates six different distortions: Gaussian Blur (GB) with standard deviation of 2.0 and a kernel size of 7, Median Blur (MB) with kernel size of 7, Gaussian Noise (GN) with a variance of 0.05 and mean of O, Salt & Pepper Noise (S&P) with noise ratio of 0. JPEG Com- pression (JPEG) with a quality factor of 50, and Dropout (DP) with drop ratio of 0.6. more detailed experimental setup can be found in the Appendix D.
Computational Complexity The proposed model also achieves a remarkable reduction in FLOPs (Floating Point Operations), which is a critical measure of computational complexity. The FLOPs for our model are: Encoder (0. Decoder (0.07G), Total (0.22G). In comparison, the FLOPs for the other models are significantly higher: CIN (34.47G), MBRS (15.15G), FIN (3.56G), and HiDDeN (7.39G). This indicates that our model not only requires fewer parameters but also operates with significantly lower computational complexity. This makes it suitable for real-time applications and scenarios where computational resources are limited
The proposed lightweight model excels in both storage ef- ficiency and computational complexity, making it highly practical solution for real-world applications. By signifi- cantly reducing the number of parameters and FLOPs, our model ensures that watermarking can be performed effi- ciently on devices with limited resources.
4.2. Invisibility and Robustness against Combined Noise
In Tables 2 and 3, the four watermarking Maaells-HiDDeN.. MBRS, CIN, and FIN-are are implemented based on the au-
6

---

Lightweight-Marrs Rethinking Deep Learning- Based Watermarking
Lightweight Model +MSE
Lightweight Model +PH
Lightweight Model +DO
HiDDeN
MBRS
CIN
FIN
co
w
R x10
Figure 3. Visual comparison of watermarked images. Top: cover image. Middle: watermarked image. Bottom: the magnified difference
w Ionl x 10 between the cover image and the watermarked image.
Benchmark comparisons on invisibility and robustness against combined noise. BCE, MSE, PH. and DO refer to the BCE loss, MSE loss, detachable projection head, and decoding-orienter surrogate loss.
Table 2.
PSNR
Dropout (%)
JPEG (%)
GN (%)
S&P (%)
GB
MB
Ave (%)
Method
(dB)
(%)
(%)
HiDDeN MBRS
27.28
74.59
74,63
77.36
77.81
77.17
75.28
76.14
40.72
99.76
98.85
97.68
99.95
99.89
99.38
99.25
CIN
40.31
99.78
86.01
97.39
100
99.84
99.58
97.10
FIN
41.58
99.80
99.90
96.46
99.99
99.97
99.56
99.28
Lightweight Model+BCE
39.11
99.55
97.04
96.04
99.79
99.80
98.80
98.50
Lightweight Mod
39.31
99.04
90.53
98.28
99.95
99.95
98.18
97.66
Lightweight Model+PH
41.67
99.99
98.92
97.21
99.99
99.96
99.59
99.28
Lightweight Model+DO
41.70
99.12
97.40
100
99.63
99.36
Table Benchmark comparisons on invisibility and robustness against combined noise. KD (-) represents the proposed lightweight model trained using knowledge distillation, where the proposed model serves the student model and (-) denotes the teacher model.
PSNR
Dropout (%)
JPEG
GN
S&P (%)
GB
MB
Method
(dB)
(%)
(%)
(%)
(%)
(%)
KD (HiDDeN)
27.20
65.06
75.89
75.40
73.82
75.39
74.52
KD (MBRS)
38.98
83.40
88.17
87.82
93.42
92.70
89.05
89.09
KD (CIN)
38.90
65.75
85.03
86.86
90.29
86.98
82.92
82,97
KD (FIN)
40.10
96.04
96.25
95.76
97.96
97.60
96.39
96.67
Lightweight Model+BCE
39.11
99.55
97.04
96.04
99.79
99.80
98.80
Lightweight Model+MSE
39.31
99.04
90,53
98.28
99.95
99.95
98.18
97.66
Lightweight Model+PH
41.67
99.99
98.92
97.21
99.99
99.96
99.59
99.28
Lightweight Model+DO
41.70
100
99.12
97.40
100
100
99.63
99.36
thors' public code. For the proposed lightweight model, we used four different training methods: BCE loss, MSE loss, detachable projection head (PH), and decoding-oriented surrogate loss (DO).
as a representation of visual quality. For additional metrics related to visual quality, please refer to Appendix D.5. The comparison performance under single noise with other models is reported in Appendix D.6. When using the orig- inal MSE BCE losses. the proposed lightweight model shows inferior performance compared to other state-of art (SOTA) large models such as CIN, FIN, and MBRS. This is evident from the average accuracy (Ave) values, which
Benchmark with SOTA deep watermarking models The benchmark comparisons in Table 2 demonstrate the performance various watermarking models under com- bined noise. Due to space constraints, Table uses PSNR

---

Lightweight-Mark: Rethinking Deep Learning-Basee Watermarking
Table Benchmark comparisons invisibility and robustness against diffusiionhassee attack.
t0.0
t=0.05
t=0.1
t=0.2
Method PS Acc( PSNR(dB) Acc(%) PSNR(dB) Acc(%) PSNR(dB) Acc(%)
PRGAI Attack:
MSE
29.11
99.21
28.90
99.02
28,47
98.67
27.59
98,61
PH
29.22
99.90
29.11
99.70
28.52
99.31
27.66
99.51
DO
29.79
100
29.53
99.12
28.97
98.82
28.03
98.57
DiffPure
Attack:
MSE
36.08
100
34.43
99.80
31.62
67.68
27.75
53.91
PH
36.21
100
34.48
99.80
31.64
69.24
27.86
56.26
DO
36.25
100
34.60
100
31.76
74.22
27.77
57.23
Table 5. Comparison of invisibility and robustness against combined noise by training with different components in MSE loss.
PSNRT (dB)
Dropout
JPEG
GN
S&P
GB
MB
Ave (%)
Method
(%)
(%)
(%)
(%)
(%)
(%)
repularizasion
85.47
49.67
50.08
50.40
49.81
50.25
49.91
50.02
Liniatioon
5.16
49.78
49.78
49.78
49.78
49.78
49.78
49.78
Ldcttation
40.62
99.75
91.83
98.19
99.91
99.60
98.56
97.97
MSE
39.31
99.04
90.53
98.28
99.95
99,95
98.18
97.66
DO
41.70
100
99.12
97.40
100
100
99.63
99.36
serve as an overall indicator of performance against com- bined noise. Although the lightweight model reduces pa- rameter and computational complexity, it fails to achieve the robustness of larger models when using MSE BCE losses. This highlights the inherent limitations of the lightweight model when applied with the original MSE and BCE losses.
corresponding teacher model in Table across various dis- tortions. This degradation becomes more pronounced as the disparity in model size between the student and teacher mod- els increases. This phenomenon underscores a limitation of knowledge distillation, where the effectiveness diminishes when there is substantial gap in model capacities.
The introduction of the detachable projection head (PH) and decoding-oriented surrogate loss (DO) methods significantly enhances the performance of the proposed lightweight model in terms of both invisibility and robustness. Both PH and DO methods lead notable improvement com- pared the MSE and BCE losses. PH Method: The detach- able projection head improves the robustness and invisibility of the model without increasing the model size during in- ference. The average accuracy reaches 99.28%, which is higher than the MSE and BCE methods. DO Method: The decoding-orienter surrogate loss not only achieves the high- est average accuracy of 99.36%, but also outperforms the other SOTA models including FIN and MBRS in terms of invisibility without adding any extra parameters or compro- mising efficiency. This demonstrates the effectiveness of the DO method in releasing the lightweight model's 's capability. The visual quality for these models shown in Fig. 3.
Among the student models, KD (FIN) performs the best, outperforming the lightweight model trained with MSE loss. This highlights the effectiveness of knowledge distillation in compressing model parameters and improving model ef- ficiency. However, despite the improvements achieved by KD, the superiority of the PH and DO remains consistent. Even with higher invisibility, the proposed methods consis- tently outperform KD (FIN) across all single distortions. In summary, while knowledge distillation can compress model parameters and improve efficiency, the PH and DO methods consistently outperform it. The proposed methods exhibit re- markable effectiveness enhaneing the lightweight model's performance, making them valuable tools for optimizing lightweight watermarking models for real-world applica- tions.
4.3. Invisibility and Robustness Against Diffusion-Bann -Based Attacks
Benchmark with knowledge distillation method Table illustrates the results obtained when training the lightweight model using knowledge distillation (Hinton et al., 2015), where our proposed lightweight model serves as the student model and larger models act as teacher models. It is ob- served that the performance of the student model, guided by knowledge distillation, tends to degrade compared to the
Unlike incorporating distortions as a noise layer during train- ing, we acknowledge that utilizing a diffusion model as a noise layer is impractical. However, the purification pro- cesses descrihed PRGAI (Zhao et al., 2023a) and DiffPure (Saberi et al., 2024) attacks both involve adding noise the watermarked image, followed by multi-denoising steps. To simulate this type of attack, we employed new composite
8

---

Lightweight-Man Rethinking Deep Learning Basee Watermarking
PRGAI
DiffPure
Cover Image
Watermarked Image
0.03
t-
0.1
t=
Attacked Images
Figure Visual comparison of images attacked by diffusion with different denoising time steps t.
noise layer: the watermarked images first pass through Gaussian noise layer, followed by median filter layer.
explosion. In contrast, training the model with Ldeflation alone achieves better performance than the original MSE loss, particularly in robustness metrics. This improvement stems from the removal of irrelevant optimization directions, which allows the model to utilize previously consumed pa- rameters more effectively. Despite these gains, the training process remains unstable, often requiring multiple adjust- ments to the weight of Ldetlation to avoid model collapse. Additionally, while Ldeflation improves robustness, the DO method still outperforms it in both visual quality and aver- age accuracy, particularly for JPEG compression. In con- clusion, while Lecttation shows potential in enhancing the lightweight model's performance, the stability and overall effectiveness of the DO method make it superior choice for improving both invisibility and robustness in deep termarking models.
From Table 4, our model demonstrates nearly perfect ro- bustmess against the PRGAI attack. For the DiffPure attack, our results indicate that at = 0.05, the accuracy our DO method remains approximately 100%. At & 0.1, the DO method still achieves 74.22% accuracy, despite significant degradation in image quality after diffusion purification, which results in PSNR drop of approximately dB. While the semantic content of the attacked images remains intact, there is significant damage to the details (as shown in Fig. 4), rendering such high levels unacceptable for scenarios requiring detailed image preservation.
In these challenging conditions, our DO method retains 74.22% accuracy, demonstrating its robustness. Reduc- ing the denoising steps t helps preserve image details but also decreases the effectiveness of watermark removal. Thus, diffusion-based purification attacks have not yet fully evolved to eliminate watermarks without compromising im- age quality. Our method retains an advantage against these attacks by employing a composite noise layer of Gaussian noise and median filtering.
5. Conclusion
This paper enhances the efficiency of deep learning- watermarking models. identify a mismatch between the commonly used decoding losses and the information extraction task. To address this, propose the detachable projection head (PH) and decoding-oriented surrogate loss (DO), which reduce the impact of irrelevant components and improve model efficiency. We validate our methods by designing a lightweight model that achieves state-of-the-art visual quality and robustness against various distortions. Ad- ditionally, we introduce five-module deep learning-basee watermarking framework, providing a finer-grained divi- sion of the encoder and decoder. Extensive experimental results demonstrate the superiority of our proposed method over existing models in terms of invisibility, robustness, and efficiency. Moreover, the DO and PH methods are de- signed to be plug-ama aldg-and-pg aud-play. making them widely applicable to lightweight models with different architectures.
4.4. Ablation Study
Impact of MSE components model performance Ta- ble 5 presents the performance of the proposed lightweight model when trained using different components of the MSE loss: Eregularization Linfatioon and Ldeflation- The results provide insights into the impact of each component on the model's performance terms of invisibility and robustness against combined noise. The results demonstrate that using Cregularization or Lintlation in isolation does effectively reduce the decoding error. Lregularizaion and Liuflation sult in poor decoding accuracy, suggesting that these com- ponents do not contribute positively to the information ex- traction task and can lead to issues such as output collapse

---

Lightweight-Markk Rethinking Deep Learning- Based Watermarking
Acknowledgments
A matlab-like environment for machine learning. In Bigleam, NIPS workshop, number CONF, 2011.
This work is funded by the NUS-NCS Joint Laboratory for Cyber Security (WBS A-0008542-00-00 & A-0008542-01- 00).
Daren, H., Jiufen, L.., Jiwu, H., and Hongmei, L. A dwt- based image watermarking algorithm. In IEEE Interna- tional Conference on Multimedia and Expo, 2001. ICME 2001., pp. 80-80. IEEE Computer Society, 2001.
Impact Statement
This paper introduces a lightweight deep watermarking architecture designed to address the challenge of deploy- ing high-performance watermarking models in resource- constrained environments. Our work improves the practical applicability of digital watermarking in real-world appli- cations, particularly in scenarios such video streaming, online education, and embedded systems, where compu- tational power and storage are limited. By significantly reducing model size and computational demands, our ap- proach facilitates the broader adoption of digital watermark- ing for intellectual property protection, ensuring effective copyright enforcement even low-power edge devices. This can help mitigate unauthorized content distribution and strengthen digital rights management across various do- mains, including images, videos, and 3D content. Moreover, the computational efficiency of our method is well-aligned with energy mneryy-conscious system-on-chip (SoC) architectures, promoting sustainable Al deployment. Overall, our work ad- vances practical, resource-efficient watermarking solutions while fostering responsible AI deployment in real-world applications. While our research may have broader soci- etal implications, we do not identify any specific ethical concerns that require further discussion.
Fang, H., Jia, Z., Qiu, Y., Zhang, J., Zhang, W., and Chang. E.-C De-end: secoder-drivent watermarking network. IEEE Transactions Multimedia, 2022.
Fang, H., Qiu, Y., Chen, K., Zhang, J.. Zhang, W., and Chang, E.-C. Flow-based robust watermarking with in- vertible noise layer for black-box distortions. Proceed- ings of the AAAI Conference on Artificial Intelligence, volume 37, pp. 5054-5061, 2023.
Fernandez, P., Couairon, G., Jégou, H., Douze, M., and Furon, T. The stable signature: Rooting watermarks in latent diffusion models. In Proceedings of the IEEE/CVF International Conference on Computer Vision, pp. 22466- 22477, 2023.
Gao, M., Wang, Y., and Wan, L. Residual error based knowledge distillation. Neurocomputing, 433:154-161, 2021.
Hamidi, M., Haziti, M. E., Cherifi, H., and Hassouni, M. E. Hybrid blind robust image watermarking technique based on dft-det and arnold transform. Multimedia Tools and Applications, 17:27181-27221 2018
Hinton, G., Vinyals, O., and Dean, Distilling the knowledge in neural network. arXiv preprint arXiv: 1 1503.05531. 2015.
References
Ahmidi, N. and Safabakhsh, R. A novel det-based ap- proach for secure color image watermarking. In Interna- tional Conference on Information Technology: Coding and Computing, 2004. Proceedings. ITCC 2004., vol- ume 2, pp. 709-713 Vol.2, 2004. doi: 109/TTCC 2004.1286733.
Hu, J., Shen, L.. and Sun, G. suneeze-and-excitatie networks. In Proceedings of the IEEE conference on computer vision and pattern recognition, pp. 7132-7141, 2018.
Jang, Y., Lee, D. I., Jang, M., Kim, J. W., Yang, F., and Kim,
Bartlett, P. L., Jordan, M. I., and McAuliffe, J. D. Convexity, classification, and risk bounds. Journal of the American Statistical Association, 101(473):138-15)
S. Waterf: Robust watermarks in radiance fields for pro- tection of copyrights. arXiv preprint arXiv: 020666 2024.
2006.
Cheng, X., Rao, Z., Chen, Y., and Zhang, Q. Explaining knowledge distillation by quantifying the knowledge. In Proceedings of the IEEF/CVF conference on computer vision and pattern recognition, pp. 12925-12935, 2020.
Jia, Z., Fang. H., and Zhang, W. Mbrs: Enhancing robust- ness of dnn-based watermarking by mini- of real and simulated jpeg compression. In Proceedings of the 29th ACM international conference multimedia, pp.
Cho, J. H. and Hariharan, B. On the efficacy of knowledge distillation. In Proceedings of the IEEE/CVF interna- tional conference computer vision, pp. 4802, 2019.
41-49, 2021.
Kandi, H., Mishra, D., and Gorthi, S. R. S. Exploring the learning capabilities of convolutional neural networks for robust image watermarking. Computers Securrtty 65: 247-268, 2017.
Collobert, R., Kavukcuoglu, K., and Farabet, C. Torch7:
10

---

Lightweight-Mark: Rethinking Deep Learning- -aasd Watermarking
Kim, J., Park, S., and Kwak, N. Paraphrasing complex net- work: Network compression via factor transfer. Advances in neural information processing systems, 31, 2018.
Viterbi, U. The usc-sipi image database. http:/ //sipi. eucceedu/ataad
1977. Accessed: Mar. 2023.
Wan, W., Wang, J., Zhang, Y., Li, J., Yu, H., and Sun, J. A comprehensive survey on robust image watermarking. Neurocomputing, 488:226-247, 2022.
Kingma, D. P. and Ba, J. Adam: A method for stochastic optimization. In 3rd International Conference on Learn- ing Representations, ICLR 2015, San Diego, CA, USA, May 7-9, 2015, Conference Track Proceedings, 2015.
Zhang, C., Karjauv, A., Benz, P., and Kweon, I. S. Towards robust deep hiding under non-differentiable distortions for practical blind watermarking. In Proceedings of the 29th ACM international conference on multimedia, pp. 5158-5166, 2021.
Lin, T.-Y., Maire, M., Belongie, S., Hays, J., Perona, P., Ra- manan, D., Dollár, P.. and Zitiick, C. L. Microsoft coco: Common objects in context. In Computer Vision-ECCC 2014: 13th European Conference, Zurich, Switzerland, September 6- 12, 2014, Proceedings. Part V 13, pp. 740- 755. Springer. 2014.
Zhao, B., Cui, Q., Song, R., Qiu, Y., and Liang, J. De- coupled knowledge distillation. In Proceedings of the IEEE/CVF Conference on computer vision and pattern recognition, pp. 1953--1962, 2022.
Liu, Y., Guo, M., Zhang. J., Zhu, Y., and Xie, X. A novel two-stage separable deep learning framework for practical blind watermarking. In Proceedings of the 27th ACM International conference on multimedia, pp. 1509-1517, 2019.
Zhao, X., Zhang, K., Su, Z., Vasan, S., Grishchenko, I., Kruegel, C., Vigna, G., Wang, Y.-X., and Li, L. Invisible image watermarks are provably removable using genera- tive ai. arXiv preprint arXiv:2306.0199
2023a.
Luo, Z., Guo, Q. Cheung, K. C., See, S., and Wan, R. Copymeeff: Protecting the copyright of neural radiance fields. In Proceedings of the IEEE/CVF International Conference on Computer Vision, pp. 22401-22411, 2023.
Zhao, Y., Pang, T., Du, C., Yang, X., Cheung, N.-M,, and Lin, M. A recipe for watermarking diffusion models. arXiv preprint arXiv:2303.10137 2023b.
Ma, R., Guo, M., Hou, Y., Yang, F., Li, Y., Jia, H., and Xie,
Zhu, J., Kaplan, R., Johnson, J., and Fei-Fei, L. Hidden: Hiding data with deep networks. In Proceedings of the European conference on computer vision (ECCV), pp. 657-672, 2018
X. Towards blind watermarking: Combining invertible and non-invertible mechanisms. In Proceedings of the 30th ACM International Conference on Multimedia, pp. 1532-1542, 2022.
Mirzadeh, S. I., Farajtabar, M., Li, A., Levine, N., Mat- sukawa, A., and Ghasemzadeh, H. Improved knowledge distillation via teacher assistant. In Proceedings of the AAAI conference on artificial intelligence, volume 34, pp- 5191-5198, 2020.
Saberi, M., Sadasivan, V. S., Rezaei, K., Kumar, A., Chegini, A. Wang, W., and Feizi, S. Robustness of ai-image de- tectors: Fundamental limits and practical attacks. In The Twelfth International Conference on Learning Represen- tations, 2024.
Singh, Himanshu Kumar, A. K. Comprehensive review of watermarking techniques in deep-leaming environments. Journal of Electronic Imaging, 32(3):031 884-033 038804 2023.
Tancik, M., Mildenhall, B., and Ng. R. Stegastamp: Invisi- ble hyperlinks in physical photographs. In Proceedings of the IEEE/CVF conference computer vision and pattern recognition, pp. 2117-2126, 2020.
Van Schyndel, R. G., Tirkel, A. Z., and Osborne, C. A digital watermark. In Proceedings of 1st international conference on image processing, volume 2, pp. 86-90. IEFE, 1994.

---

Lightweight-Mark: Rethinking Deep Learning- Based Watermarking
A. Proof Results
A.I. Equation (3) (restated), MSE loss can be decomposed into seven terms as follows:
LAw
Iw
Lww
MSE (n
B
Di (no) 2
Pel
no)
2 Di (noo)
I.
i=1
Ln gi (oo) -
Ln
In +
+2
gi
Σ
gf (noo) +
i=1
We divide the decoded bits 9: (Ino) from the decoded message (Lno) into two groups based on whether they are correctly or incorrectly decoded, with lengths I and Lw respectively. Additionally, we can also divide these bits based on their sign into two groups with lengths L and L The combinations R (right) and W (wrong) with + (positive) and (negative) represent the decoded bits that satisfy both conditions.
Proof. We expand the MSE loss in Equation (2) as follows:
MSE (g([no)) M) E
T (gi(Tno) -Mi)2
(9)
L Migi (nno) + Σ M2
9 (mo) - Σ
T.
(10)
i=1
The expectation in Equation (10) contains three terms, and the first term can be further decomposed into two more terms.
Lww
L.R
Σ (1oo)
Σ (noo) +
Σ
g (Ino)
(11)
1=1
The second term can be further decomposed into four more terms.
Lw
Live
L
L
Σ Migr(Lno) Σ
M.gi(Ino)
Σ
(Io + Σ (no)(no)) t=1
Σ Migi(Ano)
(12)
The four terms contain gi (nno) follows: gi(Ano) decoded incorrectly and with a negative sign, gi (no)))) decoded incorrectly and with positive sign, gi (Ino) decoded correctly and with negative sign, and gi(nn)) decoded correctly and with positive sign. Therefore, the values of M; in these four groups are +1, -1, -1, and +1, respectively. Then, Equation (12) can be transformed as follows:
Lw
Lu
Σ Migi(Tno) = Σ (i())
Σ ge (i(on))
Σ gi (Tna)
Σ ge(Tno 1=1
(13)
Since Mj E [-1,1), the third term can rewritten as follows:
Σ M3 = L
(14)
1=1
Combining Equations (11), (13), and (14) yields:
Law
1a (i(nn)) 2
1
E
9
Ino
9 (no))
L
Lx
LB
+2
gel (nno) - 2
gi (Noo) + 2
o (nno) + L
(15)
i=1
i=1
12

---

Lightweight-Marks Rethinking Deep Learning- Based Watermarking
A.2. BCE loss be decomposed into four terms as follows:
The decomposition process for BCE loss is similar that of MSE loss. However, there are a few key points to note: M E {0, 1)": 2) The direct output of the decoder, 9: (nno), need pass through the sigmoid activation function o(); 3) The classification boundary is no longer 0 but rather 0.5. Therefore, based whether o (gg (Ano) is conrectly decoded (i.c., (Tooo)))) 0.5) (M; 0.5) > 0), we divide (g: (Tuo) into two parts with lengths Ln and Lw. We further categorize a (gi( (no) based on its relationship with 0.5 (i.e., (gg (Ino) > 0.5)) into two parts with lengths L and L
Lw (o +
L log(1 (ggi
BCE
L
Edeitation
log(1 oggi(Ina))
log(o((;((no)))
Lintlation
The objective of penalizing incorrectly decoded bits is also totally reflected in the first two terms. minimize the BCE loss, these terms encourage (gg (fuo)) converge to the boundary at 0.5, The two components of Linflation are both comprised of correctly decoded parts (Ln (-)- Minimizing Linflation does not directly reduce the decoding error; rather, its primary function is to push correctly decoded (g.(nno)) away from the classification boundary at 0.5. Although Eregularization is not explicitly included the decomposition of BCE loss, the limitation on the unbounded growth of the model output (ge (noo)) is implicitly enforced by the sigmoid activation function, its output constrained between and 1.
Proof. The BCE loss is follows:
1
BCE
=
E
M, log(o((((())))) + (1- M,) log(1 (I)
(16)
1
M, log (og()(()(4no)))
Σ (1) log(1 ((g((Loo)))
(17)
The expectation in Equation (17) contains two terms, and the first term can be further decomposed into two more terms.
L
M log(o(g;(
(og(o(g:(Tna))) +
(og(a((;((no)))
0 log(o(9,(4no)))
(og(o(()(4no)))
(18)
log (g: +
log (g.
(19)
The second term can also be further decomposed into two more terms.
4 log(1 ((gi(nn))
Lg log(1 ((gs(noo)))
M,) -log(1 - ((
Σ
(20)
13

---

Lightweight-Marks Rethinking Deep Learning- Based Watermarking
Combining Equations (19) and (20) yields:
w
L (gg((((9((Z2))) Σ
log(1 - (gi((uo)))
log(1 (0gi(Tno))
(gi((()))))))))
(21)
B. Proposed Lightweight Model Structure
Here, we provide comprehensive overview the proposed lightweight model depicted Fig. 5, which exclusively employs fundamental transposed convolution and convolution layers. The activation function utilized between each pair of layers is LeakyReLU.
In previous works, the partitioning of the encoder submodule has been well established, whereas contribution lies in the delineation of the decoder. The separation of the two modules within the decoder is based on specific criterion: layers with stride of 1, which do not reduce the shape of the input, are designated as data processing layers, while layers with a stride greater than 2, which do reduce the input shape, are designated as data extraction layers. Previous approaches, such as those in MBRS and CIN, often mix or alternate these two kinds of layers. our framework, however, these two kinds of layers are grouped into two distinct blocks, the noised watermarked image preprocessing (NWIP) module and message extraction (ME) module. This division is primarily structural separation. Since NWIP and ME are trained simultaneously and share the same objective function, complete functional distinction between them is not feasible. However, the advantage of this structural separation is that the two modules do not need to share the same number of channels. This allows to independently reduce the parameters of each part, enabling a more focused study and design of the decoder.
Encoder
Crecs
Addiins
Caea
Decoder
IP module
Layer
ME modulll!
module
NWIP module
module
Watermaried
lsegge fu.
Euratel
Watemarkk
Figure The structure of the proposed lightweight model. IP module represents image preprocessing module, MP module represents message preprocessing module. FF module represents feature fusion preprocessing. NWIP module represents noised watermarked image preprocessing module. ME module represents message extraction module.
C. The Training and Inference Phases of PH
As illustrated Fig. 2, the backbone network structure used in the Detachable Projection Head (PH) method is identical that of the MSE loss-based backbone network, except for the addition of four identical projection blocks after the original decoder. Specifically, M denotes the input to the jth Projection Block. Notably, Mfex is the output of the original backbone network, denoted as M.x-
Training Phase:
For the decoder loss calculation, the MSE bass- method uses the direct output May from the backbone network. In contrast, the PH method utilizes the output of the last projection block, M5 (since there are four projection blocks), for computing the MSE loss.
14

---

Lightweight-Mark: Rethinking Deep Learning-Basse Based Watermarking
Inference Phase: As shown in Fig. during inference, the PH method retains only the backbone network. We compute the decoding accuracy based the output of the backhone network, Mex-
This section highlights how the PH method integrates the proposed lightweight structure during both the training and inference phases. The additional projection blocks in the training phase help refine the decoder output, while during inference, we simplify the structure to use only the backbone network for efficiency.
D. Extensive Experimental Details and Results
Datasets and Settings All networks trained the COCO dataset (Lin et al., 2014) and tested the classical USC-SIPI image dataset (Viterbi, 1977). The number of channels C, width W, and height H of the images are set to 3, 128, and 128, respectively; the length L of the secret message is set to 64. The safe distance e in CDO is set to 0.1, and both 1. All experimental models are implemented through PyTorch (Collobert et al., 2011) 1) and run NVIDIA RTX 3090 (24GB). As for the optimizer, used the Adam optimizer (Kingma & Ba, 2015) with learning rate of Le-3 and default hyperparameters. In the training phase, distortions: Gaussian Blur (GB) with standard deviation of 2.0 and kernel size of 7, Median Blur (MB) with kernel size of 7, Gaussian Noise (GN) with a variance of 0.05 and a mean of O, Salt & Pepper Noise (S&P) with a noise ratio of 0.1, Dropout (DP) with a drop ratio of 0.6, JPEG Compression (JPEG) with a quality factor of 50, and JPEGSS (simulated differentiable JPEG distortion) with quality factor of 50. These distortions are applied in combination to simulate variety of noise conditions, ensuring the model can effectively handle different types of degradation during training.
X PH((O) and X/ (H((O)) are initially
apply combination of seven types of
Benchmarks To evaluate the efficiency, robustness, and invisibility of the proposed method, four widely used watermarking models are selected for comparison including HiDDeN (Zhu et al., 2018), MBRS (Jia et al., 2021), CIN (Ma et al., 2022) and FIN (Fang et al., 2023). For robustness testing, we choose six different distortions ("Gaussian Blur", "Median Blur", "Gaussian Noise", "Salt & Pepper Noise", "JPEG Compression" and "Dropout"), well "Combined Noise" incorporating these six distortions.
Metrics For efficiency, we show the model size and the Floating Point Operations (FLOPs), where lower values signify higher efficiency. The peak signal-to-noise ratio (PSNR) chosen to evaluate the visual quality of watermarked images. larger PSNR value suggests smaller alterations from the original image, thus reflecting better invisibility, For robustness, decoding accuracy (ACC) is utilized the metric. higher ACC indicates better robustness.
D.1. The Structure of Projection Block
Projection Block
Aj
Dut Prodect
Addldso
x
Uptample
Dorabaaple
Bj
Figure 6. The structure the projection block.
15

---

Lightweight-Mark: Rethinking Deep Learning- Watermarking
D.2. Develop the Decoding-Oriecn Oriented Surrogate Loss from BCE Loss
Similarly, the deflation loss here is adapted from deeflation in Equation (21), which is formulated as follows:
Lw
CBCE deflation
-
log (gi(o(()())))))) +
Σ log(1 (gi((n))))
(22)
BCO inflation
in here can be formulated as follows:
1..5 L 30.5--
10.4+< <
cBCE inflation
log(1 (gg((no)))
Σ
log(o()(((no)))
(23)
The total loss function CBCR can be represented as follows:
DO
2p Liiiunal + (
CBCE
BCE inflation
(24)
Table 6. Comparison of Performance between DO (MSE-based) and DO (BCE-based) Methods
PSNR1
Dropout
JPEG
GN
S&P
GB
MB
Ave
Method
(dB)
(%)
(%)
(%)
(%)
(%)
(%)
(%)
DO (MSE)
41.70
100
99.12
97.40
100
100
99.63
99.36
DO (BCE)
41.10
100
98.11
97.96
100
99.94
99.74
99.29
The comparative experiments for the DO method based on BCD loss are shown in Table 6. As can be seen, the performance of DO (MSE-base) and DO (BCE-based are very similar.
D.3. Impact of individual modules model performance
Table Benchmark comparisons on invisibility and robustness against different single distortions.
S&P Noise (%)
Gaussian Noise (%)
Model
PSNR(dB)t
10.08
0.09
0.1
PSNR(dB)
var=0.03
0.04
0.05
w/o IP
67.19
99.97
99.93
99.87
39.94
99.94
99.70
99.25
w/o FF
67.02
99.87
99.92
99.75
39.68
99.98
99.76
99.34
w/o NWIP
56.66
97.43
97.25
96.29
39.54
99.92
99.78
99.33
Whole Model
67.75
99.97
99.96
99.94
39.91
99.97
99.82
99.51
JPEG Compression (%)
Dropout (%)
Model
PSNR(dB)t
QF 50
60
70
PSNR(dB) t
r=0.6
0.5
0.4
w/o
49.70
95.73
96.95
98.46
72.04
98.22
99.59
99.81
w/o FF
49.62
90.79
92.36
94.08
71.63
95.55
97.78
98.79
w/o NWIP
49.55
91.38
93.20
94.81
70.01
96.99
99.75
99.95
Whole Model
49.73
99.06
99.75
99.99
72.64
99.50
99.95
99.98
Gaussian Blur (%)
Median Blur (%)
Model
PSNR(dB)t
==0. 0.5
PSNR(dB)
5
w/o IP
67.84
99.96
99.34
99.63
49.15
99.63
99.69
98.75
67.31
98.55
96.99
94.02
49.47
99.45
98.67
96.08
w/o NWIP
62.36
84.25
79.44
65.
45.85
99.31
99.78
99.00
Whole Model
67.91
100
99.99
99.57
49.95
99.97
99.82
99.26
Fig. shows deep learning beanedng-based watermarking framework composed of five modules. Among them, the MP (Message Preprocessing) module and ME (Message Extraction) module are essential as they are directly responsible for the transfor- mation and extraction of watermarks. Therefore, Table focuses on the remaining three modules and examines their impact under various single distortions. The performance difference between the model without the (Image Preprocessing)
16

---

Lightweight-Mark: Rethinking Deep Learning-Basse Based Watermarking
module and the whole model is minimal, indicating its limited contribution to the overall model performance. However, the roles of the FF (Feature Fusion) module and the NWIP (Noised Watermarked Image Preprocessing) module consistently significant across various distortions. The absence of the NWIP module leads to severe degradation in performance under Gaussian blur and S&P noise. In summary, when model size is constrained, effective parameter allocation is crucial to handle different distortions in varying application scenarios. Our results highlight the importance of the FF and NWIP modules in maintaining robustness and invisibility the watermark, while the IP module has a relatively minor impact.
D.4. The Capacity of Lightweight Model
For testing the capacity of the lightweight model, the cover images are 3-channel color images with a width and height of 128 x 128. We follow the noiseless environment setting described in HiDDeN (Zhu et al., 2018), meaning there is no noise layer to distort the watermarked images !w. Instead, L directly fed into the decoder for the accuracy test. The specific experimental results are shown in Table
Table The Capacity Lightweight Model.
Method
Message Length
Bits Per Pixel
PSNR(dB)
Accuracy($6)
64
0,0013
43.15
100
256
0.0052
42.14
100
PH Lightweight Model
1024
0,0208
41.11
100
4096
0.0833
40.41
100
16384
0,3333
39.12
100
64
0.0013
42.91
100
256
0.0052
42.14
100
DO + Lightweight Model
1024
0.0208
41.03
100
4096
0.0833
40.12
100
16384
0.3333
39.01
100
D.5. Benchmark Comparisons Visually Quality
Additional evaluations of the visual quality across the models under combined noise conditions conducted. In addition to the previously discussed PSNR, four other metrics, including SSIM, LPIPS, 12, and lin are also incorporated. As shown in Table 9, the methods DO and PH consistently outperform the other models across all metrics, with the exception of SSIM, where they perform slightly worse than MBRS.
Table 9, Benchmark comparisons on visual quality base on five different metrics.
Method
PSNR (dB)f
SSIM
LPIPS
l2
4nn $
HiDDeN
27.28
0.87
0.062
85.12
0.38
MBRS
40.72
0.98
0.004
4.19
0.16
CIN
40.31
0.97
0.003
5.03
0.13
FIN
41.58
0.97
0.014
3.46
0.08
Lightweight Model+MME
39.31
0.97
0.005
5.67
0.12
Lightweight Model+PH
41.67
0.97
0.002
3.46
0.07
Lightweight Mo
41.70
0.97
0.001
3.36
0.06
D.6. Invisibility and Robustness against Single Noise
In Table 10, the proposed lightweight model, using the MSE loss, exhibits inferior performance compared to other SOTA large models (CIN, FIN, MBRS) under certain single distortions. Specifically, significant discrepancies are observed in Gaussian blur and median blur. Under Gaussian blur, the proposed lightweight model (MSE) shows lower invisibility and robustness compared to the MBRS, with a more pronounced difference observed under median blur, particularly when compared to the MBRS and CIN.
In contrast, our proposed methods, the detachable projection head (PH), and the eecodiing-orentter surrogate loss (DO),
17

---

Lightweight-Mark: Rethinking Deep Learning- -aased Watermarking
show significant enhancements over the MSE loss. Notably, the PH and DO methods outperform MSE loss across almost all single distortions, showeasing higher PSNR and improved robustness. Noteworthy is the success of the DO method in enabling the proposed lightweight model to surpass other SOTA large models without increasing model parameters or sacrificing efficiency. demonstrating significant advantage.
These findings underscore the considerable performance gains achievable by adopting PH and DO methods over traditional MSE loss in deep learning-based watermarking models, particularly in the context lightweight models.
Table 10. Benchmark comparisons invisibility and robustness against different single distortions. MSE, PH. and DO refer to the original MSE loss, detachable projection head, and decoding-orionn oriented surrogate loss.
S&P Noise (%)
Gaussian Noise ( (%)
Model
PSNR(dB)T
r=0.08
0.09
0.1
PSNR(dB)1
var=0.03
0.04
0.05
HiDDeN
31.93
96.81
96.73
96.69
26.57
87.64
87.31
87. 87.14
MBRS
67.73
99.95
99.91
99.89
40.36
99.89
99.53
99.05
CIN
66.31
98.12
97.41
97.26
39.77
99.91
99.33
98.42
FIN
63.53
99.44
99.25
99.02
40.35
99.87
99.41
99.04
MSE
66.86
99.67
99.61
99.43
40.34
99.76
99.13
98 08.82
PH
67.34
99.96
99.97
99.86
40.16
99.81
99.38
98.73
DO
67.75
99.97
99.96
99.94
40.38
99.88
99.53
99.08
JPEG Compression (%)
Dropout (%)
Model
PSNR(dB)
QF = 50
60
70
PSNR(dB)
r=0.6
0.5
0.4
HiDDeN
24.68
78.72
79.58
79.86
30.31
86.65
86.69
86.84
MBRS
47.82
96.01
97.85
99.31
70.48
99.05
99.91
99.98
CIN
48.47
84.77
88.58
93.36
63.41
97.07
98.73
99.22
FIN
48.76
98.24
99.51
62.58
99.22
99.61
99.68
MSE
48.47
99.00
99.52
99.72
71.86
98.69
99.69
99.70
PH
49.68
99.02
99.55
99.85
71.27
99.43
99.85
100
DO
49.73
99.06
99.75
99.99
72.64
99.50
99.95
99.98
Gaussian Blur (%)
Median Blur (%)
Model
PSNR(dB)t
PSNR(dB)
7
HiDDeN
29.02
81.76
60.65
34.12
79.28
75.03
MBRS
65.78
99.84
99.21
49.85
99.77
99.56
CIN
63.32
98.83
97.66
49.08
98.86
98.44
FIN
52.51
99.80
97.27
41.97
99.54
99.13
MSE
57.50
99.35
98.85
48.98
99.38
98.06
PH
65,47
99.34
98.55
49.84
99.75
98.93
DO
67.91
99.99
99.57
49.95
99.82
99.26
D.7. Visual Quality under Combined Noise
In Fig. 3, we present the watermarked images T, embedded with watermarks by four different models, HiDDeN, MBRS, CIN, and FIN, as well as the lightweight models trained using three different methods when facing combined noise. can be observed that not only do the watermark patterns differ significantly among the four different models, but also the watermark patterns generated by the lightweight models with the same architecture vary under different training methods. Although methods, PH and DO, do not directly affect the encoder, since the encoder and decoder are trained together, the losses generated by PH and DO during backpropagation will also be propagated to the encoder, thereby influencing the watermark patterns. From Table 2, it can be seen that the lightweight models trained with PH and DO not only exhibit improved robustness but also achieve enhanced visual quality. Therefore, this influence is positive.
D.8. The Effect of Discriminator on Proposed Lightweight Model
For the watermarking task, the discriminator serves as additional module. In our work, to clearly demonstrate and validate the effectiveness of the proposed DO and PH methods, we chose to minimize the influence of other factors that could affect the model's visual quality and robustness. Therefore, we did not use the discriminator in our model.
To further illustrate the impact of including or excluding the discriminator on the visual quality and robustness of our
18

---

Lightweight-Mark: Rethinking Deep Learning-Basee Based Watermarking
Table 11.
Benchmark comparisons on invisibility and robustness with without Discriminator (DIS).
PSNR
Dropout
JPEG
GN
S&P
GB
MB
Ave
Method
(dB)
(%)
(%)
(%)
(%)
(%)
(%)
(%)
DO w/o DIS
41.70
100
99.12
97.40
100
99.63
99.36
DO w DIS
41.21
100
98.57
97.79
99.99
100
99.70
99.34
PH w/o DIS
41.67
99.99
98.92
97.21
99.99
99.96
99.59
99.28
PH DIS
41.07
100
98.73
97.64
100
100
99.49
99.31
Table 12. Benchmark comparisons on visual quality base on five different metrics with and without Discriminator (DIS),
Method
PSNR (dB)t
SSIM
LPIPS
l2 +
lin $
DO w/o DIS
41.70
0.97
0.001
3.46
0.06
DO w DIS
41.21
0.97
0.001
3.74
0.08
PH w/o DIS
41.67
0.97
0.002
3.36
0.07
PH w DIS
41.07
0.97
0.002
3.84
0.09
proposed lightweight model, we conducted extensive experiments using the method from MBRS (Jia et al., 2021). The specific experimental results shown in Table 12 and Table 11. As seen, the presence absence of the discriminator does not significantly affect the visual quality and robustness of method.
Table 13. Comparison of Parameter Size and FLOPs Between the Lightweight Model and the Discriminator.
Method
Size
FLOPs
Discriminator
113.15K
1.86G
Lightweight Model
16.59K
0.22G
Furthermore, as shown Table 13, the parameters and computational complexity the discriminator are 6.8 times and 8.5 times larger than those of the entire lightweight model, respectively. To maintain the lightweight nature of the overall model, we also chose not to include the discriminator.
D.9. In-Depth Analysis of the Detachable Projection Head (PH)
Smoothed Distribution Decoded Values
Smoothed Distribution of Decoded Values
0.012
0.010
2.0
0.008
Dematy
0.006
0.004
0.5
0.002
0.000
-3
-100
-75
-30
-25
0
30
75
100
Decoded Value
Decoded Value
Figure 7. The smoothed distribution of decoded values for PH method with projection head.
Figure 8. The smoothed distribution of decoded values for PH method without projection head.
19

---

Lightweight-Markk Rethinking Deep Learning- Watermarking
The Difference Between the PH Method With and Without the Projection Head As illustrated in Fig. 7 and Fig. the output distribution from the backbone model with projection head is densely centered around -1 and 1. This is expected, as the objective of the MSE loss is to push the outputs as close to the targets as possible. In contrast, the distribution of outputs decoded from the backbone model without projection head is more dispersed. This suggests that the projection head's main function is normalization when considered separately from the backhone model.
Table 14. Benchmark comparisons invisibility and robustness with and without projection head.
PSNR
Dropout
JPEG
GN
S&P
GB
MB
Ave
PH Blocks
(dB)
(%)
(%)
(%)
(%)
(%)
(%)
(%)
PH(w ph)
40.74
99.98
98.43
98.07
99. .4
100
99.14 14
99.26
PH(w/o ph)
40.74
100
98.62
98.03
99.99
100
99.54
99.36
The Effect of Removing the Projection Head on Inference Performance Table 14 shows that discarding the projection head has negligible impact the model's performance during inference. As analyzed in the "Detachable Projection Head" section, the projection head mainly handles "normalization" which is not essential for the decoding goal. For decoding, only relative values are necessary.
Table 15. Influence of projection block numbers.
PSNR (dB)
Dropout (%)
JPEG
GN (%)
S&P
GB
MB (%)
Ave (%)
PH Blocks
(%)
(%)
(%)
37.49
99.43
95.92
98.75
99.96
99.96
99.37
98.90
39.14
100
97.28
98.73
100
100
99.84
99.31
40.29
99.99
97.90
98.69
100
100
99.43
99.34
40.34
100
98.28
98.12
100
100
99.78
99.36
40.74
100
98.62
98.03
99.99
100
99.54
99.36
40.96
99.99
98.40
97.81
100
100
99.57
99.30
Table 16. Influence of channel numbers in projection block.
Channel Numbers
PSNR (dB)
Dropout (%)
JPEG
GN
S&P
GB
MB
Ave
(%)
(%)
(%)
(%)
(%)
(%)
40.44
99.09
93.88
97.58
99.98
99.92
98.54
98.17
40.56
98.66
94.49
98.11
100
99.81
98.73
98.30
16
41.43
100
97.22
97.75
99.99
100
99.50
99.09
41.67
99.99
98.92
97.21
99.99
99.96
99.59
99.28
Impact of Block Number and Channel Number in the Projection Head on Inference Performance For the experiments involving the number of blocks, we fixed the channel number at 32. From Table 15, we observe a slight performance degradation as the block number decreases. Similarly, for the experiments with varying channel numbers, we fixed the block number at 4. As shown in Table 16, reducing the channel dimension also results a slight decline in model performance.
From these two experiments, we can conclude that there trade-off between the size the PH module and the performance of the lightweight model. Users can refer these findings select appropriate PH size based their computational resources and application requirements.
D.10. Impact of X
PH(DO) and X/
PH(DO)
As shown in Table 17 and 18, initially, both and are set to at the beginning of training. Throughout the training process, we increase the value of X PH(DO) every 30 epochs. The tables below show the final values of X PH(DOO and X PH(DO) along with the corresponding visual quality and average accuracy of the model under combined noise. Our experiments indicate PH{(DO) PH(DO) and X₂
that A
represent trade-off between the visual quality of the encoder and the decoding accuracy
20

---

Lightweight-Mark: Rethinking Deep Learning-Basse Watermarking
of the decoder. Larger values of lead to better visual quality but will result in reduced decoding accuracy. There is one-size-fits-al standard for them. Users who prioritize the visual quality of the watermarked images and are willing accept reduction in accuracy might opt for higher values of A PH(DO) Conversely, if decoding accuracy more critical, PH(DO) values should be chosen. lower X
Table 17. The influence of X1 and X for PH.
Method
2P
APH
PSNR(dB)
Ave(%)
1
31.58
100
10
36.36
99.85
PH
100
40.74
99.36
1000
45.84
95.54
10000
55.47
83,40
Table 18. The influence of XP and 22 for DO.
Method
xpo
PSNR(dB)
Ave(%)
1
27.58
100
10
31.30
100
DO
1000
36.48
100
100000
43.15
98.47
1000000
49.03
93.16
D.11. Impact of Safe Distance
In Table 19, we report the visual quality and decoding accuracy under combined noise with different safe distances Our experiments utilize the proposed lightweight model and the decoding-oriented oriented surrogate loss (DO loss).
Table 19. The influence of safe influence in the decoding--orentee surrogate loss (DO loss).
PSNR
Dropout
JPEG
GN
S&P
MB (%)
Ave (%)
Safe Distance e
(dB)
(%)
(%)
(%)
(%)
(%)
0.001
41.19
99.97
98.39
97.87
99.99
99.97
99.48
99.28
0,01
41.23
100
97.66
97.57
100
99.97
99.68
99.15
0.05
41.47
100
98.35
96.98
99.99
100
99.88
99.20
0.1
41.70
100
99.12
97.40
100
100
99.63
99.36
0.5
41.46
99.99
97.06
97.83
99.98
100
99.73
99.10
1.0
41.11
100
98.46
97.19
99.98
100
99.74
99.23
10.0
38.41
99.51
96.88
98.99
100
100
99.36
99.12
D.12. Invisibility and Robustness against Geometric Distortions
Our work primarily aims to explore the feasibility of lightweight deep learning-basse based watermarking models. To this end, we validate the effectiveness and applicability of the proposed training methods, DO and PH, using a model with an intentionally simple structure and minimal parameters. We further investigate the broader applicability of these methods to different scenarios.
While our original lightweight model demonstrates strong robustness and visual quality against combined and multi-single distortions, achieving significant parameter reduction without compromising robustness across all distortion types remains inherently challenging. The distortions evaluated above are primarily digital channel-based distortions, which tend not to alter the geometric features of images significantly. Consequently, the substantial parameters and architectural components (e.g., the SE block in MBRS) designed for handling geometric distortions can be reduced without impacting performance in these cases. This characteristic explains why our original lightweight model, combined with the proposed DO and PH methods, performs effectively under such digital distortions.
21

---

Lightweight-Mark: Rethinking Deep Learning-Basee Watermarking
Table 20. Benchmark comparisons invisihility and robustness against geometric distortions, where RA represents Random RP
represents RandomPendses Perelltteesspetivve, and RET represents KandomEEasticTTanssfooo
PSNR (dB)
RP
RA
RET
Ave
Method
(%)
(%)
(%)
(%)
HiDDeN
37.08
66.65
66.30
69.63
67.53
MBRS
48.09
98.05
98.44
99.71
98.73
FIN
42.05
73.63
74.45
99.51
82.53
MSE with Lightweight Model
39.89
82.22
82.34
99.41
87.99
PH with Lightweight Model
42.33
83.26
83.24
99.72
88.74
DO with Lightweight Model
43.66
84.23
84.69
99.68
89.53
MSE with Lightweight Model + PH with Lightweight Model
48.04
94.59
97.11
98.40
96.70
48.14
98.07
98.56
99.62
98.75
DO with Lightweight Model
48.42
98.79
99.51
99.83
99.38
However, experiments in Table 20 reveal that our lightweight model's robustness declines when subjected to geometric Transform (RET). These distortions introduce greater complexity, requiring more sophisticated feature extraction to achieve optimal performance. While our original lightweight model does not achieve the best performance under geometric distortions, the DO method still ranks second, just behind MBRS.
distortions like GandomPerspective (RP), RandomAffine (RA), and Taandommlattieeransfoo
To address this limitation, extended the original lightweight model to enhance its robustness against geometric distortions. Specifically, modified the noised watermarked image preprocessing (NWIP) module, the first module interacting with the noise layer, by incorporating an SE block and increasing the intermediate channel count from 12 to 32. The enhanced model, referred to as Lightweight Model +, achieves significant improvements in robustness to geometric distortions. Despite the enhancements, its total parameter count remains remarkably low at 0.056M, representing only 12.44% % of HiDDeN, 7.47 % of FIN, 0.27 % of MBRS, and 0.16% % of CIN.
As shown in Table 20, the enhanced Lightweight Model + achieves substantial improvements across all geometric distortions. When coupled with the DO method, it attains the best performance in visual quality and robustness against all three distortions. The PH method also performs strongly, achieving comparable robustness, with only a slight gap in CnndomEElstiicTrasffooo while outperforming MBRS in both visual quality and average accuracy.
In summary, the proposed training methods, DO and PH, exhibit broad applicability across various lightweight model architectures. We believe these methods will prove instrumental in advancing the development of lightweight watermarking models and will assist other researchers achieving superior performance this domain.
E. Limitations
We propose two effective training methods: the detachable projection head (PH) and the decoding-orienter surrogate loss (DO). For PH, although we retain and use only the lightweight model during the inference stage, the training stage still requires additional storage space and computational resources to jointly train the detachable projection head, which not efficient during training. For DO, while does not require extra modules during training or inference, it introduces a new hyperparameter, the safe distance c. To achieve optimal performance, manual tuning of this hyperparameter is required, as demonstrated in Appendix D.11, which is not straightforward. Furthermore, as discussed in Appendix D.12, there is still room for improvement regarding geometric distortions. However, future researchers aiming to train lightweight models can readily adopt our training approaches to enhance model performance without modifying the underlying architecture. In conclusion, our work represents a significant advancement in balancing efficiency and robustness in watermarking models.
22


Reviews:
[{"review_id": "uAsNrQWyJb", "reviewer": "Reviewer_6BgQ", "summary": "The authors address the challenges of computational efficiency and accuracy in steganography. By identifying shortcomings in commonly used decoding loss functions, such as MSELoss and BCELoss, they introduce two techniques to mitigate these issues.\n\nThe first method, Detectable Projection Head (PH), scales the decoding output to maintain values close to 1 (or -1), improving training stability. The second method, Decoding-Oriented Surrogate Loss (DO), selectively filters out loss contributions from correctly decoded bits, focusing only on incorrectly decoded bits and those near the decision boundary. This targeted approach stabilizes training and enhances decoding accuracy.\n\nFurthermore, the authors demonstrate that their approach achieves similar or slightly better performance than the previous state-of-the-art method, FIN, while enabling the use of a smaller model, thereby reducing computational overhead without sacrificing effectiveness.\n\n### Update after Rebuttal\n\nI would like to revise my score from 2 to 3, as the extended experimental results show that PH (referring to Table 1 in the second-round response) and DO (referring to Table 2 in the second-round response) offer valuable contributions to the development of future watermarking frameworks. Additionally, all questions and suggestions raised during the two-round discussions have been adequately addressed. This work demonstrates the potential for producing robust watermarking techniques while maintaining a lightweight model.", "questions": "", "limitations": "", "rating": 3, "confidence": null, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "**Notation and Typographical Corrections**\n\nThank you for your detailed review. We will ensure proper formatting of subscripts and expressions in the final version.\n\nRegarding the typos, you are right that in L159 it should be \"the last three terms,\" and the citation in L359 should be \"2024\". We will address these issues in the final version.\n\n---\n\n**To provide a comprehensive response, we have included some results in the anonymous link:** \n\nhttps://anonymous.4open.science/r/Rebuttal-ICML-8393/Rebuttal_ICML2025_%208393.pdf\n\n**Q1:** Thank you for your constructive suggestion! If we remove the projection head, we could indeed add a Tanh function after the decoder to constrain the output to the range (-1,1), as shown in Figure 3 (linked). However, we do not impose such a restriction on the decoder output because the success of decoding depends on the relationship between the decoded bits and the boundary value (0 for MSELoss, 0.5 for BCELoss), rather than on the magnitude of the output itself. For example, an output of 0.1 and 2 both indicate the same decoded bit '1' under MSELoss.\n\nAdding a Tanh function would not alter the relative relationship between the decoded bits and the boundary (i.e., values greater than 0 remain positive, and values less than 0 remain negative). Consequently, as shown in Table 1 (linked), the final decoding accuracy remains unaffected, so we opt not to introduce an additional function.\n\nFor BCELoss, the sigmoid function is necessary because BCELoss is designed for probabilistic outputs. The sigmoid ensures that the outputs lie within the [0,1] range, representing valid probability distributions. In contrast, MSELoss does not require such a transformation, as it directly optimizes the squared error.\n\n**Q2:** Thank you for your question. The term \"Combined noise\" was originally introduced by HiDDeN, and its purpose is to address the scenario where watermark images may encounter different types of distortions in real-world applications. Since it is difficult to predict which specific distortion may occur, the watermarking model needs to be trained to handle multiple types of noise simultaneously. In practice, during training, we employ a Combined Noise technique, where the model is exposed to a random noise layer in each mini-batch. This enables the model to learn robustness to multiple types of distortions at the same time. Additionally, during evaluation, we assess the model's robustness under different noise layers to demonstrate its general robustness. This approach is also widely used in watermarking models such as MBRS, CIN, and FIN.\n\n**Q3:** Thank you for your insightful suggestion. Following your advice, we experimented with directly using a few-step diffusion model as a noise layer for training. The results are presented in Table 2 (linked).\n\nAs the number of steps (t) in the noise layer diffusion model increases, the robustness of the watermarking model against diffusion-based attacks also improves. However, with smaller t, the model’s performance remains inferior to surrogate method. We believe this is due to the difficulty of simulating large t attacks with smaller t. Additionally, using t=0.03 already demands substantial GPU memory and time, which limits our ability to explore larger values of t with our current resources. \n\nDespite these challenges, we believe your approach holds significant potential. Developing efficient few-shot diffusion models to simulate larger t attacks is an important direction for future research. However, this goes beyond the scope of our current paper. Our main contribution lies in providing a lightweight watermarking model that demonstrates state-of-the-art performance across various distortions. We are confident that our model can soon be integrated with future diffusion noise layers, and we believe it can as an efficient and effective framework for the watermarking community.\n\n**Q4:** Thank you for your valuable suggestion. We have included the results in Table 3 (linked). For your convenience, we summarize the findings below. Our method consistently performs best in most cases for the PRGAI attack, and it consistently ranks in the top two for the DiffPure attack.\n\n**Q5:**  Thank you for your insightful suggestion. We have included the watermarked image without an attack in Figure 1 (linked) and will update Figure 5 in the final version accordingly.\n\n**Q6:**  Thank you for your insightful suggestion. We conducted extensive experiments to evaluate the model's performance under stronger perturbations, and the results are provided in Table 4 (linked). For your convenience, we summarize the key findings below: Under stronger perturbations, both PH and DO methods remain competitive. Notably, DO outperforms other models across all distortions, except for Median Blur. This confirms the effectiveness of our methods and demonstrates that the robustness acquired from training with less perturbations generalizes well to more perturbations.", "claims_and_evidence": "Yes. The authors provide the convincing experimental result that support their claims. \n\nThe authors compare their method's performance with prior works, demonstrating its effectiveness in terms of lightweight design and decoding accuracy. They also validate the soundness of their loss decomposition and grouping through an ablation study.", "methods_and_evaluation_criteria": "The Decoding-Oriented Surrogate Loss (DO) method makes sense for the problem.\n\nFor evaluation, the authors use an image dataset with a resolution of 3 × 128 × 128, embedding watermark messages (default L = 64) and assessing extraction accuracy across various noisy channels. The evaluation metrics, including the visual preservation score (PSNR) and decoding accuracy, are standard metrics commonly used in the field. Note that they also evaluate robustness against two watermark removal attacks, PRGAI and DiffPure, demonstrating the effectiveness of the watermark under adversarial cases.", "theoretical_claims": "I reviewed Appendix A and E.2, where the authors demonstrate how the loss can be decomposed and grouped based on decoding correctness (Right/Wrong) and decoded value (+/-). The mathematical formulation appears sound, and no major issues were identified in the proofs.", "experimental_designs_or_analyses": "The authors compare message decoding performance against four baselines: HiDDeN, MBRS, CIN, and FIN. The proposed method (lightweight model + DO) achieves performance comparable to the state-of-the-art (SOTA) method FIN, with slight improvements in visual preservation and decoding accuracy.", "relation_to_broader_scientific_literature": "I am not familiar with the broader scientific literature in this area, so I am unable to provide a detailed answer to this question.", "essential_references_not_discussed": "I did not identify any relevant works that are not referenced in the paper.", "other_strengths_and_weaknesses": "**Strengths**\n- The paper is well-written and easy to follow overall.\n\n**Limitations**\n- The authors address limitations in the appendix: there is still room for improvement in the robustness of the watermarking against geometric distortion channels.\n\n**Weakness**\n- Some details remain unclear. Please refer to the Questions section.", "other_comments_or_suggestions": "I believe that the subscript should be written in normal text—for instance, $L_{\\text{deflation}}$ rather than $L_{deflation}$—when it represents a word. Moreover, using $\\log$ instead of $log$ is much more preferred. To express the condition \"and\" in the formula more clearly, it would be better to use the intersection operator—such as $L^{−}_R \\cap L^{>−ε}_R$— rather than $L^{−\\text{and}>−ε}_R$.\n\nSome typos were found in the paper:\n\n1. L159, second column: The phrase \"... first three terms of Equation (3) ...\" seems incorrect, as this paragraph discusses the loss contributed by wrongly decoded bits. It should likely read \"the last three terms.\"\n2. L359, second column: The citation is missing the year.", "questions_for_authors": "1. Is it possible to bound the output value of the decoder to the range [0, 1] using the $\\text{tanh}$ function when using MSELoss? Currently, without the projection head, the output ranges from [-100, 100]. However, for BCELoss, a sigmoid function is typically added to restrict the co-domain of the decoder. Would applying a $\\text{tanh}$ function with MSELoss produce a similar effect, or is there a specific reason for using the current approach?\n2. I am confused about the term \"Combined noise,\" as the performance of these perturbations is evaluated and reported separately. Please explain this term and the experiment design in more detail.\n3. Referring to Section 4.3, the authors use Gaussian noise and a median filter as surrogates for diffusion-based watermark removal attacks for some reasons. Have you tried using a few-step diffusion model or Tweedie Estimation to avoid the multi-step sampling?\n4. Referring to Table 4, the authors only compared the robustness of the baseline (MSE) and the proposed methods (PH and DO). What about prior works (HiDDeN, MBRS, CIN and FIN)?\n5. Referring to Figure 5, it would be better to also show the watermarked image without an attack.\n6. Referring to Table 10, the authors show the robustness when adjusting the noise layer with *less* perturbation. What about when the noise layer is adjusted with *more* perturbation?", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "m6bx55P4Q3", "reviewer": "Reviewer_R1ca", "summary": "This manuscript presents a novel approach to deep learning-based watermarking, aiming to balance efficiency, invisibility, and robustness while reducing computational cost. The key contributions include: 1. Decoding-Oriented Surrogate Loss (DO): The authors identify a mismatch between commonly used decoding losses (e.g., MSE and BCE) and the actual decoding objective. They propose a surrogate loss that mitigates the influence of optimization directions unrelated to decoding accuracy. 2. Detachable Projection Head (PH): A temporary module introduced during training to handle decoding-irrelevant optimization directions, which is removed during inference to reduce model complexity. 3. Lightweight Model: The proposed watermarking model achieves state-of-the-art robustness and invisibility while using only 2.2% of the parameters of previous frameworks. 4. Comprehensive Experiments: The authors validate their approach across multiple distortions (Gaussian blur, noise, JPEG compression, etc.) and show robustness against diffusion-based watermark removal attacks.", "questions": "", "limitations": "", "rating": 3, "confidence": null, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "Thank you for your thorough review and the constructive comments on our manuscript. Below, we address your comments to clarify and improve our manuscript:\n\n**Weakness 1 & Suggestion 1: Can ($\\epsilon$) in DO be Automated Tuning and How to Choose a Reasonable ($\\epsilon$)?**\n\n**1. Can Safe Distance ($\\epsilon$) in DO be Automated Tuning?**\n\nFollowing your suggestion, we attempted to make $\\epsilon$ a learnable parameter integrated into the optimization process. We initially set $\\epsilon$ to 0.1 and left other training settings unchanged. During training, we monitored both decoding accuracy (ACC) and the value of $\\epsilon$. We found that $\\epsilon$ decreased continuously as training progressed and eventually reached 0, leading to instability.\n\nAt this point, the ACC dropped to around 50%, and the model was unable to decode correctly. We analyzed this behavior and identified that in the DO method, the role of $\\epsilon$ in the DO method is to penalize values close to the boundary (0). A larger $\\epsilon$ applies a broader penalty, while a smaller $\\epsilon$ shrinks the penalty range. When $\\epsilon$ reaches 0, no penalty is applied, and the model effectively minimizes $L_{inflation}$ by setting $\\epsilon = 0$, reducing the DO method (i.e., $L_{deflation} + L_{inflation}$) to $L_{deflation}$. As shown in Section 2.2 (\"The Gap between Two Objectives\") of our original paper, this causes model instability, which we further validated and reported in Table 5 of Section 4.4 (Ablation Study).\n\n **How to Choose a Reasonable ($\\epsilon$)?**\n\nWe acknowledge that directly incorporating $\\epsilon$ as a learnable parameter was not feasible. However, your suggestion was valuable, and we conducted extensive experiments on the model's performance under varying $\\epsilon$ values. The results of these experiments are presented in Appendix E.11, offering guidance on selecting an appropriate $\\epsilon$.\n\nFor now, we empirically selected $\\epsilon$ based on these experiments, balancing model stability and optimal performance.  We also plan to explore more automated and convenient methods in future research. We hope this explanation clarifies the challenges we faced and addresses your concerns. \n\n---\n\n**Weakness 2 & Suggestion 2: More Visual Results in Main Text.**\n\nThank you for your constructive comment! Indeed, due to the current length constraints, we are unable to include more images in the main text now. However, in the final version, we will incorporate Figures 3 and 4 into the main body of the paper.\n\n---\n**Question 1: The Motivation of the lightweight deep watermarking model.**\n\nThe motivation behind the lightweight deep watermarking architecture stems from the practical demands of deploying models in resource-constrained environments. The motivations are as follows:\n\n**1. Practical Need for Lightweight Models in Real-World Applications**\nDigital watermarking plays a crucial role in protecting intellectual property across various domains, such as images, videos, and 3D content. However, high-performance models are often impractical for deployment due to their:\n\n- **Large parameter sizes**, which increase storage requirements.\n- **High computational demands**, which exceed the capacity of many real-world systems.\n\nThis challenge is particularly acute in scenarios like **video streaming** and **online education**, where devices must operate efficiently within strict computational and energy constraints. High-performance lightweight models are essential to enable such deployment while remaining effective for copyright protection.\n\n**2. Importance of Lightweight Design in SoC Architectures**\nIn SoC-based environments, lightweight design is not just beneficial but imperative:\n\n- **Storage Constraints**: The storage capacity in embedded devices is limited, making parameter-efficient models essential.\n- **Computational Efficiency**: SoCs lack significant computational power. Lightweight models reduce energy consumption, enabling practical deployment on edge devices.\n\n---\n**Question 2: Further Improving Subjective Visual Quality.**\n- **PSNR** primarily measures pixel-level differences but does not reflect visual quality well in terms of image structure and texture details.\n- **SSIM** considers luminance, contrast, and structure, offering a better alignment with human perception, but it still does not fully capture complex visual features.\n- **LPIPS** compares feature representations from deep neural networks, providing a closer approximation to human perception, especially in terms of high-level perceptual quality.\n\nFor improving subjective visual quality, more detailed experiments can be found in weakness 2 of Reviewer QY8P's feedback. For your convenience, we summarize the results here. We experimented with two approaches: directly adding SSIM and LPIPS losses, and using a discriminator. Both methods effectively improved subjective visual quality (LPIPS), but adding SSIM and LPIPS losses was computationally more efficient.", "claims_and_evidence": "The manuscript claims that existing decoding losses introduce parameter inefficiency by optimizing directions that do not directly contribute to decoding accuracy. To address this, it proposes the Decoding-Oriented Surrogate Loss (DO), which aims to eliminate irrelevant optimization directions, and the Detachable Projection Head (PH), a temporary module used during training to handle decoding-irrelevant tasks. The paper further claims that these methods enhance both robustness and invisibility while significantly reducing model complexity. Experimental results are presented to support these claims, demonstrating that the proposed methods achieve improved decoding accuracy and visual quality across multiple distortions while using only a small fraction of the parameters.", "methods_and_evaluation_criteria": "- Baseline Comparisons: The paper benchmarks against multiple SOTA watermarking models (HiDDeN, MBRS, CIN, FIN).\n- Distortion Types: Assesses performance under Gaussian blur, noise, JPEG compression, dropout, salt & pepper noise, and diffusion-based attacks.\n- Metrics: Uses PSNR, SSIM, LPIPS (visual quality), accuracy (robustness), and FLOPs/parameter numbers (efficiency).", "theoretical_claims": "The manuscript provides a mathematically decomposition of MSE loss (Equation 3) and BCE loss (Equation 21, Appendix A.2), clearly identifying components that do not directly contribute to decoding accuracy. These insights form the foundation for the proposed Decoding-Oriented Surrogate Loss (DO), which offers an innovative approach to improving efficiency by focusing optimization on decoding-relevant directions. This finding is interesting to the deep learning based watermarking community.", "experimental_designs_or_analyses": "1. Soundness: The experiments are well-structured, testing both traditional and diffusion-based watermark removal techniques. Additionally, the authors compare their method with knowledge distillation techniques, demonstrating the effectiveness of their approach.\n2. Ablation Studies: The paper provides detailed analyses of different loss components (Table 5), verifying the necessity of each proposed module. The five modules in the proposed watermarking framework are also thoroughly tested in Table 7 under different distortions.\nHowever, as mentioned in the limitations, the choice of some important hyperparameters is not sufficiently clear. For example, the safe distance (\\epsilon) in the DO loss is manually set. Could this parameter be improved with automated tuning to enhance performance and ease of use?", "relation_to_broader_scientific_literature": "The main problem addressed by this paper is still the visual quality and robustness of deep learning-based watermarking models (e.g., HiDDeN, CIN, FIN, MBRS). Beyond this, the authors also consider model lightweighting, setting their work apart from knowledge distillation methods (e.g., Hinton et al., 2015; Zhao et al., 2022), as their approach does not require a teacher model. Instead, the focus is primarily on improving the shared issues present in the widely used decoding losses (MSE and BCE loss) within watermarking tasks.", "essential_references_not_discussed": "-", "other_strengths_and_weaknesses": "Strengths:\n- The approach is interesting to the digital watermarking community, offering a simple and easy-to-deploy method. The experimental validation is comprehensive, covering multiple distortions and diffusion-based attacks. \n- The proposed separable projection head (PH) and decoding-oriented alternative loss (DO) are effective in mitigating the negative impact of irrelevant optimization directions, enabling the lightweight model to achieve state-of-the-art performance. \n- The novel lightweight watermarking framework outperforms existing models in terms of invisibility, robustness, and efficiency, making it a valuable solution for applications with limited computational resources.\nWeakness:\n- As mentioned in the limitations section, the safe distance (\\epsilon) in the DO loss is manually set. Why hasn't an automated tuning approach been considered for this parameter? Wouldn't this enhance both performance and ease of use, making the method more robust and adaptable?\n- I understand that due to space limitations, the authors have placed a lot of content in the Appendix. However, some important content should be in the main text. For example, Figure 3 in Appendix B and Figure 4 in Appendix C are essential visual representations that are crucial for the paper's presentation and should have been incorporated into the main body of the manuscript.", "other_comments_or_suggestions": "1. Clarification on Hyperparameters:  \nThe manual setting of certain hyperparameters, such as the safe distance (ϵ) in the DO loss, needs further clarification. How is a reasonable value for ϵ chosen in practice? Also, could you explore ways to automate the optimization of ϵ during training to improve adaptability and ease of use?\n2. Figures in Appendix:  \nFigures like Figure 3 in Appendix B and Figure 4 in Appendix C are crucial for understanding the methods. I suggest moving these figures to the main body of the manuscript to improve accessibility and clarity.", "questions_for_authors": "1.\tWhat motivates the design of the lightweight deep watermarking model?\n2.\tThe manuscript uses several evaluation metrics like PSNR, SSIM, and LPIPS to evaluate visual quality. Can you provide more detailed insights on how these metrics compare in terms of their correlation with human perception of image quality, and whether the proposed method could be further improved in subjective visual quality?", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "EhpGQxSFf5", "reviewer": "Reviewer_QY8P", "summary": "The paper proposes a deep watermarking framework that achieves state-of-the-art performance with significantly fewer parameters. The authors identify a mismatch between commonly used decoding losses and the decoding goal, which leads to parameter redundancy. To address this, they propose a Detachable Projection Head (PH) and a new loss function.", "questions": "", "limitations": "", "rating": 3, "confidence": null, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "**Weakness 1: Complexity of MSE Expansion and the Role of Positivity/Negativity**\n\nWe appreciate the your insightful feedback. We understand your concern regarding the complexity. \n\nIn watermark decoding tasks, positivity or negativity is a key criterion for determining whether decoding is correct. This not only serves as the foundation for decoding results but also plays an important role in our analysis, helping to express optimization behaviors such as **inflation** or **deflation**. Therefore, to ensure the rigor and completeness of the proof, considering positivity or negativity is indeed indispensable.\n\nHowever, your suggestion is very reasonable, and we plan to improve the paper in the following ways to enhance readability and clarity:\n\n**1. Simplification of Symbols and Formulae**:  \n   To improve the readability of the formulas, we will simplify certain symbols and expressions. For example, we will rewrite $L_R^{+ and < \\epsilon}$ as $L_R^{+} \\cap L_R^{< \\epsilon}$, making the expression more concise.\n\n**2. A More Intuitive Explanation of Equation 3**:  \n   The goal of decoding is to ensure that the decoded bits are correctly separated from the boundary value (0), without considering the magnitude of each bit (e.g., 0.1 or 1). However, the objective of the MSE loss is not only to ensure that each bit is correctly separated from the boundary value but also to push the bits closer to ±1. Clearly, MSE loss is a stricter loss function, but this stricter requirement does not directly improve decoding accuracy. To highlight the gap between MSE loss and decoding accuracy, we have decomposed it into three parts:\n   - **L_deflation** mainly optimizes the portion of the decoding error and directly affects decoding accuracy.\n   - **L_inflation** and **L_regularization** optimize the portion of correct decoding but do not directly influence decoding accuracy.\n\nAdditionally, based on the analysis of Equation 3, we propose two methods, **PH** and **DO**, to alleviate the redundancy introduced by **L_inflation** and **L_regularization**.\n\n\n---\n\n\n**Weakness 2: Adding perceptual loss or adversarial training for perceptual quality**\n\n**1. Adding perceptual loss:**\n\nFollowing your suggestion, we expanded our experiments to include perceptual loss in our training process. To improve perceptual quality, we incorporated SSIM and LPIPS losses and present the results in Table 1.\n\nAs shown in the Table 1, adding SSIM and LPIPS individually improves SSIM and LPIPS scores, particularly LPIPS, which **is reduced by at least half**.\n\nAlthough a slight drop in PSNR and average accuracy is observed, these trade-offs are reasonable given the enhanced perceptual quality. \n\n**Table 1. Benchmark comparisons on visual quality and robustness against combined noise**\n\n| **Method**         | PSNR | SSIM  | LPIPS   | Ave  |\n|--------------------|----------|-------|---------|---------|\n| PH                | 41.67    | 0.97  | 0.00184 | 99.28   |\n| PH + SSIM         | 41.14    | 0.98  | 0.00173 | 99.13   |\n| PH + LPIPS        | 40.14    | 0.97  | 0.00058 | 99.23   |\n| PH + SSIM + LPIPS | 40.06    | 0.98  | 0.00050 | 99.03   |\n| DO                | 41.70    | 0.97  | 0.00097 | 99.36   |\n| DO + SSIM         | 41.20    | 0.99  | 0.00158 | 99.30   |\n| DO + LPIPS        | 41.15    | 0.97  | 0.00047 | 99.31   |\n| DO + SSIM + LPIPS | 41.05    | 0.99  | 0.00044 | 99.06   |\n---\n\n**2. Adding Adversarial Training：**\n\nTo further investigate adversarial training, we analyzed the impact of adding a discriminator (DIS) to our proposed lightweight model. Detailed results are provided in Appendix E.8, and the key findings are summarized in Table 2.\n\n**Table 2. The Effect of the Discriminator (DIS) on the Proposed Lightweight Model**\n\n| **Method**    | **PSNR** | **SSIM** | **LPIPS** | **Ave** |\n|--------------|--------------|--------------|--------------|------------|\n| **PH w/o DIS**  | 41.67           | 0.97       | 0.00184       | 99.28       |\n| **PH w DIS**    | 41.07           | 0.97       | 0.00157       | 99.31       |\n| **DO w/o DIS**  | 41.70           | 0.97       | 0.00097       | 99.36       |\n| **DO w DIS**    | 41.21           | 0.97       | 0.00062       | 99.34       |\n\nAs observed, the discriminator does indeed lead to some improvement in perceptual quality (LPIPS). Additionally, **efficiency is also a key metric for our model**. As shown in Appendix E.8 Table 13, the discriminator requires **6.8×** more parameters and **8.5×** more FLOPs than our entire lightweight model. Given the small perceptual gain and the substantial increase in computational cost, we prioritize **perceptual loss** as a more efficient approach to enhancing perceptual quality.\n\n---\n\nWe sincerely appreciate your insightful suggestion regarding perceptual quality. Your recommendation to incorporate **perceptual loss** has proven to be effective and efficient, and we will include this experimental analysis in the final version of our paper.", "claims_and_evidence": "Yes", "methods_and_evaluation_criteria": "This scheme should add perceptual loss or adversarial training to enhance perceptual quality.", "theoretical_claims": "No", "experimental_designs_or_analyses": "No", "relation_to_broader_scientific_literature": "N/A", "essential_references_not_discussed": "No", "other_strengths_and_weaknesses": "Strength:\n\nThere is a significant improvement in computation and efficiency. The proposed lightweight model utilizes less parameters compared to state-of-the-art frameworks, while achieving comparable or better performance in terms of invisibility and robustness.\n\nWeaknesses:\n\n(1)\tThis expansion of mean squared error seems to have been complicated. Can an effective analysis still be provided without considering the positivity or negativity of the decoding output?\n\n(2)\tThis scheme should add perceptual loss or adversarial training to enhance perceptual quality.", "other_comments_or_suggestions": "NO", "questions_for_authors": "No", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}]

Author rebuttal:

Meta-review: This paper introduces a novel and practical framework for deep learning-based watermarking that aims to improve decoding efficiency and robustness while significantly reducing model complexity. The main innovations—Decoding-Oriented Surrogate Loss (DO) and Detachable Projection Head (PH)—are both conceptually sound and well-motivated, addressing a known gap in current loss formulations for watermark decoding. The manuscript offers strong empirical support through comprehensive evaluations across various distortions and benchmarking against state-of-the-art models. Despite some concerns from the reviewers, such as some type of distortions not evaluated in the experiments and some important hyperparameters not sufficiently clear, the contributions are meaningful and timely for the watermarking community.
Decision: Accept (poster)