On the Coexistence and Ensembling of Watermarks
Authors: Aleksandar Petrov
Shruti Agarwal
Philip Torr
Adel Bibi
John Collomosse
Venue: NeurIPS 2025 poster ()
Keywords: Watermarking
Ensembling
Machine Learning
Primary area: social_and_economic_aspects_of_machine_learning
TL;DR: We find that, surprisingly, different watermarks can coexist in the same image which enables us to build ensembles of watermarks that can open up new accuracy-robustness-capcity-quality trade-offs without further training.

Abstract: Watermarking, the practice of embedding imperceptible information into media such as images, videos, audio, and text, is essential for intellectual property protection, content provenance and attribution. The growing complexity of digital ecosystems necessitates watermarks for different uses to be embedded in the same media. However, to detect and decode all watermarks, they need to coexist well with one another. We perform the first study of coexistence of deep image watermarking methods and, contrary to intuition, we find that various open-source watermarks can coexist with only minor impacts on image quality and decoding robustness. The coexistence of watermarks also opens the avenue for ensembling watermarking methods. We show how ensembling can increase the overall message capacity and enable new trade-offs between capacity, accuracy, robustness and image quality, without needing to retrain the base models.

On the Coexistence and Ensembling of Watermarks
Aleksandar PetrorA, Shruti Agarwal
Philip Torr
Adel Bibi
John Collomosse
A Adobe Research,
University of Oxford,
University of Surrey
Abstract
Watermarking, the practice of embedding imperceptible information into media such as images, videos, audio, and text, is essential for intellectual property pro- lection, content provenance and attribution. The growing complexity of digital ecosystems necessitates watermarks for different uses to be embedded in the same media. However, detect and decode all watermarks, they need to coexist well with one another. We perform the first study of coexistence of deep image wa- termarking methods and, contrary to intuition, we find that various open-source watermarks can coexist with only minor impacts on image quality and decoding robustness. The coexistence watermarks also opens the avenue for ensembling watermarking methods. We show how ensembling can increase the overall message capacity and enable new trade-offs between capacity, accuracy, robustness and image quality, without needing to retrain the base models.
Introduction
Watermarking, the encoding information into media such as images (Zhu et al., 2018), video (Doerr and Dugelay, 2003; Luo et al., 2023), audio (Hua al., 2016) text (Liu al., 2024) in imperceptible ways, has long been a cornerstone tool for intellectual property protection. While watermarking is not recent growth of Al-generated content and the increased societal expectations and serutiny (Longpre al., 2024). Watermarking has been proposed as tool for restoring stripped content provenance metadata (Collomosse and Parsons, 2024), and for content attribution, where it can be used to trace what training data influenced a newly generated sample (Asnani al., 2024). In spite of concerns about stripping and spoofing watermarks (Zhao et al., 2023), standards such as C2PA (C2PA, 2025) implement solutions with visual similarity search, manifest databases, and robust fingerprinting.
technology, it is experiencing resurgence in interest result of the
Watermarking adoption is increasing, especially if legally required as recently proposed (Ricketts, 2023; Wicks, 2024), making it necessary to consider complex ecosystems of watermark providers. However, in a world with many watermarking algorithms, a user, or more likely, their web browser, would not know which detector to use. As such, sign-posting super watermark added alongside the original watermark can indicate how the original watermark has been encoded and what detector should be used to decode it. Furthermore, different actors need encode different watermarks in the same media, e.g. the author might want to add content provenance watermark, the distributor could apply an intellectual property tracking watermark, and a generative model developer might need a content attribution watermark. Hence, we will likely see more and more cases of multiple watermarks in the same media.
Embedding multiple watermarks in one image requires their cocxistence without mutual interference, enabling independent and accurate decoding of every watermark. Yet, the coexistence of multiple deep learning-baan based watermarks has not been studied, possibly with the assumption that they overwrite each other. That is why conducted comprehensive analysis demonstrating they indeed effectively coexist within the same image. While coexistence incurs minor reductions in image quality and decoding robustness, it persists when controlling for these factors.
39th Conference on Neural Information Processing Systems (NcurIPS 2025).

---

Super watermark
B. Muldi-ccor provenance chains
super watermork:
creater 0ad5 proveionne Meternsrr
An cattor oath wokermork
publicher 1P Wotenmork
image generatios idda metermovk
watermark provider:
API colls to
REA
Siower More reparatue
Potentally gucus
With watermork:
indicated:
Palqutee Bepatable Scasperet
11018..
Dinecty using mair dosoder
Figure I: Two use-cases requiring coexistence of watermarks in the same image. A. A super watermark informs the which watermark detector to use for this image. For super watermark to work. has coexist with the main watermark. B. different actors would use different watermarks content provenance, intellectual property protection and content attribution, these all need to be able to coexist in the same image.
The coexistence of watermarks opens up avenue for building watermarking ensembles. If two watermarks, with capacity my and my bits, generated with different methods can both be present in media, then one effectively encode mi+mi bits in the image. Combining such watermark ensembling with watermark strength clipping and error-correcting codes, can modify the capacity- accuracy-robustnes--qullll trade-off's of existing methods with no need to retrain. We show how one can improve existing watermarking techniques by ensembling them with others.
In summary, the contributions of this paper are as follows:
We evaluate whether image watermarking techniques can coexist when applied to the same image and demonstrate that coexistence happens to much greater degree than expected. ii. We demonstrate that some level of coexistence persists even when one controls for the small quality and robustness degradation resulting of the application of second watermark.
ii. We show how coexistence enables the ensembling of watermarking models and can be used to modify the performance of existing methods without retraining.
Our experiments focus on image watermarks as the most mature watermarking domain but the same principles likely apply video, audio and possibly text watermarking.
2 Preliminaries
Image watermarking. Image watermarking the of encoding string of bits (a secret) by perturbing the pixel values of an image (cover image) in a way that is minimally disruptive and is robust to edits. We will consider the setting when the detector does not have access to the cover image (blind watermarking). Watermarking requires trade-off between four competing objectives:
i. Capacity: the length of the secret message (in bits);
ii Image quality: the amount of distortion added to the cover image to embed the secret, often measured in peak signal-to-noise ratio (PSNR), larger values indicating better quality; ii. Accuracy: the fraction of correctly decoded secrets, usually over test dataset of images; iv. Robustness: the fraction of secrets we can decode correctly when certain transformations edits have been added to the image after watermarking. There is no commonly agreed on set of transformations, so we consider the augmentations used for training several popular methods, namely RivaGAN, SSL, TrustMark (low, medium, high), the details in App. D.
Increasing capacity often lowers the image quality, accuracy, and robustness. Similarly, improving accuracy and robustness typically reduces quality and/or capacity (if using error-correction), while enhancing image quality tends to lower accuracy and robustness. These trade-offs make watermarking multi-objective problem with no single "best" method, with only Pareto-optimal solutions. In the literature, bit accuracy is often measured instead of full secret accuracy. We believe that full secret accuracy is better indicator of performance, recovering the entire message is usually necessary. Therefore, we report the fraction of cases with all bits being correct decoded.
Watermarking methods. Classical watermarking methods are based on perturbing the representa- tion of an image in some transform domain: discrete cosine transforms (Det Tang and Aoki, 1997), discrete wavelet transforms (Dut Wang et al., 1998, or combination of the two (DwtDet Al-Haj. 2007 and DwtDctSvd Navas et al., 2008). Deep watermarking leverages neural networks to do

---

Table I: Watermarks from different methods can coexist. We first apply the watermark corresponding to the row, then the one the column. A new random secret is sampled for every watermark. We report the fraction of secrets with all bits correctly decoded. We show the accuracy of the first method alone (in brackets), followed by the first method when the second is applied, followed by the same for the second method. Surprisingly, for a number of pairs, the application of the second watermark does not overwrite the first watermark. These are the cases where the first two numbers are close, indicating that the accuracy of the first watermark is unaffected when the second applied. The results are averaged over 1020 samples from Adobe Stock.
DwiDal
DwiD
HDD
RxzGAN
RoS
SSL (6205
3GG))
Daebe
DwiDcttid
mm5.0% 0%% 7 serr
retu5%
86%
H0D
Jam 22%
/ 000ur5
sum 06:
/umu 0s.
05
sespes
Zom 56%
/an 40%
2am
/ 43%
mwm.
con 28%
con
/
15L (4248 3040))
206
TrasiMark B
pare 52%
045
20m0
2955
35%
pmn 000
60%
055
TruikMarx
pers
52%
(90%
65%
088
200
7775
ute 35%
47%
Jue 055
195
0% Prets
the encoding and decoding of images, leading more robust watermarks with less distortion with methods such as HiDDeN (Zhu et al., 2018), RivaGAN (Zhang et al., 2019), RoSteALS (Bui et al., 2023b). SSL uses a pretrained image encoder and allows selecting a carrier vector, target image quality and message length at inference time (Fernandez et al., 2022). TrustMark (Bui et al., 2023a, 2025) comes in versions with higher accuracy (TrustMark B) and higher quality (TrustMark Q) and has controllable watermark strength, set to 0.95 by default. Generative watermarking integrates image generation and watermarking to produce watermarked images directly (Wen et al., 2023; Fernandez et al., 2023). However, since these methods do not produce a won-raaermrrred image, we cannot measure quality degradation, hence we will not consider them in this work.
3
Watermarking methods can coexist
Why might we need more than one watermark in the same image? Although media manipulation and disinformation are longstanding issues, recent advancements in generative models have intensified concerns. This has led to push for comprehensive tools to assure media authenticity (Jones, 2023), often relying on watermarking technology (Gowal and Kohli, 2023; David, 2024). with some proposals to mandate it by law (Ricketts, 2023; Wicks, 2024). With many actors introducing watermarks using diverse techniques, determine which decoder to use for given image. For example, C2PA, the most widely adopted content provenance standard, agnostic to watermarking technology and supports any watermark (C2PA, 2025). Naïvely trying all decoders is impractical, as it requires storing all of them locally or making numerous API calls, which is costly and inefficient. Furthermore, different providers might use the same watermarking method but encode the messages in different ways, leading to multiple watermarks being decoded with only one being the intended one.
challenging for users and their web browsers- to
We need an efficient way to identify the decoder for given watermark. One solution is adding a second watermark carrying the provider identifier, similarly disk partition table. We call this identification watermark super watermark (see Fig. IA). With unified standard for the super watermark, web browser could support many decoders without evaluating every image against all of them.' ! For a super watermark to be effective, it must coexist with the main watermark without hindering its decodability. Another scenario requiring watermark coexistence is the increasingly complex media production and distribution chains, with more and more actors adopting watermarking. For instance, a photo might come with a watermark and editing it in Photoshop might add another to recover its provenance metadata, if stripped. Publishers may add watermarks for copyright detection and developers of generative models might watermark the image to track its contribution to new content and remunerate the copyright holder (Fig. IB). These varied uses necessitate that watermarks can be applied and decoded independently, i.e., watermarks that can coexist.
These two settings, super watermarks for selecting the correct decoder and multi-actor content provenance chains, depend on different watermarks coexisting in the same image. Yet, our knowledge, watermark coexistence has not been studied before. While coexistence has been proposed
'Different methods tend to have different watermark residuals (see App. E), hence one might consider training a classifier to map images to watermarking methods. Unfortunately, this is impractical because i) the classifier would need retraining and redistribution for each new method, and ii) different providers might use the same technology but encode messages differently.
3

---

Second watermark
Owcett
DWWDeSedd
HIDDNN
RvGGW
RocibALS
5SL (A2cB. 3001tst
TrustMakk 8
TructMank
106
DviDtt
Dw
HIDDNN
RMOG
First
ReStenls
SRL (4aa 3008S)
TrustMork
Trushook Q
Figure Watermarks can coexist in the same image. show accuracy, robustness and image quality when applying all possible pairs of methods. The left arrow for each metric indicates the change in performance of the first method with and without the second one; vice-versa for the right arrow. In general, two different watermarks can be added to the same image after the other (in series) and both be decoded with non-zero accuracy. However, coexistence tends to come small of accuracy, robustness and image quality. We have highlighted the cases where there is no significant reduction accuracy and robustness.
for classical frequency- these techniques do not apply to modern deep-learning-basee approaches.
methods (Sheppard al., 2001; Wong et al., 2003; Zear al., 2018),
Watermarks can coexist in the same image. Considering that watermark coexistence is critical for multi-actor provenance chains and super watermarking, we study to what extent existing open-source techniques can coexist. In the simplest setting, we can apply two watermarks sequentially and measure the accuracy (fraction correctly decoded secrets) for both methods. We expect the second watermark to be detectable, the presence of the first should not affect the addition of the second. However, we anticipate that the second watermark would overwrite the first, resulting in 0% accuracy for the first watermark. Similarly, different secrets would yield low accuracy for the first secret. In Table 1, we present results for watermarking methods, applying each pair in both possible orders. We report the accuracy of the first method, followed by the second. The accuracy when a method is applied alone shown in grey. When apply SSL after itself,
expect that applying the same watermarking method twice with
two different carrier vectors.
Our first observation that no watermarking method can coexist with itself: decoding the first secret yields 0% accuracy across the diagonal in Table 1. In other words, watermarking methods overwrite

---

their previous message. That holds true also for different but similar methods like TrustMark Q and TrustMark Recovering the first secret is unlikely because even if both secrets were theoretically preserved, decoders can output only one secret. SSL is an exception since both encoder and decoder are conditioned on the carrier vector, yet it too cannot coexist with itself.
Our second observation is the high accuracy for the second method across the board. We see at most a few percentage points drop in accuracy for the second method when two methods are applied. In some cases, we even notice a slight improvement in the accuracy of the second method compared to its solo application, possibly because these methods find it easier to encode noisier images (see columns for DutDct, DwtDctSvd, Ri RivaGAN, and SSL). Therefore, the presence of watermark does not hinder adding a new one. The only exceptions are HiDDeN, RivaGAN, and RoSteALS, whose second watermark shows significantly lower accuracy when the same method is applied twice.
Surprisingly, and contrary to our expectations that watermarks overwrite each other, often the secret of the first watermark can also be decoded with high accuracy! Since this occurs in most cases, it is more interesting to focus on where coexistence fails. As mentioned earlier, when applying the same watermarking method twice, or when watermarks from the same family are used (c.g., TrustMark and TrustMark B or SSL with different carrier vectors), the first watermark's 's secret seems to be overwritten. RoSteALS overwrites the previous watermark, reducing its accuracy by up to 76% (after TrustMark Q). SSL loses significant accuracy when it is the first method, for example, drop by 58% when applied before HiDDeN. In other cases, the first watermark can be detected with only a moderate drop accuracy, with lower numbers corresponding to watermarks with lower baseline accuracy. There are also cases where the detection of the first watermark is improved by the presence of the second, e.g., DwtDet followed by DwtDetSvvd, RivaGAN, SSL, TrustMark B or Mrrk Q. Thus, existing watermarking methods coexist well out of the box.
Channel coding interpretation of why watermark coexistence is surprising. Watermarking transmits information (the message) over medium (the image). Traditionally, communication channels are studied in frequency domain (Goldsmith, 2005). Analogous to multiple watermarking, siquuecy--divsiinn multiple access (FDMA) splits the frequency spectrum among users to prevent interference. However, FDMA requires explicit coordination wwith authorities dividing the radio frequency spectrum limiting users to fraction of the channel's capacity. Watermark coexistence suggests capacity division might be occurring here as well, even without explicit coordination, akin to radio communicators randomly selecting different frequency bands and voluntarily restricting their bandwidth. As deep watermarking is highly non-linear, we cannot directly apply this frequency intuition. Nevertheless, coexistence might indicate that existing methods fail fully utilize the image capacity to carry information imperceptibly. If a method fully utilized the "channel", it would overwrite any other watermark, which Table I indicates to be not happening. In App. A we do offer possible geometric explanation as to why watermark coexsistence might naturally occur and in Table 2 shows that residuals of different methods tend to be orthogonal.
Watermark coexistence does not immediately imply that existing methods are suboptimal. One might assume that current watermarking techniques are close to Pareto-optimal. However, watermark coexistence suggests that deep watermarking methods may not fully utilize the available capacity, i.e., they fail to use the whole channel. If messages of lengths m and my can be encoded and decoded using different methods, then the true watermarking capacity is at least m1+m2, implying that method reaching this capacity should exist. While tempting, this view is too simplistic. Recall the four-way trade-off among capacity, quality, accuracy, and robustness from Sec. 2. To argue that the channel is underutilized, the effective increase in capacity that coexistence hints at must not reduce the other three factors. To check whether the capacity gain from ensembling comes the cost of lower image quality and robustness, in Fig. 2 we show the accuracy, robustness, and quality for both methods and all watermarking pairs. For each metric, we display two arrows: the left for the method applied first and right one for the second. Each arrow starts at the method's standalone value and ends at its value when applied in series. The figure demonstrates that changes in robustness generally track changes in accuracy; when the first method maintains accuracy after the second is applied, it also tends to maintain robustness. There are also cases where the accuracy and robustness of both methods are barely affected by their joint application, for example. DwtDct and DwtDctSvd, TrustMark B or TrustMark Q followed by DwtDct, and HiDDeN followed by SSL, TrustMark or TrustMark (highlighted in Fig. 2). The impact on image quality is more complex. The right-most column in each plot shows that image quality is always worse when two watermarks are applied. Thus, coexistence might involve a trade-off between capacity and quality.
5

---

Second watermark
Owtett
DiWDcSedd
HDDDNN
SvGGW
RocibALS
SSL (4ace. a0bitst
TrustMark 8
TructMark
DviDtt
m
POUD poL0
Dw
HIDDNN
RMOG
First
ReSreNlS
SRL (2aa 3088S)
TrustMork
Trushook Q
Qualtyy
Quality
Figure Controlling for image quality degradation due to ensembling, We can reduce image quality degradation in Fig. 2 due to ensembling by clipping the watermarks to strength 0.5 (see Sec. 4 and Lst. for details). Improving the image quality comes at a further drop in accuracy and robustness but some level of cocxistence (i.c., non-zero accuracy for both methods, the endpoints of the leftmost pair of arrows in cach cell) persists most pairs of watermarks, We have highlighted the cases with accuracy 225%.
For many watermarking method pairs, some level of coxistence preserved even after con- trolling for image quality. We mitigate the lower image quality by reducing the watermark strength so that the final PSNR approximates the mean of the individual methods' PSNRs (details in Lst. with strength=O. 5). The results in Fig. 3 show that controlling for the reduced quality results in non-negligible reduction in accuracy and robustness for most methods though they often are not completely overwritten. As the first set of arrows (corresponding to the detection accuracy) do not go down to zero for most pairs, the accuracy of the first method is not zero (we have highlighted the cases with accuracy 25%)). Therefore, the success of coexistence appears be conditional on the implicil trade-offs between capacity, accuracy, robustness and image quality.
The implicit trade-offs underlying watermark coexistence do not explain why it happens in the first place. At first, the coexistence of watermarks suggests underutilization channel capacity across methods. However, as shown in Fig. 3, the situation is more nuanced: much of the added capacity comes at the cost of reduced quality and robustness. While these trade-offs indicate that underutilization does not fully explain watermark coexistence, they do not clarify why coexistence occurs. Our results suggest that different methods encode information in different, quasi-orthogonal subspaces. It remains open question why this happens and how to encourage prevent it.

---

Existing techniques
Ours
Strength clipping
Error correction
Ensembling
All three together
Reduring mmegm of quality redoces
Froor coneetion nosets annureyy by wriling
Frvemblnn socreones resortyy applyng noo vparev watzrmanss
image
Capacity
Quality
+
Accuracy
Robustness
Strenger
correction eapocity andror acouracy and robustness worse off
Ensembi boasts ata small qu quality capacity and robusoness cost
Depending strength ofe ind individual effects, app ying al three might resui benter model
Figure 4: Comparison of the tools for modifying existing watermarking methods. Combining strength clipping and ECCs with ensembling, as proposed, can vvdglead to new trade-offs and, possibly, better models.
Ensembling as a watermark model modification tool
Applications of invisible watermarks have varying requirements. An image generator developer might be less concerned about artifacts, since users lack non non-watermarked image for comparison, but may wish to encode extra information like the prompt used. In contrast, content provenance frameworks need high image quality to ensure adoption among creators. Conversely, print media watermarking might need higher robustness remain detectable after printing and photographing. with lower capacity and quality requirements. Unfortunately, watermarking methods are not easily customizable. Once trained for a specific trade-off between capacity, quality, accuracy and robustness, adjusting this balance typically requires retraining. 2 Consequently, each application might require slightly different model. Ideally, one would want to modify a watermarking method post-training to adapt it to new application. We have only two tools used for this purpose:
Strength clip:
One can perform a linear interpolation between the original image and the watermarked image. By bringing the final image closer to the original image, can improve the image quality, while reducing the detection accuracy and robustness.
ii Error-correcting codes (ECCs): Error-correctin codes used for reducing errors in data transmission over unreliable or noisy communication channels by reducing the number of information carrying bits from is and introducing n. k redundancy bits in their place (Hamming, 1950). Applying ECCs to the watermarked message reduces the effective capacity of the watermarking method but improves the accuracy and robustness.
While these tools can improve the image quality, accuracy and robustness of existing methods, they cannot increase the information capacity, and b. leave one of the objectives worse off and hence cannot be used to obtain strictly better watermarking method without retraining.
Watermark ensembling boosts capacity. Our observation of watermark coexistence in Sec. 3 offers a potential avenue for a new post-training modification tool: watermark ensembling. the watermarks generated by two different models coexist, then the application of the two methods can be effectively considered to new watermarking method having the sum of the capacities of the individual methods. Hence, ensembling directly addresses the first limitation of strength clip and ECCs: can be used to increase the capacity without retraining (see the third column Fig. 4), For example, ensembling TrustMark B and SSL (42 dB, 100 bits) gives us 200bit capacity at the cost of lower accuracy and robustness (the capacity doubling can be seen in the first column of Fig. 5A).
Combining strength clip, ECC and ensembling could, in principle, result in strictly better models. As seen in Sec. 3, coexistence may come at small quality, accuracy and robustness cost, thus ensembling alone cannot result in strictly better models. Still, the application of all three tools together could, in principle, outperform either of the two models start with. Ensembling two watermarking methods coexisting well together increases the capacity to the sum of the indi- vidual capacities but slightly reduces quality, accuracy and robustness. Clipping the strength of the watermarks will boost image quality and keep the capacity unchanged but may decrease the accuracy and robustness and robustness, though reducing the effective capacity. Depending on the strength of each of the individual steps, we can produce various watermarks with no training whatsoever, as seen in Fig, 4.
further. Finally, applying ECC to the secret restore the accuracy
? Exceptions do exist, e.g., SSL allows choosing the secret length and target PSNR watermarking time.
7

---

Trusthdark 551 isnait 10c6)a))
Trankkarkk so. jszals 100thas)
Restwals 551 (dbatt sabeis
R.RdSNALLS 5, HIDD
strength
strength 100,32)
strength 0.2 UCT1 100,10)
strength and 102,14
1004
Capacity (bits) / Accuracy (%)
140
160
140
120
PSNR (de)
100
40
00
20
Capacity
Accuracy
RMaGAN
SSL
TM
TM M
TM
Quality
Capacity
Accuracy
RiveGAN
SSL TMH
TM M
TM
Quality
Capacity
Accuragy
RIvGGANN
SSL
TMH
TM M
Quality
Capadry
Accuracy
RwaGAN
SSL
TM
TM
Quality
LRobustress
LRobustness
(Robustness
LRobustness
Figure 5: Ensembling with another method can boost performance. These plots show two base watermarking
methods (the starting points of the left and the right arrows for each pair) and their ensemble with strength clipping and ECC (the horizontal lines/arrow ends). In A. the ensemble has significantly larger capacity and image quality, in ensembling SSL with TrustMark boosts its robustness and quality, in C. ensembling RoSteALS with SSL improves its accuracy and quality, and in D. ensembling HiDDeN with RoSteALS boosts its capacity, accuracy, robustness and quality. Numerical values can be found in App. F.
Ensento of ReSteALS BraGAN with LCj121 32,37, tmppntt
Croarble of BudiaaLs and HDCCNN win L0114840034 Iospesity bea
winh L299436 12 cuppeity 36
PottmAL dooo HICOVN
Brow S
Senvee
MOSULL man RoJoNAL
TeSoal show
RoSonkLS ptone
12%
20
Dastberied than
20
38
(PLL 58]
Figure 6: Ensembling as a tool for fine-tuning watermark trade-offs. We show how ensembling (together with strength clipping and ECCs) can obtain models with new accuracy-qualin tradc-offs without further training. In cases when ECC cannot be applied to the baseline models, the ensembles have higher accuracy or better image quality than the base models (A). When ECC be applied to one of the base models, then that can result higher accuracy than ensembling but ensembling still offers better image quality and C).
Experimental setup for testing post-training watermark modifiers. We consider two ensembling approaches: series, where the second watermark is applied to an image already watermarked by the first method (order matters), and parallel, where both watermarks are independently applied to the original image, their residuals are averaged, with the result applied to the original image (order doesn't matter). Pseudo code is provided in Lst. 1. To adjust the watermark strength, we apply PSNR clipping where strength of 0 means the target PSNR is the lower of the individual methods' PSNRs, and strength of means it is the higher one (pseudo code in Lst. 2). Clipping can also use strengths outside this range. While one could apply the same target PSNR for all images, for an image-wise approach since PSNR values vary greatly between images. We use linear codes (Purser, 1995; Guruswami et al., 2023) with block lengths matching the sum of the capacities of the two base methods. We denote a binary linear code as LC[n, k d]. with n being the block size, h the message size, and d the minimum Hamming distance between codewords. Such code reduces the effective capacity from n bits to k bits and can correct up to [d-1)/2] bit flips using the resulting k redundancy bits. The codes we use are from the code tables of Grassl (2006).
opted
Ensembling with another method can boost the watermarking performance. We observe cases where a method is improved along all dimensions. For example, in Fig. 5C, we can see that when RoSteALS is ensembled with SSL (42 dB, 30 bits) (series application, 0.2 clipping, LC 100, 10), Lstt. 7), we can maintain 100 bit capacity while boosting accuracy by almost 15%, robustness with respect to RivaGAN augmentations with more than 8% and quality with 2dB while maintaining the
8

---

robustness to SSL augmentations. While SSL alone has higher accuracy, robustness and image quality, its capacity is significantly lower. Similarly, in Fig. 5D we see the capacity of HiDDeN boosted from 48 bits to 102 bits when ensembled with RoSteALS (series, 1.0 clip, LC[148, 102, 14], Lst. 10), with also small improvements in accuracy, robustness, and quality. At first sight RoSteALS might appear to be better than the ensemble due to its higher accuracy and robustness. However, it has noticeably lower image quality and 2 bits less capacity. However, it is important to note that in both of these cases we improve over watermarking methods which are overall less performant.
Ensembling is not sufficient to produce state-of-the-an watermarking models. Despite the examples above, when ensembling does improve weak watermarking methods, we did not find cases when stronger methods were boosted across all metrics via ensembling. App. shows grid search over different pairs of base models, ECCs, ensembling modes (series vs parallel) and strength clipping settings. While there are ensembles that outperform all the base models across one or more metrics, no ensemble dominates across all metrics. These results, therefore, indicated that ensembling alone cannot produce ofte--o-thhearr models. However, it might be possible that with other base models and other ECCs, ensembling modes or strength clipping techniques, ensembling could result in models that dominate across all dimensions.
Ensembling as a tool for fine-tuning watermarking trade-offs. While it is only for less powerful models that ensembling leads to strictly better models, it can nevertheless be used for targeted adjustments in order to meet the requirements of new watermarking applications. In Fig. 6 we explore how ensembling achieves various uccuracy-qualit trade-offs. Each subplot shows ensembles of a pair of watermarking methods: RivaGAN and DwtDctSvv (with LC[64, 36, 12). Lst. 3), RoSteALS and RivaGAN (with 1.C[131, 32, 37), Lst. 8), and RoSteALS and HiDDeN (with LC[148, 49, 34). Lst. 9). We ensemble them in series and in parallel and apply various levels of strength clipping: from strength -0.2 to strength 1.2. We observe some inherent trade-offs. For example, in Fig. 6A, the base methods have higher accuracy and image quality than the comparable ensembles but 4 bits less capacity. Furthermore, there are ensembles with higher accuracy than the base models (top left corner) and with higher quality than the base models (lower right). In Fig. 6B, while RoSteALS is not on the accuracy-quee quality Pareto front, it has significantly higher capacity than the ensembles (100 bits vs 32 bits). Finally, in Fig. 6C, we see that the ensembles dominate the base models, RoSteALS and HiDDeN, for all accuracy and quality values. However, RoSteALS has a much higher capacity (100 vs 49 bits). Overall, ensembling enables new trade-offs which would otherwise be accessible only via retraining one of the base models.
Parallel ensembling tends to result in higher quality while series ensembling seems to result in higher accuracy. This effect is especially prominent in Fig. 6A and C. As the parallel application multiplies the individual watermarks by 1/2 before combining them, it has a smaller image perturbation, higher quality and less frequent need for strength clipping. This effect is clear from Fig. 7 which shows that all series-ensembled images have PSNR under 40dB but 5.6% of the parallel-enseman images have PSNR higher than that. Finally, in Fig. 6A and C series ensembling without strength clip has a drastic reduction of quality, albeit reaching the highest accuracy in both cases.
In some cases, a strong base method with ECC can perform better than ensembling. We wish to measure the benefit of ensembling beyond only using ECC and strength clipping. Let's first look at applying ECC alone. ECCs are only applicable if the target capacity is lower than the original model capacity; in case of spare bits for redundancy. Thus RivaCAN or DwtDetSvd, the base methods in Fig. 6A, cannot use ECC. In Fig. 6B, we apply LC 32, 25| (Lst. 4) as RoSteALS has capacity 100 bits but the ensembles just 32 bits. While RoSteALS with LC 32, 25) gets close to 100% accuracy, it maintains the poor image quality of RoSteALS. There are ensembles with similar accuracy but about 2dB higher quality. Finally, in Fig. 6C, RoSteALS with LC 48, 20) (Lst. 5) does have significantly higher accuracy than the ensembles with similar PSNR. However, there are ensembles that have up to 3.5 dB higher PSNR. Therefore, there are cases where applying ECC to a base models can result in higher accuracy than ensembling with ECC but ECC cannot always be applied (as in Fig. 6A) and cannot improve the image quality (Fig. 6B, C).
We also compare whether both ECC and strength clipping can outperform ECC, strength clipping and ensembling and find that there are cases where this occurs. For example, in Fig. 8, simply applying 1CC100, 32, 25] (Lst. 4) to TrustMark Q with various strengths dominates all ensembles of RivAN and TrustMark Q. Therefore, there are also cases when one might be better off simply applying ECC and strength clipping (if possible) to the stronger model than to ensemble them first.
9

---

80
Accute 1M
Series
Parallel
20
22.20
20
25
30 Qualitty (PSNR,
35
40
45
SP54,, cI))
Ensembling in parallel results in higher image quality than ensembling in series. The plot shows the distribution PSNR of images watermarked with ensembles of RoSteALS and HiDDeN in series and in parallel (without strength clipping) over 1020 images from Adobe Stock.
Figure 7:
Figure 8: In some cases, applying ECC alone to strong base method can perform better than ensembling. En- sembling Ri vaGAN and TrustMark Q (with various levels of strength clipping vs applying TrustMark Q at various strengths alone. TrustMark Q alone with ECC is better than the ensemble at all quality/aceuracy points.
Overall, ensembling is not one-size-fits-ll solution. Ensembling is the only way to increase the capacity of an existing model without retraining. Combined with ECC and strength clipping. ensembling opens new trade-off points but might not result strictly better watermarks. This is likely due to the added capacity failing to compensate for the reduced accuracy and robustness. For example, LC[200, 100, 32] (Lst. 11) uses 100 error-correcting bits but corrects only at most 15 bit flips. Overall, one might better off to apply ECC and/or strength clipping to a base model, or simply retraining for new configuration, rather than ensembling it with another method.
Discussion and open questions
While we showed that different watermarks can coexist in the same image, we still lack understanding and control of coexistence. Classic frequency analysis offers good mental model but cannot be directly applied to non-linear deep models. We need new theory and tools to characterize and evaluate the non-linear channels for encoding information in images, given resolution, quality and robustness constraints. Such theory would enable coexistence by design: by limiting the channels individual methods use, designing techniques with explicit channel selection allowing multiple coexisting watermarks with the same method, or, conversely, building methods that fail to coexist with any other watermarks thus fully utilising the information- -arraaiinnnnariinngg capacity of the image.
Despite ensembling being used frequently for increasing the accuracy of classification and regression tasks (Dong al., 2020), for boosting robustness (Pang al., 2019; Petrov et al., 2023), for achieving computational efficiency for large models (Fedus et al., 2022), we have not seen it applied to watermarking, possibly because was not obvious that watermarks can coexist. As we showed that watermarks do coexist, we opened an avenue for their ensembling. We observed that ensembling offers nuanced benefits: it boosts the capacity of existing models and open new trade-off points, but sometimes one might be better-off by simply applying ECCs and strength clipping to a single well- performing model as linear codes correct few errors relative to the extra capacity they use. Perhaps, modern ECCs -for instance soft-decision ones which factor in the confidence with which each bit decoded (Fossorier and Lin, 2002) could better utilise the extra capacity. Beyond parallel and series ensembling, there could be more advanced adaptive techniques or small learnable mixers that one could use for more performant ensembles. Finally, a further boost to the accuracy and robustness of the ensembles could be possible by fine-tuning their decoders on the jointly watermarked images.
Our analysis was limited in several ways. We used PSNR as a proxy for image quality despite not tracking human quality perception well; in practice one might want to also consider other quality metrics. Ensembling typically has computational cost: both the encoding and the decoding steps require inference through both watermarking models. This could be addressed by distilling the two models into single one. Finally, we focused on images, but watermarking (and hence their coexistence and ensembling) could be applied to other domains such as video, audio and text.
10

---

Impact statement
This paper explores the coexistence and ensembling of deep learning-basee watermarking methods, with implications for advancing digital media provenance. This work could positively benefit indus- tries reliant on content provenance, such as journalism, entertainment, and Al-generated media. From an ethical perspective, these advancements may strengthen media authenticity, reduce disinformation, and enable fair attribution in the growing digital ecosystem.
Reproducibility statement
To ensure reproducibility of our experiments, we restricted ourselves to watermarking methods with open-source implementations. We used the mnvisible-waterman implementations of DwtDct, DutDctSvd and RivaGAN and the official implementations of SSL, RoSteALS and TrustMark. For HiDDeN, we used the Stable Signature reimplementation. Furthermore, we provide pseudo-code for our ensembling strategies (in App. B), detailed description of the error-correctngg codes we used (in App. C), details about the augmentations for the robustmess measures we benchmarked against (in App. D) and comprehensive tables with all the experiments discussed in the paper (in App. F).
Acknowledgments and Disclosure of Funding
AP is supported by the EPSRC Centre for Doctoral Training in Autonomous Intelligent Machines and Systems (EP/S024050/1), PT is supported by a UKRI grant Turing Al Fellowship (FP/W002981/1), AB acknowledges funding from the KAUST Office of Sponsored Research ASS-CCRG02114401 JC supported in part by the UKRI/EPSRC grant DECaDE Next Stage Centre for the Decentralised Digital Economy (EP/T022485/1).
References
Ali AI-Haj. 2007. Combined DWT-DCT digital image watermarking, Journal of Computer Science, (19):740-746,
Vishal Asnani, John Collomosse, Tu Bui, Xiaoming Liu, and Shruti Agarwal. 2024. ProMark: Proac- tive diffusion watermarking for causal attribution. In Proceedings of the IEEE/CVF Conference on Computer Vision and Puttern Recognition.
Tu Bui, Shruti Agarwal, and John Collomosse. 2023a. TrustMark: Universal watermarking for arbitrary resolution images. arXiv preprint arXiv:2311.18297
Tu Bui, Shruti Agarwal, and John Collomosse, 2025, TrustMark: Robust watermarking and watermark removal for arbitrary resolution images. In Proceedings of the IEEE/CVE International Conference Computer Vision.
Tu Bui, Shruti Agarwal, Ning Yu, and John Collomosse. 2023b. RoSteALS: Robust steganography using autoencoder latent space. In Proceedings of the IEEF/CVF Conference Computer Vision and Pattern Recognition.
C2PA. 2025. C2PA technical specification, v2.2. The Coalition for Content Provenance and Authenticity.
John Collomosse and Andy Parsons. 2024. To authenticity, and beyond! Building safe and fair generative Al upon the three pillars of provenance. IEEE Computer Graphics and Applications, 44(3):82-90.
Emilia David. 2024. OpenAl is adding new watermarks to DALL-E 3. The Verge.
Gwenael Doerr and Jean-Lue Dugelay. 2003. guide tour of video watermarking. Signal processing: Image communication, 18(4):263-222.
Xibin Dong, Zhiwen Yu, Wenming Cao, Yifan Shi, and Qianli Ma. 2020. A survey on ensemble learning. Frontiers of Computer Science, 14:241-258.

---

William Fedus. Jeff Dean, and Barret Zoph. 2022. A review of sparse expert models in deep learning. arXiv preprint MXX1:2209901667.
Pierre Fernandez, Guillaume Couairon, Hervé Jégou, Matthijs Douze, and Teddy Furon. 2023, The stable signature: Rooting watermarks in latent diffusion models. In Proceedings of the IEEE/CVF Internationa Conference on Computer Vision.
Pierre Fernandez, Alexandre Sablayrolles, Teddy Furon, Hervé Jégou, and Matthijs Douze. 2022. Watermarking images in self-supervised latent spaces. In ICASSP 2022-2022 IEEE International Conference on Acoustics, Speech and Signal Processing (ICASSP).
Marc Fossorier and Shu Lin. 2002. Soft-decision decoding of linear block codes based on ordered statisties. IEEE Transactions on Information Theory, 41(5):1379-1366
Andrea Goldsmith. 2005, Wireless Communications. Cambridge University Press.
Sven Gowal and Pushmeet Kohli. 2023. Identifying Al-generated images with SynthID.
Markus Grassl. 2006. Searching for linear codes with large minimum distance. In Discovering Mathematics with Magma: Reducing the Abstract to the Concrete, pages 287-313. CodeTables.de.
Venkatesan Guruswami, Atri Rudra, and Madhu Sudan. 2023. Essential Coding Theory.
Richard W Hamming. 1950. Error detecting and error correcting codes. The Bell System Technical Journal, 1902):147-160.
Guang Hua, Jiwu Huang, Yun Q Shi, Jonathan Goh, and Vrizlynn LL Thing, 2016. Twenty years of digital audio watermarking-42 comprehensive review. Signal Processing, 128:222-242.
Nicola Jones. 2023, How to stop Al deepfakes from sinking society and science. Nature, 621:676- 679.
Aiwei Liu, Leyi Pan, Yijian Lu, Jingjing Li, Xuming Hu, Xi Zhang, Lijie Wen, Irwin King, Hui Xiong, and Philip Yu. 2024. survey text watermarking the era large language models. ACM Computing Surveys
Shayne Longpre, Robert Mahari, Naana Gero, Alex Pentland, and Jad Kabbara. 2024. Data authenticity, consent, & provenance for AI are all broken: What will it take to fix them? In International Conference on Machine Learning.
William Brannon, Tobin South, Katy Ilonka
Xiyang Luo, Yinxiao Li, Huiwen Chang, Ce Liu, Peyman Milanfar, and Feng Yang. 2023. DVMark: A deep multiscale framework for video watermarking. IEEE Transactions on Image Processing.
K. A. Navas, Mathews Cheriyan Ajay, M. Lekshmi, Tampy S. Archana, and M. Sasikumar. 2008. DWT-DCT-SVD based watermarking. 2008 3rd International Conference on Communication Systems Software and Middleware and Workshops (COMSWARE '08), pages 271-274.
Tianyu Pang, Kun Xu, Chao Du, Ning Chen, and Jun Zhu. 2019. Improving adversarial robustness via promoting ensemble diversity. In International Conference on Machine Learning.
James Peters and Piotr Wasilewski. 2012. Tolerance spaces: Origins, theoretical aspects and applications. Information Sciences, 195:211-25
Aleksandar Petrov, Francisco Eiras, Amartya Sanyal, Philip Torr, and Adel Bibi. 2023. Certifying ensembles: A general certification theory with S-Lipschitzness. In International Conference on Machine Learning.
Michael Purser. 1995. Introduction to Error-Correcting Codes. Artech House, Inc.
Pete Ricketts. 2023. S.2765 118th Congress (2023-2024): Advisory for Al-Generated Content Act. (2023, September 12).
Nicholas Paul Sheppard, Reihaneh Safavi-Naini, and Philip Ogunbona. 2001. On multiple water- marking. In Proceedings of the 2001 Workshop on Multimedia and Security: New Challenges, pages 3-6.
12

---

Weili Tang and Y. Aoki. 1997. A DCT-based coding of images in watermarking. In Proceedings of ICICS, 1997 International Conference on Information. Communications and Signal Processing. volume 1, pages 510-512.
Houng-Jyh Mike Wang, Po-Chyi Su, and C.-C. Jay Kuo. 1998. Wavelet-based digital image water- marking. Optics Express, (12):491-44)
Yuxin Wen, John Kirchenbauer, Jonas Geiping, and Tom Goldstein. 2023. Tree-ring watermarks:
Fingerprints for diffusion images that are invisible and robust. arXiv preprint arXiv:23355.20000
Buffy Wicks, 2024. AB 3211: California Digital Content Provenance Standards.
Peter HW Wong, Oscar C Au, and Yick Ming Yeung. 2003. Novel blind multiple watermarking technique for images. IEEE Transactions on Circuits and Systems Video Technology, 13(8):813- 830.
Aditi Zear, Amit Kumar Singh, and Pardeep Kumar. 2018. proposed secure multiple watermarking technique based DWT, DCT and SVD for application in medicine. Multimedia Tools and Applications, 77:4863 4882.
Kevin Alex Zhang, Lei Xu, Alfredo Cuesta-Infante, and Kalyan Veeramachaneni. 2019. Robust invisible video watermarking with attention. arXiv preprint arXiv:1909.0128;
Xuandong Zhao, Kexun Zhang, Zihao Su, Saastha Vasan, Ilya Grishchenko, Christopher Kruegel, Giovanni Vigna, Yu-Xiang Wang, and Lei Li. 2023. Invisible image watermarks are provably removable using generative AL. arXiv preprint arX.v:2306.01953
Jiren Zhu, Russell Kaplan, Justin Johnson, and Li Fei-Fei. 2018. HiDDeN: Hiding data with deep networks. In Proceedings of the European Conference on Computer Vision (ECCV).
13

---

A Geometric intuition as to why watermarks can coexist
We would like offer geometric intuition
why watermarks could coexist in the same image without overwriting one another. One explanation is that watermarks are designed to be robust various augmentations, which induces sparsity into what perturbations can be considered valid watermarks. However, there are many possible sparse patterns that can satisfy the robustness requirements and different watermarking methods might either by random selection, or due to particular design decisions picking different such patterns. As result, the perturbations used by different methods could be overrlaaag and might be sufficiently different that they are still identifiable even after composing.
Consider the space of all images I [0. 1|3x Given an image x E I, watermarking method selects set of images W (x) and maps these images to messages. The capacity of the watermarking and will consider
method in bits thus log, W (x). For illustration will take h discretized pixel values (as used in practice). Hence, our space of all images Z would look like this:
When we watermark an image, we typically want to limit the perturbation applied to an image I as a quality constraint. For example, quality constraint formulated as bound on the PSNR of the watermarked image can be described as limiting ö to lie in B2 e). an l ball centred with radius
v3wh 10log:o At ft-minSNNR/10, with R being the range of pixel values (R in our case). That means that out of the whole image domain above, we can only use the images near clean image The following illustrates these images blue, with æ the centre of the x x cube:
Finally, when watermarking, one typically has robustness constraints as well. That we want that the watermarks are identifiable even after they are perturbed little. Practically, that means that we can only consider subsets of the above blue cube such that all their elements are sufficiently spread out. Formally, the robustness requirement can be formulated as a tolerance relation," that is, non non-transitive equivalence relation ~. For two images a, b the relation a holds if there exists an augmentation under the robustness requirement that transforms a into b or vice-versa For watermarking method to satisfy such a robustness requirement, the set images uses to encode messages cannot contain two images that can be confused under such transformation, that is:
o b,
Va, E W(x).
However, there can exist many such sets W under the same image quality and robustness con- straints.
For the sake of our example, consider that we want our watermarking algorithm to be robust to changing a single pixel value by one discretization step. With this robustness constraint, we can
A tolerance relation on a set A is binary relation that is reflexive (a ~ a for all a E A) and symmetric for all b A). See Peters and Wasilewski (2012) for review tolerance relations.
(a ~ = b
14

---

formulate two sets of images that a watermarking scheme might use (with the original image being marked in red):
Both sets are maximal: we cannot add an extra element that satisfies both the image quality and the robustness constraints. Moreover, as both sets have size that means that the maximum capacity of watermarking algorithms with these constraints is bits. From the above illustration, one can see how the typical watermarking constraints induce symmetries and sparsity over the sets of images that can be used for watermarking.
Notice also that the sets overlapping and, furthermore, when add their perturbations, they are still not-overlapping, indicating why coexistence is possible. For example, if we apply the green watermark to marked blue watermarked image, we see that the green and blue images are not overlapping:
Of course, we also see degradation in the robustness and image quality. In the above illustration, some watermarked images further away from our original image (in red) than the corresponding to our target PSNR. Furthermore, some watermarked images are next to each other, meaning that the they are no longer robust augmentations. However, notice that this is "graceful" degradation: only some images have worsened image quality and robustness. This intuition supports the empirical observations
in Sec. 3.
also important note that in reality, we operate higher dimensions with much more complex robustness requirements. Therefore, the sparsity induced in real watermarking applications would likely be much higher than our toy example. Nevertheless, it remains an open question to perform a formal analysis of watermark coexistence for this general case.
15

---

B Pseudo-code for ensembling and strength clipping
def aaries_anzenble
original: Vasernarkingffeeee VateroarkingNeshod,
vaternarking
List [hool], o2: [ixt[hoo]] the hinary sscreta cornsspending waternarking sathods
} -> inage:
(origina) raterzarked2 (natoorrmarreed x2) return vaternarked2
paraliel..scenble(
12
original: Inage
13
vnl: Varormrkinggeettdd va2: Vaternarkinghethodd, callable watornarking zetžeds
al: Liotlbool), n2: List[bool] the Inage:
for the coressponding katornarking zethods
17
>atermarked! - (nliignnna,, ml)
vaterzarzed2 vnā(eriginai,
residuall vaterzarkedi original
20
residual2 waterzarked2 original
21
parallel original 0.5 recidusil O.5 zesidual2
retura (par(paalll,l,, KIV_PINEL_VALUE. NIX,LIXEL
Listing I: Pseudo-code for the series and parallel in ensembling experiments.
def paax_ Inage, original: Inage, target_panr: float) >> Image: use (aiif-)))
original
scaling-facto egrt (10 (2eepp.oooo (EEIOOOAA_PPEEE)..... PIXE), VALUB -IIE_ target.pent/10.0) / if scaling.faetor >-
elipping is пасaкeатy
return clip(origins) scaling.factor diff, KIN.PINEL,VALUR, MAX_PIRBL_.VAUUE)
def atregth
Ieage,
Ixage
strength: float,
12
znl: Vaternarkingletthd vn2: VaternarkingMethod, callable waternarking xethode
13
al: List [hool], n2: [hoo[ a the
for the corasspending uaternarking sathods
Inage:
15
vaterzarkedi (original, mi)
16
saterrarked2 vn2(orgiinn n2)
17
panr(original, saternarkedi) pear2 penr(origiaal,
20
targer_poar (pearr penr2) strength + (zax(p penr2) pin(pearl, penr2))
(vasermarked, original, target_ppan)
Listing 2: Pseudo-code for the strength clipping in ensembling experiments.
16

---

C Construction of the error-correcting codes
Construction of a linear code [64, 164,88.1 .2] over GF (2):
[1]: [66, 12] Linear Code GF (2)
paraneters
Listing Recipe for constructing LC|64, 36, 12) binary linear error-correcting code capable of correcting up 5 bit flips. Recipe taken from CodeTables.de (Grassl, 2006).
,22,28] (2)
[1]: [192, 33, 26] Quaricyclic of degree 2 Linear Code over OF (2)
QuasiCyclicCede length 102 with goneracing polyzenials: x-46 x-44 x.41 x-39 x x
x x
x x'42 x x040
"33 x-7 x"6 x"4
x*29 x-26
2-23 x
x-19
x
[2]: [101, 32, 26] Linear Code over (2)
Shostening [100. 32,
102
Pancturing of (2) at 101
Listing 4: Recipe for constructing a 100, 32, 25] binary linear error-correcting code capable correcting up to 12 bit flips. Recipe taken from Code de (Grassl, 2006).
Construction of linear cade [100, 48, 201 orez GF (2):
[1]: [104, 52, 20] Linear Code GF (2)
GF of [2]: [100, 48, 20] Linear Code over OF (2)
Retand
Shortening of [t] at [ 101 104 )
Listing 5: Recipe for constructing 1C 48, 20) binary lincar error-correctng code capable of correcting up to 9 bit flips. Recipe taken from dables (Grassl, 2006).
17

---

Construction
[130,330 .3] (F
[1]: [8, 1, Cyclic Linear Code over OF (2)
RepecitioaCode of length 8
[2] [127, 29, 43] Cyclic Lizear Code over C2
Cyclistode
Polynonial
xx82
x-79 x-78 2-77 x- x7
x-
x-70 x-
x-64
x + x x57 x-66 + x-51 x + x x x'43 x" x040 x
x
"31 2-2 x-26 x-25 x-23 1118 x 11 x 2112 x
x x
x"4
[3] [127, 20, 35]
Code
Bubcade of dimensios 30 belseen the eyelic codes of length
127 with Gonsrating Pol Polynoniala x-91
x x*87 x-86
x-
x-30 T8 + x x
x
x
x767
x
x.62
x*
140
33
x3
x-29
x
2-
x-26
x
x223
222 22
x*19 + x-
16
1
x
1113
x"12
11
x
x x 14
and 1988
x-91
x-00
888
88
x-84
8883
x
1880
x-79
T8 x777
"75
"50 x x-45 x'43 x-42
x040
x
x-32
x
x"27
x
-13 211 x115 + 1113 x-12 +
111 x
278
855
4.74
x*2
[4]: [135, 30, 48] Linsar Code 0F (2)
uxing
[5] [131, 30, 40] Linsar Code
(2)
11
Peacturing of [4] at 26, 86, 128
12 [6]: [130, 30, 39] Linear Code OF (2)
Listing 6: Recine for constructing L, 30, binary linear error-correcting code capahle of correcting up 19 flips. Recipe taken from CodeTables.de (Grassl, 2006).
Construction of linear code [130, 1000,100,0000 orer OF (2)
[1]: [0, Cyclis Linear Code GF (2)
hegetistonCode
length
[2]: [136, 106, 9] Linear Code over (2)
Les C1 be the aCliCoede over GP( 2) BCECode paranesere 127 7, Let 02 the SabcodellatveennCoo dimension
105 paraneters 127 9. Return Constructionl using
Ci
[3]: [136, 106, 10] Linear Gode over (2(2)
Extendtode [2] by
[4]: [130, 10] Linear Code (2(2)
Shortening
..
Listing Recipe for constructing a LC 100, 10) binary linear error-correcing code capable of correcting up to bit flips. Recipe taken from CodeTablls.de (Grassl, 2006).
Construction of linear code [:31,32,37] ovez OF
(1]: [8, Cyclic Linear Code (2)
Duul of RepetitionCole of langth
[2]: [127, 29, 43] Cyclic Lisear Code over (F(2)
dyclietode of lengt2 127 with Generating Polymonial x x191 x-90 x'89 85 x x
2-80
x-88 x"57
x-51 x-E0
x-45
x040
1-32
"31 77 + x-28 *22 *723 + 1188 x717 111 *718 #712 + 2111 x x *
x"4 + x-2
[3]: [127, 36, 35]
CF(2)
Cyclincode langth
with Generating Polynonial *781 X789 *787 2786 x782 + =780 x-78
x"76 25 + x-71 + 2-70 2"67 4 2762 X760 + 2550 2"57 + 258 + X-55 *552
x-52 x060 x-49 2-48 + x-47 2-46 x-45 2-43 X-40 x-37 x-35 x-34 x-33
"14 2713
1-10 x-9
x"5
[4]: [135. 36, 37] Linear Code over (2(2)
Constructionk wxing [3] [2] and [1] [5]: [131, 37]
Code (F(2)
Shortaning [4] at 132 .. 135
Listing Recipe constructing LC 32, binary linear error-correcting capable correcting up to 13 bit flips. Recipe taken from CodeTables.te de (Grassl, 2006).
18

---

Construction of linear code [148, 49, ovez (2):
(1): [4, dyclie Linear Code length
RepericiosCode
[2]: [4, 3, 2] dyelic Linear Coda over (2)
Dual of the ZepeticioaCode of length
[3): 4, 'Beed Kuller
3)" Code (2
PlotkinSan
[4): [8, 7, 2] Cyclic Linear Code over (2)
Dual of the RepotirioaCede of length 8
[5): [16.
4] Quasicyclie
degrae Lineer Code (2(
PlotkinBan
12 [8]: [12, 7, 4] quaxicyslie
degres 3 Linaar Code nver GF (2)
13
Shortening of (6] at (.13 )
[7]: [127, 42, 32]
CyclinSode langth Lizear Code
gensrating polynonial x88
x782 x-77 x8
77
+ x 2- + x-70 + x 1*68 x-87 2-65 x-63 + 1660 x-57 +
15
x-55
1-64
x-53 x-11 x-45 2-44 x-43 2-41 + x x-37 x.36 x- x x
x
[8]: [127, 42, 32] Cyclic
avez
17
Cyclictode of length 127 with gensrating polynonial x785 x784 888 X780
X8 + x- x575
x-72 70 x-68 x785 1760 58 7-57 x-56 2-58 K-51
X-47
x748
"17 1-16 x-11 X'B x"5 =+1
18
[9]: [127, 49, 28] Cyclic Lisear Code nver CF(2)
19
Cyclietode of length 127 with generating pelynoniel T8 X-77 76 X-74
X 1-67 x-61
x- 2728 x525
x-20 111 x 18 X-12
2750
8
20
[10]: [147, 49, 34] Linear Coda over OF (2)
CosstructiontX
[9]
[4] [4]
22
[111: [148, 49, 34] Linear Code over GF
23
RatandCode [10] by
Listing 9: Recipe for constructing 148, 49, 34 binary linear error-correcting code capable of correcting up to 16 bit flips. Recipe taken from Code de (Grassl, 2006).
Construction of linear code [140, 1040, 144 orer GF (2)
(1]: [149, 13]
oF
Using the construction Sugiyans with 3-57=x"6 2"106xx'd 43377x23 a-71xx"2 2020 3*6 where :- PrisitivedlemesttCC (2,(1)))
[2] [150, 104, 14] Linear Code over (2
[3]: Extendtode [i]
Shortening of (2) at { 149 150 }
Listing 10: Recipe for constructing a LC 102, 14) binary linear crror-correcting code capable of correcting up to 6 bit flips. Recipe taken from CodeTables.de (Grassl, 2006).
Construction of a linser code [200,100,_] .100,32] over OF (2):
(1): [199, 100, 3i] "Quadratic Residue code" Linser Code over CF (2)
langth
[2]: [200, 52] Linear
(F((2)
EatendCode [s] by
Listing 1I: Recipe for constructing a LC|200, 100, 32] binary linear error-correctigg code capable of correcting up to 15 bit flips. Recipe taken from de (Grassl, 2006).
19

---

D Augmentations used for robustness evaluation
Throughout the paper we use five different robustness measures, each corresponding to a set of augmentations. In this section, we outline the specific augmentations that each robustness measure consists of.
RivaGAN augmentations:
Random crop with scale between 0.8 and 1.0 and with probability 0.5.
Random scale with scale between 0.8 and 1.0 and with probability 0.5.
Random compress by maintaining between 50% and 100% of the frequencies with probabil-
ity 0.5.
SSL augmentations:
Random horizontal flip with probability 0.5.
Followed by one transform randomly sampled from the following list:
Do nothing.
Random rotation with range (-30, 30).
Random crop with scale between 0.2 and 1.0 and ratios between 8/4 and 4/3.
Random resize with scale ratio between 0.2 and 1.0.
Random blur with kernel maximum size 17.
Trustmark Low augmentations:
Random horizontal flip with probability 0.5.
Random resized crop with scale between 0.7 and 1.0 and ratios between 3/4 and 4/3.
Followed by two transforms randomly sampled from the following list:
JPEG compression with quality 70 and with probability 0.5.
Random brightness adjustment to range (0.9, 1.1) with probability 0.5.
Random contrast adjustment to range (0.9, 1.1) with probability 0.5.
Random color jiggle with factor (0.05, 0.05, 0.05, 0.01) and with probability 0.5.
Random grayscale with probability 0.5.
Random Gaussian blur with kemel size 3, sigma (0.1, 1.0) and with probability 0.5.
Random Gaussian noise with std 0.02 and with probability 0.5.
Random hue adjustment with factor (-0.1, 0.1) and with probability 0.5.
Random motion blur with kernel size (3,5), angle (225,25) direction (-0.25, 0.25) and with probability 0.5.
Random posterize to 5 bits with probability 0.5.
Random RGB shift with limit for all channels 0.02 and with probability 0.5.
Random saturation range (0.9, 1.1) and with probability 0.5.
Random sharpness to 1.0 and with probability 0.5.
Random median blur with kernel size 3 and with probability 0.5.
Random box blur with kernel size 3, border type reflect and with probability 0.5.
20

---

Trustmark Medium augmentations:
Random horizontal flip with probability 0.5.
Random resized crop with scale between 0.7 and 1.0 and ratios between 8/4 and 4/3.
Followed by two transforms randomly sampled from the following list:
JPEG compression with quality 50 and with probability 0.5.
Random brightness adjustment to range (0.75, 1.25) with probability 0.5.
Random contrast adjustment to range (0.75, 1.25) with probability 0.5,
Random color jiggle with factor (0.1, 0.1, 0.1, 0.02) and with probability 0.5.
Random grayscale with probability 0.5.
Random Gaussian blur with kernel size 5, sigma (0.1, 1.5) and with probability 0.5.
Random Gaussian noise with std 0.04 and with probability 0.5.
Random hue adjustment with factor (-0.2, 0.2) and with probability 0.5.
Random motion blur with kernel size (3,7), angle (-45, 45), direction (-0.5, 0.5) and with probability 0.5.
Random posterize 4 bits with probability 0.5.
Random RGB shift with limit for all channels 0.05 and with probability 0.5.
Random saturation to range (0.75, 1.25) and with probability 0.5.
Random sharpness to 1.5 and with probability 0.5.
Random median blur with kernel size 3 and with probability 0.5.
Random box blur with kernel size 5, border type reflect and with probability 0.5.
Trustmark High augmentations:
Random horizontal flip with probability 0.5.
Random resized crop with scale between 0.7 and 1.0 and ratios between 3/4 and 4/3.
Followed by two transforms randomly sampled from the following list:
JPEG compression with quality 40 and with probability 0.5.
Random brightness adjustment to range (0.5, 1.5) with probability 0.5.
Random contrast adjustment to range (0.5, 1.5) with probability 0.5.
Random color jiggle with factor 10.1, 0.1, 0.1, 0.05) and with probability 0.5.
Random grayscale with probability 0.5.
Random Gaussian blur with kernel size 7, sigma (0.1, 2.0) and with probability 0.5.
Random Gaussian noise with std 0.08 and with probability 0.5.
Random hue adjustment with factor (-0.5, 0.5) and with probability 0.5.
Random motion blur with kernel size (3,9), angle (-90, 90), direction (-1, 1) and with probability 0.5.
Random posterize 3 bits with probability 0.5.
Random RGB shift with limit for all channels 0.1 and with probability 0.5.
Random saturation to range (0.5, 1.5) and with probability 0.5.
Random sharpness to 2.5 and with probability 0.5.
Random median blur with kernel size 3 and with probability 0.5.
Random box blur with kernel size border type reflect and with probability 0.5.
21

---

E Residuals of various watermarking methods
Figure Residuals (difference between the watermarked and original image) the watermarking methods studied in the paper. The difference is computed in the RGB space and is scaled 10x. One can observe clear differences in how the different methods perturb the images in order to encode their signal.
22

---

Figure 10: Residuals (difference between the watermarked and the original image) for the 8 watermarking methods studied in the paper. The difference computed in the YChCr space and scaled 10x. One observe clear differences how the different methods perturb the images order encode their signal.
23

---

Fourier transform of the residuals (difference between the watermarked and the original image) for the 8 watermarking methods studied in the paper. The difference is computed in the RGB space, the 2D Fourier transform is applied channel-wise, the channels then scaled with ((x) log(1 + abs(z)) and finally normalized lie between and 255 for producing the images. One can observe clear differences how the different methods perturb the images in order to encode their signal.
Figure 11:
24

---

F Extended results
Necund
ECC Easemble Cip Capadly Atcuracy (bits)
PSNR (dB)
PSNR [dB]
RIvGGAN
TmLaw
Trmbted
Thillihh
DwiDa
DwiDkt
parld
05
0.075
35.7
0.0%
0.07%
DoDD
DwiDa
peald
0.06
DudDa
DwiDkt
acrics 0.5
0.0%
40.7
0.0%
0.0%
0.0%
0.0%
0.0%
DoDa
DwiDtt
scries
64
0.0%
40.5
2.2
0.0%
0.0%
0.0%
0.0%
0.0%
DoiDa
DwDDaSed
peald
0.5
64
1000
30.4
4.5
2.0%
0.0%
0.06
0.0%
0.%
DoiDa
DwDaaSed
peald
64
10.0%
39.4
4.5
2.5%
133%
0.0%
0.0%
0.0%
Detba
cenos
0.
52.9%
398
12.0%
0.0%
007
DwDDaSSe
sotio
DodDa
HIDDaN
peald
0.5
0.2%
0.0%
0.0%
0.06
0.0%
0.%
Detba
RIDDeN
pratd
80
0.2%
3700
40
0.0%
0.0%
0.06
0.0%
80%
Dolha
HiDDeN
scrios
0.
0.0%
15.5
3.5
0.0%
0.0%%
0.06
0.0%
00%
Doihd
HiDDeN
actic
50
6.9%
32.0
4.1
1.5%
LIN
0.0%
0.0%
0.%
Detkat
5100%
38.3
12.7%
RoaGAN
prald
15.0%
6006
80%
DedDa
RauGAN
poald
15,075
41.
4.2%
2.4%
0.06
Detbt
REoGAN
senes
0.5
64
34.5%
39.7
21
5AN
3.3%
0.066
0.00
00%
Dwikt
RiOKIAN
sonees
64
45.9%
36
2A
1044
8.1%
0.966
000
10%
DwDa
RoStnALS
paald
0.5
132
2.5%
36.3
3.4
0.9%
0.3%
0.0%
0.0%
00%
Dwtbxt
RoSEALSS
poratd
00%
DoiDa
RoSEALSS
0.5
0.0%
00%
DodDa
ReStALS
scries
35.1%
30.4
8.3%
4.8%
0.0%
0.0
00%
DobDt SSL (42d8.50N8s)
seres
0.5
62
39.1%
40.2
211
9.4%
4.8%
0.066
0.00
00%
DoiDa SSL (42.B,501ax)
sofic
62
40.5%
36.5
2.0
11.5%
6.5%
0.156
0.0%
0.%
DwDD Tiusmak (0.55)
peald
0.5
132
2.2%
418
26
0.7%
0.2%
0.0%
0.0%
0.0%
Doindd Tnmenek (6.95)
peald
132
2.2%
41.7
0.6%
0.2%
0.0%
0.0%
00%
DoiDa
Tuwaeek (0.95)
0.5
0.0%
0.0
DudDa
Trwanek (0.95)
scrics
49.7%%
362
12.9%
5.7%
9.0%
600
00%
DotDa
Trustmak (0.95)
prald
0.
188%
42.1
22
0.4%
0.2%
0.066
000
00%
DoiDa
Trastaak O (0.95)
peald
132
18%
42.1
288
0.5%
0.3%
0.06
0.0%
00%
DwdXt
Trustmank Q (6.95)
senes
05
132
1599%
4U.5
25
3.4%
1.4%
0.16
0094
10%
Detld
Trustmank (0.95)
sonox
49.9%
13.2%
0.0%
009
00%
DwiDd
05
41.7%
11.5%
0.0%
000
11%
DwtDertied
Dwitte
sones
46.775
39.1
11.5%
4.8%
Destbattied
prald
95
000
4.
0.0%
0.0%
0000
00%
DwiDdSiid
DwDDaSid
paald
64
0.0%
38.8
43
0.0%
0.0%
0.066
0.00
00%
DwiDetee
DwiDedivd
senes
05
64
D00%
41.5
24
0.0%
0.0%
0.0%%
0044
00%
Uwiteriid
Duttbettie
00%
DwiDaSid
HiDDeN
paald
05
0.0%
00%
Dw
HiDDeN
porld
0.175
0.0%
0.0%
007
DwiDeSed
HiDDaN
satio
0.
2,3%
35.4
0.5%
0.2%
0.0%
0.%
0.%
DwiDaSid
HIDDaN
scrics
30
11.0%
31.8
3.9
2.6%
1.7%
0.066
0.0%
0.0%
DwiDaSed
32
85.07%
38.
3.
20.3%
15.5%
0.35%
0.4
0.1%
DwiDaSed
BisGAN
LC(5436112
peald -02
36
55.5%
41.3
23
13.5%
9.7%
0.11
0.0%
0.0%
DwiDaSid
RiuGAN
LC16426121
prald
55.9%
12.9%
10.0%
0.2%
0.%%
Danaaad
peald
13.4%
610% 6006
80%
DwiDaSed
RioGAN
1C64433122
peald 811
35.9%
413
14.5%
9.4%
0.11 6.1%%
0.%
0.1%
DuiDaSed
RaaGAN
LC54436121
peald 02
36
55.9%
41.
23
14.5%
10.6%
0.15
900
0.0%
Dannsd
RooKIA
12
prald 0.5
36
55.8%
41.5
23
13.5%
10.9%
0.11
60%
1.1%
DwDDaad
BioGAN
LC(54.36112
prald 0.4
36
55.9%
41.
23
13.25
9.0%
0.0%
0.5%
0.%
Dwibettid
ReaGAN
11
poald 95
14.7%
0.1%
Re0DAN
prald 06
59.3%
13.%%
9.4%
9.17
12%
BioGAN
pridd
87
36
$5.2%
41.5
20
13.1%
8.8%
6.9%
80%
DwitdtSed
RsGGAN
prald 08
36
54.7%
41.7
19
14.1%
10.2%
0.15
0.10
815
DwDDadd
RX0GAN
prald 9M
36
54.0%
41.9
12.9%
9.9%
0116
809
100
DwiDaSed
RAGGAN
LC
paild
36
$3.0%%
42.1
13
12.3%
8.9%
0.25
0.1%
0.5
DwtDetidd
RaaGAN
LC3426112
paald
1.1
51,8%5
13.0%
0.0%
Dwtlered
RsOGAN
[133611
poald 1,2
50.27%
12.5%
8.9%
0106
10%
DwiDaSed
RauGAN
LC6433121
paild
55.9%
41.3
14.0%
10.0%
0.11
0,4%
0.%
DwiDessed
RasGAN
LC343612
series
-22
36
53.47%
37.3
33
13.0%
10.5%
0.26
0.%
8.1%
DwiDeSed
BsoGAN
LC
safas
-0.1
36
54.0%
37.4
33
12.5%
10.2%
0.15
0.2%
0.19
DwiDeSed
RasGAN
LC
seric
36
54.69%
37.7
32
12.7%
9.5%
0.4%
0.1%
0.0%
DwiDeSid
RasGAN
LC1413611
0.1
$4.395
0.0%
BasGAN
safia
A2
13.1%
0.1%
0.2%
0.%
DwiDesed
RaaGAN
LC5433121
03
54.7%
39.0
14.0%
10.0%
0.0%
0.1%
0.1%
Dotosd
RooGAN
84
36
$4.2%
39.5
23
13.9%
8.8%%
0.256
0.0%
10%
BsoGAN
AS
36
5410%
39.7
211
14.1%
9.5%
0.15
0.1%
0.%
DuiDaSed
RssGAN
LC
06
36
53.4%
40.0
200
12.7%
9.3%
0.15%
0.0%
01%
RN
0.7
52.0%
40.3
12.5%
10.4%
00%
BasGAN
AR
11.35
0.75
1000
10%
DwiDeseed
ReoGAN
sones
0.9
51.2%
41.0
13.1%
8.4%
600%
02%
Dottesee
RNoGAN
(1304.6.11
senos
36
49.8%
41.3
12
12.0%
9.2%
0.06
0002
BsoGAN
12 12)
1.1
16
48.2%
41.6
18
12.1%
8.7%
0.11
8004
11%
DwiDeSed
RsOGAN
series
1,2
36
47.0%%
42.0
13
12.0%
8.2%
0.11
0.15
00%
Uwibettd
RNaGAN
53.475
14AN
10.4%
0234
00%
DwieeSed
RasGAN
paald
0.
34.9%
9.3%
0.0%
000
DwDasdd
RauGAN
poald
34.5%
41.3
5.5%
5.0%
0.0
60%
0.7
Dwttesed
REsGAN
seniss
0.5
64
32.8%
39.7
21
5.5%
4.7%
0006
0.17
80%
DwiDaSed
RaGGAN
sorie
64
36.4%
36.1
2.6
9.5%
6.9%
0.06
0.0%
0.0%
DwiddSid
RoSIAALS
paald
0.5
132
5.2%
36.3
3.4
1.3%
0.8%
0.0%
0.0%
0.%
DwiDaSad
R.SIALLS
peald
192
5.2%
362
1.5%
0.6%
0.0%
0.0%
0.%
Dwieesed
RoSEALLS
saries 0.5
DwDaSid
RoSWALS
scries
3.0%
30A
1.0%
0.4%
0.0%
0.0%
0.0%
DiiDsSe SSL (EMJR, 30h1s.)
0.5
62.1%
401
15.05
8.8%
0.0%
0.0%
01%
DuiDaSed SSL (42JB, 30kaa)
safie
62
80.2%
364
2.8
19.7%
14.0%
0.0%
0.1%
0.2%
DwiDdsid Trssmuk B (0.55)
peild
0.5
132
4.9%
41.
25
1.1%
0.9%
0.0%
0.0%
0.0%
Denhidfl Tnoonek (0.95)
prild
112
5.0%
41.
1.5%
0.7%
0.06
0.0%
0.%%
25

---

Find mithod
Nacnnd mithod
FCC Easemble Clip Capadit Arruracy
Moon PSNR (dB]
Sid
Rehnst.
Rubust.
Rehust.
Rubuut.
Robust.
(bits)
PSNK [dB]
RIvIGAN
SSL
TmLLaw
TraMted
Twilligh
Tnremeek (6.85))
scrios
0.5
112
76.9%
19.7
2.5
6.7%
1.7%
0.0%
0.0%%
110%
DuiDaSed
Trwenek (0.955
aztics
132
79.5%
36.0
2.8
19.4%
13.5%
0.25
0.2%
0.0%
Irustaak
porald
0.5
4.2%%
41.9
1.1%
0.06
0.7%
0075
Trustark (0.95)
prald
DwDaaed
Trastark (0.95)
actics
0.5
22.9%
40.3
5.5%
0.0%
0.1%
00%
Trustmark (0.95)
series
132
76.9%
36.5
30
19.3%
11.9%
0.116
0.0%
01%
serios
0.5
30
110%
15.5
3.5
0.1%
0.1%
0.066
0.%
00%
HDDDN
Dwitt
series
80
8.0%
31.5
2.8%
1,0%
0.0%
0.0%
007%
BIDDNN
Dwibbettidd
05
HONN
sones
13.2%
00%
HEDDN
HIDDEN
pazld
0.5
0.0%
33.2
0.0%
0.0%
0.0%
0.%
007
HRDDNN
HIDDON
porld
96
000%
33.2
0.0%
0.0%
0.066
0.0%
00%
HDD
HDDD&N
sctics
0.5
96
0.0%
32.6
4.5
0.0%
0.0%
0.06
0.0%
0.%
HDDDNN
HIDDeN
series
96
0.0%
30.8
4.1
0.0%
0.0%
0.0%
0.0%
0.%
BIDDNN
HEDDN
RosGAN
0.5
0.0%
00%
HEDDN
RauGAN
scrics
9.4%
31.8
2.4%
1.2%
9.0%
0.1%
HIDONN
RoSk:11
1C114849.4
(4
schix
-02
81.6%
10.2
38
54.5%
16 1..5%
0.766 6.26%
0.1%
0.%
HEDDNN
RoSIcALS
1CQ148,4034 34]
scrics
-0.1
40
50 5%
30.4
3.8
40.1%
18.1%
0.25% 02556
0.%
0.%
HDDDN
RoSIcALS
serics
49
79.2%
30.7
38
35.5%
14.3%
0.11 0.15
0.1%
0.15
HEDDON
R
011
31.0
17.9%
18
0.1%%
00%
00%
HEDAN
BeSICALS
1C1148.49.44
saric
02
77.0%
35.0%
15.1%
0.0%
02%
REDDNN
RoSMALS
sones
0.5
75.075
31.5
35.0%
14.0%
9109
HEDDON
(4144.49.44
sonos
84
49
22.
31.7
38
14.3%
0.176
0/1
11%
HIDDAN
(C(48,49954 54]
sotio
a.
49
70.0%
32.0
38
$1.6%
12.8%
0.11
0.1%
000
REDDAN
ReSIALS
[C[148,99344
senes
0.6
49
68.5%
32.5
51.3%
12.3%
0.09%
00%
00%
HIDDON
ReSEALS
8.7
10.1%
12.8%
0.11
01%
HEDDA
ReSIAALS
LCT148,00.44
sories
088
2924%
10-7%
8.12
07N
HEDDEN
RoSIsALS
101148,00.44
senes
0.9
62.97
33.0
20.76
11.9%
0:39
0.32
REDDON
RoSHAAS
senos
49
61.0%
33.3
40
27,9%
10.77
1000
0002
00%
HEDDEN
RoSIEALS
1C1148,99344
scrics
1.1
49
58.8%
33.5
4.1
27.9%
10.8%
0.316
0.0%
0.%
REDDEN
RoSIeALS
101118,9:344
series
1.2
49
56.9%%
33.8
42
26.7%
6.74
0.09%
00%
0.1%
HEDD.N
RoSIcALS
1C148,99.34
sctic
49
85.6%
28.
38
40.5%
1644%
033
0.3%
HEDDNN
RoSICALS
0.5
0.00
000
HDDDNN
RoStALSS
scries
1855
25.8
1.0%
0.1%
007
HDD SSL (4hi))
actic
0.5
01%
37.5
0.0%
0.0%
0.0%%
600
00%
HDD
SSL (42JB,
sorics
78
14.8%
32.0
30
4.7%
LAN%
0.31
0.0
0.0%
Iniemerk R (6.95)
peald
0.5
148
D00%
379
0.0%
0.0%
0.44%
0004
00%
HE0D.N
Tnrencek (0.95)
peald
148
0.0%
37.7
3.0
0.0%
0.0%
0.0%%
00%
009
HDDDN
Tuwamek (00665)
satics
0.5
0.0%
000
Iniemek (0.95)
sonios
12.9%
1.7%
9109
0000
10%
HED0-N
Trastark (0:95)
prald
05
14R
00%
182
0.0%
0.0%
6.06%
0000
60%
HEDDNN
Trustmark Q (0.95)
parld
148
000%
37.9
400
0.0%
0.0%
0:06
0.00
000%
RIDDNN
Trustmak Q (6.95)
sonos
95
148
37.5
5.
0.0%%
0.0%
0004
100
HEDD-N
Trastmakk (0.95)
xzrix
148
10.4%
12.1
1.3%
0 11%
004
00%
RivGAN
Dwibke
series
05
38.5%
10.5%
RisGGAN
Dwibae
sones
43.7%
11.0%
5.8%
RisGAA
DwiDdSid
LC1443611
sories -02
85.0%%
37.3
20.5%
15.3%
0.4%
02%
0.2%
RivGGAN
DwDDdSdd
LC3446112
series
36
84.5%
37.5
34
19.9%
17.6%
0.156
0.2%
0.2%
RisGGAN
Dwibetidd
[243311
senes
36
84.2%
S7M
33
1964
16.1%
0.35
0.1%
100%
RivGAN
DwiDaSid
LC16436111
scrics
0.1
36
82.8%
38.
3.0
19.6%
15.2%
0.256
0.2%
0.2%
RivGAN
DwiDaSid
LC1442612
0.2
15.0%
0.1%
RisGAN
DoDaaSal
LC(44.6.11
0.3
21.2%
15.4%
0.26% (
0.4%
0.1%
RisGAA
DxDassd
LC1443612
sarics
0.4
27.1%%
39.3
18.6%
13.5% -
0.25%
0.2%
0.2%
RivGAA
DwDaSid
LC6443612
series
0.5
36
74,8%
38.6
2.1
18.7%
13.6%
0.15% 0115
0.1%
0.1%
RisGAN
DodDaSel
12
sofics
0.6
36
72.7%
39.9
1.0
18.5%
13.9%
0.35 0.55
0.1%
8.1%
RivGAN
DxdDaSed
LC(4433222
sarics
0.7
36
70.1%
40.2
1.7
16.2%
11.3%
0.3%
0
0.2%
0.2%
RivGAN
DwiDaSid
LC14426111
0.8
16.5%
12.5%
RisGAN
DodDaSal
15.%%
10.6%
1115
0.1%
0.%
RicGAN
DwdDaSel
LC543312
61.3%
41.3
18
15A%
11.0%
0.3%%
0.2
60%
RivIGAN
Dettadidd
senos
1.1
36
59.7%
41.6
1.
16.3%
10.1%
0.17%
0.2%
81%
RisGAN
DoDDaSol
1.2
16
55.9%
42.0
20
11.1%
10.5%
0.11
0.1%
81%
RisGAN
DedDaSol
LQ643612
aafox
36
86.9%
36.0
21.24
16.2%
0.26%
0.1%
0.%
RisGGA
Dwibbettid
85
$7.3%
39.6
15.9%
00%%
00%
RisGAN
DodlaaSe
17.35
11.8%
6.11%
0.1%
80%
RisGGAN
HIDDeN
pold
0.
0.25
0.0%%
0.0%
0.00
60%
007
RivIGAN
HiDDeN
prald
80
0.2%%
37.6
37
0.1%
0.0%
000%
00%
RisGAN
BiDDeN
sonos
05
80
0.5%
36.7
233
0.14
0.1%
0004
00%
RIvGAN
HIDDeN
serees
30
11.9%
31.8
3.8
3.7%
1.5%
0.05%
00%4
0.0
RivGAN
71.9%
29.3%
2734
24.9%
RisGAN
RAuGAN
peald 05
6.0%
0.0%
RisGAN
RANGAN
pozld
0.075
42.6
0.0%
0.0%
0.0%
60%
0.0
RisGGA
RESGAN
series 0.
64
B.0%
40.7
0.7
0.0%
0.0%
0.06
000
00%
RisGAN
RasGAN
safee
64
0.0%
37.8
122
0.0%
0.0%
0/06
8.0
0.0
RisGAN
RoSICALS
1C1131,32.77
paald -02
32
97.4%
36.4
3.0
51.6%
29.4%
0.25
0.%
0.2%
RisGAN
ReSCALS
Ic(13132,57]
peald -11
12
97.4%
164
43.0%
78
0.4%
0.4%
0.4%
RisGAN
ReSIALLS
1C1131,32,57)
peald
27.7%
0.4%
RisGAN
RoSHALS
1C1131,32571
prild 0.1
97.4%
36A
45.3%
20.3%
0.3%
0.7%
0.%
RisGAN
BoSkA1S
(c(19139257)
prald 02
97.4%
164
48.15
0.1%
0.3%
0.4%
RisGAN
R.SEALL
1c(131,32.57)
peald 03
32
97.4%
36.
3.0
51.4%
20.2%
0.3%
0.2%
0.3%
RISGGAN
RcSHALS
[<1131,32,57]
pridd 0.6
32
9T.0%
36.5
24
49.0%
28.3%
0.0%
0.2%
1.1%
RisGAN
ReSEALS
1<(13,32,57]
prald 05
12
94.9%
3688
1%
29.0%
0.11%
0.9%
0.2%
RisGAN
BeSIALLS
1C[131,32377]
peald 06
90.7%
0.5%
RISGGAN
ROSHALS
[K[111,32_57]
pold 077
8507%
381
41.9%
22.5%
0.3%
0.2%
0.5
RisGAN
RoSBALS
[<131133257]
poadd 88
32
79.8%
3900
111
40,0%
21.9%
0.4%
0.3%
81%
RiuGAN
RoSIALLS
1C1131,32.371
prid 3.9
32
74.5%
39.9
0.9
37.2%
20.0%
0.15
0.0%
0.2%
26

---

Find mothod
Nacund mithod
FCC Easembrr Clp Capadiy Arruracy
Moon PSNR (dB]
Sid
Rahnst.
Rubust.
Rehust.
Rubuut.
Robust.
(bits)
PSNK [dB]
RivIGAN
SSL
TmLLaw
TraMted
Twilligh
EisGAN
[<(13132257)
peald
12
67.2%
4118
0.7
57.4%
19.4%
0.1%
0.3%
0.2%
RisGAN
BoSIcALS
1C(131,2257)
peald 1.1
32
39.6%
41.
0.3
50.2%
16.8%
0.0%
0.1%
0.1%
KivGIAN
RoSIAALS
[K1131332577]
prald 1.2
53.15 1%5
20.4%
15.4%
0.17
0075
BiaGAN
S
1<(131392577)
peald
RisGAN
BoSicALS
1C(131,32,77
sctix -02
99.5%
310
51.5%
31.0%
0.8%
0.5%
0.%
RiNGAN
RoSReALS
161131,322577
senes -0.1
32
99.5%
31.0
35
51.5%
11.3%
0.256
0.4%
0.77
ReGGAN
14(131.32.57)
soniss 0
32
99.5%
31.5
36
50.9%
10.9%
0.4%6
0.5%
0.%
RINGAN
RoSIAALS
LC1131.22.57
series
0.1
32
99.1%
32.3
32
49.9%
32.1%
0.5%
0.5%
0.2%
RiaGAN
RoSIAALS
1C1131.32.57]
92
31.0%
0.3%
RISGAN
RoSHALS
[<(111.32.57)
10n0s
03
49.4%
28.7%
RiaGAN
ReSHALSS
1C1131.32.77
0.4
95.075
35.1
67.2%
27.3%
0.4%
0.3%
0.2%
RivGAN
RoSIENLS
1C(131.32.577
senes
055
32
91.7%
36.1
15
47.7%
25.4%
0.256
0.3%
0.7%
RisGAN
RoSICALS
1c(131,32..57
kaia
0.6
32
87.69
37.0
1.6
44.7%
24.4%
0.3%6
04%
0.3%
RivGAN
RoSICALS
LC1131,32.577
sefies
0.7
32
82.9%
35.0
122
43.0%
22.9%
0,256
0.2%
0.3%
RivGAN
RoSIAALS
[C1131.32.577
08
38.9
21.0%
RiaGAN
RoSIcALS
1C1131,32.57)
0.9
35.2%
19.3%
RiaGAN
ReSIcALS
1C1131,325711
sorcc
65.3%
40.8
32.5%
16.5%
0.56
000
015
KieGAN
B
kchox
1.1
12
58.1%
412
02
16.0%
6.116
0.7%
01%
RisGAN
RoSIcALS
1c(131,32.57]
safos 1.2
32
51.6%
42.7
0.
24.5%
13.1%
0.156
0.0%
81%
RisGAN
RoStcALS
1C1131,32.577
sefics
32
99.4%
30.9
33
51.4%
29.8%
0.4%
0.3%
0.6%
RiaGAN
ReStaLS
prald 05
112
168
25
2.1%
0.7%
0.0%
0.0%
00%
RiaGAN
ReSIcALS
peald
0.06
00%
RISGGA
ReSMALS
sones 0.
5M15
36.1
2,4
0.7%
0106
KieGAN
ReSeALS
sonos
132
2400%
309
33
10.9%
5.0%
0.06
0.0%
00%
EioGAN SSL. (6b4)
0.
62
63.7%
414
06
90.9%
20.7%
11 11.9%
11.8%
104%
RisGAN
SSL (42a).50bas)
senes
62
69.9%
3K4
U.
64.3%
24.7%
21.0%
19.15
153%
KiaGIAN
Insemek (6.0.99 (8.95)
poild
85
2.9%
428
4.1%
1.4%
00%
RiuGAN
Twumak (0.85)
paald
1.0%
100
11%
RisGGN
Trusnack (0.95)
senes
0.5
26,275
25.4%
5.7%
900
RisGGAN
Divmmrnt (0.95)
senos
132
0K00%
37.5
11
64.%%
1899%
21.95
1800
RisGAN
Trusmark (0.95)
paatd
0.5
132
3.5%
43.3
12
4.1%
0.6%
1,156
0.3
RivGGAN
Trusmark (0.95)
parld
132
3.5%
43.3
12
4.2%
0.8%
0.756
0,5%
0.59
RisGAN
Truataak Q (0.85)
0.
132
21.6%
41.5
12
24.14
5.1%
7.9%
6.%
60%
RisGAN
Trustark
sorics
67.2%
65.0%
16.3%
22.4%
20200
1980
RoSIAALS
DwiDtt
scries
0.5
13,47
348
277
1.N%
007
BoSkALS
DwiDd
36.8%
3044
4.6%
6.0%
000
00%
RoSk:LS
DwDaaSed
scrics 0.5
132
16.0%
34.8
3.
4.2%%
2.7%
0.066
0.0%
00%
RoSk-AI S
Dotbatoed
sonos
112
65.1%
304
54
11.3%
0.16
0.15
80%
BoSICALS
HDDDaN
101141102.14 14]
xcrio
102
21.5%
33.3
40
8.24
5.2%
0.0%%
00%
00%
RoSCALS
HIDDaN 1C1148,49.44
peald
25.24
10.5%
0.1%
1000
0.0
RoSeALS
(C(148.90.44
prald
6007
37
10.9%
BoSkALS
HIDDNN
1C(148.9,34
peald
60.0%
34.5
30
10:2%
6.0%%
0000
00%
RoSieALS
HiDDeN
1C[148,89944]
parad 0.1
49
6007%
34.5
37
20.24
10.0%
0.116
0000
107
RoSWALS
MDDDON
LC(148,49344 54)
prald 022
4V
6007%
34.5
57
25
10.4%
0.165
0004
100
RoSWALS
HiDDAN
IC[148,99
peald
03
600%
34.5
30
21 14
9.6%
0.99%
00%
ROSIALSS
HIDDeN
141148.99:44
poald
0.4
27.0%
11.7%
000
ROSEALS
HIDDON
[C(148.00.44
poald 05
60075
37
25.04
19-17
9:16
RoSEALS
HIDDaN
1C1148,40.44
palld 0.6
60.0%
34.5
37
26,4%
11.7%
0,00
00%
RoSIALL
RDDDNN
1C[148,69.44)
parld
R7
49
59.9%
34.5
37
25
10,4%
0000
0.1%
00%
ROSMALS
RDDDNN
[C(148.19.44
prald
0N
59.9%
36.5
57
25,0%
10.0%
100%%
0.25
0.154
100
RaSICALS
HDDDN
LC[148,9234]
palld
0.9
49
59.4%
34.6
3.7
27.2%
10.8%
0.9%
0.%%
0.0
RoSIALLS
HIDDeN
LC1148,89:44
25.3%
0.0%
BoSCALS
1C[148,40.44
peald
25.0%
10.4%
00%
01%
RoSEALS
HIDDAN
4C1148,00.44
peild
12
57,3%
34.9
25.3%
9.0%
-.0%%
0.06
0.0
0.1%
RoSicALS
HDDON
LC[148,99.44
prald
49
60.0%
34.5
37
25.7%
11.8%
0.066
0.0%
0.%
RoSicALS
HI0D-N
LC[148.49.3 34)
soriss
-02
49
91.9%
30.2
3.8
45.6%
30.0%
0.256
0.2%
00%
BaSICALS
HDDDN
LC[148,92.44
scrics
-0.1
49
91.0%
30.4
38
44.2%
19.1%
0.11%
0.%%
0.0%
RoSIAALS
HIDDAN
3C1148,99.44
89.9%
43.2%
0.3%
02%
BoSKALS
1C[148.4
41.0%
21 4.%%
6.15
0.%
BoSKALS
HIDDAN
4C1148.0.344
scric
02
88.3%
312
37
19-5% -
0.35%
0.0%
03%
RoSMALS
(C(148.99344
seros
0.5
49
87.0%
31.5
41.7%
19.4%
0.17
0.17%
10%
BoSKALS
HDDDNN
1C [C[48.49.4 44)
0.4
49
85.1%
31.7
47.4%
17.7%
6.15
8.%%
02%
BoSIALLS
HIDDNN
LC[148,9,344 34]
aaric
0.
49
81.6%
3200
38
38.0%
17.6%
0.11% 1.1
0.2%
RoSIAALS
RiDDON
[4
0.6
16.1%
0.1%
00%
IC[148.0044
07
11.0%
19.9%
6.75
0.1%
10%
RoSIALS
HIDDeN
1C[148,0234
series
08
75.075
32.8
36.4%
15.4%
0.0%
0.1%
025
RoSHALS
HiDDeN
[C(148.99.44
senes
0.9
49
73.3%
33.0
40
34.7%
14.0%
0.06
0,0%
0.5
ROSWALS
14 LC1148,9934 54)
sonos
49
72.7%
33.5
40
54.1%
14.4%
0.35%
0004
10%
RaSHAALS
HDDDN
LC[118
series
1.1
49
69.47
33.5
35.1%
13.1%
02%
00%
ROSHAALS
MIDDON
14
1.2
12.7%
80%
ReSEALL
HIDDN
1C1148,0034)
94.9%
47.3%
24.5%
0.266
0.3%
RoSIAALS
HIDDAN
poild
0.5
148
0.07%
34.5
0.0%
0.0%
0.0%
60%
0.0%
ROSHALL
HIDDON
parld
148
BAP%
31.5
37
0.0%
0.0%
0/06
0.0%
00%
RoSKALS
HIDD&N
scrics
0.
148
0.2%
32.0
3.8
0.0%
0.0%
8.0%
0.%
RoSICALS
HIDDeN
series
148
7.0%
28.7
3.
1.5%
LIN%
0.0%%
0.0%
0.0
BoSICALS
1C(100,22255]
12
99.9%
31.4
50.4%
M.75%
0.4%
0.5%
0.5%
RoSKALS
1C1100,44:000
0.3%
RoSICALS
72.1%
31.4
35.4%
22.1%
0.1%
0.1%
0.1%
RoSeALS
RioGAN
(C(33132397
kcriox -0.2
99.9%
308
50.0%
M0.6%
0.5%
0.8%
0.%%
BaSWALS
BioGAN
1c(131,32.57]
scrios -0.1
32
99.8%
30.
3.5
$2.1%
30.5%
0.4%
0.7%
0.9%
ROSMALS
RIOGIAN
[c1131,32,77]
seness
0
32
99.9%
31.3
36
51.7%
31.2%
0.5%
0.4%
0.3%
RoSWALS
RooGIAN
1<[13,32,57]
0.1
12
99.8%
12.5
51.5%
10.0%
0.4%
0.4%
0.6%
BoSKALS
RisGAN 1C[131,32377]
0.2
$1.0%
ROSEALS
ReSGAN 1K[131_32_57]
sones
0.5
98377
50.0%
30.8%
0.5%
0,4%
0.25
ROSMALS
RioGAN [<(111,9257]]
sinos
84
32
87.1%
35.1
222
49.1%
29.0%
0.1%
0.3%
0.5%
RoSIALSS
RAGGAN
1C1131,32,371
series
0.5
32
94,4%
36.1
19
43.9%
27.5%
0.35
0.3%
0.1%
27

---

Find mothod
Nacund mithod
FCC Easemble Clip Capadit Arruracy
Mhon PSNR (dB]
Sid
Rehnst.
Rubust. SSL
Rehust.
Rubuut.
Robuut.
(bits)
PSNK [dB]
RIvIGAN
TmLLaw
TraMted
Twilligh
R
EsoKIAN
[C(33132257)
sorios 0.6
12:
86.7%
17.0
1.6
43.0%
24.1%
0.0%
0.2%
0.1%
B
BosDAN
1C(131,2257)
xatic 0.7
32
83.2%
38.0
1.2
43.3%
22.1%
0.15%
0.1%
0.1%
RoSIAALS
ReoGAN
[K1131332577]
0.5
77.9%
38.9
60.1%
22.3%
0.116
0.25
0.1%
12(111922577
BoSkALS
RioGAN
1C(131,22.77
40.
33.7%
16.8%
0.15
0.1%
011%
RoSieALS
ReoGAN
161131,322577
senos
1.1
32
55.37
418
0.7
27.0%
15.8%
0.256
0.0%
0.1%
RoSwALS
EsoDIN
14(131.32,57)
soniss
1.2
32
40.2%
42.7
115
21.9%
14.8%
0.116
0.2%
01%
RaSHAALS
RNOGAN
1C(131,32.57)
series
32
59.9%
30.7
3.1
54.5%
28.3%
0.5%
0.4%
0.5%
RoSIALSS
ResGAN
05
KOTS
ROSeALS
sones
22.5%
007
RoSIAALS
ReSHAASS
paald
0.5
200
0.075
322
0.0%
0.0%
0.0%
0.%
007
RoSHAALS
RoSHAALS
parld
200
0.7%
32.2
36
0.0%
0.0%
0.06
0.0%
00%
RoSKALL
RoSHALS
scrics
0.5
200
0.0%
31.3
3.6
0.0%
0.0%
0.06
0.0%
0.%
RaSIAALS
RoSteALS
scries
200
0.0%
27.8
32
0.0%
0.0%
0.0%
0.0%
0.0%
RoSieALS SSL (62d8.20bas)
(0115001001100
0.2
100
43.8%
21.8%
0.75
RoSKALS SSL (4208,30684))
satics
0.5
20.0%
0.0%
RoSIcALS
SSL (4248,000aa
scrics
130
66.8%
30.9
32.5%
16.8%
0.0%
0.5%
Tnmemeek (0.95)
prald
0.
200
4.6%
36.0
30
1.5%
1.0%
0.066
0.0%
60%
BoSisALS
Trwoneek (0.95)
peald
200
4.7%
36.4
3.2
2.7%
1.6%
0.066
0.0%
0.%
RaSWAALS
Trsanek (0.85)
scrics
0.5
200
5.8%
36.3
27
2.6%
1.9%
0.0%
0.0%
0.0%
RoSeALS
Tnienekk (0.955)
2000
46.9%
108
28.7%
14.7%
0.0%
0.1%
00%
BaScALS
Trustmark (0.95)
peald
0.
200
0.06
RoSIAAL
Tristark (0.95)
porad
200
3075
36.5
1A%
0.8%
9109 0109
RoSMALS
Trusmark (0.30 95)
scnos
9.5
2000
5.3%
3688
2
3.1%
1.2%
00%
BoSicAL5
Trastaak (0:95)
200
50.2%
30
34
24.9%
16.5%
0.96
0.2%
00%
SSL (4Ld1,21,,000
Dwitte
porale
0.5
62
9-87%
42.3
26
2.7%
0.9%
0.0%
00%
00%
SSL (
Uwithet
poald
2.3%
0.0%
00%
SSL (4240,2080s)
DwiDtt
0.5
25.0%5
0.0%
0000
000
SSL (:200,2000)
Dwittt
senes
32,075
36.5
7.5%
2.8%
600%
SSL (C2di, JuNns
prald
9.5
62
21.5%
42.2
25
6/1%
2:28
0106
0000
00%
SSL (42.8. 300ss
DwdDaSid
peald
62
21.5%
42.1
277
5.1%
1.9%
0.066
0.0%
0.%
(4248, (4260,20h0s) 20h0s)
DwiDeiid
series
0.5
62
46.8%
40.2
21
12.3%
6.9%
0.056
0.0%
0.15
SSL. (42,B, (42.8,300aa) 30b4a)
DodDaSal
scrics
62
64.0%
36.4
28
1544
9.2%
0.0%%
0.1%
0.0%
SSL (42., 20
HIDDeN
0.5
0.0%
SSL (42d8 (0000
HIDDeN
poald
0.3%5
37.9
0.0%
0.0%
0.066
0.0
007
(+2,,, 2014))
HIDD&N
0.5
0.1%
37.4
0.0%
0.0%
0.0%%
0.0%
00%
SSL, (42an 20N6s
HIDD&N
scrce
78
5.1%
32.0
3.9
1.4%
0.6%
0.966
0.0%
0.%
SSI. (etan NINN)
30
61.8%
42.
06
MA 1%
78.8%
5% 146
$2.75
47.%
SSL. (42a8, N0bis)
BosGAN
peald
0.
62
27.8%
43.7
11.6%
4.3%
1.5%
1.0%
1.5%
SSL. (42,n, 50hil)
RisGAN
10.7%
6.9% 0.9%
10%
44%
(67dm1 (INN)
RiOGAN
soness
05
53.4%
17.4%
12.8%
S8I, (42I), (0hi))
B
64.8%
38.4
51.4%
17.5%
13.70%
1032
820
(S2dH 20NNS)
RoSIAALS
poratd
95
130
KOPS
37.5
25
2.7%
1/4%
0.00
0000
SSL (42di) NihN))
ReSWALS
poald
130
K.%%
368
32
1.14
1.2%
0004
(42d0, 10b4))
R
szrix
0.
130
2.5%
167
19
0.74
0.4%
0.09%
0044
60%
SSL (42d8,
RoSHALLS
15.0%
2.2%
0.0%
805
SSL (62,6,2H0,0)
(4Idi).000s) (bbas)
porld
0.
0.0%
0.0%
9106
SSL (4248,
SSL (424B.208a))
pozld
0.0%
46.
0.0%
0.0%
0.0%
00%
00%
SSL (4249.3001
SSL 20205)
series
0.5
60
0.0%
42.1
0.6
0.0%
0.0%
0.066
0.0%
00%
SSL (42d0.0000
SSL (4Idm, (0has)
senes
9.5
60
000%
42.1
UA
0.0%
0.0%
0.16
0.0%
100%
SSL. (42.B (22im. SSL 30baa)
scries
60
0.0%
3P.1
0.0%
0.0%
0.0%
0.0%
0.0%
SSL (4248, 20043)
(4248.0088)
(42.in, (4241))00hh)))
Treeneek (0.05)
peald
a.
1.2%
0.8%
0.3%
(52,4420,,100 (42.0.208is)
Trusmee (0.95)
peald
5.3%
43.8
3.1
1.6%
1.4%
0.3%
0.7%
SSL (4288.0005)
Trusnnak B (0.95)
scries
0.5
130
35.4%
41.7
1,
25.2%
16.3%
13,856
12.3%
9,5%
(42.B Nihis)
Tnnencek (0.95)
scrics
130
77.7%
38.4
12
65.5%
41 41.5%
43 166
36.7%
32.7%
SSL. (42,B (42.8.3000a))
Truatmakk Q (0.85)
peald
0.5
130
2.5%
44.3
LI
2.0%
1.2%
0.5%
0.3%
0.4%
SSL (4248, 20his)
Trustnark
(43,01, 1(Hbs)
Trustmakk
soriox
0.5
28 14
14.2%
13 4%
11.05
90%
Truatmark (0:95)
scrics
27.3%
39.0
12
17.6%
40-55%
34.0%
1188
Inusmert B (0:5)
Dwitict
serios
9.5
132
20.5%
39.7
24
4.7%
2.5%
0.00
Tnommrr B (0:05)
Duifhe
scrios
192
49 296
36.2
288
11.1%
5.4%%
6.1%
8.0%
00%
Tramarks B (0.55)
DodDatSed
0.
132
26.7%
39.7
25
6.4%
42%
0.15%
0.0%
00%
Inusmerks (0:55)
Dwitbettied
21.1%
16.4%
HiDDoN
sorio
000%
0.0%
0.0%
00%
Trusmari (0.55)
HiDDeN
scries
13.2%
31.9
4,5%
LA4%
0.0%
0.0%
Tnusmari B (0:55)
100
96.5%
41.3
211
67.9%
8S 15.256
83.1%
79.7%
Tnnemert I (0:95)
RN
serios
0.5
112
24.3%
4019
1.
21.1%
6.7%
9.4%
8.5%
6,0%
Trusmar B (0.55)
RNNGAN
series
132
73.9%%
37.5
L1
72.8%
20.1%
26.75
26.7%
21.4%
Tnnsmarks (0.955
RoSIEALS
05
00%
RoSICALS
saties
13.4%
8.9%
80%
0.0
Tremmrk (0.55) SSL (40dB.1000bs)) LC1200.100.32
scries
100
80.07%
42.5
67.4%
29.3%
27,92
Trummrr B 10:55) SSL (424B (00b8s)
series
200
22.9%
42.5
11,4%
6.2%
1.2%
2004
Tasmuri B (0.95) SSL (42JB, 30b44)
scries
0.
130
45.7%
41.7
100
42.5%
22.4%
21.99
2024
1819
Trsmmrr B (0.95) SSL (42.8,423000 30bax)
series
130
92.9%
38.4
LI
88.7%
54.1%
61.11%
538%
43065
Taxmerk B (0:95)
Tnnenoek (0.95)
peald
0.
200
0.0%
42.0
0.0%
0.0%
0064
Tramnak (0:055
Trwensek (0.05)
peald
200
0.0%
60%
Trummark (0.95)
Trusmaak (0.95)
scries 0.5
200
0.0%
0.0%
0.0%
0.0%
00%
00%
Trnemork (0.95)
Tnnemork (0:95)
200
8.%
35.0
0.0%
0.0%
0.06
0.0%
80%
Trooneei B (0:05)
Trastmark O (0:95)
satios as
200
0.1%
41.9
2.2
0.1%
0.0%
0.0%%
8.0%
8.%
Tnemmer 15 (1:55)
Trustmank Q (0.95)
senes
200
0.1%
35.
233
0.2%
0.0%
0.06
8.0%
Tristork Q
1c(150,32.25)
12
49.0%
479
$4.0%
M0.7%
40.5%
18.1%
36/9
Tradmek Q (0.45)
1C(100.32.255
65.9%
70.5%
51.7%
48.9%
Trismank (1.500
1K1100,32.255
80.2%
K3.5%
51.5%
68,
64.3%
60.9
Trastook Q2 (0.15)
[<(000092.25)
32
98.9%
46.2
20
91.0%
58.7%
71. 116
75.8%
70 5%
Trustmakk Q (0.50)
1C[150,32.25]
32
95.1%
45.7
2.1
95.9%
64.0%
83.25
51.3%
76.7%
28

---

Find mothod
Nacnnd mithod
FCC Easemblr Clip Capadit Arruracy
Moon PSNR (dB]
Sid
Rehnst.
Rubust.
Rebust.
Rubuut.
Robous.
(bits)
PSNK [dB]
RIvIGAN
SSL
TmL
Trabted
Twilligh
Tristne 12 (5.00)
EsoKIAN [C(31,32257)
soros -0.2
12
85.55
198
0.3
86.5%
18.7%
53.4%
40
46.9%
Trustak Q (0.60)
BosDAN
1C(131,2257)
xctic -0.1
32
81.7%
40.1
0.3
83.5%
36.3%
45. 85
45.7%
41.8%
Trustark Q2 (0.000
ReOGAN
[K1131332577
75.3%
401.7
78.5%
33.0%
42.1%
14.85
36.5%
()0000))
12(13192257)
13.0%
Truimol Q (0.60)
RioGAN
1C(131,22577
kanic 02
63.6%
41.7
67.%%
52.156
30.6%
25.4%
Trustmak Q2 (0.00)
RsoGAN
161131,322577
senos
0.3
32
58.375
422
62.5%
22.3%
26.85
26.07
25.7%
Trietork Q2 (0:00)
RsODIN 14(131.32,57)
soniss
0.6
12
5110%
42.6
10
55.0%
17.0%
21 556
21.4%
18.9%
Trustakk Q (0.80)
RNOGAN
LC1131.32.57)
series
0.5
32
41.3%
43.2
12
44.0%
13.1%
17.156
15.7%
15.9%
Trustaak (0.60))
ReGGAN 1C1131.32.57]
0.6
39AN
14.2%
12.95
(9:00)
ReSGAN
(C(111.32.57)
10nes
0.7
33.0%
S7AN
11.0%
14.35 14.276
13.17
12.0%
Trustakk Q (0.60)
RAGGAN
1C1131.32.77
sores
08
29.5%5
46.6
33.6%
9.7%
11,85
11.3%
10.75
Trustmakk Q (0.60)
REoGAN
1C(131.322577
senes
0.9
32
26.5%
45.1
20
27.9%
8.3%
9.96
9.1%
7.5
Trustmak 0 (0.60)
RaoGAN
1C(131,32.577
safas
32
22.5%
45.6
211
23.5%
6.7%
5.5%
7.7%
6.2%
Trustak Q (0.60)
RAGGAN
LC1131,32.577
series
1.1
32
17.7%
46.0
23
17.5%
5.0%
6,9%
5.5%
5.0%
Trustaak Q
ReOGAN
1C1131.32.57]
1.2
Truiink
RasGAN
1C1131,32.57)
46.1%
50 80
57.7%
53.2%
Trustaak Q (0.65)
LC1130,32251
97.8%
45.2
98.0%
68.1N
87-11 -7-1%-
5500
82.8%
Tradtoek Q2 (0.70)
1<(10,332244]
12
7%
46.7
94 9%
56 8.
RX 716
87
85.0%
Trusimek Q (0.75)
1C(100,32.255
32
99.9%
44.2
22
5.
68.0%
R0 856
88.8%
$6. 86.7%
Trustakk Q (0.30)
LCT100,32.551
32
99.6%
43.7
23
99.5%
69.7%
90.9%
99.1%
67.6%
Tristmak Q2 (0.50)
RooGIN
1<(131392577)
-8.
12
95 9%
39.9
50 5%
66
63.8%
Trudtel (0.50)
RosGAN
1C(131,32,77]
47.3%
61.1%
Tristank (0.20)
ReoGAN
[<1111,32_57]
sones
95.875
M5. 1N
46.5%
67.176
58.57%
55
Trudtork Q2 (2.000))
RooGAN
[Q133132257]
scnos
011
32
83.7%
410
08
94.7
47 171
5% 9%6
56.0%
56 27.7
Triemne Q (0.50)
BsoGAN
1<(131,32,57)
sotios
0.2
32
92.6%
41.3
03
94.1%
44.5%
S3 316
55.8%
$2.3%
Trustaak (0.20)
RXOGAN
[C(131,32,57)
senes
0.5
32
92.2%
41.6
100
M4.0%%
42.8%
56,
53.3%
50.0%
Tristaak (2.200
ReSGAN [<(131.92.57]
9.4
88.775
WAAN
40.3%
48.7%
45.3%
Trustakk Q (0.30)
RANGAN
1C1131,32.571
0.5
85.2%
37.3%
49.5%
44.5%
42.4%
Trustmakk (0.00)
ReGGAN
1C1131,32_57)
senee
0.6
83.475
42.5
35.0% -
46-11%
42,0%
39.375
Trustark 12 (0:20)
RsoGAN
[<(131.922577
senos
0.7
32
81.37%
42.8
155
12.1%
41: 1566
19.47
36.7%
Trustaak Q (0.30)
RsGGAN
1C1131,32,571
scrics
0.8
32
78.4%
43.1
17
80.9%
29.0%
40: 60.706
37.5%
34.4%
Trustakk Q (0.30)
ReOGAN
LC1131.32,57)
series
0.9
32
74.3%
43.4
19
78.4%
28.0%
36.05%
33.5%
30.4%
Trustmak Q (0.30)
BsGAAN
LC(131,32,57]
32
71.3%
45.7
211
74.2%
25.8%
34 (4.
32.1%
28.8%
Trustnak (0.30)
RiaGAN
1C1131,32.571
1.1
66.0%%
09.5%
24.5%
33.
28.34
26.2%
Trustaak (0.80)
RAGGAN
1C1131.32.577
sories
1.2
61,475
46.4
25
65-16
21.8%
27:50
26
23
Trustnek Q (0.300)
BioGAN
1C(131,32257]
99.6%
38.4
10
99.7%
10.7%
15:20%
7320
2 21
Trustmak 0 (0.85)
1C1100,32.251
32
99.8%
43.3
23
99.6%
60.8%
91.35
9031
5900
Trietmek 12 (0:000
(C(100,32255)
12
99.8%
42.9
23
70
M1 45%
Trustmol Q (0:55)
DwiDa
0.5
132
15.9%
40.3
3.0%
1.3%
0.0%%
00%
000
Trustnak Q
DwiDht
48.4%
12.6%
0.0%
0.0
000
Tridmork (0:95)
sonios
21.0%
6.1%
6106
Tradmoe Q (0:05
84.3%
36.4
30
19.5%
14.3%
0.366 6.56
0.%%
02%
Trustmakk Q (0.555
HiDDeN
series
05
148
D.0%
37.5
31
0.04
0.0%
0.00
0.004
007%
Instmark 12 (0:95)
HiDDeN
sones
14%
11.9%
32.1
1.7%
1.5%
0.166
800
100%
Tristmo Q (0:95)
1C(100322255
12
90.9%
42.5
24
70 11.1%
91.35 11.166
90.9%
89
Trustark Q (0:55)
24
62.6%
81.00
77.8%
74.3%
Iristark (9:55)
ReOGAN
[4(191.32.57)
sones
59.075
11
16.8%
Trustakk O (0.95)
RAuGAN
1C1131,32.71
scries
99.4%
40.1
10
9226
53.9%
-..%%
72.706
69.7%
66.5%
Trustmak Q (0:55)
RsGGAN
LC(131,32.577
series
32
99.1%
40A
10
99.2%
55.2%
71.456
69.9%
66.0%
Tristaakk (0.955
RXOGAN
[C1131,32,57)
senes
0.1
32
99.2%
100
95.9%
55.2%
69 70.756
67.4%
64.5%
Truimak Q (0.55)
RaGGAN
1CT131,32,377
serics
0.2
32
99.2%
40.9
100
98.5%
53.2%
67.5%
65.7%
62.7%
Trusmakk Q
RasGAN
1C1131,32.571
0.3
99.0%
52.2%
62.9%
Traimak (0:95)
BaGGAN
1C[131,32,57]
0.4
66-
63.9%
61.7%
Traitaak O (0.955)
RauGAN
1C1131,32.771
sarica
0.5
97.9%
41.5
97.7%
50.2%
64.4%
63.0%
55.7%
Trustaak Q (0.95)
RasGAN
1C1131.32.571
series
QU6
32
97.4%%
41.8
13
97.5%
46.7%
61.9%
50.6%
56.0%
Traemml Q (0:05]
EsoGAN
1c(131,32,57)
kofios
0.7
32
96 7%
42.0
1.5
96. 5%
45.8%
61. 316
58.1%
55.9%
Trustaak Q (0.95)
BsGAAN
1C[131,32,377
scrics
0.8
32
95.69%
42.2
16
05.6%
44.8%
ST. 57.8%%
57.6%
52.9%
Trusmak Q
RasGAN
1C1131,32.571
0.9
04.3%
43.1%
4%
48.9%
(0:05)
BoGGAN 1C(131,32357)
40.1% 1.%%%
51 4.4
11.7%
48
Traimal Q (0.055)
BioGAN
1C(131,32377
1.1
91.3%
42.9
92.0%
41.6%
51, 10.
50. 10.3%%
Tristork 12 (0:55
ReoGAN [6(13139257]]
sonos
1.2
32
89.7%
43.2
22
M000
16.1%
200 15%
42.37
45.1%
Triemee Q (0:05)
RsoGAN
(Q(33133259))
12
90.9%
380
11
10009
90.6%
W1. 116
77.4%
75 5%
Trustal Q (0.95)
BisGAN
0.
132
17.3%
41.5
12
20.0%
3.8%
6.11%
5.1%
Tristark Q (0:55
RoNGAN
67.3%
16.8%
24.00
22000
(0:95)
RoStcA1S
05
61%
10%
Trustark Q (0.555
RoSteALS
scries
200
14.5%
308
75%
4,4%
9000
0026
0075
Trustmark Q (0:055
SSL (41d).200bs)
senes
0.
130
35.5%
42.5
122
33.4%
15.9%
14:75
1855
124%
Tristork Q (0:95) SSI. (47dH) 10haes
sonts
130
85.4%
3001
11
81.1%
45.8%
54
403554
46.9
Trustakk Q (0.55) Trusmark B (0.55)
paald
0.5
200
0.0%
43.1
211
0.0%
0.0%
0.09%
0.%
00%
Tristaak Q
Trusmark
porade
200
00%
Truimaa 0
Trwemek
0.5
200
0.0%
Trasmaak Q (0.55)
Trwsmakk (0.95)
series
200
0.0%
38.7
0.0%
0.0%
0.0%
0.0%
0.7%
Trustmak Q (0:55)
Trustmark Q (0.95)
paratd
9.5
200
8.0%
42.9
23
0.0%
0.0%
0.0%
0.0%
00%
Trustmak Q (0.95) Trustmank (0.85)
peald
200
0.0%
42.9
23
0.0%
0.0%
0.066
0.0%
0.%
Trusmaak Q (0.55) Trustmak Q (0.55)
series
0.5
200
0.0%
42.5
23
0.0%
0.0%
0.0%
0.0%
0.0%
Trustmek Traxtmank (0.95)
Trustmok Q (0:95)
scrios
300
0.0%
39.0
2.4
0.0%
0.0%
0.0%
00%%
00%
1C(100,32,25]
71.3%
29

---

Table 2: The residuals of all the methods we considered are close orthogonal. This is also visible from the samples in App. the residuals are visually different RGB, YCbCr and Fourier space. This table shows the angles in degrees (computed in RGB space) between the 8 residuals (differences between the watermarked image and the cover image) for the first image in App. E (the credit card).
RivaGAN
DutDct
HiDDell
SSL
TrustMark 0
TrustNark B
RoSteALS
DutDctSvd
RivaCAN
0.000000
99.999997
89. 99.999999
89, 999999998
89. 99.999998
89. 39.999995
89. 89.999999
90,000000
DutDet
89,999997
0.000000
89.999995
89,999995
89.999997
99.999999
89.999994
89,999997
HiDDeN
89.999999
39.999995
0.000000
89.999994
89.999998
39.999994
89,999998
89,999999
SSL.
89. 9999999
999995
89. 999994
0.000000
89, 999997
999999999
89,999995
89 89.999999
TrustNark
99.999998
9999999
89.999998
99,999997
0,000000
89.999996
89,999996
TrustMark
89. 99.999995
99.999999
99.999994
89 9999999
99.999996
0.000000
89. 89.999995
89,999995
RoSteALS
9.999999
9999999
999998
89,999995
89,999996
9999999
0,000000
89.999997
DwtDotSvd
90,000000
89.999997
89. 999999999
89.999999
89.999996
$9.999995
89.999997
0.000000
Table 3: Applying three watermarking methods. The results on coexistence extend to three watermarking methods. As expected, the more watermarks applied to the same image, the more the image quality and decoding robustness go down. The bit accuracy remains high (>88%) but the PSNR goes down about 30dB.
Method Bit Acc.
Method
Method 3
Method
Method
Method
PSNR
Bit Acc.
Bit Acc.
DwtDct
RivaGAN
SSL
88.85%
99.97%
100.00%
30.60 dB
TrustMark
DwtDct
RivaGAN
98.97%
89.95%
99.97%
30.77 dB
TrustMark
DwtDet
SSL
97.88%
89.37%
100.00%
31.24 dB
TrustMark
RivaGAN
SSL
97.79%
99.94%
100.00%
31.96 dB
30

---

NeurIPS Paper Checklist
i. Claims
Question: Do the main claims made in the abstract and introduction accurately reflect the paper's contributions and scope?
Answer: [Yes]
Justification: The abstract and the introduction claim we study whether two watermarks can coexist in the same image, something we show to be the case in Sec. 3, well as how this opens the avenue for ensembling, as discussed Sec. 4.
Guidelines:
The answer NA means that the abstract and introduction do not include the claims made in the paper.
The abstract and/or introduction should clearly state the claims made, including the contributions made in the paper and important assumptions and limitations. A No or
NA answer to this question will not be perceived well by the reviewers.
The claims made should match theoretical and experimental results, and reflect how much the results can be expected to generalize to other settings.
It is fine to include aspirational goals as motivation as long it is clear that these goals are not attained by the paper.
ii Limitations
Question: Does the paper discuss the limitations the work performed by the authors? Answer: [Yes]
Justification: Our Discussion section (Sec. 5) focuses on the limitations of the present work. Namely, that there is a need for a more comprehensive theoretical analysis following the theoretical intuition
offered (App. A), the limited utility of ensembling of watermarking methods (Sec. 4), as well as that we do not consider perceptual metrics, nor do we study modalities other than images.
Guidelines:
The answer NA means that the paper has limitation while the answer No means that the paper has limitations, but those are not discussed in the paper.
The authors are encouraged to create separate "Limitations" section in their paper.
The paper should point out any strong assumptions and how robust the results are to violations of these assumptions (e.g.. independence assumptions, noiseless settings, model well-specification, asymptotic approximations only holding locally). The authors should reflect on how these assumptions might be violated in practice and what the implications would be.
The authors should reflect on the scope of the claims made, e.g., if the approach was only tested on a few datasets or with few runs. In general, empirical results often depend on implicit assumptions, which should be articulated.
The authors should reflect the factors that influence the performance of the approach. For example, facial recognition algorithm may perform poorly when image resolution low or images are taken in low lighting. Or speech-to-text system might not be used reliably to provide closed captions for online lectures because it fails to handle technical jargon.
The authors should discuss the computational efficiency the proposed algorithms and how they scale with dataset size.
If applicable, the authors should discuss possible limitations of their approach to address problems of privacy and fairness.
While the authors might fear that complete honesty about limitations might be used by reviewers as grounds for rejection, worse outcome might be that reviewers discover limitations that aren't acknowledged in the paper. The authors should use their best judgment and recognize that individual actions in favor of transparency play an impor- tant role in developing norms that preserve the integrity of the community. Reviewers will be specifically instructed not penalize honesty concerning limitations.
ii. Theory assumptions and proofs
31

---

Question: For each theoretical result, does the paper provide the full set of assumptions and complete (and correct) proof?
Answer: [NA]
Justification: In App. A we offer intuition of why watermarking coexistence occurs but the present work does not have any formal proofs.
Guidelines:
The answer NA means that the paper does not include theoretical results. All the theorems, formulas, and proofs in the paper should be numbered and cross- referenced.
All assumptions should be clearly stated or referenced the statement of any theorems.
The proofs can either appear in the main paper or the supplemental material, but they appear in the supplemental material, the authors are encouraged to provide short proof sketch to provide intuition.
Inversely, any informal proof provided in the core of the paper should be complemented by formal proofs provided in appendix supplemental material.
Theorems and Lemmas that the proof relies upon should be properly referenced.
iv. Experimental result reproducibility
Does the paper fully disclose all the information needed to reproduce the main ex- perimental results of the paper to the extent that it affects the main claims and/or conclusions the paper (regardless whether the code and data are provided or not)?
Question:
Answer: [Yes]
Justification: We leverage existing and publicly available models and provide detailed instructions on how to reproduce our experiments. While our dataset is proprietary and not publicly available, the choice of dataset would have little impact the results in this work. We cannot provide code, but we provide sufficient instructions to reproduce all experimental results. A Reproducibility statement also included the end of the main text. Guidelines:
The answer NA means that the paper does not include experiments.
If the paper includes experiments, a No answer to this question will not perceived well by the reviewers: Making the paper reproducible is important, regardless of whether the code and data are provided or not.
the contribution is a dataset and/or model, the authors should describe the steps taken to make their results reproducible or verifiable.
Depending on the contribution, reproducibility can be accomplished in various ways. For example, if the contribution is a novel architecture, describing the architecture fully might suffice, or if the contribution be necessary to either make it possible for others to replicate the model with the same dataset, or provide access to the model. In general. releasing code and data often one good way to accomplish this, but reproducibility can also be provided via detailed instructions for how to replicate the results, access to a hosted model (e.g.. in the case of large language model), releasing of a model checkpoint, or other means that are appropriate to the research performed.
specific model and empirical evaluation, may
While NeurIPS does not require releasing code, the conference does require submis- sions to provide some reasonable avenue for reproducibility, which may depend the nature of the contribution. For example
(a) If the contribution is primarily a new algorithm, the paper should make it clear how reproduce that algorithm. (b) If the contribution is primarily the architecture clearly and fully.
model architecture, the paper should describe
(c) If the contribution is new model (e.g., a large language model), then there should either be way to access this model for reproducing the results or way to reproduce the model (e.g.. with an open-source dataset instructions for how construct the dataset).
(d) We recognize that reproducibility may tricky in some cases, in which case authors are welcome describe the particular way they provide for reproducibility.
32

---

In the case of closed-source models, it may be that access to the model is limited in some way (e.g., registered users), but it should be possible for other researchers to have some path to reproducing or verifying the results.
V. Open access to data and code
Question: Does the paper provide open access to the data and code, with sufficient instruc- tions to faithfully reproduce the main experimental results, as described in supplemental material?
Answer: [No]
Unfortunately, at this time, the data and code are proprietary, but we provide sufficient instructions reproduce all experimental results. We also currently exploring whether we can release an open-source version of the evaluation setup.
Justification:
Guidelines:
The answer NA means that paper does not include experiments requiring code.
Please see the NeurlPS code and data submission guidelines (https://nips cc/
cttiammmiiiooooccccc for more details.
While we encourage the release of code and data, we understand that this might not be possible, "No" an acceptable answer. Papers cannot be rejected simply for including code, unless this is central to the contribution (e.g., for a new open-source benchmark).
The instructions should contain the exact command and environment needed to run to reproduce the results. See the NeurlPS code and data submission guidelines (https: / /nips. popuulic/guideee (Codeeommiiseeeeee aessonnPoicyyy for more details.
The authors should provide instructions on data access and preparation, including how access the raw data, preprocessed data, intermediate data, and generated data, etc.
The authors should provide scripts to reproduce all experimental results for the new proposed method and baselines. If only subset of experiments are reproducible, they should state which ones are omitted from the script and why.
At submission time, to preserve anonymity, the authors should release anonymized versions (if applicable).
Providing much information possible in supplemental material (appended the paper) recommended, but including URLs to data and code permitted.
vi. Experimental setting/details
Question: Does the paper specify all the training and test details (e.g., data splits, hyper- parameters, how they were chosen, type of optimizer, etc.) necessary to understand the results?
Answer: [NA]
Justification: This paper constitutes no training of models and hence there are no training details to be reported.
Guidelines:
The answer NA means that the paper does not include experiments.
The experimental setting should be presented in the core the paper to level of detail that is necessary to appreciate the results and make sense of them.
The full details can be provided either with the code, in appendix, as supplemental material.
vii. Experiment statistical significance
Question: Does the paper report error bars suitably and correctly defined or other appropriate information about the statistical significance of the experiments?
Answer: [Yes]
Justification: The accuracy and robustness are binary metrics and hence fully described by reporting the mean values. For image quality metric (PSNR) we report mean and standard deviation in the Extended Results tables in App.
Guidelines:
The answer NA means that the paper does not include experiments.
33

---

The authors should answer "Yes" if the results are accompanied by error bars, confi- dence intervals, or statistical significance tests, least for the experiments that support the main claims of the paper.
The factors of variability that the error bars are capturing should be clearly stated (for example, train/test split, initialization, random drawing of some parameter, or overall run with given experimental conditions).
The method for calculating the error bars should be explained (closed form formula, call to a library function, bootstrap, etc.)
The assumptions made should given (e.g., Normally distributed errors).
should be clear whether the error bar is the standard deviation the standard error of the mean.
It is OK to report I-sigma error bars, but one should state it. The authors should preferably report a 2-sigma error bar than state that they have 96% CI, if the hypothesis of Normality of errors is not verified.
For asymmetric distributions, the authors should be careful not to show in tables figures symmetric error bars that would yield results that are out range (e.g. negative enror rates).
If error bars reported in tables plots, The authors should explain in the text how they were calculated and reference the corresponding figures or tables in the text.
viii. Experiments compute resources
Question: For each experiment, does the paper provide sufficient information on the com- puter resources (type of compute workers, memory, time of execution) needed to reproduce the experiments?
Answer: [NA]
Justification: We only perform inference relatively small models. Thre has been training of models the scope of this work. Therefore, the compute costs are negligible.
Guidelines:
The answer NA means that the paper does not include experiments.
The paper should indicate the type of compute workers CPU or GPU, internal cluster, or cloud provider, including relevant memory and storage.
The paper should provide the amount of compute required for each of the individual experimental runs as well as estimate the total compute.
The paper should disclose whether the full research project required more compute than the experiments reported in the paper (e.g., preliminary failed experiments that didn't make into the paper).
ix. Code of ethics
Question: Does the research conducted the paper conform, in every respect, with the NeurlPS Code of Ethics
Answer: [Yes]
Justification: Yes, we have reviewed the NeurIPS Code of Ethics and our research conforms to it.
Guidelines:
The answer NA means that the authors have not reviewed the NeurlPS Code of Ethics.
If the authors answer No, they should explain the special circumstances that require deviation from the Code of Ethics.
The authors should make sure to preserve anonymity (e.g., there a special consid- eration due to laws or regulations in their jurisdiction).
X. Broader impacts
Question: Does the paper discuss both potential positive societal impacts and negative societal impacts of the work performed?
Answer: [Yes]
Justification: Our paper contains a dedicated Impact Statement at the end of the main text. As this work studies a content provenance technology, we do not foresee any misuse or negative societal impacts that need to be addressed.
34

---

Guidelines:
The answer NA means that there is no societal impact of the work performed.
If the authors answer NA or No. they should explain why their work has no societal impact or why the paper does not address societal impact.
Examples of negative societal impacts include potential malicious or unintended uses (e.g.. disinformation, generating fake profiles, surveillance), fairesss considerations (e.g., dep.oymmpt of technologies that could make decisions that unfairly impact specific groups), privacy considerations, and security considcrations.
The conference expects that many papers will be foundational research and tied to particular applications, let alone deployments. However, if there is direct path to any negative applications, the authors should point it out. For example, it is legitimate to point out that an improvement in the quality of generative models could be used to generate deepfakes for disinformation. On the other hand, is not needed to point out that a generic algorithm for optimizing neural networks could enable people to train models that generate Deepfakes faster.
The authors should consider possible harms that could arise when the technology is being used as intended and functioning conrectly, harms that could arise when the technology is being used as intended but gives incorrect results, and harms following from (intentional unintentional) misuse of the technology.
there are negative societal impacts, the authors could also discuss possible mitigation strategies (e.g., gated release of models, providing defenses in addition to attacks, mechanisms for monitoring misuse, mechanisms to monitor how system learns from feedback over time, improving the efficiency and accessibility of ML).
xi. Safeguards
Question: Does the paper describe safeguards that have been put in place for responsible release of data or models that have a high risk for misuse (e.g., pretrained language models, image generators, scraped datasets)?
Answer: [NA]
Justification: This work studies content provenance technology, which in of itself is safeguarding tool. Therefore, no additional consideration of safeguarding is relevant.
Guidelines:
The answer NA means that the paper poses no such risks.
Released models that have a high risk for misuse or dual- use should be released with necessary safeguards to allow for controlled use of the model, for example by requiring that users adhere to usage guidelines or restrictions to access the model or implementing safety filters.
Datasets that have been scraped from the Internet could pose safety risks. The authors should describe how they avoided releasing unsafe images.
We recognize that providing effective safeguards is challenging, and many papers do not require this, but we encourage authors to take this into account and make best faith effort.
xii. Licenses for existing assets
Question: Are the creators or original owners of assets (e.g., code, data, models), used in the paper. properly credited and are the license and terms of use explicitly mentioned and properly respected?
Answer: [Yes]
Justification:
The papers introducing the watermarking methods we evaluate in the present work have been properly cited. We own and/or have a license to use all data used for the experiments.
Guidelines:
The answer NA means that the paper does existing assets.
The authors should cite the original paper that produced the code package dataset.
The authors should state which version of the asset used and, possible, include URL.
35

---

The name of the license (e.g., CC-BY 4.0) should be included for each asset.
For scraped data from a particular source (e.g., website), the copyright and terms of service of that source should be provided.
If assets are released, the license, copyright information, and terms of use in the package should be provided. For popular datasets, paperswi thcode. com/datasets has curated licenses for some datasets. Their licensing guide can help determine the license dataset.
For existing datasets that are re-packaged, both the original license and the license of the derived asset (if has changed) should be provided. this information not available online, the authors are encouraged to reach out to the asset's s creators.
xiii. New assets
Question: Are new assets introduced in the paper well documented and is the documentation provided alongside the assets?
Answer: [NA]
Justification:
We do not release any new assets in this paper.
Guidelines:
The answer NA means that the paper does release new assets.
Researchers should communicate the details the dataset/code/model as part of their submissions via structured templates. This includes details about training, license, limitations, etc.
The paper should discuss whether and how consent was obtained from people whose asset used.
At submission time, remember to anonymize your assets (if applicable). You can either create anonymized URL or include an anonymized zip file.
xiv. Crowdsourcing and research with human subjects
Question: For crowdsourcing experiments and research with human subjects, does the paper include the full text of instructions given participants and screenshots, if applicable, as well as details about compensation (if any)?
Answer: [NA]
Justification: We not conduct any crowdsourcing experiments or research with human subjects in this paper.
Guidelines:
The answer NA means that the paper does not involve crowdsourcing nor research with human subjects.
Including this information the supplemental material is fine, but if the main contribu- tion of the paper involves human subjects, then as much detail as possible should be included in the main paper.
According to the NeurIPS Code Ethics, workers involved in data collection, curation, other labor should be paid at least the minimum wage in the country of the data collector.
xv. Institutional review board (IRB) approvals or equivalent for research with human subjects
Question: Does the paper describe potential risks incurred by study participants, whether such risks were disclosed to the subjects, and whether Institutional Review Board (IRB) approvals (or an equivalent approval/review based on the requirements of your country or institution) were obtained?
Answer: [NA]
Justification:
This paper does not involve crowdsourcing research with human subjects.
Guidelines:
The answer NA means that the paper does not involve crowdsoureing nor research with human subjects.
36

---

Depending on the country in which research is conducted, IRB approval (or equivalent) may be required for any human subjects research. If you obtained IRB approval, you should clearly state this in the paper.
We recognize that the procedures for this may vary significantly between institutions and locations, and we expect authors to adhere to the NeurIPS Code of Ethics and the guidelines for their institution.
For initial submissions, do not include any information that would break anonymity (if' applicable), such as the institution conducting the review.
xvi. Declaration of LLM usage
Question: Does the paper describe the usage of LLMs if it is important, original, or non-standard component of the core methods this research? Note that if the LLM used only for writing, editing, formatting purposes and does not impact the core methodology, scientific rigorousness, or originality of the research, declaration is not required.
Answer: [NA]
Justification: Beyond minor editing of the text of the paper, LLMs have not been used in this work
Guidelines:
The answer NA means that the core method development in this research does not involve L.LMs as any important, original, non-standard components.
Please refer to our LLM policy (https /ttp:ppp..../oooeeeees////////// for what should or should not be described.
37


Reviews:
[{"review_id": "smAxVY4r2n", "reviewer": "Reviewer_ZkVT", "summary": "The paper investigates whether multiple image watermarks can co-exist in a single image without interfering with each other's decodability. The authors find that many watermarking algorithms can coexist with minor degradation to image quality and decoding robustness. Hence, they introduce watermark ensembling, combining multiple watermarking models to improve message capacity and explore new trade-offs between capacity, image quality, robustness, and accuracy.", "questions": "* How resilient are coexisting watermarks to removal attacks or adversarial perturbations? Can you conduct experiments testing whether watermark removal tools (e.g., generative inpainting, adversarial attacks) are more effective against coexisting watermarks?\n* See above review", "limitations": "Yes", "rating": 4, "confidence": 3, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": 3, "clarity": 2, "significance": 4, "originality": 3, "strengths_and_weaknesses": "The authors address a very interesting, timely, and real-world (and well-motivated!) challenge of whether multiple watermarking methods can co-exist on the same image. The questions they pose are relevant and can make a direct impact as to how we think of watermark deployment. They addresses real-world scenarios where multiple actors (creators, publishers, model providers) may add their own watermarks. They test a wide range of watermarking methods and combination strategies. I particularly appreciated the focus on open-source methods, allowing reproduction of their results and encouragement of use of these watermarking methods.\n\nThat said, there are some downsides of the paper as of now that should be addressed by the authors before publication. It is not clear from the paper, which dataset was used for the comparison of the co-existence of the different watermarking methods, and generally the  paper would benefit from a more in-depth description of the methodology of this part. This also includes a better presentation of the results in Table 1, which is hard to read and to compare the different results (maybe a matrix plot, e.g., https://matplotlib.org/stable/api/_as_gen/matplotlib.pyplot.matshow.html) could help here? Besides the fact that the watermarks *can* co-exist, and that it is indeed still possible to retrieve them, it would be good to extend a bit on the rest of the impact of multiple watermarks, such as describing (in the main paper) more the quality decrease (quantitatively) as well as at least an intuition as to whether  watermark coexistence makes the watermarks more vulnerable to removal or spoofing. Overall the paper would benefit from stronger theoretical grounding - the empirical coexistence is surprising, but no strong theoretical framework explains why it occurs or how to design for/against it.", "was_revised": true, "final_justification": "I appreciate the authors' feedback. My concerns are mostly addressed, hence I will keep my score as I believe it still adequately reflects my evaluation of the paper.", "rebuttal": "We are extremely happy that you found our work interesting, timely and well-motivated and posing relevant questions, with our results being directly impactful. Your comments on the presentation are indeed valid and we would like to briefly address them here.\n\n>How resilient are coexisting watermarks to removal attacks or adversarial perturbations? Can you conduct experiments testing whether watermark removal tools (e.g., generative inpainting, adversarial attacks) are more effective against coexisting watermarks?\n\nThat is a great question. We did not study this because the constituent models are themselves not designed to be robust to removal attacks, adversarial perturbations, denoising attacks and other more active ways of stripping the watermark. Therefore, it is highly unlikely that the ensemble will have emergent robustness properties beyond these of the individual models. Our main focus is checking if the base methods don’t deteriorate after ensembling, hence we only evaluate against the robustness objectives of the 8 watermarking models in the paper.\n\n> It is not clear from the paper, which dataset was used [...]\n\nWe used a dataset with images that we have the rights to train and evaluate on. We have anonymized its name for the submission as that would uniquely identify us. It contains diverse images of different aspect ratios and resolutions, with roughly half being photographs and half being graphic art. You can see a small sample of the dataset in Appendix E. We will provide further details in the non-anonymous camera ready version of the paper and also share the dataset itself.\n\n> Better presentation of the results in Table 1.\n\nWe agree that Table 1 is cluttered. All the information from Table 1 (and a lot more) is also in Figure 10, but that is also difficult to read. We will explore more clear ways of presenting it. \n\n> Overall the paper would benefit from stronger theoretical grounding - the empirical coexistence is surprising, but no strong theoretical framework explains why it occurs or how to design for/against it.\n\nWe believe that a comprehensive empirical evaluation of a new phenomenon is a key contribution we can offer the broader community, as this is the basis upon which further studies can lie. We agree that stronger theoretical grounding on why and when watermark coexistence occurs would be extremely beneficial. Hence, we outlined some intuition and ideas to this end in Appendix A. Furthermore, in a follow-up work, we are studying the theoretical interplay of capacity, quality and robustness, which casts some more light on watermark coexistence."}, {"review_id": "fwpnDeuniL", "reviewer": "Reviewer_8o2R", "summary": "This paper presents the first systematic study of deep image watermark coexistence, challenging the prevailing intuition that watermarks from different methods inevitably interfere with one another. The study demonstrates that combining multiple watermarking methods using ensemble techniques can enhance overall performance. This approach enables capacity expansion and optimization of quality robustness without the need for model retraining.", "questions": "1.The authors argue that watermark coexistence implies orthogonal or non-overlapping perturbation spaces. However, they do not analyze the actual perturbation directions across methods. Why didn't the authors perform spectral or subspace overlap analysis of the residuals to empirically support this hypothesis?\n\n2.The paper primarily investigates pairwise coexistence between two watermarking methods. Have the authors considered whether similar coexistence holds when three or more watermarking methods are applied sequentially or in parallel? Is there evidence that the observed compatibility generalizes to higher-order combinations, or do interference effects compound beyond pairwise interactions?", "limitations": "1.While the study shows that different watermarks can coexist in the same image, it lacks a deeper understanding of why this happens. The explanation based on orthogonal perturbation subspaces is mostly qualitative, without empirical analysis of residual directions or interference patterns.\n\n2.The paper only considers pairwise combinations of watermarking methods. It remains unclear whether similar coexistence holds when three or more methods are applied. This limits the practical relevance for multi-actor pipelines where multiple watermarks may accumulate.\n\n3.In addition, the ensembling strategy is relatively naive. It relies on simple residual averaging or sequential application, without any learning-based coordination or optimization. As a result, the full potential of watermark coexistence is not fully explored.", "rating": 4, "confidence": 3, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": 3, "clarity": 3, "significance": 2, "originality": 3, "strengths_and_weaknesses": "Strengths\n1.\tThis study provides the first in-depth examination of image watermark coexistence, addressing a novel and intellectually compelling research question.\n\n2.The work demonstrates significant potential by showing how intelligently combining different watermarking methods through ensemble techniques can substantially improve overall watermark performance metrics.\n\nWeaknesses\n1.The presentation of the paper is poor; the main content is overly reliant on dense textual analysis, which makes the narrative hard to follow. The authors should consider adding more visualizations to support the analysis and move less important findings to the appendix.\n\n2.The study primarily focuses on experimental observations of watermark coexistence but offers only a naive use of ensembling, lacking deeper theoretical insights or more effective strategies for watermark performance enhancement.", "was_revised": true, "final_justification": "Thanks for the response. I have updated the score.", "rebuttal": "We would like to thank the reviewer for recognizing that this is the first in-depth examination of image watermark coexistence, a novel and intellectually compelling research question, and for finding our work to be of significant potential. With this in mind, we would like to address your questions and concerns.\n\n__Orthogonal perturbation spaces.__ You asked if we did perform spectral or subspace overlap analysis of the residuals to empirically support our hypothesis that different watermarking methods use different orthogonal spaces. We did study that but found the results of little additional insight and hence they did not make it to the draft. We can add these results in the revised version.\n\nIn a nutshell, the answer is that yes, the residuals of all the methods we considered are almost perfectly orthogonal. This is also visible from the samples we have in Appendix E: the residuals are visually very different in RGB, YCbCr and Fourier space. For numerical comparison, the table below shows the angles in degrees (computed in RGB space) between the 8 residuals (differences between the watermarked image and the cover image) for the first image in Appendix E (the credit card). This result is very much expected: the residuals are in a very-high dimensional space where most vectors are nearly-orthogonal.\n\n|             |   RivaGAN |    DwtDct |    HiDDeN |       SSL | TrustMark Q | TrustMark B |  Rosteals | DwtDctSvd |\n|------------:|----------:|----------:|----------:|----------:|------------:|------------:|----------:|----------:|\n|     RivaGAN |  0.000000 | 89.999997 | 89.999999 | 89.999998 |   89.999998 |   89.999995 | 89.999999 | 90.000000 |\n|      DwtDct | 89.999997 |  0.000000 | 89.999995 | 89.999995 |   89.999997 |   89.999999 | 89.999994 | 89.999997 |\n|      HiDDeN | 89.999999 | 89.999995 |  0.000000 | 89.999994 |   89.999998 |   89.999994 | 89.999998 | 89.999999 |\n|         SSL | 89.999998 | 89.999995 | 89.999994 |  0.000000 |   89.999997 |   89.999999 | 89.999995 | 89.999999 |\n| TrustMark Q | 89.999998 | 89.999997 | 89.999998 | 89.999997 |    0.000000 |   89.999996 | 89.999996 | 89.999996 |\n| TrustMark B | 89.999995 | 89.999999 | 89.999994 | 89.999999 |   89.999996 |    0.000000 | 89.999995 | 89.999995 |\n|    Rosteals | 89.999999 | 89.999994 | 89.999998 | 89.999995 |   89.999996 |   89.999995 |  0.000000 | 89.999997 |\n|   DwtDctSvd | 90.000000 | 89.999997 | 89.999999 | 89.999999 |   89.999996 |   89.999995 | 89.999997 |  0.000000 |\n\n__Applying more than two watermarking methods.__ You asked whether the results on coexistence extend to more than two watermarks. It indeed does, and we conducted some experiments to this end. However, the more watermarks you apply to the same image, the more the image quality and decoding robustness go down, which is, of course, expected. The other problem is that there are much fewer combinations of three or four watermarking methods, and much more permutations of each one of them, making the analysis of the results more complicated and less useful. Nevertheless you can see our results in the two tables below: the bit accuracy remains high (>88%) but the PSNR goes down to about 30dB.\n\n__Three watermarks:__\n| Method 1    | Method 2 | Method 3 | Bit Acc for Method 1 | Bit Acc for Method 2 | Bit Acc for Method 3 | PSNR     |\n|-------------|----------|----------|----------------------|----------------------|----------------------|----------|\n| DwtDct      | RivaGAN  | SSL      | 88.85%               | 99.97%               | 100.00%              | 30.60 dB |\n| TrustMark Q | DwtDct   | RivaGAN  | 98.97%               | 89.95%               | 99.97%               | 30.77 dB |\n| TrustMark Q | DwtDct   | SSL      | 97.88%               | 89.37%               | 100.00%              | 31.24 dB |\n| TrustMark Q | RivaGAN  | SSL      | 97.79%               | 99.94%               | 100.00%              | 31.96 dB |\n\n__Four watermarks:__\n| Method 1    | Method 2 | Method 3 | Method 4 | Bit Acc for Method 1 | Bit Acc for Method 2 | Bit Acc for Method 3 | Bit Acc for Method 4 | PSNR     |\n|-------------|----------|----------|----------|----------------------|----------------------|----------------------|----------------------|----------|\n| TrustMark Q | DwtDct   | RivaGAN  | SSL      | 97.86%               | 87.69%               | 99.97%               | 100.00%              | 29.82 dB |\n\n__More advanced ensembling strategies.__ You asked why we restricted ourselves to rather simpler ensembling strategies like series applying the watermarking methods one after the other (in series) or averaging their individual residuals (in parallel). The main reason for that is simplicity and clarity of the evaluation.\n\nThese two methods for combining watermarks are natural and non-parametric. Furthermore, the main motivation for us to study the problem of watermarking coexistence was to understand non-cooperative multi-actor watermarking, i.e., multiple organisations putting their own watermarks in a piece of media without actively coordinating. This would be exactly the series ensembling setup and is the one that is most likely in practice.\n\nThat being said, we are very open to the possibilities of more advanced ensembling approaches.  We outline several such ideas in the Discussion section:\n\n> Beyond parallel and series ensembling, there could be more advanced adaptive techniques or small learnable mixers that one could use for more performant ensembles. Finally, a further boost to the accuracy and robustness of the ensembles could be possible by fine-tuning their decoders on the jointly watermarked images.\n\nOne concern with learned solutions is, though, that then it might be more difficult to ensure that the boost in performance is due to ensembling, and not due to the additional fine-tuning and/or the added model capacity.\n\nTherefore, we chose the setups that result in clear-cut and unambiguous evaluation and relevance for the coexistence cases that occur in our practice."}, {"review_id": "1Lxg2uacFT", "reviewer": "Reviewer_UzeF", "summary": "This paper presents the first comprehensive study of the coexistence of multiple watermarking methods within a single image. Contrary to the common assumption that one watermarking method would overwrite others, the authors empirically demonstrate that multiple watermarking methods can coexist with minor accuracy and quality degradation. The paper further proposes watermark ensembling, a post-training model modification technique that combines different watermarking methods to improve capacity and adjust trade-offs among capacity, robustness, accuracy, and image quality. Through extensive experiments using both classical and deep learning-based watermarking algorithms, the authors show that ensembling opens new avenues for watermark adaptation without retraining. This work challenges the assumption of exclusive image-channel occupation and suggests a new direction in watermark design and application.", "questions": "After reading this article, I understand the author's attempts to achieve watermark coexistence, but I still have the following questions I would like the author to answer.\n\n1. A curious point in Table 1 is the presence of an extraction accuracy of 0, which is rare for a multibit watermark, as the accuracy should be about 50% to be reasonable when the watermarked signal is completely erased. And 0% means that the extracted watermark is the bitwise inverse of the original watermark, which is also unusual for the same method embedding different random watermarks; therefore, the authors should add a note about this.\n\n2. From the results of the experiments, many of the current watermarking methods actually embed the watermark in a different feature space, thus enabling coexistence in the realization. Then, suppose we manually construct different orthogonal feature spaces (e.g., FFT), and constrain the same watermarking method on different orthogonal feature spaces, can the same watermarking method realize coexistence?\n\n3. The authors tested robustness by embedding both watermarks before testing robustness. However, as shown in Fig. 1, the distortions of the watermarked image may be sequentially superimposed, and the feature space corresponding to the watermarked signal of watermark 1 may be shifted towards the feature space corresponding to watermark 2 after some distortion, and then embedding watermark 2 will erase the signal of watermark 1 to a greater extent.", "limitations": "yes", "rating": 4, "confidence": 5, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": 3, "clarity": 3, "significance": 3, "originality": 3, "strengths_and_weaknesses": "Strengths \nThis article raises a very interesting question, one that we rarely consider in our normal work.\n\n1. This is the first study to systematically evaluate the coexistence of watermarking methods. The finding that multiple watermarks can be decoded from the same image significantly advances our understanding of deep watermarking.\n\n2. The authors benchmark a wide range of watermarking methods (e.g., HiDDeN, RivaGAN, SSL, TrustMark) in pairwise combinations and provide a large empirical matrix showing coexistence results.\n\n3. A geometric explanation is provided to intuitively explain why watermark coexistence may occur, supported by experimental data.\n\nWeaknesses\n1. Ensembling is shown to improve weak models, but often fails to outperform strong models in all metrics. This limitation is acknowledged but makes ensembling less compelling as a general-purpose solution.\n\n2. The increased inference cost from ensembling two models is not quantitatively analyzed. While suggestions such as distillation are mentioned, no concrete evidence is provided.", "was_revised": false, "final_justification": "", "rebuttal": "We appreciate you finding this first systematic study on the coexistence of watermarking methods to  significantly advance our understanding of deep watermarking! As for your questions, you can find our answers below:\n\n> A curious point in Table 1 is the presence of an extraction accuracy of 0, which is rare for a multibit watermark, as the accuracy should be about 50% to be reasonable when the watermarked signal is completely erased. And 0% means that the extracted watermark is the bitwise inverse of the original watermark, which is also unusual for the same method embedding different random watermarks; therefore, the authors should add a note about this.\n\nWe are reporting the percentage of samples for which all bits of the messages were successfully decoded, meaning bit accuracy of 100%. Hence, when the signal is entirely removed, we indeed have bit accuracy of roughly 50% and therefore the fraction of samples with their full message correctly decoded is 0%. We tried to explain this in lines 71–74 and in the caption of Table 1 but will further expand on it in the main text of the revised version of the paper.\n\n> From the results of the experiments, many of the current watermarking methods actually embed the watermark in a different feature space, thus enabling coexistence in the realization. Then, suppose we manually construct different orthogonal feature spaces (e.g., FFT), and constrain the same watermarking method on different orthogonal feature spaces, can the same watermarking method realize coexistence?\n\nThis is a really good question, and indeed one of the questions we find very interesting for further studies! We discuss it a bit in the beginning of Section 5. Indeed, one could split the space of all possible images into several subspaces and constrain each method to one of them. A naive way of doing this would be to give each method a different channel (three methods can coexist this way) or to split the image in an appropriate number of tiles. However, one complication is how such a split would affect the robustness to augmentations, e.g.: if we split channels but then perform a color transform, this might mix the individual watermarks. Therefore, this designation of orthogonal spaces needs to be done in a way that these subspaces are also invariant to the augmentations one is considering. Moreover, this would prevent additional actors embedding watermarks post-factum.\n\n> The authors tested robustness by embedding both watermarks before testing robustness. However, as shown in Fig. 1, the distortions of the watermarked image may be sequentially superimposed, and the feature space corresponding to the watermarked signal of watermark 1 may be shifted towards the feature space corresponding to watermark 2 after some distortion, and then embedding watermark 2 will erase the signal of watermark 1 to a greater extent.\n\nWe are afraid we don’t fully understand your question. Would you be able to elaborate on it?  We do explore the sequential application of watermarks as one of the mechanisms for ensembling in the paper, and explore its impact in terms of accuracy (i.e. the extent to which watermark 1 interferes with the signal of watermark 2 and vice versa), image quality and robustness to perturbations.\n\nWe would also like to comment on the two weaknesses you have highlighted:\n\n>Ensembling is shown to improve weak models, but often fails to outperform strong models in all metrics. This limitation is acknowledged but makes ensembling less compelling as a general-purpose solution.\n\nThis is absolutely correct! The goal of our paper was to assess in an unbiased and as comprehensive as possible way if and when ensembling of watermarking methods can be of practical utility. And we found out that it is useful as a tool for trading-off various axes of performance, even if it fails to produce models that outperform the constituent models across all axes. \n\n> The increased inference cost from ensembling two models is not quantitatively analyzed. While suggestions such as distillation are mentioned, no concrete evidence is provided.\n\nThe inference cost of ensembling, as with any kind of ensemble, is linear in the number of constituent models. So, if we are ensembling two models, the cost of the ensemble will be the sum of the costs of the individual models. Distillation is something we have not actively explored because it will also complicate the analysis, it would be unclear if some of the performance improvements would stem from the additional training, rather than directly due to ensembling. As such, we decided to consider only training-free ensembles."}, {"review_id": "UMd6HrrTO8", "reviewer": "Reviewer_4mgZ", "summary": "- This paper presents the first investigation into the coexistence of multiple DL based image watermarks in a single image \n- The paper challenges the assumption that sequentially applying watermarks would overwrite previous signals\n- Primary contribution: Empirically demonstrates that many pairs of existing open source watermarking methods can coexist with minor degradation in decoding accuracy for each watermark with little impact on image quality. Experiments across 8 watermarking techniques are presented to support this.\n- Another contribution of the paper: Proposes ensembling as a post training tool for modifying watermarking systems by combining different watermarks (sequentially or in parallel) plus techniques like strength clipping and ECCs. \n- The work highlights practical use cases ex: 'super watermark' for identifying the correct decoder and 'multi actor provenance chains' for attribution.", "questions": "Following the order of the weakness section above:\n- How do the coexistence and ensembling results hold up against a standardized benchmark of more potent and modern attacks like diffusion based attacks? Showing non trivial resilience to these attacks would be very helpful to support robustness claims.\n- Results with re-evaluation on more perceptually metrics like LPIPS or SSIM would be helpful. Presenting that the observed quality degradation is perceptually minimal for a significant capacity gain would also be useful.\n - Can the authors more clearly describe the conditions under which ensembling provides a pareto improvement? A clearer characterization of the regime where ensembling is the better choice would be helpful.", "limitations": "Yes", "rating": 4, "confidence": 5, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": 3, "clarity": 3, "significance": 3, "originality": 3, "strengths_and_weaknesses": "Strengths\n------------\n- The finding that different watermarks can coexist to an unexpected degree is a significant discovery and opens a new direction for research.   \n- The empirical investigation about the coexistence is extensive and sound in many ways:\n   - 8 methods are tested from classical frequency based techniques (DwtDct, DwtDctSvd) to multiple modern deep learning approaches (HiDDeN, RivaGAN, RoSteALS, SSL, TrustMark B, TrustMark Q). \n   - The results (Table 1) provide strong evidence for the coexistence phenomenon. \n   - Reports full secret accuracy rather than the bit accuracy which is a great choice because it better reflects the practical utility of a watermark. \n   - The analysis is rigorous - exploring boundary conditions of coexistence, noting that a method cannot coexist with itself (Table 1) and that methods from the same family also overwrite each other. \n- Further, The paper is well written and easy to follow\n\n\nWeaknesses\n---------------\n- The paper's robustness tests are conducted against image augmentations that are specific to the training protocols of the models being tested ex: RivaGAN augmentations for RivaGAN, SSL augmentations for SSL etc in Appendix D. These does not seem like a realistic scenario where an attacker would use more potent attacks for ex: the evaluation is missing modern watermark removal techniques like diffusion based attacks, which have been shown to be highly effective. The authors could also use standard benchmarks like WAVES that include more diverse and challenging set of attacks.\n- The analysis only uses PSNR as the metric for image quality. This is a flaw as the paper's main argument about ensembling involves finding a trade off between increased capacity and decreased quality. A small drop in PSNR like 2 db could correspond to a (perceptually) significant and unacceptable level of visual artifacts. Evaluation using more perceptually relevant metrics such as LPIPS or SSIM, or a user study would be helpful.\n- The ensembling is not shown to be a consistently better strategy. For ex: Figure 6 where applying ECC to a single strong model (TrustMark Q) yields better performance across the accuracy-quality spectrum than ensembling it with a weaker one (RivaGAN). The contribution is more an exploration of the trade off space than a new SOTA technique. It is not clear under which conditions ensembling is the best choice.", "was_revised": true, "final_justification": "Tha authors addressed all my questions in the discussion below. Therefore I would like to maintain my current rating and review.", "rebuttal": "Thank you so much for finding our work comprehensive, rigorous and easy to follow. As for your outstanding questions and concerns, here are our answers:\n\n> The paper's robustness tests are conducted against image augmentations that are specific to the training protocols of the models being tested ex: RivaGAN augmentations for RivaGAN, SSL augmentations for SSL etc in Appendix D.  \n\nWe want to clarify that we don’t evaluate each method only against its own set of augmentations but against all sets of augmentations. Hence, every experiment included evaluation against the same 5 sets of augmentations.\n\n> How do the coexistence and ensembling results hold up against a standardized benchmark of more potent and modern attacks like diffusion based attacks? Showing non trivial resilience to these attacks would be very helpful to support robustness claims.\n\nThis is a really interesting question! We did not evaluate against removal attacks because none of the models in the paper is robust to them (as also mentioned in the response to Reviewer ZkVT). Therefore, it is highly unlikely that the ensemble would be robust to removal. Similarly, we did not evaluate against augmentations not considered by the base methods because we expected robustness there to be low, due to the base models not being robust to them. Our main focus was to check when the base methods don’t deteriorate after ensembling.\n\n> Results with re-evaluation on more perceptually metrics like LPIPS or SSIM would be helpful. Presenting that the observed quality degradation is perceptually minimal for a significant capacity gain would also be useful.\n\nAdditional perceptual metrics is also something we considered extensively. However, we did not see them adding much additional insight. They tend to be generally correlated with PSNR (although, of course, not perfectly predicted by it). Ultimately, we decided that would further complicate the presentation of already dense tables and figures of results while offering little additional insight. Nevertheless, we can add these values to the camera ready version.\n\n> Can the authors more clearly describe the conditions under which ensembling provides a pareto improvement? A clearer characterization of the regime where ensembling is the better choice would be helpful.\n\nThat is a great question! We found no ensemble that is strictly better in all dimensions than its constituent models, as we elaborate on that in the “Ensembling is not sufficient to produce state-of-the-art watermarking models” paragraph on page 7. And we find this very surprising, because in every other setting that we are aware of, ensembling tends to boost performance. Therefore, one of our most interesting findings is that while ensembling is indeed, in principle possible, in practice it does not seem to be of practical utility. We are actively working on understanding why that is the case."}, {"review_id": "l22oarFmgY", "reviewer": "Reviewer_x9v2", "summary": "This paper provides a pioneering investigation into the coexistence and ensembling of watermarking methods, demonstrating that multiple watermarks can coexist in a single image with minimal impact on image quality and decoding accuracy.", "questions": "Please refer to the weakness.", "limitations": "yes", "rating": 6, "confidence": 5, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": 4, "clarity": 4, "significance": 4, "originality": 4, "strengths_and_weaknesses": "Strengths:\n1. The paper offers a unique contribution by exploring the coexistence of multiple watermarks within the same image, a topic not previously studied, challenging the assumption that overlapping watermarks would overwrite each other.\n\n2. The paper conducts extensive experiments to validate the coexistence of different watermarks and proposes an effective method for watermark ensembling using strength control and error-correcting codes.\n\n3. The writing of this paper is generally good and easy to understand.\n\nWeaknesses:\n\n1. The authors in this work did not present complete scientific innovation; instead, it focuses more on engineering improvements and exploration, as strength clipping and error correction are relatively mature techniques. I am somewhat concerned about whether the authors have demonstrated sufficient scientific innovation in this work.\n\n2. The authors are encouraged to provide some theoretical justification as to why most watermarking methods can coexist. Additionally, they could offer paradigms, such as which types of watermarking integrations tend to yield better results. For example, it would be helpful to investigate whether watermarks using different hiding techniques, such as frequency and spatial domains, are more easily integrated. This would aid in the design of future watermarking methods.\n\n3. For the initially embedded watermark, the second watermark added actually serves as a form of degradation. Have the authors considered jointly training the encoding and decoding processes of the first and second watermarks? This might lead to better coexistence results.\n\nOverall, I consider this to be an excellent paper. The authors offer an original and insightful perspective on the problem of watermark coexistence, demonstrating strong innovation and solid research groundwork.", "was_revised": false, "final_justification": "", "rebuttal": "We are extremely grateful for you noting the novelty of the question we are looking at, its counterintuitiveness, the extensive experimentation and the easy-to-understand presentation. We would like to answer your questions too:\n\n> The authors in this work did not present complete scientific innovation; instead, it focuses more on engineering improvements and exploration, as strength clipping and error correction are relatively mature techniques. I am somewhat concerned about whether the authors have demonstrated sufficient scientific innovation in this work.\n\nWe observed an interesting, counterintuitive and important phenomenon which opens a few avenues for interesting further work and we wish to share these findings with the broader research community. Feedback from colleagues and the reviewers here has consistently highlighted the novelty, non-obviousness, and potential impact of our findings, which we take as strong evidence of their value to the community. \n\n> The authors are encouraged to provide some theoretical justification as to why most watermarking methods can coexist. Additionally, they could offer paradigms, such as which types of watermarking integrations tend to yield better results. For example, it would be helpful to investigate whether watermarks using different hiding techniques, such as frequency and spatial domains, are more easily integrated. This would aid in the design of future watermarking methods.\n\nWhile we did provide an intuitive explanation in Appendix A of why watermarks can coexist, formalizing this proved to be a much more ambitious project. That being said, we are nearing the completion of that and hope to soon release a follow up work putting the theory of watermarking and watermark coexistence on a solid theoretical basis. As for investigating which methods coexist better together, we have some observations to this end in the present paper. Similar methods (in terms of architecture and losses) appear to not coexist well with one another (e.g., TrustMark B and Q, or SSL with two different carrier vectors). RoSteALS appears to overwrite any other watermark that might be applied before it. DwtDct and DwtDctSvd, which are frequency-based methods tend to coexist well with all the deep watermarking methods. Therefore, similar methods appear to use similar embedding spaces and hence are less likely to coexist, while more different methods use different embedding spaces and are more likely to coexist.\n\n> For the initially embedded watermark, the second watermark added actually serves as a form of degradation. Have the authors considered jointly training the encoding and decoding processes of the first and second watermarks? This might lead to better coexistence results.\n\nWe did consider fine-tuning the models to work better with one another and even mentioned it in the Discussion section. Ultimately, we decided this would be more of a distraction from the key message of the paper because once we start to fine-tune then it is less clear whether the performance is due to the ensemble or whether it is thanks to the further fine-tuning. For practical deployments, however, this does not matter though, and we expect to improve the performance at least a bit."}]

Author rebuttal:

Meta-review: This paper presents a systematic study of image watermark coexistence, showing that multiple watermarking methods can co-exist in the same image with limited interference, and introduces watermark ensembling to explore trade-offs among capacity, robustness, accuracy, and quality.

Strengths: The work addresses a timely and practical question, provides extensive empirical evaluation across many watermarking methods, and reveals the interesting and potentially impactful finding that watermark coexistence is feasible.
Weaknesses: The paper lacks a deeper theoretical grounding, relies heavily on empirical observations, and one reviewer believes that the proposed ensembling strategy is relatively naive.

Reviewers agreed that the contribution is novel and practically relevant, though largely exploratory; while the rebuttal clarified presentation issues, the need for stronger robustness testing and theoretical analysis remains, making the work empirically valuable but not fully comprehensive. 

I recommend acceptance because the study opens an important new direction and provides strong empirical evidence, even though its impact is limited by the lack of theoretical justification.
Decision: Accept (poster)