Ultra-high Resolution Watermarking Framework Resistant to Extreme Cropping and Scaling
Authors: Nan Sun
LuYu Yuan
Han Fang
Yuxing Lu
Hefei Ling
Sijing Xie
Chengxin Zhao
Venue: NeurIPS 2025 poster ()
Keywords: Image Watermarking
Information Hiding
Implicit Neural Representations
Primary area: applications

Abstract: Recent developments in DNN-based image watermarking techniques have achieved impressive results in protecting digital content. However, most existing methods are constrained to low-resolution images as they need to encode the entire image, leading to prohibitive memory and computational costs when applied to high-resolution images. Moreover, they lack robustness to distortions prevalent in large-image transmission, such as extreme scaling and random cropping. To address these issues, we propose a novel watermarking method based on implicit neural representations (INRs). Leveraging the properties of INRs, our method employs resolution-independent coordinate sampling mechanism to generate watermarks pixel-wise, achieving ultra-high resolution watermark generation with fixed and limited memory and computational resources. This design ensures strong robustness in watermark extraction, even under extreme cropping and scaling distortions. Additionally, we introduce a hierarchical multi-scale coordinate embedding and a low-rank watermark injection strategy to ensure high-quality watermark generation and robust decoding. Experimental results demonstrate that our method significantly outperforms existing schemes in terms of both robustness and computational efficiency while preserving high image quality. Our approach achieves an accuracy greater than 98\% in watermark extraction with only 0.4\% of the image area in 2K images. These results highlight the effectiveness of our method, making it a promising solution for large-scale and high-resolution image watermarking applications.

Ultra-high Resolution Watermarking Framework
Resistant to Extreme Cropping and Scaling
Nan Sun', LuYu Yuan', Han Fang", Yuxing Lu "Hefei Ling', Sijing Xie', Chengxin Zhao School of Computer Science and Technology, Huazhong University of Science and Technology National University of Singapore
SPeking University
(sunnan, yuanly, 1hefei, xiesi jin chengxi izzho @hhust eddu. cn fanghanênus edu. sg, 7xlu06638gmat 30m.am0mmmmm..mmmmmmmmmm..1.11mm com
Abstract
Recent developments in DNN-based image watermarking techniques have achieved impressive results protecting digital content. However, most existing methods are constrained to low-resolution images as they need to encode the entire image, lead- ing to prohibitive memory and computational costs when applied to high-resolution images. Morcover, they lack robustness to distortions prevalent in large-image -magge transmission, such as extreme scaling and random cropping. To address these issues, we propose novel watermarking method based implicit neural rep- resentations (INRs). Leveraging the properties of INRs, our method employs resolution-independent coordinate sampling mechanism generate watermarks pixel-wise, achieving ultra-high resolution watermark generation with fixed and limited memory and computational resources. This design ensures strong robust- ness in watermark extraction, even under extreme cropping and scaling distortions. Additionally, we introduce hierarchical multi-scale coordinate embedding and a low-rank watermark injection strategy to ensure high-quality watermark generation and robust decoding. Experimental results show that our method significantly out- performs existing schemes in terms of both robustness and computational efficiency while preserving high image quality. Our approach achieves an accuracy greater than 98% in watermark extraction with only 0.4% of the image area in 2K images. These results highlight the effectiveness of our method, making it a promising solution for large-scale and high-resolution image watermarking applications.
Introduction
With the rapid progress of the digital age, images have become a fundamental medium information exchange, reaching unprecedented scales in dissemination and application across various fields. Concurrently, image watermarking techniques have emerged as pivotal tools for copyright protection, data security, and integrity verification. However, with the increasing demand for processing large- scale and high-resolution images, DNN-based watermarking approaches face significant challenges in adapting to the requirements of large-scale image watermarking.
Typical deep learning- based image watermarking methods are generally designed for low-resolution images, requiring full-image processing (Zhu et al. [2088) Tancik et al. 2020al Fang et al. (022).
As result, these methods face significant limitations when applied to ultra-high resolution (UHR)
images. First, processing the entire UHR image incurs high computational costs, resulting in long processing times and potential memory overflow, which impacts efficiency and feasibility. Second, in the decoding phase, UHR images more vulnerable to scaling and cropping distortions during
Conresponding Author (Ihefei @ hhust.du.s)
39th Conference on Neural Information Processing Systems (NcurIPS 2025).

---

transmission. Existing watermarking methods, optimized for low-resolution content, struggle to preserve watermark integrity under these severe transformations.
As shown in Figure (a), existing methods for embedding information in high-resolution im- ages typically use a block-based approach (Guo al. ).23), where the image is divided into non-overlapping blocks, and the same water- mark is embedded into each block. However, this approach has two main drawbacks. First, the accuracy of block localization is crucial for decoding performance; misalignment can signif- icantly reduce extraction effectiveness. Second, because the watermark block is smaller than the original image, it is highly susceptible to scaling distortions. An alternative approach embeds the watermark on low-resolution images and then interpolates the residuals to higher resolutions for embedding (Bui et al. 2023). While this reduces the computational burden, it also makes the watermark more vulnerable to local cropping attacks, compromising its robustness.
Wekrmmrk
Eabebiing à Cropphas
0101...1001
Sakee Biock
Sypl
Wanrman
Eucader
Covir Inng:
Los Fimibtho
Japepelation
Frahet
(3) Predius Methada
8101__1081
Eeleddee
Candaaa
000
000
Marreori
INR
KOO....
GOO...
O
Prepand
Figure 1: Different high resolution watermark em- bedding schemes. Where the color blocks on the image represent the watermark embedding area and the red boxes represent the area where the im- age is cropped for decoding the watermark.
To address the challenges of watermarking large-scale images, we propose an innovative solution based on Implicit Neural Representations (INRs). As illustrated in [ our method maps continuous pixel coordinates directly to the corresponding RGB values of the watermark. This eliminates the constraint of fixed image resolutions, enabling watermark embedding in UHR images while ensuring robustness against extreme cropping and scaling distortions. The main contributions of this paper can be summarized as follows:
We propose an innovative INR-based framework for ultra-high resolution watermarking, of- fering a groundbreaking solution to the challenges of watermarking high-resolution images.
We introduce a hierarchical multi-Scale coordinates embedding mechanism for accurate watermark generation across scales. In addition, we introduce a low-rank injection scheme for efficient integration of watermarks.
Extensive experiments on widely representative datasets demonstrate the exceptional per- formance and significant advantages of our proposed method in handling high-resolution images and accommodating diverse resolution scenarios. In addition, our method exhibits excellent resistance to extreme cropping and scaling that often occurs in high-resolution images.
2 Related Work
DNN-based Image Watermarking, Recent advances deep learning have significantly impacted digital image watermarking. HiDDeN (Zhu et al.] 2018) introduced an end-to-end ONNNbased watermarking framework, resembling an autoencoder, setting the stage for future models. StegaStamp (Tancik et al. (200aa) improves print-shooting robustness by simulating the printing and photographing process. RIHOOP (Jia et al.] (2020) further refines this by introducing a differentiable distortion model that preserves the integrity of the watermark under camera imaging conditions. Subsequent works (Jia et 2021 Fang et al. 20233 Li et al. 2024 Sun et al., 2024) focus on increasing robustness against various distortions. However, all of these methods are limited to fixed low-resolution images (typically less than 512). As the resolution of images increases, these methods encounter substantial challenges, including significant rise in computational complexity and memory usage, which not only slow down processing times but also make their practical application with high-resolution images increasingly difficult.
High- High-Resolution Image Watermarking. Several approaches have been proposed to address the challenges of watermark embedding in high-resolution images. DWSF (Guo et al., 2023) uses block-based strategy, selecting fixed-size watermark blocks for embedding, but it struggles with block localization and scaling resistance. TrustMark (Bui et al. 2023), on the other hand, generates

---

Normalized Coordinate Matrix
1
Rendered Watermark
XX
INR
Reshape
Sampled
Ze
Coordinates
Message
01011
Embedding
Message
Random Image
Courd Fourter Mapper
11010
Hierarchical Multi-Scale
Layer
Courdinates Embethling
(d)
Message Decoder
Watermarizd Image
Figure 2: Architecture the proposed model. (a) shows the process of embedding coordinates and messages, and (b) shows the process of rendering into watermarks via INR. (c) shows the process of low-rank watermark injection. (d) shows the decoding process of our method.
watermark residues on low-resolution images and then uses linear interpolation to scale them to high-resolution images. However, this approach vulnerable to local cropping attacks. Wang et al. (Wang et al., 2024) Implicit Neural Representations to fit the host image and then fine-tune the INR to embed watermark information at various resolutions. However, this method has significant drawbacks, it requires the training of separate networks for each individual image. This process particularly
not only increases the computational load but also makes it highly tine-consuming when dealing with large datasets, limiting its practicality for real-time applications. Although the above methods attempt to embed watermarks in large-sized images, none them effectively balance high-rato cropping, scaling resilience, and real-time performance, which are key challenges in large image watermarking.
Implicit Neural Representations. Implicit Neural Representations (INRs) use deep neural networks to model continuous mappings between inputs and outputs, rather than relying on predefined rules. INRs have been widely applied in 3D reconstruction (Mildenhall et al. 2021 Gafni et al. 1202 Hui ct al. 2024), super-resolution (Chen et al. 2021; Yang et 21.1 et 2022),, and image generation (Skorokhodov et al. [222] Shaham al. 2021 Anokhin al.) 2021). In the image domain, an INR takes spatial coordinates as input and outputs RGB values, representing the image continuous signal. CNN-based watermarking methods struggle with large images due high memory and computation costs. In contrast, INRs model continuous signals efficiently, offering scalable solution. We propose using INRs parameterize the watermark signal by coordinates, enabling continuous watermark generation at arbitrary positions and resolutions, overcoming the limitations of CNN-based methods for efficient embedding.
Methodology
Our approach is based on Implicit Neural Representations (INRs), the key idea of our method is to parametrize template watermark using coordinates, with INRs serving as the rendering function for the watermark signal. A comprehensive architecture is presented in Figure 2 illustrating the key components of our framework. The approach built upon three core modules as shown in the Figure: (a) desolution-nddeeene embedding, ensuring consistency and robustness of watermark across varying image resolutions with fixed and limited computational cost; (b) low-rank watermark injection based on Implicit Neural Representations, which reduces computational cost while achieving robust watermark embedding and (d) noise euhancement and decoding of the watermarked image.
sampling strategy combined with hierarchical multi-scale coordinate

---

3.1 Sampling and Embedding
desolution-Independerr Coordinates Sampling. For an image of size (H, W), we normalize the pixel coordinates (Ic, v) to the range [-1,]] 1] as follows:
2xr
(c, v) -
(I)
H
The normalized coordinate matrix obtained denoted as e in Figure (a). To sample submatrices of arbitrary size from 1b, we fixed x coordinate grid C, where is typically set to 128. The coordinates of the sampled submatrix are determined by the upper-left corner (Co, yo). and is defined
C (zi M5) so + A., yjj yo + A
where j E r0,r-11 1] and A is randomly selected interval. The value of As controls the resolution of C, allowing flexible extraction of regions different scales while maintaining fixed grid.
Hierarchical Multi-Scale Coordinates Embedding. Many prior works (Müller et al. 2022, Girish et al. 2023) have shown that using only coordinates input leads to longer training times, loss of high-frequency details, and poor scalability for high-resolution signals. This challenge, as we aim to decode the watermark at arbitrary resolutions while maintaining robustness to cropping and scaling. Therefore, modeling multi-scale features of the watermark crucial.
To address this issue, we propose the use of set of feature grids with varying resolutions L = {L,}* represent the embedded features of the watermark template, where (default 4) denotes the number of feature grids. Each grid L; E |gxx2 x2"+1 is a learnable parameterized matrix, with (default 32) representing the dimension of the features. The coordinates of the feature vectors in each grid are normalized to the range [-1, 1]. Given an input coordinate (x,, y). we identify the four nearest corner features in the matrix L, with the bottom-left and top-right corner features having coordinates (aias> vúr) and (zi,, ) respectively. By applying bilinear interpolation, we can obtain the feature representation corresponding to any input coordinate matrix Le(x, y):
Lo flg) Li( vhi)
La v(r) Li Virr
ytr y
(2( 3) (r x x - -=bb
k
(3)
where ls = (0) -..- = Xvi. 3 Additionally, to further enhance the ability of INR to represent high- frequency details, apply Fourier feature mapping F process the raw coordinates (Tancik et al.. 2020b), obtaining the coordinate encoding žp. Therefore, for any given coordinate (x, v). we can obtain its corresponding feature representation 2e E Rdd.:
= ((L)(I,)) @ L2(x, ... Ln (I. 3 2z)
(4)
where "O" denotes concatenation along the feature dimension and [(*) is a linear layer used to project the features into the di-diinesa space (default 256).
Message Embedding. We use a four-layer MLP with fully connected layer, BatchNorm, and ReLU activation function the Message Encoder M. For I-length binary message {0, 1)4, obtain the corresponding message feature 2. .Mmm) E Rdd.. d,, defaults to 128.
3.2 Low-rank Watermark Injection based on Implicit Neural Representations
INR Rendering, As shown in Figure (b), given positional feature embedding 2, and watermark feature 2m, we use an INR to generate the watermark signal for the corresponding pixel location. This process is repeated for all pixel positions, and the results are reshaped to form the final watermark signal W. Then we randomly sample an r x image block and obtain the watermarked image as I'= IW, where (default 0.02) controls embedding strength. A smaller y helps distribute the watermark evenly, enhancing visual quality and robustness.
Low-rank Watermark Injection. A simple INR-based approach is concatenate two features and process them through an MI.P to predict RGB values. However, prior research (Zadeh et al.) 2017 Liu et al. 2018 has demonstrated that such direct concatenation leads to inadequate feature

---

interaction between modalities. Following TFN (Zadeh et al. 2017), we compute the Cartesian product 2e and 2m facilitate richer cross-modee feature interactions. This can be formulated as:
== M Vec(a,3) + bias
(5)
Where a [Ze, E R", 3 [zm, 1] R and Vec(*) the vectorization operator. The matrix M E: (xx(mxx) is learnable parameter, and 2 is the final output feature. h is the dimension of the output feature, default is 256.
However watermark injection occurs independently at each pixel location in our method. This results in significant computational and memory overhead. To mitigate this, we reformulate (ignoring bias) as:
2 = M Vec(Iag") = (3 & Vec(()) = ( @ I)a
(6)
We expand M and 3 @ / into a block matrix form as follows:
31 l
TzT
m
[M
M2
Mm]
a
3,Maa
(7)
Where M, E R can be viewed as a slice of third-order tensor P E Rmxxxx and Σ B,M; can be interpreted as a weighted sum of the slices of P. Thus, our goal to reduce the parameter count of the learnable tensor P.
Using Canonical Polyadic Decomposition (CPD) for low-rank approximation, we introduce three small learnable matrices u E igd v E ixd and w E R2xd where d is the rank (defaults 32). Thus, any element in P can be expressed as Pijk = Σ Urr Then for any element of the output feature z can be expressed as:
11
m
n
m
Σ
2j
Uir Wkr
k=
(8)
d
3 Wkr
After simplification, we obtain: 2 = =<<(w" (u) * *B)) Where "=" denotes matrix multiplication and "o" denotes element-wise multiplication. preserve the rich semantic information contained in the features we employ skip-connection to mitigate potential information loss caused by low-rank decomposition. Additionally, we stack 4 identical modules to ensure the robust injection of the watermark information. Figure (c) illustrates our INR Block. It can be expressed as:
04 Relu( V (v (ww_1 14-1) (u._ ()))) + 04-1
Where (*) denotes batch normalization. final FC layer maps features to RGB values, and after reshaping, the watermark W E Rx3xxr is obtained.
3.3 Noise Layer and Message Decoder
Figure (d) illustrates the decoding process of model. To enhance generalization, introduce a composite noise layer to simulate worl-world distortions. The Message Decoder then extracts the watermark from the distorted image.
Noise Layer. The noise layer consists of Rotation, Cropping, Translation, Scaling, Shearing, Dropout, Cropout, Color changes, JPEG compression, Gaussian filtering, and Gaussian noise. During training, random noise type is applied to the watermarked image 1', producing 1.
Message Decoder. Our Message Decoder incorporates the SE Block (Hu et al. 2018) inspired by MBRS (Jia et al.) 2021). It processes the input through four stacked blocks of identical structure. Each block consists of a ConyBNReLU layer with kernel size of 3, followed by an SE Block and another convolutional layer. Finally, downsampling is performed using convolutional layer with kernel size of 4 and a stride The extracted features are pooled along the channel dimension, and fully connected layer predicts the watermark information m..
5

---

3.4 Loss Function
Our loss function comprises two components: the first aims to preserve the visual quality of the watermarked image / while the second seeks to minimize the diserepancy between the extracted watermark m and the embedded watermark m. Both components are formulated using the mean squared error (MSE) loss. The total loss is given by:
L= A1 1 i|
+ A Im mll2
(10)
where a and A2 are hyperparameters that balance the trade-off between visual quality preservation and watermark extraction accuracy. By default, both are set to 1.
4 Experiments
In this section, we conduct extensive experiments evaluate the effectiveness of our proposed INR-based watermarking method. First, we describe the experimental setup. Then, we compare our method with previous SOTA models under low resolution. Subsequently, we evaluate our method across various resolutions against other large-image watermarking approaches, demonstrating its superior performance. Finally, ablation studies assess the contribution of proposed components.
4.1 Experimental Setting
Implementation Details. Our model is trained on the high-resolution DIV2K (Agustsson and Timofte (017) image dataset. For each training iteration, randomly select image from the dataset and apply a random scaling operation, where the scaling factor is chosen from the range [0.06, 1]. Following the scaling, we randomly crop a 128 128 image patch from the scaled image, which serves as the input / to the model. For the watermark information m, we randomly generate a binary bit stream of length 30 in each iteration. For the sampling coordinates C, we perform random sampling from normalized coordinate grid v5, using a fixed 128 x 128 grid size. We randomly generate training samples, with a training set size of 50, 000 samples. The model is trained using the AdamW (Loshchilov and Hutter 2017) optimizer with a learning rate of 4 X 10tH 4. The batch size is set to 32, and the training is conducted for 2000 epochs across two NVIDIA RTX 3090 24G GPUs.
Metrics. We evaluate our method using three metrics: Peak Signal-to-Nee Noise Ratio(PSNR) for visual quality, Structural Similarity Index(SSIM) for structural similarity and Average Bit Accuracy (ACC) for average decoding accuracy. PSNR and SSIM assess image quality, while ACC measures watermark extraction robustness.
Baseline. We use HiDDeN (Zhu et al. 2018), StegaStamp Tancik et al. 2020a), MBRS (Jia et al. 2021). DWSF (Guo et al. 2023), TrustMark (Bui al.) 2023) and RAIMARK (Wang al. [2024] as baselines. The first three methods are limited to low resolution images, while others can work at different resolutions. To ensure fair comparison,
re-train these models (excluding TrustMark, which does not provide a training script) with our proposed noise layer, as the strength of the noise layer significantly impacts their performance. Initially, we train our model on 128 x 128 images and compare them with the low-resolution baselines to demonstrate the effectiveness of our method. Subsequently, we relax the resolution constraint, allowing models to be trained images with different sizes, and compare them with corresponding large-image watermarking models to validate the superiority of our approach.
4.2 Visual Quality
Table I presents the visual quality across different methods. Our method does not achieve the highest PSNR and SSIM values, but it consistently maintains a PSNR above 35. This result is expected, as our approach employs a template-basee based watermark, which does not leverage the content of the cover image for embedding. As result, while the visual quality is slightly lower compared to methods that embed watermarks based on the cover image content, our method still achieves a PSNR above 35, ensuring it meets practical requirements for everyday use.
In addition, as shown in Figure we also present the visualization results of our method different resolutions. We observe that watermarks generated from different embedded messages exhibit

---

Watcrmeck
Watcrmark
Figure 3: Visualization results at different resolutions. For each group, the first row presents cover images at different resolutions, starting from 2K size and progressively reduced by 75%. The second row displays the corresponding watermarked images, while the third row shows the embedded watermarks.
High Resolution
Low Resolution
Proposed
DWSF
TrustMark
RAIM
HiDDeN
StegaStamp
MBRS
PSNR
37.27
33.18
40.76
40.52
32.67
35.25
40.73
SSIM
0.9611
0.9269
0.9900
0.9898
0.8591
0.8864
0.9866
Table 1: Average visual quality of the different methods. For High Resolution methods, we measured 2K size (except for DWSF). For Low Resolution methods, measured 128 x 128 size. For DWSF, essentially embeds the watermark into many 128 x 128 blocks, so we measured the visual quality of the block.
highly similar overall structural patterns, with variations primarily reflected in color and fine details. Moreover, the watermark consistently maintains similar striped pattern and distribution across various resolutions, indicating its structural consistency across different scales. This ensures that the watermark information can successfully decoded from cropped patches at different resolutions.
4.3 Comparison with Previous Methods
compare our method with previous SOTA models a fixed resolution of 128 x 128 to evaluate its effectiveness. For a comprehensive evaluation, we test the decoding accuracy of our trained model using a varicty distortions: Identity, Gaussian Noise(std 0.01), Gaussian Filter (a = 2). JPEG Compression (Q 50), Dropout (p 0.5), Rotation (deg 10). Translation (dis 0.1) and Color Transform(f = 0.1). ensure fair comparison, we fix the PSNR at 35 for all watermarked images following the approach in the MBRS (Jia et al. 202I) method.
Table 2 presents the experimental results. Notably, despite employing INRs rather than traditional CNNs for information embedding, our proposed method achieves the best decoding accuracy under most distortion conditions. Specifically, the proposed method maintains extremely high accuracy under conditions such Gaussian noise, Gaussian filtering, rotation, translation, and color perturba- tion. Even under more severe transformations like JPEG compression and dropout operations, the method demonstrates strong robustness, achieving accuracy rates of 93.36% and 95.13% respectively.

---

Gaussian Noise
Gaussian Filter
JPEG Compression
Dropout (0.5)
Rotation (dog 10)
Translation (dis 0.1)
Color
Method
Identity
(std = 0.01)
(a 2)
(Q 50)
(f = 0.1)
HiDDeN
88.34
87.96
60.14
52.96
74.74
82,94
82.85
90.79
StegaStamp
92.16
91.72
90,78
84.42
77.53
87.19
88.46
91.21
MBRS
99.18
98.06
94,93
96.56
95.75
95.37
96.27
98.37
DWSF
90.17
89.76
89.40
87.33
76.47
86.56
65,90
78.36
TrustMark 87.65
83.72
82.60
75.22
76.58
49.50
62.13
87.25
RAIMARK
78.67
78.67
78.67
54.33
57.67
77.24
74.58
77.67
Proposed
100
99.83
98.86
93.36
95.13
99.73
99.59
99.93
Table 2: Benchmark comparisons on robustness against different distortions. Where the mean value of Gaussian Noise is O, the kernel size of Gaussian Filter is 3, and JPEG Compression is simulated using Kornia (Riba et al. 2020).
Distortions
Model
128
512
2048
2048
DIV2K
COCO
FFHQ
DIV2K
COCO
FFHQ
DIV2K
COCO
FFHQ
DIV2K
COCO
FFHQ
DWSF
90.17
78.93
53.28
54.10
50.80
50.73
50.64
50.12
Cropping
TrusMark
87.65
92.15
96.10
49.55
49.45
50.23
49.77
49.58
49.41
49.50
54.57
47.25
RAIMARK
78.67
77.33
78.30
53.33
48.67
45.33
$4.00
48.67
46.67
54.35
49.46
46.85
Preposed
99.99
99.85
99.91
99.86
99.84
99.95
98,74
94.80
93.83
85.94
86.93
83.23
DWSF
90.17
89.83
78.93
89.56
89.40
77.90
80.70
80.83
67.07
63.73
63.43
56.57
Scaling
TrustMark
87.65
85.90
76.07
86.77
RAIMARK
78.67
77.33
78.30
61.67
63.76
66.52
62.33
64.37
63.16
62.67
64.48
62.89
Proposed
99.99
99.85
99.91
99.86
99.88
99.96
98.66
99.16
99.33
99.33
92.83
98.66
Table 3: Average decoding accuracy of different models for extreme cropping and scaling at different resolutions.
This robust performance strongly demonstrates that INR-hased embedding an effective and highly resilient mechanism for steganography.
4.4 Evaluation across Varying Image Resolutions
In this section, investigate the performance of our method across different resolutions. We compare it with several SOTA watermarking methods capable of operating at various resolutions.
As modern applications increasingly involve high-resolution images such digital media, medical imaging, and professional photography, scalable and reliable watermarking technology has become essential. For high-resolution images, two key challenges are commonly encountered during trans- mission: (1) High-ratio scaling, where the image significantly reduced in size and (2) High-ratio random cropping, where only small portion of the image is retained. These operations severely compromise the integrity of embedded watermarks, particularly when using traditional spatial domain CNN-based methods.
Table 3 presents the experimental results. To evaluate the generalizability our model, we test not only on DIV2K but also on 200 separately sampled images from each of the COCO (Lin et al. 2014) and FFHQ (Karras et al. 2019) datasets. We embed watermarks different resolutions and evaluate the performance of various methods under extreme cropping and scaling. Specifically, for cropping, we randomly extract 128 128 patches for decoding, while for scaling, we uniformly resize the images to 128 x 128 before decoding. To ensure fair comparison, the PSNR is fixed at 35 for all watermarked images.
As can be seen, our method is far superior to the others. DWSF, RAIM ARK and TrustMark are all struggling resist cropping attacks in large-image watermarking, Although these methods perform reasonably well at low resolutions (128 x 128), they encounter issues in high-resolution scenarios. For instance, DWSF cannot withstand cropping at high resolutions because is difficult to ensure that the cropped image block contains complete embedding block. TrustMark, which embeds watermarks high resolutions through interpolation, retains less watermark information after cropping, leading to extraction failure. On the contrary, on 2K images, our method requires only 0.4% % of the image area to maintain 98% decoding accuracy. Notably, this high level of robustness extends even to 4K resolution, where our method still achieves over 85% decoding accuracy using only 1 128x128 patch, which corresponds to just 0. I 1% of the total image area. This superiority primarily stems from our coordinate sampling strategy and INR's capability to model continuous signals.
8

---

Model
Proposed
DWSF
TrustMark
RAIMARK
CPU
X
x
Embedding Rate
4ms
74ms
308ms
20min
Table 4: Embedding rates for different methods. Where the second represents whether the embedding is done using only the CPU or not, and the third row represents the average watermark embedding rate for single image with resolution of 2K. We use AMD Ryzen 7840HS for CPU and NVIDIA RTX 3090 24G for our GPU for testing.
In addition, we test the performance of different distortions at different resolutions. shown in Figure our model achieves performance of more than 90% at most resolutions, which is much better than other models. At the same time, we observe an interesting phenomenon: at low resolutions, the performance of Gaussian filtering and JPEG compression deteriorates. Both types of distortion are related to the image's s frequency content, suggesting that the current method still has limitations.
Projesed
Propoeed Taak
Maak
RADMAN
RAlMaa
68
Trundation
Codoe
68
Deapgex
Yutsllo
Trandatio
Colen
(a) 128 Resolution
(b) 512 Resolution
Acrumzy
Pripesaal RAlManc
Popponal RAIMARE
13eatily
635
1920
Botssion
Tradltion
Coles
63
01
Rotisien
Traslatio
2048 Resolution
(d) 4096 Resolution
Figure 4: Average decoding accuracy of different models at different resolutions and distortions. Where GN stands for Gaussian Noise and GF stands for Gaussian Filter. To ensure fairness, the PSNR of embedded images is standardized at 35.
4.5 Embedding Rate Comparison
In this subsection, we compare the computational efficiency between the different methods by the embedding rate of the watermark. Since our focus on watermark embedding for large images, which often incur high computational costs due to their large resolution, the real-time performance of watermarking systems can be significantly impacted. As shown in Table our method is significantly faster. This result primarily becauses it is based on template watermarking, allowing all watermarks to pre-generated once the model trained. contrast, other methods require the network to process the carrier image during embedding, resulting in slower performance. Worth mentioning that RAIMARK requires INR encoding and watermark embedding fine-tuning for each image, making its embedding rate extremely slow.

---

Coordinates Embedding
Low-rank Injection (rank)
(num of layers)
1
64
ACC
90.91
91.66
93.86
95.17
93.77
84.69
95.17
95.76
PSNR
35.98
36.88
36.75
37.27
36.04
37.08
37.27
36.37
SSIM
0.9706
0.9590
0.9565
0.9611
0.9639
0.9656
0.9611
0.9550
Table 5: Model performance with different components. Here, "x" indicates the absence of the corresponding component. For Coordinates Embedding, this means that only the Coordinate Fourier Mapper is used as an embedding feature. For Low-rank Injection, it signifies that features are concatenated and directly predicted by MLP.
Num of Bit
PSNR
SSIM
Avg ACC
37.27
0.9656
95.76
50
35.59
0.9563
95.62
100
31.32
0.9123
88.26
Table 6: The relationship between visual quality and decoding accuracy at varying numbers of bits.
4.6 Ablation Study
In this subsection, we examine the effectiveness of each component our proposed method, focusing on two main points: (1) the impact of the hierarchical multi-Scale coordinates embedding layers on model performance, and (2) the effectiveness of low-rank watermark injection.
presenss the results of our ablation study. We embed watermarks into 2K-resolution images and evaluate the average decoding accuracy after applying random attacks. The results show that removing multi-scale coordinate embedding significantly degrades performance, while increasing the number of embedding layers progressively improves it. For Low-rank Injection, replacing our design with feature concatenation followed by MLP prediction results in inferior performance. Moreover, lower rank significantly degrades accuracy.
Additionally, we evaluated the watermarking capacity of our method. Table 6 iillustrates the trade-off between watermark capacity, visual quality, and decoding robustness. As the embedded bit count increases from 30 to 100, the visual quality of images deteriorates, while accuracy remains at a high level. Even under 100 bits, the accuracy exceeds 88%. Since our method handles high-intensity cropping and scaling while maintaining high accuracy under current high payloads, it indicates that our embedding strategy inherently introduces significant redundancy. Therefore, exploring more efficient embedding patterns in the future to reduce redundancy and increase watermark capacity while maintaining robustness will be a highly meaningful research direction.
5 Conclusion
In this paper, we introduce a novel watermarking framework that leverages implicit neural represen- tations and resolution-independen coordinate sampling for efficient watermark embedding and extraction across images of high resolution. Unlike CNN-based methods that require processing entire images, our approach can embed watermark the pixel level, enabling watermark embedding across different scales while avoiding excessive computational overhead and ensuring robustness against extreme cropping and scaling distortions. Additionally, we introduce hierarchical multi-scale coordinate embedding and low-rank watermark injection to enhance model robustness. Experimental results show that our method outperforms existing approaches both performance and computa- tional efficiency. These findings highlight the potential of INR-based methods for high resolution watermarking solutions, offering valuable insights for future research on resolution-indepencee image watermarking.
10

---

Acknowledgments and Disclosure of Funding
This work was supported part by the Natural Science Foundation of China under Grant 62372203 and 62302186, in part by the Major Scientific and Technological Project of Shenzhen (202316021). in part by the National key research and development program of China(2022YFB220180022 in part by the Major Scientific and Technological Project of Hubei Province (2022BAA046, 2022BAA042).
References
Eirikur Agustsson and Radu Timofte. 2017. Ntire 2017 challenge on single image super-resolution: Dataset and study. In Proceedings of the IEEE conference computer vision and pattern recogni- tion workshops. 135.
Ivan Anokhin, Kirill Demochkin, Taras Khakhulin, Gleb Sterkin, Victor Lempitsky, and Denis Ko- rzhenkov. 2021. Image generators with condiionalll-indepeneent pixel synthesis. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition. 14278-14287.
Tu Bui, Shruti Agarwal, and John Collomosse. 2023, TrustMark: Universal Watermarking for Arbitrary Resolution Images. arXiv preprint arXiv:2311.1829 (2023).
Yinbo Chen, Sifei Liu, and Xiaolong Wang. 2021. Learning continuous image representation with local implicit image function. In Proceedings of the IEEE/CVF conference on computer vision and pultern recognition. 8628-8638.
Zeyuan Chen, Yinbo Chen, Jingwen Liu, Xingqian Xu, Vidit Goel, Zhangyang Wang, Humphrey Shi, and Xiaolong Wang. 2022. Videoinr: Learning video implicit neural representation for continuous space-time super-resolution. In Proceedings of the IEEE/CVF Conference on Computer Vision and Puttern Recognition. 2047-2057.
Han Fang, Zhaoyang Jia, Zehua Ma, Ee-Chien Chang, and Weiming Zhang. 2022. PIMoG:
An Effective Screen-shooting Noise-Layer Simulation for Deep-Learning-Bess -Bssed Watermark- ing Network. In MM 222 The 30th ACM International Conference on Multimedia, Lisboa, Portugal, October 10 14, 2022, João Magalhães, Alberto Del Bimbo, Shin Shin'ichi Satoh, Nicu Sebe, Xavier Alameda- Qin Jin, Vincent Oria, and Laura Toni (Eds.). ACM, 2267-2275 3548049
doi: 00 10e.1114335000
Han Fang, Yupeng Qiu, Kejiang Chen, Jiyi Zhang, Weiming Zhang, and Ec-Chien Chang. 2023, Flow- based robust watermarking with invertible noise layer for black-box distortions. In Proceedings of the AAAI conference artificial intelligence, Vol. 37. 5054-505400 5061.
Guy Gafni, Justus Thies, Michael Zollhofer, and Matthias Nießnnr. 2021. Dynamic neural radiance fields for monocular 4d facial avatar reconstruction. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition. 8649-8658
Sharath Girish, Abhinay Shrivastava, and Kamal Gupta. 2023. Shacira: Scalable hash-grid compres- sion for implicit neural representations. In Proceedings of the IEEE/CVF International Conference Computer Vision. 17513-17524
Hengchang Guo, Qilong Zhang, Junwei Luo, Feng Guo, Wenbin Zhang, Xiaodong Su, and Minglei Li. 2023, Practical deep dispersed watermarking with synchronization and fusion. Proceedings of the 31st ACM International Conference Multimedia. 7922-7932.
Jie Hu, Li Shen, and Gang Sun. 2018. Squeeze-and--xxiiationn networks. In Proceedings of the IEEE conference on computer vision and pattern recognition. 7132-7141.
Mude Hui, Zihao Wei, Hongru Zhu, Fei Xia, and Yuyin Zhou. 2024. MicroDiffusion: Implicit Exppresentation-uuidee Diffusion for 3D Reconstruction from Limited 2D Microscopy Projections. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition. 11460- 11469.
Jun Jia, Zhongpai Gao, Kang Chen, Menghan Hu, Xiongkuo Min, Guangtao Zhai, and Xiaokang Yang. 2020. RIHOOP: Robust invisible hyperlinks in offline and online photographs. IEEE
Transactions Cybernetics 52, 7 (2020), 7094-7106.

---

Zhaoyang Jia, Han Fang, and Weiming Zhang. 2021. Mbrs: Enhancing robustness of dnn-base based watermarking by mini-bated of real and simulated jpeg compression. In Proceedings of the 29th ACM international conference on multimedia. 41-49.
Tero Karras, Samuli Laine, and Timo Aila. 2019. A style-based generator architecture for generative adversarial networks. In Proceedings of the IEEE/CVF conference on computer vision and paltern recognition. 4401-4410.
Yiyi Li, Xin Liao, and Xiaoshuai Wu. 2024. Screen-Shooting Resistant Watermarking with Grayscale Deviation Simulation. IEEE Transactions on Multimedia (2024).
Tsung- Yi Lin, Michael Maire, Serge Belongie, James Hays, Pietro Perona, Deva Ramanan, Piotr Dollár, and C Lawrence Zitnick. 2014. Microsoft coco: Common objects in context. In Computer ESsion-ECCV 2014: 13th European conference, zurich, Switzerland, Seplember 6-12, 2014, proceedings, part v 13. Springer, 740-755.
Zhun Liu, Ying Shen, Varun Bharadhwaj Lakshminarasimhan. Paul Pu Liang, Amir Zadeh, and Louis-Philippe Morency. 2018. Efficient low-rank multimodal fusion with modality-specifff factors. arXiv preprint arXiv: arXxiv/806.000 1806.00044 (2018).
lya Loshchilov and Frank Hutter. 2017. Decoupled weight decay regularization. arXiv preprint
arXiv:1711.05100 (2017).
Ben Mildenhall, Pratul P Srinivasan, Matthew Tancik, Jonathan T Barron, Ravi Ramamoorthi, and Ren Ng. 2021. Nerf: Representing scenes as neural radiance fields for view synthesis. Commun. ACM 65, 1 (2021), 99-106.
Thomas Müller, Alex Evans, Christoph Schied, and Alexander Keller. 2022. Instant neural graphics primitives with multiresolution hash encoding, ACM transactions on graphics (TOG) 41, (2022), 1-15.
Edgar Riba, Dmytro Mishkin, Daniel Ponsa, Ethan Rublee, and Gary Bradski. 2020. Kornia: an open source differentiable computer vision library for pytorch. In Proceedings of the IEEE/CVF Winter Conference on Applications of Computer Vision. 3674-3683.
Tamar Rott Shaham, Michaël Gharbi, Richard Zhang, Eli Shechtman, and Tomer Michaeli. 2021. Spatially-adaptive pixelwise networks for fast image translation. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition. 14882-144 14891.
Ivan Skorokhodov, Savva Ignatyev, and Mohamed Elhoseiny. 2021. Adversarial generation of continuous images. In Proceedings of the IEEE/CVF conference on computer vision and pattern recognition. 10753-10764
Nan Sun, Han Fang, Yuxing Lu, Chengxin Zhao, and Hefei Ling. 2024. END?: Robust Dual- Decoder Watermarking Framework Against Non-Differentiable Distortions. arXiv preprint arXiv:2412.09900 0,9960 (2024).
Matthew Tancik, Ben Mildenhall, and Ren Ng. 2020a. Stegastamp: Invisible hyperlinks in phys- ical photographs. In Proceedings of the IEFF/CVF conference computer vision and pattern recognition. 2117-2126.
Matthew Tancik, Pratul Srinivasan, Ben Mildenhall, Sara Fridovich- Keil, Nithin Raghavan, Utkarsh Singhal, Ravi Ramamoorthi, Jonathan Barron, and Ren Ng. 2020b. Fourier features let networks learn high frequency functions in low dimensional domains. Advances in neural information processing systems 33 (2020), 7537-7547.
Yuchen Wang, Xingyu Zhu, Guanhui Ye, Shiyao Zhang, and Xuetao Wei. 2024. Achieving Resolution- Agnostic based Image Watermarking: A Novel Perspective of Implicit Neural Representation. In Proceedings of the 32nd ACM International Conference on Multimedia. 10354-10362.
Jingyu Yang. Sheng Shen, Huanjing Yue, and Kun Li. 2021. Implicit transformer network for screen content image continuous super-resolution. Advances in Neural Information Processing Systems 34 (2021), 13304-13315.
12

---

Amir Zadeh, Minghai Chen, Soujanya Poria, Erik Cambria, and Louis-Philipee Morency. 2017. Tensor fusion network for multimodal sentiment analysis. arXiv preprint arXiv: 1eor;,707005555 (2017).
Jiren Zhu, Russell Kaplan, Justin Johnson, and Li Fei-Fei. 2018. Hidden: Hiding data with deep networks, In Proceedings of the European conference on computer vision (ECCV). 657-672.
13

---

NeurIPS Paper Checklist
The checklist is designed encourage best practices for responsible machine learning research, addressing issues of reproducibility, transparency, research ethics, and societal impact. Do not remove the checklist: The papers not including the checklist will be desk rejected. The checklist should follow the references and follow the (optional) supplemental material. The checklist does NOT count towards the page limit.
Please read the checklist guidelines carefully for information on how to answer these questions. For each question in the checklist:
You should answer [Yes], [No], or [NA].
[NA] means either that the question Not Applicable for that particular paper or the relevant information is Not Available.
Please provide short (1-2 sentence) justification right after your answer (even for NA).
The checklist answers are an integral part of your paper submission. They are visible to the reviewers, area chairs, senior area chairs, and ethics reviewers. You will be asked to also include (after eventual revisions) with the final version of your paper, and its final version will published with the paper.
The reviewers of your paper will be asked use the checklist as one of the factors their evaluation. While "[Yes] is generally preferable to "[No]" ", it is perfectly acceptable to answer "[No] providedd proper justification is given (e.g.. "error bars are not reported because it would be too computationally expensive" or "we were unable to find the license for the dataset we used"). In general, answering binary way, we
"[No] or "[NA]" is not grounds for rejection. While the questions are phrased acknowledge that the true answer is often more nuanced, please just use your best judgment and write justification to elaborate. All supporting evidence can appear either in the main paper or the supplemental material, provided in appendix. If you answer [Yes] to a question, in the justification please point to the section(s) where related material for the question can be found.
IMPORTANT, please:
Delete this instruction block, but keep the section heading "NeurIPS Paper Checklist",
Keep the checklist subsection headings, questions/answers and guidelines below.
Do not modify the questions and only use the provided macros for your answers.
1. Claims
Question: Do the main claims made in the abstract and introduction accurately reflect the paper's contributions and scope?
Answer: [Yes]
Justification: Section explains our contributions
Guidelines:
The answer NA means that the abstract and introduction do not include the claims made in the paper.
The abstract and/or introduction should clearly state the claims made, including the contributions made in the paper and important assumptions and limitations. A No or
NA answer to this question will not perceived well by the reviewers.
The claims made should match theoretical and experimental results, and reflect how much the results be expected to generalize other settings.
is fine include aspirational goals as motivation long is clear that these goals are not attained by the paper.
2. Limitations
Question: Does the paper discuss the limitations of the work performed by the authors?
Answer: [Yes]
Justification: Section 4.2 and Supplementary Material B exxlain limitations
14

---

Guidelines:
The answer NA means that the paper has no limitation while the answer No means that the paper has limitations, but those are not discussed in the paper.
The authors are encouraged to create a separate "Limitations" section in their paper.
The paper should point out any strong assumptions and how robust the results are to violations of these assumptions (e.g., independence assumptions, noiseless settings, model well-specification, asymptotic approximations only holding locally). The authors should reflect on how these assumptions might be violated in practice and what the implications would be.
The authors should reflect on the scope of the claims made, c.g., if the approach was only tested few datasets or with few runs. In general, empirical results often depend on implicit assumptions, which should be articulated.
The authors should reflect on the factors that influence the performance of the approach. For example, facial recognition algorithm may perform poorly when image resolution is low or images are taken in low lighting. Or speech-to-text system might not be used reliably to provide closed captions for online lectures because it fails handle technical jargon.
The authors should discuss the computational efficiency the proposed algorithms and how they scale with dataset size.
If applicable, the authors should discuss possible limitations of their approach to address problems of privacy and fairness.
While the authors might fear that complete honesty about limitations might be used by reviewers as grounds for rejection, worse outcome might be that reviewers discover limitations that aren't I acknowledged in the paper. The authors should use their best judgment and recognize that individual actions in favor of transparency play an impor- tant role in developing norms that preserve the integrity of the community. Reviewers will be specifically instructed to not penalize honesty concerning limitations.
3. Theory assumptions and proofs
Question: For each theoretical result, does the paper provide the full set of assumptions and complete (and correct) proof?
Answer: [Yes]
Justification: Section
3.2 gives the full proof.
Guidelines:
The answer NA means that the paper does not include theoretical results.
All the theorems, formulas, and proofs in the paper should be numbered and cross- referenced.
All assumptions should be clearly stated or referenced in the statement of any theorems.
The proofs can either appear in the main paper the supplemental material, but if they appear in the supplemental material, the authors are encouraged to provide short proof sketch provide intuition.
Inversely, any informal proof provided in the core of the paper should complemented by formal proofs provided in appendix supplemental material.
Theorems and Lemmas that the proof relies upon should properly referenced.
4. Experimental result reproducibility
Question: Does the paper fully disclose all the information needed to reproduce the main ex- perimental results of the paper to the extent that it affects the main claims and/or conclusions the paper (regardless whether the code and data are provided or not)?
Answer: [Yes]
Justification: Section 4.1 gives details.
Guidelines:
The answer NA means that the paper does not include experiments.
15

---

If the paper includes experiments, a No answer to this question will not be perceived well by the reviewers: Making the paper reproducible is important, regardless of whether the code and data are provided or not.
If the contribution is dataset and/or model, the authors should describe the steps taken to make their results reproducible or verifiable.
Depending on the contribution, reproducibility can be accomplished in various ways. For example, if the contribution is a novel architecture, describing the architecture fully might suffice, or if the contribution is specific model and empirical evaluation, it may be necessary to either make it possible for others to replicate the model with the same dataset, or provide access the model. In general. releasing code and data is often one good way to accomplish this, but reproducibility can also be provided via detailed instructions for how to replicate the results, access a hosted model (e.g., in the case of a large language model), releasing of a model checkpoint, or other means that are appropriate to the research performed.
While NeurlPS does not require releasing code, the conference does require all submis- sions to provide some reasonable avenue for reproducibility, which may depend on the nature of the contribution. For example
(a) If the contribution is primarily a new algorithm, the paper should make it clear how to reproduce that algorithm. (b) the contribution is primarily a new model architecture, the paper should describe the architecture clearly and fully.
(c) If the contribution is new model (e.g., a large language model), then there should either be way to access this model for reproducing the results or way to reproduce the model (e.g., with an open-source dataset instructions for how to construct the dataset).
(d) We recognize that reproducibility may be tricky in some cases, in which case authors are welcome describe the particular way they provide for reproducibility. In the case of closed-source models, it may be that access to the model is limited in some way (e.g., registered users), but it should be possible for other researchers to have some path to reproducing or verifying the results.
5. Open access to data and code
Question: Does the paper provide open access to the data and code, with sufficient instruc- tions to faithfully reproduce the main experimental results, as described in supplemental material?
Answer: [Yes]
Justification: Section 4.1 and Supplementary Material A.3 give details.
Guidelines:
The answer NA means that paper does not include experiments requiring code.
Please the NeurIPS code and data submission guidelines (bttps://nips.cr co/
public/ httee//uudd/eeoeeeeeeeee CodeeuumieSeeeee ssmommsiiopppg for more details.
While we encourage the release of code and data, we understand that this might not be possible, so "No" an acceptable answer. Papers cannot be rejected simply for not including code, unless this is central to the contribution (e.g., for new open-source benchmark).
The instructions should contain the exact command and environment needed to run to reproduce the results. See the NeurIPS code and data submission guidelines (https / //nips cc/ http://cccpulic/uiieeeeeeeee Code Sumii as cesssoooooiirr for more details.
The authors should provide instructions on data access and preparation, including how to access the raw data, preprocessed data, intermediate data, and generated data, etc.
The authors should provide scripts to reproduce all experimental results for the new proposed method and baselines. only subset of experiments are reproducible, they should state which ones are omitted from the script and why.
At submission time, to preserve anonymity, the authors should release anonymized versions (if applicable).
16

---

Providing as much information as possible in supplemental material (appended to the paper) recommended, but including URLs to data and code permitted.
6. Experimental setting/details
Question: Does the paper specify all the training and test details (e.g., data splits, hyper- parameters, how they were chosen, type of optimizer, etc.) necessary to understand the results?
Answer: [Yes]
Justification: Section gives details.
Guidelines:
The answer NA means that the paper does not include experiments.
The experimental setting should be presented the core the paper to level of detail that is necessary to appreciate the results and make sense of them.
The full details can be provided either with the code, in appendix, supplemental material.
7. Experiment statistical significance
Question: Does the paper report error bars suitably and correctly defined or other appropriate information about the statistical significance of the experiments?
Answer: [Yes]
Justification: Section gives details.
Guidelines:
The answer NA means that the paper does not include experiments.
The authors should answer "Yes" if the results accompanied by error bars, confi- dence intervals, or statistical significance tests, at least for the experiments that support the main claims of the paper.
The factors of variability that the error bars are capturing should be clearly stated (for example, train/test split, initialization, random drawing of some parameter, or overall run with given experimental conditions).
The method for calculating the error bars should be explained (closed form formula, call to a library function, bootstrap, etc.)
The assumptions made should be given (e.g.. Normally distributed errors).
It should be clear whether the error bar is the standard deviation or the standard error of the mean.
OK to report 1-sigma error bars, but one should state The authors should preferably report a 2-sigma error bar than state that they have 96% CI, if the hypothesis of Normality of errors is not verified.
For asymmetric distributions, the authors should be careful not to show in tables or figures symmetric error bars that would yield results that out of range (e.g. negative error rates).
If error bars reported in tables or plots, The authors should explain in the text how they were calculated and reference the corresponding figures or tables the text.
8. Experiments compute resources
For each experiment, does the paper provide sufficient information on the com- puter resources (type of compute workers, memory, time of execution) needed to reproduce the experiments?
Question:
Answer: [Yes]
Justification: Section gives details.
Guidelines:
The answer NA means that the paper does include experiments.
The paper should indicate the type of compute workers CPU or GPU, internal cluster, or cloud provider, including relevant memory and storage.
17

---

The paper should provide the amount of compute required for each of the individual experimental runs as well estimate the total compute.
The paper should disclose whether the full research project required more compute than the experiments reported in the paper (e.g., preliminary or failed experiments that didn't make into the paper).
9. Code of ethics
Question: Does the research conducted in the paper conform, in every respect, with the NeurIPS Code of Ethics
Answer: [Yes]
Justification: this paper ensures that the research adheres ethical standards and the NeurIPS Code of Ethics.
Guidelines:
The answer NA means that the authors have reviewed the NeurIPS Code of Ethics.
the authors answer No, they should explain the special circumstances that require deviation from the Code of Ethics.
The authors should make to preserve anonymity (e.g., if there is special consid- eration due to laws or regulations their jurisdiction).
Broader impacts
Question: Does the paper discuss both potential positive societal impacts and negative societal impacts of the work performed?
Answer: [NA]
Justification: The paper is no societal impact of the work performed.
Guidelines:
The answer NA means that there is no societal impact of the work performed.
If the authors answer NA or No, they should explain why their work has socictal impact or why the paper does not address societal impact.
Examples of negative societal impacts include potential malicious or unintended uses (e.g., disinformation, generating fake profiles, surveillance), fairness considerations (e.g., deployment of technologies that could make decisions that unfairly impact specific groups), privacy considerations, and security considerations.
The conference expects that many papers will be foundational research and tied to particular applications, let alone deployments. However, if there is direct path to any negative applications, the authors should point it out. For example, it is legitimate to point out that improvement in the quality of generative models could be used to generate deepfakes for disinformation. On the other hand, it is not needed to point out that generic algorithm for optimizing neural networks could enable people to train models that generate Deepfakes faster.
The authors should consider possible harms that could arise when the technology is being used intended and functioning correctly, harms that could arise when the technology is being used as intended but gives incorrect results, and harms following from (intentional or unintentional) misuse of the technology.
If there are negative societal impacts, the authors could also discuss possible mitigation strategies (e.g., gated release of models, providing defenses in addition to attacks, mechanisms for monitoring misuse, mechanisms to monitor how a system learns from feedback over time, improving the efficiency and accessibility of ML).
11. Safeguards
Does the paper describe safeguards that have been put in place for responsible release of data models that have high risk for misuse (e.g., pretrained language models, image generators, or scraped datasets)?
Question:
Answer: [NA]
Justification: the paper poses such risks.
Guidelines:
18

---

The answer NA means that the paper poses no such risks.
Released models that have high risk for misuse or dual-use should be released with necessary safeguards to allow for controlled use of the model, for example by requiring that users adhere usage guidelines or restrictions to access the model or implementing safety filters.
Datasets that have been scraped from the Internet could pose safety risks. The authors should describe how they avoided releasing unsafe images.
We recognize that providing effective safeguards challenging, and many papers do not require this, but encourage authors to take this into account and make best faith effort.
12. Licenses for existing assets
Are the creators or original owners of assets (e.g., code, data, models), used in the paper, properly credited and are the license and terms of use explicitly mentioned and properly respected?
Question:
Answer: [NA]
Justification: he paper does not use existing assets.
Guidelines:
The answer NA means that the paper does existing assets.
The authors should cite the original paper that produced the code package or dataset.
The authors should state which version of the asset used and, possible, include URL.
The name of the license (e.g., CC-BY 4.0) should be included for each asset.
For scraped data from a particular source (c.g.. website), the copyright and terms of service of that source should be provided.
assets are released, the license, copyright information, and terms of the package should be provided. For popular datasets, pppeerswiti www.swiiiioeeeee. com/ Gatasets s has curated licenses for some datasets. Their licensing guide can help determine the license of dataset.
For existing datasets that re- ce-packaged, both the original license and the license of the derived asset (if it has changed) should be provided.
If this information is not available online, the authors are encouraged to reach out to the asset's s creators.
13. New assets
Question: Are new assets introduced in the paper well documented and is the documentation provided alongside the assets?
Answer: [NA]
Justification: the paper does not release new assets.
Guidelines:
The answer NA means that the paper does not release new assets.
Researchers should communicate the details the dataset/code/model as part of their submissions via structured templates. This includes details about training, license, limitations, etc.
The paper should discuss whether and how consent was obtained from people whose asset used.
At submission time, remember to anonymize your assets (if applicable). You can either create anonymized URL or include anonymized zip file.
14. Crowdsourcing and research with human subjects
For crowdsourcing experiments and research with human subjects, does the paper include the full text of instructions given to participants and sereenshots, if applicable, as well details about compensation (if any)?
Question:
Answer: [NA]
19

---

Justification:
the paper does not involve crowdsourcing nor research with human subjects.
Guidelines:
The answer NA means that the paper does not involve crowdsourcing nor research with human subjects.
Including this information in the supplemental material is fine, but if the main contribu- tion of the paper involves human subjects, then as much detail as possible should be included in the main paper.
According to the NeurIPS Code of Ethics, workers involved data collection, curation, or other labor should be paid at least the minimum wage in the country of the data collector.
15. Institutional review board (IRB) approvals equivalent for research with human subjects
Question: Does the paper describe potential risks incurred by study participants, whether such risks were disclosed to the subjects, and whether Institutional Review Board (IRB) approvals (or an equivalent approval/review based on the requirements of your country or institution) were obtained?
Answer: [NA]
Justification: the paper does not involve crowdsourcing nor research with human subjects.
Guidelines:
The answer NA means that the paper does not involve crowdsoureing nor research with human subjects.
Depending the country in which research is conducted, IRB approval (or equivalent) may be required for any human subjects research. If you obtained IRB approval, you should clearly state this in the paper.
We recognize that the procedures for this may vary significantly between institutions and locations, and we expect authors to adhere to the NeurIPS Code of Ethics and the guidelines for their institution.
For initial submissions, do not include any information that would break anonymity (if applicable), such the institution conducting the review.
16. Declaration of LLM usage
Question: Does the paper describe the usage of LLMs if it is an important, original, or non-standard component of the core methods in this research? Note that if the LLM is used only for writing, editing, or formatting purposes and does not impact the core methodology. scientific rigorousness, or originality the research, declaration is not required.
Answer: [NA]
Justification: the core method development in this research does not involve LLMs as any important, original, or non-standard components.
Guidelines:
The answer NA means that the core method development in this research does not involve LLMs as any important, original, or non non-standard components.
http://ppppcccccoooeeennn/ee///e 2005/ LLM) for what should should not be described.
Please refer to our LLM policy (https:
20

---

A Appendix
A.1 Details of the Noise Layer
The combined noise layer is implemented using Kornia (Riba et al. 2020). incorporating various
transformations such as Identity, Rotation, Cropping, Translation, Scaling, Shearing, Dropout, Cropout, Color Transformation, JPEG Compression, Gaussian Filtering, and Gaussian Noise. These transformations applied as follows:
Rotation: Random rotation within the angle range of [-30%, 330).
Cropping: Randomly retains scale of [0.5, 1] of the original image.
Translation: Generates random displacements of [-0.1, 0.1] times the image's 's edge length along the and axes.
Scaling: Random scaling within factor of [0.5, 1.2].
Shearing: Random shear transformation with an angle range of 1-01,00.]]
Dropout: Randomly discards [10%, 30%] of the pixels.
Cropout: Randomly discards blocks of the image with scale of [0.05, 0.1].
Color Transformation: Perturbs Brightness, Saturation, and Hue with intensities of [-0.4, 0.4), [-0.4, 0.4], and [-0.1, respectively.
JPEG Compression: Applies random quality factors between [50, 100)
Gaussian Filter: Applies Gaussian filters with kernel sizes in the range of [3, 8] and intensities of [0.05, 0.1] with [0.1,2]
Gaussian Noise: Adds Gaussian noise with a mean of 0 and variance of 0.01.
During training, a random noise type is selected and applied to perturb the watermarked image.
A.2 The Role of Hyperparameter
In the section "Low-rank Watermark Injection based Implicit Neural Representations", we intro- duced the y parameter to regulate the embedding strength of the watermark. Since our INR-based watermarking approach essentially functions template watermark, its pattern remains independent of the carrier image. As a result, the model naturally tends to generate sparse high-frequency textures to minimize visual loss, leading significant spatial inefficiencies
As illustrated in Figure 5 the left side shows the watermark generated without constraints. substantial portion of the area contains null values, which not only wastes available space but also poses a critical issue-If the image is cropped to a region containing only null values, the essential watermark information may be lost entirely during transmission. To address this, we impose constraint on the embedding strength, ensuring that the watermark more uniformly distributed across the image.
Moreover, we empirically set 7 0.02, maintains a PSNR approximately 34 while preserving good visual quality, even for a completely randomized watermark template. If y is reduced further, the watermark's robustness deteriorates due to insufficient redundancy.
A.3 TrustMark Settings in Baseline
Since TrustMark does not provide training script, we rely on its pre-trained weights for testing. However, TrustMark's pre-trained watermarks are 100 bits long and are available in four open-source versions. We use the version with a 40-bit payload (BCH SUPER), with the remaining 60 bits reserved for error correction and versioning. To ensure a relatively fair comparison, we modify the decoding process: after extracting the full 100-bit sequence, we first apply enror correction to the 40 valid bits and discard the remaining 60 bits. The evaluation is then based solely on the decoding accuracy of the 40 valid bits.
21

---

w/o y
(b) Proposed
Figure 5: Different watermark styles generated by the hyperparameter 7.
A.4
More Results
In the main text, present visualization results across different resolutions. Here, provide additional experimental results, as shown in Figure 6 We randomly select various resolutions for embedding, where each group's 's first row represents the cover images, the second row shows the watermarked images, and the third row displays the watermarks. It can be observed that while the watermarks exhibit scale-dependent variations at different resolutions, they consistently retain similar stripe-like structure and maintain considerable complexity at each resolution. This ensures the successful decoding of watermark information across varying image scales.
B Limitations and Future Work
Our approach shows promise but has some limitations. The visual quality of the watermarked images is lower than content-dependent methods, mainly due to INR's weaker feature representation compared to CNN. Additionally, INR fitting be slow. Future work will aim address these issues by combining CNN with INR to enhance both visual quality and embedding efficiency. We will also explore optimizing INR fitting to reduce training time and improve scalability. Moreover, how to better enhance watermark capacity another issue that needs to be addressed.
22

---

Figure 6: Visualization results different resolutions.
23


Reviews:
[{"review_id": "TPrD8LkoL6", "reviewer": "Reviewer_2eV2", "summary": "This paper introduces a novel watermarking framework based on Implicit Neural Representations (INRs), explicitly designed for ultra-high-resolution (UHR) images. Traditional CNN-based watermarking methods often fail on UHR due to their high computational overhead and vulnerability to distortions such as scaling and cropping. In contrast, the proposed method decouples the watermark from the image resolution using a coordinate-based INR, enabling efficient, pixel-wise watermark embedding that is resolution-independent. Key contributions include a hierarchical multi-scale coordinate embedding, a low-rank watermark injection mechanism using CP decomposition, and a robust decoding strategy. Extensive experiments demonstrate superior robustness and efficiency compared to existing methods on datasets such as DIV2K, COCO, and FFHQ, even under extreme cropping and scaling scenarios.", "questions": "Could the INR watermarking be combined with content-aware features (e.g., via a hybrid INR-CNN model) to improve perceptual quality?\n\nIs the embedding strength γ fixed, or could it be adaptively set based on local image content to balance robustness and perceptual quality?\n\nHow would the system perform against adversarial examples or model inversion attacks aimed at decoding or removing watermarks?\n\nCan the authors demonstrate the robustness of the method on images shared via online platforms (e.g., Instagram, Twitter), where compression artifacts are non-differentiable?\n\nAre there conditions under which the decoding accuracy drops significantly (e.g., heavy color jitter or combined augmentations)?", "limitations": "The authors acknowledge lower visual quality due to template-based watermarking and the computational cost of INR fitting. Section 4.2 and Supplement A.6 discuss this in detail.", "rating": 4, "confidence": 4, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": 2, "clarity": 3, "significance": 3, "originality": 2, "strengths_and_weaknesses": "Strengths\nQuality: The proposed method is well-engineered, with a sound methodology and strong experimental support. It demonstrates state-of-the-art robustness to distortion, particularly on high-resolution images.\n\nClarity: The paper is well-structured and includes detailed architectural diagrams (e.g., Figure 2) and a short ablation studies to support claims. However the fig 2 isn't the clearist figure to follow\n\nSignificance: The ability to embed and decode watermarks in UHR images under extreme distortions has practical significance in copyright protection and forensic tracking.\n\nOriginality: The use of INRs for watermarking, combined with coordinate-based sampling and low-rank injection, is novel. The low-rank decomposition for computational efficiency is an elegant solution.\n\nWeaknesses\nVisual quality trade-off: The method sacrifices some PSNR and SSIM compared to content-aware methods, which may be limiting in sensitive applications. This is the major concern I have\n\n\nReal-world validation: While synthetic distortions are thoroughly tested, no results are presented for real-world scenarios like camera-captured images or social media uploads.\n\nLimited discussion on potential adversarial attacks: There's minimal analysis on robustness against intentional tampering or adversarial watermark removal.", "was_revised": true, "final_justification": "following the other reviews and rebuttal, I am happy to uplift my score to tend towards accept", "rebuttal": "Thank you for your patience and thorough review! We note your concerns regarding visual quality.\n\nIt is important to emphasise that our `contribution` primarily lies in proposing a novel paradigm centred on INRs to address the challenge of robust embedding on ultra-large images.\n\nWe adopt this architecture specifically to overcome the computational bottlenecks and memory constraints that CNN-based methods face with high-resolution inputs. \n\nThe slight reduction in visual fidelity stems from the inherent nature of INRs, which process pixel coordinates independently and thus do not leverage local spatial features as effectively as CNNs.\n\nIn fact, we made `considerable efforts` in perceptual quality but encountered some challenges. We will detail these in the following sections.\n\n# Q1: Using a hybrid INR-CNN model to improve perceptual quality\n\nWe appreciate the reviewer's insightful suggestion. Indeed, we explored similar hybrid architectures during our initial investigations but found them unsuitable due to several fundamental challenges.\n\nwe have explored hybrid architectures, using methods similar to LIIF [1], which involve first extracting features from the entire image using a lightweight CNN(3-layer Conv-BN-ReLU structure with 3×3 kernels), and then sampling these feature maps by coordinate for prediction with an INR.\n\nIt can be expressed as:\n\n$$\nL_c = \\mathrm{CNN}(I)\n$$\n\n$$\nz_e=\\Gamma(L_c(x,y)\\odot z_p)\n$$\n\n$L_c$ is similar to the embedded features mentioned in the section **\"Hierarchical Multi-Scale Coordinates Embedding\"** in the paper, while $z_e$ is equivalent to formula (4) in the paper.\n\nHowever, this introduces three `issues`: \n\n> (1) It is still necessary to perform CNN on the entire image, which results in computational overhead increasing with image size.\n\n> (2) Computational efficiency is extremely low. In the CNN part, we need to perform calculations on the entire image, but in the INR part, we only sample local regions for watermark embedding during training, resulting in most of the computational overhead being meaningless. \n\n> (3) More importantly, since the final watermark generation still relies on the INR, during actual training, the network `selectively ignores` features from the CNN, degenerating into pure INR training.\n\nIf we only perform CNN on the specific regions where watermarks are to be embedded, This reintroduces the block-based generation problem shown in Figure 1 at our paper, requiring precise watermark block localization.\n\nwe give our results on DIV2K dataset (2K resolution):\n\n|  Methods  | PSNR |  SSIM  | Avg ACC | GPU Memory |\n| :-------: | :---: | :----: | :-----: | :--------: |\n| Proposed | 37.27 | 0.9611 |  95.17  |   0.51GB   |\n| LIIF-Like | 38.14 | 0.9652 |  94.64  |  12.34GB  |\n\nAvg ACC represents the average decoding accuracy after various noise attacks, and GPU Memory represents the computing memory occupied by one sample during training. It can be seen that the visual quality has not improved significantly, while the GPU usage during training is much higher than that of our method.\n\n\n# Q2: About adaptive $\\gamma$\n\nWe have tried two strategies:\n\n> (1) Assigning a dynamic trainable parameter to each pixel, i.e., INR predicts not only RGB but also $\\gamma$. However, this approach has issues where the predicted gamma values become completely ineffective, and due to the `lack of hard constraints`, this method produces very low visual quality.\n\n> (2) Pre-computing the texture richness of each pixel using the Laplacian operator and normalising it to [0,1] as $\\gamma$. This approach effectively controls embedding only in high-frequency regions, but the decoding accuracy is very low. This is because INR cannot perceive the Laplacian operator, inevitably leading to `information loss` in low-frequency regions.\n\nThis is results:\n\n| Methods | PSNR | SSIM | Avg ACC |\n|:-------:|:----:|:----:|:------:|\n| Proposed | 37.27 | 0.9611 | 95.17 |\n| Predict$\\gamma$ | 22.53 | 0.7298 | 97.33 |\n| Laplacian Operator | 40.16 | 0.9811 | 78.41 |\n\n# Q3: Adversarial examples or model inversion attacks\n\nCurrently, existing image watermarking methods do not extensively discuss this type of attack, so we primarily adopt mainstream attacks from previous SOTA methods like DWSF[2] (ACM MM 23) and $\\mathrm{RAIM_{ARK}}$[3] (ACM MM 24) in our design.\n\nTo our knowledge, **\"model inversion attacks\"** are mainly used to infer the original data used to train the model. This does not seem to be particularly relevant to the domain we are discussing.\n\nIn addition, we test the performance of different **adversarial attack** methods using the DIV2K dataset, where watermarks are embedded at 2K resolution with a fixed PSNR of 35 dB.\n\n\n| Attack Method |   Proposed   |      |     DWSF     |      |   TrustMark   |      | $\\mathrm{RAIM_{ARK}}$ |      |\n| :-----------: | :-----------: | :---: | :-----------: | :---: | :-----------: | :---: | :---------------------: | :---: |\n|              | Attacked PSNR |  ACC  | Attacked PSNR |  ACC  | Attacked PSNR |  ACC  |      Attacked PSNR      |  ACC  |\n|     PGD1     |     34.90     | 99.99 |     32.88     | 25.17 |     38.20     | 95.41 |          30.61          | 76.94 |\n|     PGD2     |     28.95     | 96.33 |     27.46     | 20.17 |     32.22     | 94.67 |          26.43          | 75.53 |\n|     FGSM1     |42.31     | 99.99 |     24.13     | 40.17 |     38.92     | 85.83 |          24.23          | 62.33 |\n|     FGSM2     |25.94 | 99.99 |7.6 | 41.83 |22.40 | 72.83 |7.74| 48.12 |\n|     BIM1     |36.92| 99.99 |18.75| 13.50 |33.04| 88.17 |25.12| 65.73 |\n|     BIM2     |31.44| 99.99 |13.39 | 13.17 |27.67| 84.32 |16.16 | 51.99 |\n\n\nWe use **torchattacks** (a third-party adversarial example library) to test three different attack methods: PGD[4], FGSM[5], and BIM[6]. Attacked PSNR represents the PSNR of the distorted image and the clean image after the attack,  ACC is the accuracy rate after the attack.\n\nThe specific settings are as follows:\n\n```python\n    pgd1 = torchattacks.PGD(wrapped_model, eps=8/255, alpha=2/255, steps=20)\n    pgd2 = torchattacks.PGD(wrapped_model, eps=16/255, alpha=4/255, steps=20)\n    fgsm1 = torchattacks.FGSM(wrapped_model, eps=16/255)\n    fgsm2 = torchattacks.FGSM(wrapped_model, eps=128/255)\n    bim1 = torchattacks.BIM(wrapped_model, eps=64/255, alpha=8/255, steps=20)\n    bim2 = torchattacks.BIM(wrapped_model, eps=128/255, alpha=16/255, steps=20)\n```\nwrapped_model is the watermark decoder from different methods.\n\nWe find that our method demonstrates greater resistance to such attacks compared to other methods, as evidenced by two key factors: \n> (1) Under identical attack parameters, our method maintains a higher PSNR after the attack, indicating its insensitivity to adversarial perturbations; \n\n> (2) At the same PSNR level, our method achieves a higher accuracy rate, demonstrating its superior robustness against such attacks.\n\n# Q4: Robustness of online platforms\n\nWe select 50 images and test our method on different media at PSNR 35 （2K resolution on DIV2K）:\n\n|          |Propsed| DWSF | $\\mathrm{RAIM_{ARK}}$ | TrustMark |\n| :-------: | :-------------: | :---: | :---------------------: | :-------: |\n|  Twitter  | **92.45** | 60.67 |58.67|   81.27   |\n| Instagram | **99.67** | 76.33 | 66.13 |82.4|\n|  Wechat  | **99.33** | 70.53 |76.33|81.87|\n\nOur method is the most effective.\n\n# Q5: Performance under extreme conditions\n\n\"We test the extreme cases with combined distortions involving `\"noise + scaling + cropping\"`.\n\nWe first embed the messages into 2K images. These images are then subjected to various distortions. After that, we enlarge the distorted images to 4K resolution. Finally, we randomly crop 128×128 blocks from the enlarged images for decoding.\n\n|                        |    Identity    |       GN       |       GF       |      JPEG      |     Dropout     |    Rotation    |   Translation   |      Color      |\n| :---------------------: | :-------------: | :-------------: | :-------------: | :-------------: | :-------------: | :-------------: | :-------------: | :-------------: |\n|         propsed         | **85.95** | **87.97** | **58.07** | **52.10** | **87.40** | **77.87** | **74.97** | **76.70** |\n|          DWSF          |      50.02      |      49.9      |      50.73      |      50.16      |      49.16      |      50.73      |      50.12      |      50.16      |\n|        TrustMark        |      53.99      |      51.34      |      51.25      |      50.75      |      50.25      |      50.75      |      50.54      |      48.99      |\n| $\\mathrm{RAIM_{ARK}}$ |   54.14 |    54.25      |      53.24      |      50.25      |      54.34      |      54.05      |      53.12      |      52.61      |\n\nIn this case, our performance will decline significantly, but it will still be far better than other solutions.\n\n# Reference\n\n[1] Chen Y, Liu S, Wang X. Learning continuous image representation with local implicit image function[C]//Proceedings of the IEEE/CVF conference on computer vision and pattern recognition. 2021: 8628-8638.\n\n[2] H. Guo, Q. Zhang, J. Luo, F. Guo, W. Zhang, X. Su, and M. Li, “Practical deep dispersed watermarking with synchronization and fusion,” in Proceedings of the 31st ACM International Conference on Multimedia, 2023, pp. 7922–7932.\n\n[3] Y. Wang, X. Zhu, G. Ye, S. Zhang, and X. Wei, “Achieving resolution-agnostic dnn-based image watermarking: A novel perspective of implicit neural representation,” in Proceedings of the 32nd ACM International Conference on Multimedia, 2024, pp. 10 354–10 362.\n\n[4] Madry A, Makelov A, Schmidt L, et al. Towards deep learning models resistant to adversarial attacks[J]. arXiv preprint arXiv:1706.06083, 2017.\n\n[5] Goodfellow I J, Shlens J, Szegedy C. Explaining and harnessing adversarial examples[J]. arXiv preprint arXiv:1412.6572, 2014.\n\n[6] Kurakin A, Goodfellow I, Bengio S. Adversarial machine learning at scale[J]. arXiv preprint arXiv:1611.01236, 2016."}, {"review_id": "lH6ULIVRTE", "reviewer": "Reviewer_Ggtd", "summary": "This paper proposes an INR-based watermarking framework designed for ultra-high-resolution images. The watermark can be accurately extracted from a single 128x128 image patch. To achieve this, the authors introduce a hierarchical multi-scale coordinate embedding mechanism and a low-rank watermark injection scheme. Experimental results demonstrate the effectiveness of the proposed method.", "questions": "Please refer to the weakness part.", "limitations": "The authors note limitations in visual quality and computational complexity.", "rating": 4, "confidence": 3, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": 3, "clarity": 3, "significance": 3, "originality": 3, "strengths_and_weaknesses": "### Strengths\n\n1. The proposed INR-based template watermarking framework is novel and achieves strong performance.\n\n2. The ability to reliably extract watermarks from only a small patch of high-resolution images is impressive.\n\n3. The paper is well-written and presents a clear methodology.\n\n### Weakness\n\n1. From the visualizations, the watermark appears to vary across spatial locations. Does extraction accuracy depend on the location of the patch? If so, this could affect robustness.\n\n2. The method section suggests that INR is only used to generate template watermarks and does not require per-image fitting. However, Section A.6 mentions that \"the fitting process of INR can be computationally expensive,\" which limits embedding efficiency. This seems contradictory:  what exactly is being fitted during embedding, and why is it computationally intensive?\n\n3. In Section 4.5, the authors mention that watermarks can be pre-generated, but in practice, precomputing $2^30$ unique watermarks is infeasible. It would be helpful to report the actual time required to generate a single watermark during embedding.", "was_revised": true, "final_justification": "A high-performance, efficient template-based watermarking scheme is valuable for both academic research and industrial implementation. Considering that, I tend to recommend accepting this paper.", "rebuttal": "Thank you for your patience in reviewing our work! \n\nWe have noticed that you seem to have some questions about the computational efficiency of our method, and we sincerely apologise for any confusion caused by unclear wording.\n\nIn the main text, we primarily aimed to highlight that INR has `weaker representational capabilities` compared to CNN. As a result, under the same scale, INR-based methods require longer training times and converge more slowly. However, since INR is essentially an MLP, its computational overhead during inference is significantly lower than that of CNN under the same scale. We will provide a detailed explanation in the following sections.\n\n# Q1: Robustness analysis across different spatial locations\n\nDue to our coordinate sampling strategy, our method can guarantee `decoding at any position`.\nTo prove this, we embedded the watermark in 2K images (DIV2K dataset) and cropped blocks ranging from 128×128 to 1024×1024 pixels from five different positions (top left, bottom left, top right, bottom right, and center), then calculated the average accuracy rate of blocks(PSNR at 35 dB).\n\n|   Position   | 128x128 | 512x512 | 1024x1024 |\n| :----------: | :-----: | :-----: | :-------: |\n|   top left   |  99.93  |  99.99  |   99.99   |\n|  top right  |  99.83  |  99.99  |   99.99   |\n| bottom left |  99.87  |  99.99  |   99.99   |\n| bottom right |  99.83  |  99.99  |   99.99   |\n|    center    |  99.73  |  99.99  |   99.99   |\n\nAs can be seen, our method can robustly decode regardless of the position.\n\n# Q2: Clarification on INR fitting process and computational cost\n\nWe sincerely apologise for any confusion caused by our unclear statement.\n\nWhen we say that \"the fitting process of INR can be computationally expensive,\" we mean that the `model converges` slowly during training. This is because INR has weaker representation capabilities than CNN, and our method requires more time to train than CNN-based methods. However, once training is complete, our method can not only pre-generate watermark templates, but also process arbitrary pixels independently and in parallel, resulting in high computational efficiency.\n\nHere is a comparison of training times using one RTX 3090 24G (32 batch):\n\n| Method | Proposed | HiDDeN | StegaStamp | MBRS | DWSF | TrustMark | $\\mathrm{RAIM_{ARK}}$ |\n| :----: | :------: | :----: | :--------: | :--: | :--: | :-------: | :---------------------: |\n| Times |   26h   |  23h  |    19h    | 14h | 39h |     -     |    >20min per image    |\n\nAlthough our method is slower than methods such as MBRS, it is still faster than DWSF. Furthermore, $\\mathrm{RAIM_{ARK}}$ requires fine-tuning for each image, which is unacceptable in large-scale production.\n\n# Q3: Report the actual time required to generate a single watermark during embedding\n\nUnlike CNNs, which require computations across the entire image, our method enables independent parallel processing for each pixel. Consequently, in theory, given sufficient GPU resources for parallel execution, our computational overhead is equivalent to the inference time of a single pixel.\n\nWe demonstrate this by measuring the inference time for watermarking a single 2K image using one GPU, two GPUs(RTX3090 24GB):\n\n|      |    Ours(1 GPU)    |    Ours(2 GPU)    | DWSF | TrustMark | $\\mathrm{RAIM_{ARK}}$ |\n| :---: | :---------------: | :---------------: | :--: | :-------: | :---------------------: |\n| Times | **24.16ms** | **13.74ms** | 74ms |   308ms   |    >20min per image    |\n\nOur INR method requires only 24.16ms on a single GPU, which is 3x faster than DWSF and 12.7x faster than TrustMark. Essentially, INR is just MLP, and its computational load is much lower than that of CNN of the same scale."}, {"review_id": "NlRdYDvGBW", "reviewer": "Reviewer_RwW9", "summary": "This paper presents an INR-based ultra-high resolution watermarking framework. Using resolution-independent coordinate sampling, hierarchical multi-scale embedding, and low-rank injection, it enables robust watermark extraction under extreme cropping/scaling, outperforming baselines in both robustness and efficiency with high image quality.", "questions": "See the weaknesses", "limitations": "yes", "rating": 4, "confidence": 4, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": 2, "clarity": 2, "significance": 3, "originality": 2, "strengths_and_weaknesses": "Paper Strengths:\n1. This paper applies INRs to ultra-high resolution watermarking, offering a good perspective and breaking fixed resolution constraints via resolution-independent coordinate sampling for efficient watermark generation across scales.\n2. Technical designs including hierarchical embedding and low-rank injection, achieve high performance under extreme cropping, outperforming baselines and enabling faster embedding speed.\n\n\nPaper Weaknesses:\n1. Uses template-based watermarks without leveraging cover image content, resulting in slightly lower visual quality, restricting applicability in scenarios with high quality requirements (e.g., professional photography). The paper could benefit from presenting more failure cases and discussions.\n2. Experiments focus on single distortion types (e.g., cropping, scaling) and lack systematic evaluation under mixed distortions (e.g., extreme cropping + scaling + noise), leaving real-world transmission robustness unconfirmed.\n3. Generated watermarks are mostly stripe-like; templated features may reduce concealment and make them vulnerable to targeted attacks.\n4. Experiments use fixed-length (30-bit) watermarks, with no mention of adaptability to variable-length messages, limiting the flexibility.\n5. Curious cite formats like \"(1; 2; 3)\", and some typos (e.g., line 18 in Abstract, \"0. 4%\" with extra space)\n\nOverall, I appreciate the authors' efforts in presenting an ultra-high resolution watermarking framework. Considering the strengths along with the weaknesses in details, analysis and experiments, I lean towards \"3: Borderline reject\" at this stage.", "was_revised": true, "final_justification": "I have read the rebuttal and other reviews, and my concerns are almost well addressed. Given the premise that the missing certain details and format issues will be solved, I raise my score to \"4: Borderline accept\".", "rebuttal": "Thank you for your appreciation of our approach! Our main `contribution` lies in proposing a completely new paradigm to break through the inherent resolution problem. We apologise for any confusion caused by our oversight of certain details, and we will address each of your questions below.\n\n# Q1: Discussion about application scenarios due to template-based watermarking approach\nTemplate-based watermark selection involves a `trade-off`. The content-agnostic nature of the method is a double-edged sword. While it doesn't adapt to the image content, this very independence is what enables its offline generation and mass reusability, making it uniquely suited for scalable platforms like large image libraries, news agencies, content distribution platforms and so on.\n\nMoreover, we have provided many `examples` of embeddings at different sizes in Figure 3 and Figure 7. As shown in Figure 3 (first row) shows that smaller image sizes with simpler textures exhibit more obvious visual distortion.\n\nAt the same time, we also explored how to utilise cover image content under the INR architecture, but encountered challenges. Our experimental methods are as follows:\n\n> (1) The RGB values of the original image and the feature $z_e$ in Section 3.1 are concatenated and fed into INR.\n\n> (2) Pre-computing the texture richness of each pixel using the Laplacian operator and normalising it to [0,1] as $\\gamma$ (shown in Section 3.2). This approach effectively controls embedding only in high-frequency regions.\n\nThis is result at DIV2K:\n\n| Methods | PSNR |  SSIM  | Avg ACC |\n| :------: | :---: | :----: | :-----: |\n| Proposed | 37.27 | 0.9611 |  95.17  |\n|   (1)   | 37.31 | 0.9632 |  94.67  |\n|   (2)   | 40.16 | 0.9811 |  80.41  |\n\nFor method (1), the INR model `selectively ignores` raw RGB values, which makes sense since isolated pixels do not convey meaningful semantic information on their own.\n\nWhile using the Laplacian operator to constrain embedding to high-frequency regions improves visual quality, it significantly reduces decoding accuracy. This occurs because the Laplacian constraint ($\\gamma$) and the predicted watermark residual are independent variables, making decoding accuracy unreliable.\n\n\n# Q2: Robustness of mixed distortions\n\nFor clarity, we have not included the performance of combination distortion in the main text.\n\nHere is the `“noise+scaling+cropping\"` results. The results represent the average accuracy rate of embedding on a 2K image(DIV2K datasets), first performing different distortion attacks, then scaling to different resolutions, and finally randomly cropping a 128x128 patch for decoding. For fair comparison, PSNR is unified to 35.\n\n|         128x128         |    Identity    |       GN       |       GF       |      JPEG      |     Dropout     |    Rotation    |   Translation   |      Color      |\n| :---------------------: | :-------------: | :-------------: | :-------------: | :-------------: | :-------------: | :-------------: | :-------------: | :-------------: |\n|         propsed         | **99.99** | **99.93** | **99.93** | **99.97** | **99.99** | **99.90** | **99.99** | **97.40** |\n|          DWSF          |      90.17      |      89.76      |      89.4      |      87.36      |      76.4      |      85.56      |      65.9      |      78.36      |\n|        TrustMark        |      87.65      |      83.72      |      82.6      |      75.22      |      75.7      |      49.5      |      62.13      |      87.25      |\n| $\\mathrm{RAIM_{ARK}}$ |      78.67      |      72.43      |      54.24      |      56.43      |      64.23      |      57.42      |      54.63      |      60.33      |\n\n|         512x512         |    Identity    |       GN       |       GF       |      JPEG      |     Dropout     |    Rotation    |   Translation   |      Color      |\n| :---------------------: | :-------------: | :-------------: | :-------------: | :-------------: | :-------------: | :-------------: | :-------------: | :-------------: |\n|         propsed         | **99.86** | **99.89** | **99.57** | **98.90** | **99.85** | **99.81** | **99.81** | **98.07** |\n|          DWSF          |      53.28      |      54.36      |      55.39      |      52.36      |      51.76      |      54.1      |      52.93      |      53.33      |\n|        TrustMark        |      79.55      |      70.39      |      74.72      |      61.55      |      72.3      |      71.12      |      59.07      |      70.65      |\n| $\\mathrm{RAIM_{ARK}}$ |      53.24      |      53.1      |      52.53      |      52.54      |      54.21      |      50.53      |      49.2      |      50.54      |\n\n|        2048x2048        |    Identity    |       GN       |       GF       |      JPEG      |     Dropout     |    Rotation    |   Translation   |      Color      |\n| :---------------------: | :-------------: | :-------------: | :-------------: | :-------------: | :-------------: | :-------------: | :-------------: | :-------------: |\n|         propsed         | **98.74** | **98.40** | **77.27** | **62.97** | **98.03** | **97.30** | **93.30** | **94.23** |\n|          DWSF          |      50.83      |      50.93      |      50.7      |      50.5      |      49.93      |      50.92      |      50.21      |      50.87      |\n|        TrustMark        |      52.5      |      51.43      |      51.25      |      50.75      |      50.25      |      50.75      |      50.5      |      51.25      |\n| $\\mathrm{RAIM_{ARK}}$ |      54.64      |      54.21      |      51.23      |      53.26      |      54.16      |      53.53      |      50.76      |      54.32      |\n\n|        4096x4096        |    Identity    |       GN       |       GF       |      JPEG      |     Dropout     |    Rotation    |   Translation   |      Color      |\n| :---------------------: | :-------------: | :-------------: | :-------------: | :-------------: | :-------------: | :-------------: | :-------------: | :-------------: |\n|         propsed         | **85.95** | **87.97** | **58.07** | **52.10** | **87.40** | **77.87** | **74.97** | **76.70** |\n|          DWSF          |      50.02      |      49.9      |      50.73      |      50.16      |      49.16      |      50.73      |      50.12      |      50.16      |\n|        TrustMark        |53.99|51.34|51.25|50.75 |      50.25      |      50.75      |      50.54      |      48.99      |\n| $\\mathrm{RAIM_{ARK}}$ |54.14 |54.25|53.24 | 50.25 |54.34| 54.05 |53.12 | 52.61 |\n\nOther methods cannot withstand resolutions higher than 512x512, while our method performs well under most combinations of noise.\n\n# Q3: Discussion about stripe-like watermark pattern\n\nWe acknowledge this limitation may reduce concealment and make them vulnerable to targeted attacks and believe it represents a significant area for future improvement. During our early explorations, we found that using SIREN [1] as the base INR block or employing different parameter initialization methods for the Hierarchical Multi-Scale Coordinates Embedding resulted in `different watermark textures` (e.g., fractal-like effects). However, most of these approaches led to training failures where visual quality improved but decoding accuracy remained at 0.5.\n\nConsequently, we chose the ReLU activation function for INR and default parameter initialization as the most stable option. This finding suggests that model structure and initialization methods significantly influence watermark texture, making this a promising direction for future research.\n\n# Q4: Discussion about variable-length messages\nWe designed the message following `mainstream methods` such as HiDDeN[2] (2018), MBRS[3] (2021), DWSF[4] (2023), and $\\mathrm{RAIM_{ARK}}$[5] (2024), all of which are fixed at 30 bits. As our primary focus is on proposing a new paradigm to effectively embed watermarks in high-resolution images, we adopt consistent designs with mainstream methods in other aspects.\n\n\nTo the best of our knowledge, only training-free diffusion-based methods [6,7] can dynamically change embedding bit counts during inference. Other trained image watermarking methods cannot modify number of bits at inference time.\n\nNevertheless, we can approximate dynamic bit changes through redundant embedding. For example, if trained with 6 bits but only 3 bits are needed (e.g., \"010\"), we embed \"010|010\" instead. This method can improve robustness through voting.\n\n# Q5: Format problem\n\nThank you for your careful review and attention to detail. We will fix these formatting issues in the camera-ready version.\n\n# Reference\n\n[1] Sitzmann V, Martel J, Bergman A, et al. Implicit neural representations with periodic activation functions[J]. Advances in neural information processing systems, 2020, 33: 7462-7473.\n\n[2] Zhu J, Kaplan R, Johnson J, et al. Hidden: Hiding data with deep networks[C]//Proceedings of the European conference on computer vision (ECCV). 2018: 657-672.\n\n[3] Jia Z, Fang H, Zhang W. Mbrs: Enhancing robustness of dnn-based watermarking by mini-batch of real and simulated jpeg compression[C]//Proceedings of the 29th ACM international conference on multimedia. 2021: 41-49.\n\n[4] H. Guo, Q. Zhang, J. Luo, F. Guo, W. Zhang, X. Su, and M. Li, “Practical deep dispersed watermarking with synchronization and fusion,” in Proceedings of the 31st ACM International Conference on Multimedia, 2023, pp. 7922–7932.\n\n[5] Y. Wang, X. Zhu, G. Ye, S. Zhang, and X. Wei, “Achieving resolution-agnostic dnn-based image watermarking: A novel perspective of implicit neural representation,” in Proceedings of the 32nd ACM International Conference on Multimedia, 2024, pp. 10 354–10 362.\n\n[6] Wen Y, Kirchenbauer J, Geiping J, et al. Tree-ring watermarks: Fingerprints for diffusion images that are invisible and robust[J]. arXiv preprint arXiv:2305.20030, 2023.\n\n[7] Yang Z, Zeng K, Chen K, et al. Gaussian shading: Provable performance-lossless image watermarking for diffusion models[C]//Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition. 2024: 12162-12171."}, {"review_id": "dl8RljVBDR", "reviewer": "Reviewer_jFV8", "summary": "The work proposes watermarking of ultra-high resolution images by representing said watermarks as implicit neural representations. The goal is to make the watermarks resistant to extreme cropping and scaling. The authors propose to forego CNN modules and use a multiscale INR approach to encode watermarks in cover images, thus achieving their goal of robustness to cropping and scaling. Compared to SOTA watermarking methods, the proposed approach achieves higher visual quality and comparable decoding performance under different noise settings.", "questions": "See the weaknesses above. Besides that, It may not be the scope of the current work, but have the authors performed tests with printed images? From my understanding, this is not the focus of the work, although the authors also employ noise layers, used by StegaStamp [2] in their printer-proof method. Thus it would be interesting to have an idea whether the proposed method can be adapted to such media, and how straightforward would this adaption be.", "limitations": "Yes, the authors have adequately adressed the limitations.", "rating": 5, "confidence": 4, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": 3, "clarity": 3, "significance": 3, "originality": 3, "strengths_and_weaknesses": "# Strengths\nThe work is well motivated and presents a clear goal. The idea of parameterizing the watermark using INRs adds flexibility and saves computational resources when using high-resolution images. I believe that it may impact in training time, however, I'm not really sure by how much. The idea of encoding images as INRs is fairly new and the application is of paramount importance to provide an authenticity stamp against deep-fake methods, even though the authors don't frame their work this way. \n\nFurthermore, I appreciate that the authors submitted source-code for the review process, as it helps the reader to check for implementation details of the method.\n\n# Weaknesses\nI missed experiments with varying message sizes. The authors focus on 30 bit messages, following HiDDeN [1], which is significantly less than StegaStamp [2], and RiemStega [3], both more recent methods. Furthermore, [2,3,4] perform tests with varying message sizes, including 30, 50, 100, 150 and 200 bits, which are missing in the current work. This is important to assess the balance between image quality and method capacity to decode the watermark.\n\nAs I mentioned in the strengths, I appreciate that source-code was submitted, although it is missing instructions regarding package and versions, in addition to local packages used (FastTools).\n\nFurthermore, there is no mention of training time of the proposed method. Since there is a major architectural change by swapping CNNs for INRs (I know the changes are much larger than that, bear with me), the reader needs to know the impact regarding training time. Typically INRs are not particularly lightweight on computational resource usage. which is reinforced by the authors' statement on Sec. A.6.\n\nFinally, a more thorough hardware specification should be made. What is the memory ammount of the GPUs? The authors only list the model (RTX 3090), without memory and processor details, which may differ depending on the manufacturer.\n\n# Minor comments\n- Typo on abstract: \"...with only 0. 4% of the image...\" => extra space between point and digit.\n- In Sec. 3, the first paragraph, where the approach is described. The authors mention three core modules and mark them as (a), (b), and (d).\n- Table captions should come above the content, as per NeurIPS template.\n- On the appendix, Figure 5. The subcaptions are really large compared to the remaining text\n\n# References\n[1] Zhu, J., Kaplan, R., Johnson, J., & Fei-Fei, L. (2018, September). HiDDeN: Hiding Data with Deep Networks. Proceedings of the European Conference on Computer Vision (ECCV).\n\n[2] Tancik, M., Mildenhall, B., & Ng, R. (2020, June). StegaStamp: Invisible Hyperlinks in Physical Photographs. Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR).\n\n[3] Cruz, A., Schardong, G., Schirmer, L., Marcos, J., Shadmand, F., & Gonçalves, N. (2025). RiemStega: Covariance-Based Loss for Print-Proof Transmission of Data in Images. 2025 IEEE/CVF Winter Conference on Applications of Computer Vision (WACV), 7572–7581. https://doi.org/10.1109/WACV61041.2025.00736\n\n[4] Bui, T., Agarwal, S., & Collomosse, J. (2023). TrustMark: Universal Watermarking for Arbitrary Resolution Images (arXiv:2311.18297). arXiv. https://doi.org/10.48550/arXiv.2311.18297", "was_revised": true, "final_justification": "Based on the other reviews and authors' answers, I believe that most concerns were answered adequately (at least my concerns were). I see no reason to not raise my rating. Good luck and excellent work to the authors!", "rebuttal": "Thank you for your appreciation of our work! We will answer your questions one by one.\n\n# Q1: Capacity of framework\n\nFixing the message length at 30 bits is a `common practice`. It is widely adopted in both low-resolution studies such as HiDDeN[1] (**2018**), MBRS[2] (**2021**), and recent high-resolution approaches like DWSF[3] (**2023**) and $\\mathrm{RAIM_{ARK}}$[4] (**2024**).\n\nWe present the relationship between visual quality and decoding accuracy for models trained with message payloads of 30, 50, and 100 bits: \n\n| num of bit | PSNR |  SSIM  | Avg ACC |\n| :--------: | :---: | :----: | :-----: |\n|     30     | 37.27 | 0.9656 |  95.76  |\n|     50     | 35.59 | 0.9563 |  95.62  |\n|    100    | 31.32 | 0.9123 |  88.26  |\n\nIn addition, We find that convergence is quite difficult when exceeding 100 bits (the convergence rate is slow), and the visual quality deteriorate significantly.\n\nThis is reasonable. In order to accurately extract watermarks at any size, it is inevitable that a large amount of redundant information will be embedded. Therefore, how to further improve capacity based on existing methods remains a topic worthy of further exploration.\n\n# Q2: Missing of local packages and instructions\n\nWe apologize, but since FastTools is an internal package that contains a large amount of private information (such as Hugging Face user tokens and passwords), we have not yet organised it. We will organise clean code and clear instructions after the camera-ready version is complete and open source it.\n\n# Q3: Compare of training time\n\nHere is a comparison of training times using one RTX 3090 24G (32 batch):\n\n| Method | Proposed | HiDDeN | StegaStamp | MBRS | DWSF | TrustMark | $\\mathrm{RAIM_{ARK}}$ |\n| :----: | :------: | :----: | :--------: | :--: | :--: | :-------: | :---------------------: |\n| Times |   26h   |  23h  |    19h    | 14h | 39h |     -     |    >20min per image    |\n\nAs can be seen, CNN-based methods have a clear advantage in terms of training time, but we are still significantly faster than DWSF in training. Furthermore, $\\mathrm{RAIM_{ARK}}$ requires fine-tuning for each image, which is unacceptable in large-scale production.\n\n# Q4: Hardware specification\n\nWe provide detailed specifications for hardware and software.\n\n|        |                                          |\n| :----: | :---------------------------------------: |\n|  GPU  |        NVIDIA GeForce RTX 3090 24G        |\n|  CPU  | Intel(R) Xeon(R) Platinum 8269CY @ 2.5GHz |\n| Memery |  Samsung M393A4K40CB2-CTD DDR4 32G x 12  |\n|   OS   |            Ubuntu 20.04.1 LTS            |\n|  CUDA  |                   12.8                   |\n\n# Q5: Printing images distortion adaptation\n\nStegaStamp is able to cope with printing image distortion mainly because it implements noise layers that simulate this process. Therefore, we only need to replace our noise layer with theirs, which enables adaptation to printing image distortion.\n\nAdditionally, our designed distortion layers already encompass their design to a certain extent. Therefore, we directly present our experimental results.\n\nwe randomly select 50 2K images (PSNR at 35 dB), print them on A4 paper using the **HP Color Laser MFP 178nw** printer, and capture them using a **Redmi K20 Pro** at a distance of 20 cm from the image. The average accuracy rate we achieved is `91.2%`.\n\n# Q6: Format problem\n\nThank you for your patience and attention to detail. We will correct these formatting errors in the camera-ready version.\n\n# Reference\n\n[1] Zhu J, Kaplan R, Johnson J, et al. Hidden: Hiding data with deep networks[C]//Proceedings of the European conference on computer vision (ECCV). 2018: 657-672.\n\n[2] Jia Z, Fang H, Zhang W. Mbrs: Enhancing robustness of dnn-based watermarking by mini-batch of real and simulated jpeg compression[C]//Proceedings of the 29th ACM international conference on multimedia. 2021: 41-49.\n\n[3] H. Guo, Q. Zhang, J. Luo, F. Guo, W. Zhang, X. Su, and M. Li, “Practical deep dispersed watermarking with synchronization and fusion,” in Proceedings of the 31st ACM International Conference on Multimedia, 2023, pp. 7922–7932.\n\n[4] Y. Wang, X. Zhu, G. Ye, S. Zhang, and X. Wei, “Achieving resolution-agnostic dnn-based image watermarking: A novel perspective of implicit neural representation,” in Proceedings of the 32nd ACM International Conference on Multimedia, 2024, pp. 10 354–10 362."}, {"review_id": "qvuI4Hjezg", "reviewer": "Reviewer_v2Wa", "summary": "The manuscript introduces a novel watermarking framework designed for ultra-high resolution (UHR) images, leveraging implicit neural representations (INRs) to overcome the limitations of traditional deep neural network (DNN)-based watermarking techniques, which struggle with high computational and memory demands when applied to large-scale images. The proposed method utilizes a resolution-independent coordinate sampling mechanism to generate watermarks pixel-wise, ensuring efficient embedding with fixed computational resources. It incorporates hierarchical multi-scale coordinate embedding and a low-rank watermark injection strategy to enhance watermark quality and robustness against extreme distortions such as cropping and scaling. Experimental evaluations demonstrate that this approach outperforms existing methods in robustness and efficiency while maintaining acceptable image quality, making it a promising solution for protecting digital content in high-resolution contexts.", "questions": "1. Section 3.2 describes the low-rank watermark injection using tensor decomposition, but it does not sufficiently clarify the practical consequences for watermark quality and robustness. Specifically, how does the selection of rank influence the balance between computational efficiency and watermark performance? A quantitative example or analysis demonstrating this trade-off would greatly aid comprehension.\n2. The resolution-independent coordinate sampling is highlighted as a key innovation, yet the manuscript lacks detail on how the sampling grid $\\mathcal{C}$ adapts to varying image resolutions. Could the authors specify the process for determining the interval $\\Delta_t$ and explain how it ensures consistent watermark generation across different scales?\n3. What were the specific image dimensions used for the high-resolution and low-resolution categories in Table 1, and were these dimensions consistent across all methods within each category?\n4. Were the models evaluated in Table 2 retrained for each of the resolutions tested, or was a single pretrained model applied across all resolutions without retraining?", "limitations": "yes", "rating": 5, "confidence": 4, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": 3, "clarity": 3, "significance": 3, "originality": 3, "strengths_and_weaknesses": "Strengths   \n1. Innovative Application of Implicit Neural Representations (INRs) for Watermarking \\\nThe manuscript proposes a pioneering approach by employing INRs to address the challenge of watermarking ultra-high resolution (UHR) images. Unlike traditional deep neural network (DNN)-based methods, which often falter under the computational and memory demands of large-scale images, this INR-based framework offers a resolution-independent solution. The use of coordinate sampling to generate pixel-wise watermarks is particularly noteworthy, as it ensures efficient embedding with fixed computational resources. This innovation fills a critical gap in the field and aligns well with the increasing demand for robust watermarking in high-resolution media applications.  \n\n2. Robustness to Extreme Distortions \\\nA standout feature of the proposed method is its exceptional resilience to extreme cropping and scaling distortions—common issues in the transmission of large images. The hierarchical multi-scale coordinate embedding preserves watermark integrity across varying scales, while the low-rank watermark injection enhances efficiency without sacrificing robustness. Experimental results are compelling, with watermark extraction accuracy exceeding 98% even when only 0.4% of a 2K image remains. This performance marks a significant improvement over existing techniques and underscores the practical value of the framework.\n\n3. Comprehensive Experimental Validation \\\nThe manuscript excels in its rigorous experimental evaluation, conducted across diverse datasets and multiple resolutions. The use of well-established metrics such as PSNR, SSIM, and decoding accuracy, coupled with comparisons to state-of-the-art methods, convincingly demonstrates the framework’s superiority in robustness and efficiency. The inclusion of visualization results and ablation studies further bolsters the credibility of the findings, providing readers with a clear understanding of the method’s strengths and limitations.\n\nWeaknesses\n1. Lack of Detailed Computational Complexity Analysis \\\nDespite touting computational efficiency as a major advantage, the manuscript falls short in providing a detailed analysis of the method’s computational complexity or memory requirements. For UHR images, these factors are paramount, and the absence of quantitative data, such as time complexity or memory footprint, hinders a full evaluation of the method’s feasibility. Including a comparative analysis of computational costs against baseline methods would have strengthened the manuscript’s claims and overall rigor.\n\n2. Insufficient Clarity in Explaining Hierarchical Multi-Scale Coordinate Embedding \\\nThe explanation of the hierarchical multi-scale coordinate embedding is the cornerstone of the proposed method, but it lacks clarity and accessibility. The technical description is dense and may prove difficult for readers without prior expertise in INRs or multi-scale techniques to grasp. The addition of illustrative diagrams or a step-by-step breakdown of the process would have significantly enhanced comprehension and made this key contribution more transparent to a broader audience.", "was_revised": true, "final_justification": "My concern is addressed. I will keep my original positive score.", "rebuttal": "Thank you for your high praise of our work! We apologize for any confusion that may have been caused by unclear wording in the main text. We will make the necessary corrections in the camera-ready version.\n\n# Q1: Lack of detailed computational complexity analysis (shown in Weaknesses)\n\nWe have already provided the inference time in Table 4. We mainly claim that we can train images of any size with fixed and limited computing resources. To this end, we provide the GPU usage (GB) per sample during training (Adam optim) for different methods:\n\n|          |    Proposed    | HiDDeN |   StegaStamp   | MBRS | DWSF | $\\mathrm{RAIM_{ARK}}$ |\n| :-------: | :------------: | :----: | :------------: | :--: | :--: | :---------------------: |\n|  128x128  |      0.51      |  0.18  | **0.07** | 0.47 | 1.8 |          1.54          |\n|  512x512  | **0.51** |  5.04  |      0.75      | 4.73 |  -  |          11.93          |\n| 1024x1024 | **0.51** |  7.42  |     2.628     | 17.4 |  -  |          > 24          |\n| 2048x2048 | **0.51** |  >24  |     10.51     | >24 |  -  |          > 24          |\n\nIt can be seen that the memory usage of our method does not increase with the image size.\n\n# Q2: The selection of rank influence the balance between computational efficiency and watermark performance\n\nIn Section 4.6, we have already shown the impact of different ranks on visual quality and decoding accuracy in the ablation experiment.\n\nHere, we focus on the GPU memory consumption of different ranks with the corresponding number of INR parameters in training single samples, and we also provide the GPU memory consumption without using low-rank watermarking for watermark injection:\n\n|                    | w/o low-rank |  r=8  | r=32 | r=64 | r=128 | r=256 |\n| :-----------------: | :----------: | :---: | :---: | :--: | :---: | :---: |\n| GPU consumption(GB) |     > 24     | 0.49 | 0.51 | 0.53 | 0.60 | 0.71 |\n|   INR parameters   |    34.6M    | 22.6k | 84.2k | 166k | 330k | 659k |\n\nIf we directly use formula (5) from the paper, single sample training would exceed 24GB memory. Since we use RTX 3090 with 24GB, this makes training impossible to complete.\n\n# Q3: Interval selection process and consistency guarantee\n\nFor simplicity in the main text, we refer to this as a \"randomly selected interval $\\Delta_t$\". However, in our actual implementation, $\\Delta_t$ is `automatically determined` based on the selected region.\n\nWe first randomly sample the top-left coordinates $(x,y)$ from the **\"normalised coordinate matrix\"** (shown in section 3.1) and randomly sample the submatrix side length $s\\in[0,2]$. The code is as follows:\n```python\n    def gen_start_coords():\n        side_length = np.random.uniform(0, 2)\n        start_x = np.random.uniform(-1, 1 - side_length)\n        start_y = np.random.uniform(-1, 1 - side_length)\n        return (start_x, start_y), side_length\n```\n\nThen, we generate the subcoordinate matrix using the fixed grid parameter $r$. The code is as follows:\n\n```python\n    x = torch.linspace(start_x, start_x + side_length, r)\n    y = torch.linspace(start_y, start_y + side_length, r)\n    xv, yv = torch.meshgrid(x, y, indexing='ij')\n    coordinates = torch.stack([xv, yv], dim=-1)\n```\n\nAs can be seen, as long as we sample a matrix of any size from the **\"normalised coordinate matrix\"**, we can determine a corresponding $\\Delta_t$.\n\nConsistency is ensured by the intrinsic properties of INRs, which learn a continuous coordinate-to-RGB mapping. Since each coordinate maps to a unique RGB value and coordinates are processed independently during training, the `same coordinate will always yield the same RGB value` regardless of the sampling submatrix's size or location, thereby maintaining consistency across scales.\n\n# Q4: Specific image dimensions used for the high-resolution and low-resolution categories in Table 1\n\nFor High Resolution, we measured at 2K size (except for DWSF), and for Low Resolution, we measured at 128x128 size. For DWSF, it essentially embeds the watermark into many 128x128 blocks, so we measured the visual quality of the block.\n\nWe understand your concern that visual quality may vary across different resolutions, so we have also measured the visual quality of our method at different resolutions:\n\n|      | 128x128 | 512x52 | 1024x1024 | 2048x2048 |\n| :--: | :-----: | :----: | :-------: | :-------: |\n| PSNR |  37.46  | 37.56 |   37.34   |   37.27   |\n| SSIM | 0.9621 | 0.9632 |  0.9613  |  0.9611  |\n\nOur method maintains consistent visual quality at different resolutions.\n\n# Q5: Whether a single pretrained model is applicable across all resolutions without retraining\n\nAs mentioned in Section 4.3, in order to make a fair comparison with the low-resolution model, Table 2 shows the results of training at a fixed resolution of 128×128 only.\n\nTable 3 and Figure 4 shows the performance of our method at varying image resolutions. It is trained only at 2K resolution and tested at different resolutions.\n\nWe will clarify this point in the camera-ready version."}]

Author rebuttal:

Meta-review: This paper presents an INR-based ultra-high-resolution watermarking framework, a novel approach combining resolution-independent coordinate sampling, multi-scale embedding, and low-rank watermark injection to enable robust watermark extraction from small patches and resist extreme cropping and scaling in high-resolution images. In the initial concerns, reviewers agreed the work is novel, practical, and relevant, especially its use of INRs for robustness under UHR conditions. Main concerns include slightly lower visual quality, limited evaluation (e.g., mixed distortions, real-world channels, adversarial attacks), and clarity on capacity and efficiency.

In rebuttal, the authors added new experiments and clarified efficiency/capacity trade-offs. These responses addressed the key issues, leading most reviewers to maintain or increase their scores, with consensus shifting to acceptance. The AC has also read the comments by reviewer and the corresponding rebuttal and discussions, and agree that the remaining concerns do not suffice for rejection. Thus, I recommend acceptance of this paper.
Decision: Accept (poster)