Mask Image Watermarking
Authors: Runyi Hu
Jie Zhang
Shiqian Zhao
Nils Lukas
Jiwei Li
Qing Guo
Han Qiu
Tianwei Zhang
Venue: NeurIPS 2025 poster ()
Keywords: image watermarking
Primary area: social_and_economic_aspects_of_machine_learning

Abstract: We present MaskWM, a simple, efficient, and flexible framework for image watermarking. MaskWM has two variants: (1) MaskWM-D, which supports global watermark embedding, watermark localization, and local watermark extraction for applications such as tamper detection; (2) MaskWM-ED, which focuses on local watermark embedding and extraction, offering enhanced robustness in small regions to support fine-grined image protection. MaskWM-D builds on the classical encoder-distortion layer-decoder training paradigm. In MaskWM-D, we introduce a simple masking mechanism during the decoding stage that enables both global and local watermark extraction. During training, the decoder is guided by various types of masks applied to watermarked images before extraction, helping it learn to localize watermarks and extract them from the corresponding local areas. MaskWM-ED extends this design by incorporating the mask into the encoding stage as well, guiding the encoder to embed the watermark in designated local regions, which improves robustness under regional attacks. Extensive experiments show that MaskWM achieves state-of-the-art performance in global and local watermark extraction, watermark localization, and multi-watermark embedding. It outperforms all existing baselines, including the recent leading model WAM for local watermarking, while preserving high visual quality of the watermarked images. In addition, MaskWM is highly efficient and adaptable. It requires only 20 hours of training on a single A6000 GPU, achieving 15× computational efficiency compared to WAM. By simply adjusting the distortion layer, MaskWM can be quickly fine-tuned to meet varying robustness requirements.

Mask Image Watermarking
Runyi Hu' Jie Zhang"; Shiqian Zhao', Nils Lukas', Jiwei Li", Qing Guo", Han Qiu Tianwei Zhang'
Nanyang Technological University 2CFAR and IHPC, A*STAR, Singapore MBZUAI *Zhejiang University "Tsinghua University
frunyi.hu, tianwei. (nt..e edu.
(bangj66a-star edu. https://github com/ httmhhuunyi/MMaktie
Abstract
We present MaskWM, a simple, efficient, and flexible framework for image wa- termarking. MaskWM has two variants: (1) MaskWM-D. which supports global watermark embedding, watermark localization, and local watermark extraction for applications such as tamper detection; (2) Mask WM--D, which focuses local watermark embedding and extraction, offering enhanced robustness in small regions support fine-grined image protection. MaskWM-D builds on the clas- sical incoder-distortion layer-decoder training paradigm. In HaskWWM-H we introduce simple masking mechanism during the decoding stage that enables both global and local watermark extraction. During training, the decoder is guided by various types of masks applied to watermarked images before extraction, helping it learn to localize watermarks and extract them from the corresponding local areas. Mask WM-ED extends this design by incorporating the mask into the encoding stage as well, guiding the encoder to embed the watermark in designated local regions, which improves robustness under regional attacks. Extensive experiments show that MaskWM achieves state-of-the-arr performance in global and local watermark extraction, watermark localization, and multi-watermart embedding. It outperforms all existing baselines, including the recent leading model WAM for local watermarking, while preserving high visual quality of the watermarked images. In addition, MaskWM is highly efficient and adaptable. It requires only 20 hours of training on a single A6000 GPU, achieving 15x computational efficiency compared to WAM. By simply adjusting the distortion layer, MaskWM can be quickly fine-tuned to meet varying robustness requirements.
Introduction
Image watermarking [15] is crucial technique for embedding imperceptible information into images, serving purposes such copyright protection, content authentication, and provenance tracking. With the proliferation of Al-generated content (AIGC) [17, 19], the boundary between real and synthetic images has become increasingly blurred, making it especially important to develop robust watermarking schemes for content verification and traceability.
Traditional deep image watermarking methods [32, 22, 10, 4, 26] typically perform global watermark embedding and extraction, treating the entire image
uniform entity. However, these global approaches suffer from several critical limitations. Lack of local watermark extraction: When an image undergoes heavy tampering, such as inpainting [25, 28], the watermark may survive only in small, local region that remains untouched by manipulation. In such cases, global methods often fail
'Tee corresponding author
39th Conference on Neural Information Processing Systems (NcurIPS 2025).

---

to extract the watermark effectively. 2. Inability to localize the watermark: Even if a watermark is successfully extracted from the image, global methods cannot localize which region actually contains the watermark, making it difficult for fine-grained forensic analysis and fair judgment. 3. Lack of local watermark embedding: In scenarios where only specific regions of an image are valuable and need protection, or when different parts of the image originate from different sources and require distinct watermarking, global embedding is inherently incapable of providing the flexibility and granularity.
We argue that the training paradigm of traditional global watermarking methods, which treats the entire watermarked image as whole for both encoding and decoding, prevents the encoder and decoder from developing spatial awareness. Specifically, the decoder cannot identify which regions of the image contain watermark signals for effective extraction, while the encoder lacks the ability to adaptively embed the watermark into specific spatial regions.
Based on the above analysis, we propose MaskWM, M, a simple, efficient, and flexible image water- marking framework. MaskWM introduces a masking mechanism during training to guide the model learn spatially aware embedding and extraction of local watermark signals. Depending on the stage which the mask is introduced, Ma offers two variants: MaskWM-D introduces the mask only during the decoding phase, enabling global watermark embedding while supporting local extraction. Specifically, by applying masks to retain only the selected regions of the watermarked images during extraction, the decoder is guided to identify which regions contain watermark signals and to focus on them for effective local extraction. Mask WM-ED introduces the mask during the encoding and decoding phases, allowing the embedding and extraction of the local watermark. In this setting, the encoder is trained to embed not only the watermark bits but also the spatial mask into the image. This allows the encoder to leverage the mask to adaptively allocate watermark strength to designated regions, while keeping the rest of the image nearly unaffected.
Extensive experiments demonstrate that MaskWM significantly outperforms existing baselines in both global and local watermark extraction, watermark localization, and local watermark embedding, while preserving image quality. Specifically, for local watermark extraction, MaskWM achieves a nearly 100% extraction accuracy even when only 5% of the image carries watermark signals. In terms of watermark localization. Mask demonstrates high precision in identifying watermark regions. Furthermore, although not explicitly trained for multi watermarkk embedding, Mask WM maintains strong extraction and localization performance even when embedding up to 5 distinct watermarks in single image. More importantly, Mask exhibits strong robustness across a wide range of distortions, including geometric distortions that typically break many existing watermarking methods. In addition to its effectiveness, MaskWM is highly efficient. Training the encoder-decoder model requires only approximately 20 hours a single A6000 GPU, which is 15x less compute than the recent state-of-the-art local watermarking model WAM [20]. MaskWW also scales effortlessly to different bit lengths (c.g., 32, 64, and 128), whereas WAM is inherently limited to 32-bit embedding and does not scale beyond that. Furthermore, MaskWM supports fast fine-tuning for different use cases. For example. Mask can reach near 100% extraction accuracy against VAE-based adaptive attacks after just 20k training steps. These advantages make MaskWM a practical, efficient, and scalable solution for real-world applications.
2 Background
2.1 Image Watermarking
Image watermarking techniques can generally be categorized into two types: global watermarking and local watermarking methods. Global watermarking methods aim to extract watermark information from the entire image. Most traditional deep learning-based approaches fall into this category. These methods focus on achieving robustness against various types of distortions, ensuring that the embedded watermark can still be reliably recovered even when the image undergoes degradation. For example, MBRS [10] specifically targets robustness against JPEG compression. Methods like StegaStamp [22] and PIMoG [5] are designed to handle real-world physical distortions such as screen-shooting and print-shooting. More recent approaches like ZoDiac [27] and SuperMark [6] tackle adaptive attacks, while Robust-Widd [8] and VINE [14] focus on robustness against instruction-driven image editing.

---

In contrast, local watermarking methods focus on extracting watermark information from specific region of the image. Recent methods, such as WAM [20] and our proposed MaskWM, belong to this category. WAM treats watermark extraction as a segmentation task [12], predicting watermark bits at the pixel level and then averaging these per-pixel predictions to obtain the final result. While this fine-gr tne-grained approach enables local watermark extraction, it also presents several challenges. 1. Limited extraction fromm small regions: When the watermarked area is very small, only few pixels contribute to extraction, making naive averaging unreliable, especially under distortions. 2. Lack of scalability with longer messages: WAM struggles to scale beyond 32-bit messages, as training becomes increasingly difficult with longer bit lengths. 3. High computational cost: Training requiring eight V100 GPUs for nearly a week, which limits its practicality. 4. Lack of native local embedding: WAM embeds watermarks globally and then crops for local focus, introducing embedding losses that reduce extraction robustness.
WAM is essorce-intensiin
2.2 Watermark Localization
Watermark localization [30, 7, 20] refers the ability determine which regions of watermarked image still contain watermark information after modifications. This capability enables the identifica- tion of unaltered content, serving as an active detection mechanism for tamper localization. Currently, image watermarking techniques primarily adopt two paradigms for watermark localization. The first paradigm embeds a one-dimensional copyright watermark alongside a two-dimensional local- ization watermark in the original image. During extraction, localization is based on the fragility of the localization watermark, which cannot be fully recovered from a modified image. Key methods in this category include EditGuard [30] and OmniGuard [31]. EditGuard embeds solid-color template within the host image and attempts to recover it from a modified version. The difference between the recovered and original templates is calculated at each pixel, and threshold-based decision identi- fies watermark- preserved regions. OmniGuard improves upon EditGuard by embedding a natural image the template, enhancing fidelity. It also introduces Degradation-aware Tamper Extractor, improving robustness in detecting tampered regions under distortion. This paradigm requires parallel extraction of both copyright and localization watermarks, which may affect image quality. Moreover, both watermarks need independent robustness, and the presence of the template watermark does not guarantee the presence of the copyright watermark.
The second paradigm, in contrast, embeds only a one-dimensional copyright bitstream and directly determines the presence or absence of watermark information at each pixel to achieve localization. Methods such as WAM [20] and our proposed MaskWM fall under this category. WAM employs a decoder that simultaneously performs pixel-wise watermark presence detection and copyright bit extraction. In contrast, our MaskWM incorporates a dedicated localization module within the decoder, focusing solely on watermark presence detection at each pixel. This approach is more lightweight and easier to optimize. Compared to the first watermark localization paradigm, this method ensures that the local watermarked regions strictly correspond to the areas containing copyright watermark information, enhancing interpretability. Additionally, it guarantees both the robustness of copyright watermark extraction and the robustness of localization.
3 Methodology
3.1 Design Principles
In general, we have three main objectives: local watermark extraction, watermark localization, and local watermark embedding. Among these, our primary goal is local watermark extraction, which aims to recover the embedded message from images where only small, spatially local region contains the watermark signal. In practice, we find that achieving high performance on this task naturally necessitates solving the other two problems well. We now identify three key reasons why traditional watermark models fail under this setting.
First, since the decoder is trained exclusively on globally watermarked images and has never encoun- tered cases with only locally embedded watermarks, fails to perform zero-shot extraction on such inputs. Second, the non- non-watermarked portions of an image interfere with the decoder's extraction process, especially when the watermark occupies a small area, leading to extraction failure. Third, because the decoder is optimized for global watermark extraction, the encoder tends to dilute the
3

---

Watermark Embedding
Watermark Masking
Distortion Pool
Juee
Furio
Valuemetric
Wgr
Gevmetric
Encoder
lene
Fyure
Renden
See.
Candidate Masks
10..10
Decoder
Wie
Mask Generation
Watermark Extraction
Figure I: The overall end-to-end training pipeline of MaskWM. (1) In the Mask Generation stage, we generate candidate masks from four predefined types and randomly select one mask M for the subsequent stages. (2) In the Watermark Embedding stage, the encoder & embeds the watermark bits Wgt into the original image Lorig. optionally using the mask M (for Mask (M--), to produce the watermarked image Lum- (3) In the Watermark Masking stage, the mask M is used to fuse Torig and Tm (see Eq. 2), resulting in the fused image Juse. which is then subjected to a randomly selected distortion from a predefined distortion pool, yielding the distorted image '' The masked region is then cropped using M to obtain maskk- (4) In the Watermark Extraction stage, the decoder 'D extracts the predicted mask Mpd from //use and the predicted watermark bits W pd from mask.
watermark's 's intensity over the entire image. This results in local regions having either insufficient or fragmented watermark strength, thereby exacerbating the extraction challenge.
To address these challenges, we propose Mask which introduces a basic mask mechanism during the decoding stage guide the decoder in identifying and focusing on watermark-containing regions. To solve the first issue, we retain the watermark only in the masked regions and set other regions' pixels zero, training the decoder images. For the second issue, we replace the non-masked regions with the original clean image and add watermark localization module in the decoder differentiate between watermarked and watemaaerrrrked areas, reducing interference from irrelevant content. These two strategies directly address the first two issues by enabling the decoder extract watermarks from local regions, while also indirectly mitigating the third issue by guiding the encoder to evenly distribute the watermark under the end-to-end training, thus facilitating the decoder's extraction process.
extract watermarks from partially watermarked
To further enhance the encoder's ability to address the third challenge, we propose Mask which incorporates the mask during the encoding stage explicitly guide watermark placement. In Mask W WM-ED, the mask is embedded into the image along with the watermark bits during training. This enables the encoder learn actively concentrate the watermark within the selected regions based on the embedded mask, thereby further improving the robustness of local watermarking.
3.2 Training
The overall end-to-end training pipeline is shown in Figure 1. consists of four stages: (1) Mask Generation, (2) Watermark Embedding, (3) Watermark Masking, and (4) Watermark Extraction. In the following, we provide a detailed description of each stage.
Mask Generation. The mask generation process constructs a pool of candidate masks with diverse types, from which one mask M is randomly selected for each image during training. We follow similar mask generation strategy as LaMa [21] for image inpainting, utilizing four distinct types of masks: Full Mask, Rectangle Mask, Irregular Mask, and Segment Mask. These masks can enhance the model's 's ability to handle watermark embedding and extraction under diverse conditions from different perspectives: Full Mask enables the model to embed and extract watermarks across the entire image, serving fundamental capability. Rectangle Mask focuses on regularly shaped local regions, encouraging the model to operate within confined areas of varying sizes. Irvegular Mask introduces complex, arbitrarily shaped regions to improve robustness in non-uniform contexts. Lastly,

---

Segment Mask targets semantically meaningful areas by leveraging object masks from the MS-COCO dataset [13], helping the model generalize real-world scenarios.
Watermark Embedding. We describe the process of embedding both the watermark bits Wae and the optional mask M into the original image Lorig. We first randomly sample binary watermark bits Wgt E 0, 1 of length I, which transformed into feature map f R x using lightweight CNN, where Cy is the number of channels in f. and H and W denote the height and width of Torig- respectively. This CNN consists of linear layer that maps We, gt tensor of shape (1,1, 1), followed by bilinear interpolation to (1, H, W) and several Conv-Norm Mor--Noo--LLL (CNR) blocks that produce the final feature map f.
To embed the watermark, we concatenate the original image Torig with the watermark feature f along the channel dimension. For the MaskWM-D, this results in tensor of shape (3 + Cy, H, W), promoting global watermark embedding. For the Mask WD-ED, the optional mask M is further concatenated, yielding a tensor of shape (3 + Cj + 1, H, W". The mask guides the model focus on the selected regions during training, enabling local embedding within those specified areas.
The concatenated tensor is then passed through a U-Net [12] to generate an intermediate encoded image Lene. To obtain the final watermarked image Lum we apply a Noticcable--ifffreeee (JND) module [23], which modulates the embedding signal based on human visual sensitivity to enhance the perceptual quality:
Tum = Torig + 1a X JND(Torig) x (Jene - Torig);
where μ is the JND scaling factor to control the watermark strength. We explore several strategies improve the visual quality of the watermarked image and find that JND modulation consistently delivers the best performance (see Appendix D.I for details).
Watermark Masking. We describe how the mask M is used to process the watermarked image Tro for subsequent mask prediction and watermark extraction by the decoder. First, we generate a fused image I fuse by combining Jum and the original image T Torig, where the unmasked regions are replaced with the corresponding pixels from Torig:
1 Fase = Jum @ M + Lorig 2 M).
(2)
Next, a randomly selected distortion from predefined distortion pool is applied to Juse, producing an augmented image l/ase- This step follows a common practice in traditional watermarking methods to improve robustness against various transformations. Finally, we use the mask M once more to isolate the watermarked regions of I' Jusee setting all other pixels to zero to obtain the input I mask for
watermark extraction:
Iask
Juse @ M.
Watermark Extraction. We describe how the decoder 'D extracts the predicted mask from T'/ fase and recovers the watermark bits from Lmask. To achieve these two objectives, D consists of two dedicated modules: a U2-Net [16] for mask prediction, and U-Net [18] followed by CNN for watermark extraction. Specifically, the U2-Net takes I'Jue as input and predicts mask Mpd- Meanwhile, the U-Net processes mask to produce an intermediate feature I' with shape (Cy, H, W)), which is then passed through a CNN to obtain the predicted watermark bits Wpt. Unlike the CNN used in the encoder E, the CNN in the decoder 2 first applies several Cony-Norm-Rell to further extract features from f'. The resulting features are then interpolated to a fixed shape of (1, I, () and subsequently transformed by linear layers into bit sequence of length i, yielding the final watermark prediction W Wpd-
layers
Training Objectives. For all loss functions, we use Mean Squared Error (MSE). Specifically, the encoder loss defined as:
(4) Note that we impose constraints only in the pixel space, as we find that this setup, combined with JND modulation, already achieves high visual quality. Introducing constraints in the feature space or using GaN-based losses would negatively impact the overall performance, as discussed in Appendix D. The decoder loss is formulated as:
Lenc LMSE (Tum; Torig).
Lite = LMSE ( pd, Wst) + or CLLSE (Mpd, M),
(5)
5

---

where a is factor controlling the weight of the mask loss. The overall objective function is:
Lioall = Penc Lene + Bate
Liees
(6)
where Sene and B are the weights for the encoder and decoder losses, respectively. Compared to conventional watermarking methods, our approach introduces only mask loss at the decoder stage. As result, retains simple yet effective objective, making easy to extend.
3.3 Inference
The inference process consists of three main stages: watermark embedding, localization, and extraction. Embedding is performed by the en- coder. In MaskWM-D, the encoder embeds the watermark bits across the entire image. In MaskWM-EID users provide both the water- mark bits and a mask, allowing the encoder to embed the watermark into specific regions. Lo- calization and extraction are performed by the decoder. As shown in Figure 2, unlike conventional global extraction methods,
10
Decoder
Figure 2:
Watermark localization and extraction process in decoder during inference.
approach first uses the decoder's localization module to identify watermark datermark-containing containing regions. The rest of the image is masked out by setting non- -on-watermrrked areas to zero, reducing noise during extraction. The watermark is then recovered from the retained regions. As discussed in Sec. 4.5, this strategy improves extraction robustness, especially when only small regions remain watermarked.
3.4 Usage Scenarios
This section outlines the usage scenarios of MaskWM-D and MaskWM-ED, which are tailored to different protection requirements. WM-D is designed for full-image protection. It enables reliable watermark extraction when parts of the image tampered with, making it suitable for scenarios that demand global content integrity and tamper detection, such as copyright enforcement image provenance verification. MaskWM-END regions of interest, such as faces, logos, or sensitive content. It allows targeted verification or tracing if these regions are reused or misappropriated, without introducing watermarks across the entire image. This strategy not only supports privacy-aware or content-specific protection, but also tends to provide better robustness within the marked regions.
the other hand, focuses on protecting specific
Experiments
4.1 Implementation Details
Training. For all experiments, we train MaskWM on 83k images from the MS-COCO 2014 training set [13] and the training details are provided in Appendix C.1.I.
Evaluation. To ensure fair comparison, we fix the image resolution to 512 x 512. For baseline methods that do support this resolution, we follow the resolution scaling strategy from TrustMark [2] to interpolate the watermark strength (see Appendix C.2.1), which has been shown to preserve watermarking performance. To ensure comparable visual fidelity across variants, we set the JND scaling factor μ to 1.3 for MaskWM- and 1.75 for Mask MaskWM-ED. For robustness evaluation, we separately assess valuemetric and geometric distortions. For valuemetric robustness, we randomly sample from set of ten common distortions, including JPEG Compression, Gaussian Filter, Gaussian Noise, Median Filter, Salt&Pepper Noise, Resize, Brightness, Contrast, Hue, and Saturation. For geometric robustness, we randomly sample from three typical transformations: Rotation, Perspective, and Horizontal Flip. These distortions collectively cover the vast majority of real-world transfor- mations that watermarked images are likely to encounter in practical scenarios. Detailed parameter settings for each distortion are provided Appendix C.2.2. We also evaluate robustness under each specific distortion individually and the detailed results are presented in Appendix D.2.

---

4.2 Global and Local Watermarking Comparison
Settings. We compare MaskWN with seven recent open-source watermarking methods, including both global (e.g., StegaStamp [22], SepMark [24], TrustMark [2]. EditGuard [30]. Robust-Wing [8]. VINE [14]) and local (WAM [20]) approaches. We use the clean (EditGuard-C) and degraded (EditGuard-D) variants of EditGuard, and the robust version (VINE-R) of VINE. For global water- marking, we evaluate on kk images from the MS-COCO 2014 validation set using PSNR, SSIM, and Bit Accuracy, where PSNR and SSIM measure the visual quality of watermarked images, and Bit Accuracy evaluates watermark extraction performance. For local watermarking, we use all 41k validation images and evaluate Bit Accuracy under different watermarked area ratios. By default, MaskWM embeds 32 bits for fair comparison with WAM, though MaskWM supports flexible bit lengths (see Sec. 4.5). See Appendix C.2.3 for more implementation details and evaluation settings.
Global Watermarking Results. The global watermarking results for all methods are summarized in Table 1. First, both MaskWM-D and MaskWM-ED achieve high visual fidelity, with PSNR scores above 39.5 and SSIM scores exceeding 0.98. These results outperform WAM and are only marginally lower than TrustMark and Robust- Wobust-Wide. More importantly, under this high-fidelity setting, both variants of MaskWM still maintain near 100% bit accuracy, even under various valuemetric and geometric distortions. This demonstrates significantly better robustness compared to both global and local watermarking baselines. Notably, geometric distortions, which often break existing global watermarking methods, are effectively handled by our robust and reliable MaskWM framework.
Table 1:
Comparison with baseline watermarking methods in terms of global watermarking. The best and the second best results are highlighted in bold and underlined, respectively.
Distortions
Method
Bit Length
PSNR f
SSIM
No Distortion
Valuemetrie
Geometric
Global
Watermarking Methods
StegaStamp [22]
100
28.87
0.9019
0.9990
0.9976
0.6646
SepMark [24]
30
35.73
0.9876
0.9957
0,9643
0,5086
TrustMark [2]
100
41.19
0.9922
0.9996
0,9955
0.7868
EditGuard-CC C [30]
64
37.27
0.9332
0.9991
0,5482
0.4925
EditGuard-D [30]
64
32.30
0.8199
0.9999
0.5444
0.4975
Robust-Wiae [8]
64
41.58
0.9923
1.0000
0,9944
0.4951
VINE [14]
100
36.04
0.9874
0.9997
0,9986
0,5012
Local Watermarking Methods
WAM [20]
32
39.32
0.9791
1.0000
0.9986
0.8979
MaskWM-D (Ours)
32
39.55
0,9814
1.0000
1.0000
0.9998
MaskWM-EI (Ours)
32
39.52
0.9828
1.0000
1.0000
1.0000
Local Watermarking Results. The local watermarking results for all methods presented in Figure 3. Global watermarking methods suffer a significant drop in extraction accuracy as the watermarked region shrinks, revealing their weakness in local watermarking tasks. In contrast, both WAM and MaskWM maintain high accuracy even with small watermarked areas, and MaskWM consistently outperforms WAM, especially under distortions, demonstrating greater robustness. Between our variants, Mask WM-ED performs better when the watermarked area is small, with the performance gap narrowing as the watermarked area increases.
Visualized Results. The visualized watermark patterns embedded by Mask WM- and MaskWM ED are shown in Figure 15 in Appendix D.6.
4.3 Watermark Localization Comparison
Settings. We further compare MaskWM with EditGuard [30] and WAM [20], two methods with watermark localization capabilities. Localization performance is evaluated using the local watermark- ing dataset described Sec. 4.2, with Intersection-over-nnii (IoU) metrics computed between the predicted and ground-truth regions for both the watermarked and unwatermarked areas.
7

---

No Distorton
Veluemetric Distortons
Geometric Distortions
BitAccuracy
0.00
0.00
0.00
0.50
0.30
0.50
20
Watermaried Ar83 (%)
Watermaried Arta (96)
Watemarred Area (%)
MaxciMM-E (O.i)
EIIGuartDD
SiegaSlamp
RobustWWed
MastWMle D (Oun)
Edhouard-C
Seykaak
TrusMars
MINE
Watermark extraction performance of different methods under different ratios of water- marked areas. The intervals of ratios are: 1-5%, 5-10%, .... 95-99%, 99-100%. We select the average value for each interval's ratios to stand for the interval (e.g., 3% for 1-5%).
Figure 3:
The localization results of different methods are presented in Figure 4. First, MaskWM con- sistently achieves the best localization performance across nearly all watermark ratios and distortion conditions, with WAM showing noticeable performance gap and EditGuard performing signifi- cantly worse. Second, MaskWM-ED outperforms MaskWM in localizing small regions, whether watermarked unwatermarked, especially under distortion conditions. Interestingly, EditGuard-C shows an unusual rise in localization performance for unwatermarked regions as the watermark area increases under non-distorted conditions, behavior observed in EditGuard-D, possibly due overfitting from being trained solely on clean data. The visualized localization results of different methods are provided Appendix D.7.
Results.
No Distorton
Voluemetric Distortons
Geometric Distortions
1.00
1.00
0.80
Unwatermakoo Arna Wogemartoe Akea
0.40
0.40
0.40
0.20
0.20
0.20
0.00
0.00
0.00
0.30
0.80
0.00
8.20
0.20
0.20
20
50
50
Watermaried Ares (1)
Watermareed Arto (96)
Watemmared Area (%)
MIwAMMAD (Dund)
MaxdWAh-D (Dun))
WMM
EdGGundeC
EdiCuurs-D
Figure 4: Localization performance of different methods under different ratios of watermarked areas.
4.4 Performance Comparisons of Embedding Multiple Watermarks
Settings. We further compare MasKWM-ED with WAM [20] under multi- nattii- setting by embedding to five distinct watermarks into separate masked regions. The evaluation considers extraction accuracy and localization performance under stricter masking constraint (5% area per region). We report the average watermark extraction accuracy across all embedded watermarks and the mean IoU of the predicted watermark regions. Detailed setup is provided in Appendix C.2.4.
Results. Figure 5 presents the comparison results. First, our MaskWM consistently outper- forms WAM in both watermark extraction and localization, across all tested numbers of embedded watermarks and under various distortion conditions. Second, despite being trained solely with single-watermark supervision, MaskWM-ED generalizes well to multi-watermmrk settings, demon- strating strong scalability. However, under geometric distortions, Mask extraction accuracy degrades the number of embedded watermarks increases. This is mainly due to spatial transfor-

---

mations (particularly rotation) shrinking the watermark regions in the image corners, reducing the effective area available for extraction (see Figure 20 in Appendix D.8).
Watermark Extraction Companison
Localization Companison
1.0
8.44
S7T 6.977 003
0.97
6:22
Watermattod www.daahooooooooooooooo wreaaaooooeeeeeooeeeoo lou
75.0
00.7
0.5
0.5
No Danation
VaMamatic Distoroons
Goomutre Denoroor
0.5
No Diitoioon
Valuemen: Dutortons
GeomaR 1C Liitor BOTG
MaccAM-B
WAM
Figure 5: Performance comparison of watermark extraction and localization when embedding multiple watermarks, The bar colors transition from light to dark from left to right, representing the embedding of I different bit strings in single image.
4.5 More Analysis
Scalability to Different Watermark Bit Lengths. While WAM constrained to 32-bit watermarks, our MaskWN readily scales to longer bit lengths. Detailed results are provided Figure 12 in Appendix D.3. MaskWM maintains high extraction accuracy across various bit lengths. Even at 64 bits, the accuracy experiences only a slight drop and still outperforms WAM at 32 bits. While the accuracy decline becomes noticeable 128 bits, MaskWM consistently surpasses WAM under both no distortion and valuemetric distortion conditions. The only exception arises under geometric distortion, where a performance gap emerges when the watermarked region covers between 5% and 75%. These results underscore the scalability and optimization-friene frienddly design of our method, emphasizing its practical advantages.
Enhancing Robustness against Adaptive Attacks via Fast Fine-tuning. While MaskWM is trained on broad range common distortions, it is impractical to cover all possible scenarios. Fortunately, our framework supports task-specific fine-tuning, allowing it to adapt to new and emerging threats. As a demonstration, we consider adaptive attacks based on variational autoencoders (VAEs) [11], which reconstruct images and may inadvertently remove watermark signals. To counter this, we expand the distortion pool during tine-tuning by incorporating VAE modules from Stable Diffusion v1-4 [17]. Bmshj18 [1], and Cheng20 [3]. Training details are provided in Appendix C.I.I. Fine-tuning for 20k steps on a single A6000 GPU (~55 hours) significantly improves robustness against these attacks, as shown in Figure 13 in Appendix D.4, outperforming existing baselines. While there is a slight drop in robustness to other distortions, Mask WM still maintains strong overall performance. These results demonstrate the adaptability of our approach to specific threats.
Importance of Localization before Extracting Local Watermarks. We evaluate watermark extraction performance using three masking strategies when processing the watermarked image for extraction: (1) a full mask, which uses the entire image; (2) a predicted mask, which focuses on regions predicted to contain the watermark; and (3) a ground-trute mask, which focuses on the regions. As shown in Figure 14 in Appendix D.5, when watermarks
actual Patermark-embedee are embedded in small regions, using the full mask significantly reduces accuracy. In contrast, the predicted and ground-truth masks progressively improve performance. This highlights the importance of localizing watermarked regions before extraction to reduce interference from irrelevant content.
Computation Overhead Evaluation. We compare training and inference costs of WM with EditGuard [30] and WAM [20], both supporting watermark extraction and localization, summarized in Table MaskWM has fewer parameters than WAM, with similar encoder and decoder sizes; WAM allocates most parameters to the decoder due to its more complex task. In training, MaskWM requires only about 1/15 WAM's TFLOPs. EditGuard doesn't report training cost, its data consumption already reaches 60% of MaskWM is, despite using fewer strong distortions for robustness. Fewer parameters don't 't always mean lower inference overhead, as different image processing methods affect memory and speed. Although EditGuard has the fewest parameters, it uses

---

more memory and runs slower due to embedding both localization and copyright watermarks. In contrast, Mask WM and WAM have lower latency with similar memory use.
Table 2: Training and inference costs of different methods. The inference time is evaluated on single A6000 with batch size of by averaging the total processing time over 1000 images.
Params (M)
Train
Inference
Method
Doc
Total
Steps
Time
THLOPS
Memory
Total Time
Memocy
EdiiCuard [30]
266
6.3
250K
0.080
WAM (20)
960
97.1
3,60KK
90h
10
8.015 0.009 s
0017
McskWM (Ous)
31.1
322
63.3
100K
16
A6000
20
7.74 x
10"
25.84 GB
0.02 s
0031 6
2.21 GB
Conclusion
In this paper, propose MaskWM, simple and efficient framework for both global and local image watermarking. Its core design introduces masks in encoding and decoding stages to guide the encoder and decoder to learn local embedding and extraction. Extensive experiments demonstrate Mask WM 's superior performance in local watermark extraction and localization, along with high efficiency and adaptability. We hope our simple design can inspire future research further enhance the practicality and functionality of watermarking models.
Acknowledgments
This research / project is supported by the National Research Foundation, Singapore and Infocomm Media Development Authority under its Trust Tech Funding Initiative. Any opinions, findings and conclusions or recommendations expressed in this material are those of the author(s) and do not reflect the views of National Research Foundation, Singapore, and Infocomm Media Development Authority.
References
[1] Johannes Ballé, David Minnen, Saurabh Singh, Sung Jin Hwang, and Nick Johnston. Variational image compression with a scale hyperprior. In International Conference on Learning Representations, 2018.
[2] Tu Bui, Shruti Agarwal, and John Collomosse. Trustmark: Universal watermarking for arbitrary resolution images. arXiv preprint arXiv:2311.18297 2023.
[3] Zhengxue Cheng, Heming Sun, Masaru Takeuchi, and Jiro Katto. Learned image compression with discretized gaussian mixture likelihoods and attention modules. In Proceedings of the JEFF/CVF conference on computer vision and pattern recognition, pages 7939-7948, 2020.
[4] Han Fang, Dongdong Chen, Qidong Huang, Jie Zhang, Zehua Ma, Weiming Zhang, and Nenghai Yu. Deep template- based watermarking. IEEE Transactions on Circuits and Systems for Video Technology. 31(4):1436-1 -451, 2020.
[5] Han Fang and et al. Pimog: An effective screen-shooting noise-layer simulation deep-learning watermarking network. In ACM MM, pages 2267-2275, 2022.
[6] Runyi Hu, Jie Zhang, Yiming Li, Jiwei Li, Qing Guo, Han Qiu, and Tianwei Zhang. Supermark: Robust and training- free image watermarking via diffusion- based super-resoluse resolution. arXiv preprint arXiv:2412. 2024.
[7] Runyi Hu. Jie Zhang, Yiming Li, Jiwei Li. Qing Guo, Han Qiu, and Tianwei Zhang. Videoshield: Regulating diffusion-based video generation models via watermarking. In International Conference on Learning Reprexentations (ICLR), 2025.
[8] Runyi Hu, Jie Zhang, Ting Xu, Jiwei Li, and Tianwei Zhang. Robust-wide: Robust watermarking against instruction-driver image editing. In European Conference on Computer Vision, pages 20-37. Springer, 2024.
[9] Phillip Isola, Jun- Yan Zhu, Tinghui Zhou, and Alexei A Efros. Image-to to to-itageeeeaaaa translation with conditional adversarial networks. In Proceedings of the IEEE conference on computer vision and pattern recognition. pages 1125 1134, 2017.
10

---

[10] Zhaoyang Jia, Han Fang. and Weiming Zhang. Mbrs: Enhancing robustness of dan-based watermarking by mini-batch of real and simulated jpeg compression. In Proceedings the 29th ACM international conference on multimedia, pages 41 41-49, 2021.
[11] Diederik P Kingma and Max Welling. Auto-encoding variational bayes. In Proceedings of the 2nd International Conference on Learning Representations (ICLR), 2014.
[12] Alexander Kirillov, Eric Mintun, Nikhila Ravi, Hanzi Mao, Chloc Rolland, Laura Gustafson, Tete Xiao, Spencer Whitehead, Alexander C Berg, Wan-Yen Lo, et al. Segment anything. In Proceedings of the IEEE/CVF international conference on computer vision, pages 4015-4026, 2023.
[13] Tsung-Yr Yi Lin, Michael Maire, Serge Belongie, James Hays, Pictro Perona, Deva Ramanan, Piotr Dollár, and C Lawrence Zitmick. Microsoft coco: Common objects in context. In Computer Vision-ECCV 2014: 13th European Conference, Zurich, Swirzerland, September 6-12, 2014, Proceedings, Part V 13, pages 740-755. Springer, 2014.
[14] Shilin Lu, Zihan Zhou, Jiayou Lu, Yuanzhi Zhu, and Adams Wai- Kin Kong. Robust watermarking using generative priors against image editing: From benchmarking to advances. arXiv preprint 2r1ii:2410. 1410.1875, 2024.
[15] Vidyasagar Potdar, Song Han, and Elizabeth Chang. A survey of digital image watermarking techniques. In 05 2005 3rd IEEE International Conference on Industrial Informatics, 2005., pages 709 716. IEEE, 2005.
[16] Xuebin Qin, Zichen Zhang, Chenyang Huang. Masood Dehghan, Osmar R Zaiane, and Martin Jagersand. U2-net: Going deeper with nested u-structure for salient object detection. Pattern recognition, 106: 107400444, 2020.
[17] Robin Rombach, Andreas Blattmann, Dominik Lorenz, Patrick Esser, and Bjöm Ommer. High-resolution image synthesis with latent diffusion models. In Proceedings of the IEEE/CVF conference on computer vision and pattern recognition, pages 11884-1695,, 2022.
[18] Olaf Ronneberger, Philipp Fischer, and Thomas Brox. U-net: Convolutional networks for biomedical image segmentation. In Medical image computing and computer-asiisted intervention 2015: 18th international conference, Munich, Germany, October 5-9, 2015, proceedings, part III 18, pages 234 2411 Springer, 2015.
[19] Chitwan Saharia, William Chan, Saurabh Saxena, Lala Li, Jay Whang, Emily L Denton, Kamyar Ghasemipour, Raphael Gontijo Lopes, Burcu Karagol Ayan, Tim Salimans, et al. Photorealistic text-to- image diffusion models with deep language understanding. Advances in neural information processing systems,
2022.
[20] Tom Sander, Pierre Fernandez, Alain Durmus. Teddy Furon, and Matthijs Douze. Watermark anything with localized messages. In International Conference on Learning Representations (ICLR), 2025.
[21] Roman Suvorov, Elizaveta Logacheva, Anton Mashikhin, Anastasia Remizova, Arsenii Ashukha, Aleksei Silvestrov, Naejin Kong, Harshith Goka, Kiwoong Park, and Victor Lempitsky. Resolution-robus large mask inpainting with fourier convolutions. In Proceedings of the IEEE/CVF winter conference on applications of computer vision, pages 2149-22200 2159, 2022.
[22] Matthew Tancik, Ben Mildenhall, and Ren Ng. Stegastamp: Invisible hyperlinks in physical photographs. In Proceedings of the IEEE/CVF conference on computer vision and pattern recognition, pages 21 2712212. 2020.
[23] Jinjian Wu, Leida Li, Weisheng Dong, Guangming Shi, Weisi Lin, and C-C Jay Kuo. Enhanced just noticeable difference model for images with pattern complexity. IEFE Transactions Image Processing, 26(6):2682 2693, 2017.
[24] Xiaoshuai Wu, Xin Liao, and Bo Ou. Sepmark: Deep separable watermarking for unified source tracing and deepfake detection. Proceedings of the 31st ACM International Conference on Multimedia, pages 11001101, 2023.
[25] Tao Yu, Runseng Feng, Ruoyu Feng, Jinming Liu, Xin Jin, Wenjun Zeng, and Zhibo Chen. Inpaint anything: Segment anything meets image inpainting. arXiv preprint arXiv:2304.067. 2023.
[26] Jie Zhang, Dongdong Chen, Jing Liao, Weiming Zhang, Huamin Feng. Gang Hua, and Nenghai Yu. Deep model intellectual property protection via deep watermarking. IEEE Transactions on Pattern Analysis and Machine Intelligence, 44(8):405 4020, 2021.

---

[27] Lijun Zhang, Xiao Liu, Antoni Viros Martin, Cindy Xiong Bearfield, Yuriy Brun, and Hui Guan. Attack- resilient image watermarking using stable diffusion, 2024.
[28] Lymin Zhang, Anyi Rao, and Maneesh Agrawala. Adding conditional control to text-to-image diffusion models. In Proceedings of the IEEE/CVF international conference computer vision, pages 3837-3847, 2023.
[29] Richard Zhang, Phillip Isola, Alexei A Efros, Eli Shechuman, and Oliver Wang. The unreasonable effectiveness deep features perceptual metric. Proceedings of the IEEE conference on computer vision and pattern recognition, pages 386-595, 2018.
[30] Xuanyu Zhang, Runyi Jiwen Yu, Youmin Xu. Weiqi Li, and Jian Zhang, Editguard: Versatile image watermarking for tamper localization and copyright protection. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pages 11964-1 19944, 2024.
[31] Xuanyu Zhang, Zecheng Tang, Zhipei Xu, Runyi Li, Youmin Xu, Bin Chen, Feng Gao, and Jian Zhang Omniguard: Hybrid manipulation localization via augmented versatile deep image watermarking. arXiv preprint ar::::242..00000
2024.
[32] Jiren Zhu, Russell Kaplan, Justin Johnson, and Li Fei-Fei. Hidden: Hiding data with deep networks. In Proceedings of the European conference computer vision (ECCV), pages 657 672, 2018.
12

---

NeurIPS Paper Checklist
1. Claims
Question: Do the main claims made in the abstract and introduction accurately reflect the paper's contributions and scope?
Answer: [Yes]
Justification: The claims in the abstract and introduction are consistent with the actual contributions of the paper. They accurately summarize the proposed method, its motivations, and the key experimental findings presented in the main text.
Guidelines:
The answer NA means that the abstract and introduction do not include the claims made paper.
The abstract and/or introduction should clearly state the claims made, including the contributions made in the paper and important assumptions and limitations. A No NA answer to this question will not be perceived well by the reviewers.
The claims made should match theoretical and experimental results, and reflect how much the results can be expected to generalize to other settings.
is fine to include aspirational goals as motivation as long as is clear that these goals not attained by the paper.
2. Limitations
Question:
Does the paper discuss the limitations of the work performed by the authors?
Answer: [Yes]
Justification:
We discuss the limitations of MaskWM Appendix
Guidelines:
The answer NA means that the paper has limitation while the answer No means that the paper has limitations, but those are not discussed in the paper.
The authors are encouraged to create a separate "Limitations" section in their paper.
The paper should point out any strong assumptions and how robust the results are to violations of these assumptions (c.g.. independence assumptions, noiseless settings, model sell-speciiiatiinn asymptotic approximations only holding locally). ). The authors should reflect on how these assumptions might be violated in practice and what the implications would be.
The authors should reflect on the scope of the claims made, e.g., if the approach was only tested on few datasets or with few runs. In general, empirical results often depend on implicit assumptions, which should be articulated.
The authors should reflect on the factors that influence the performance of the approach. For example, facial recognition algorithm may perform poorly when image resolution low or images are taken in low lighting. Or speech-to-tex, system might not be used reliably to provide closed captions for online lectures because it fails handle technical jargon.
The authors should discuss the computational efficiency of the proposed algorithms and how they scale with dataset size.
If applicable, the authors should discuss possible limitations of their approach to address problems of privacy and faimesss.
While the authors might fear that complete honesty about limitations might be used by reviewers as grounds for rejection, a worse outcome might be that reviewers discover limitations that aren't 't acknowledged in the paper. The authors should use their best judgment and recognize that individual actions in favor of transparency play an impor- tant role in developing norms that preserve the integrity of the community, Reviewers will be specifically instructed to not penalize honesty concerning limitations.
3. Theory assumptions and proofs
Question: For each theoretical result, does the paper provide the full set of assumptions and complete (and correct) proof?
13

---

Answer:
[NA]
Justification:
We do not include theoretical results.
Guidelines:
The answer NA means that the paper does not include theoretical results.
All the theorems, formulas, and proofs in the paper should be numbered and cross- referenced.
All assumptions should be clearly stated or referenced in the statement of any theorems.
The proofs can either appear in the main paper or the supplemental material, but they appear in the supplemental material, the authors are encouraged to provide short proof sketch to provide intuition.
Inversely, any informal proof provided in the core of the paper should be complemented by formal proofs provided in appendix supplemental material.
Theorems and Lemmas that the proof relies upon should be properly referenced.
4. Experimental result reproducibility
Does the paper fully disclose all the information needed to reproduce the main ex- perimental results the paper to the extent that affects the main claims and/or conclusions of the paper (regardless of whether the code and data are provided not)?
Question:
Answer: [Yes]
The paper provides detailed descriptions of the experimental setup, including model architectures, training procedures, hyperparameters, evaluation metrics, and baselines. This information is sufficient to reproduce the main experimental results and verify the paper's core claims, even without access to the code or data.
Justification:
Guidelines:
The answer NA means that the paper does not include experiments. If the paper includes experiments, a No answer this question will not be perceived well by the reviewers: Making the paper reproducible is important, regardless of whether the code and data are provided or not.
If the contribution is dataset and/or model, the authors should describe the steps taken to make their results reproducible or verifiable.
Depending on the contribution, reproducibility can be accomplished in various ways. For example, if the contribution is a novel architecture, describing the architecture fully might suffice, or if the contribution is specific model and empirical evaluation, it may be necessary to either make it possible for others to replicate the model with the same dataset, or provide access the model. In general. releasing code and data is often one good way to accomplish this, but reproducibility can also be provided via detailed instructions for how replicate the results, access a hosted model (e.g.. in the case of large language model), releasing of a model checkpoint, or other means that are appropriate to the research performed.
While NeurIPS does not require releasing code, the conference does require submis- sions to provide some reasonable avenue for reproducibility, which may depend on the nature of the contribution. For example
(a) the contribution is primarily a new algorithm, the paper should make clear how reproduce that algorithm. (b) If the contribution is primarily
model architecture, the paper should describe the architecture clearly and fully.
(c) the contribution is a new model (e.g., a large language model), then there should either be way to access this model for reproducing the results or way to reproduce the model (e.g., with an open-source dataset or instructions for how to construct the dataset).
(d) We recognize that reproducibility may be tricky in some cases, in which case authors are welcome describe the particular way they provide for reproducibility. In the case of closed-source models, it may be that access to the model is limited in some way (e.g., to registered users), but it should possible for other researchers to have some path to reproducing verifying the results.
14

---

5. Open access to data and code
Does the paper provide open access to the data and code, with sufficient instruc- tions to faithfully reproduce the main experimental results, as described in supplemental material?
Question:
Answer: [Yes]
Justification: Both the code and data have been publicly released and detailed instructions are provided to enable faithful reproduction of the main experimental results.
Guidelines:
The answer NA means that paper does not include experiments requiring code.
Please see the NeurlPS code and data submission guidelines (https://nips.co
public/ cubbic//uiies/// hatps//oeeSSubiiseeeee sasisssssiiiyyy for more details.
While we encourage the release of code and data, we understand that this might not be possible, so "No" an acceptable answer. Papers cannot be rejected simply for not including code, unless this is central to the contribution (e.g., for new open-source benchmark).
The instructions should contain the exact command and environment needed to run to reproduce the results. See the NeurlPS code and data submission guidelines (https: / //nips. wwtppcccc//pcccccccccccccccccclt wtwic//gg//////eieeieiiicccsise/ guwdee//ooeeuuumiiiiic Cwweeoomiisisiiieoooooo wwwsssssssiiioooooooo for more details.
The authors should provide instructions data access and preparation, including how to access the raw data, preprocessed data, intermediate data, and generated data, etc.
The authors should provide scripts to reproduce all experimental results for the new proposed method and baselines. only subset of experiments are reproducible, they should state which ones are omitted from the script and why.
At submission time, to preserve anonymity, the authors should release anonymized versions (if applicable).
Providing much information possible in supplemental material (appended to the paper) is recommended, but including URLs to data and code is permitted.
6. Experimental setting/details
Question: Does the paper specify all the training and test details (e.g., data splits, hyper- parameters, how they were chosen, type of optimizer, etc.) necessary to understand the results?
Answer: [Yes]
Justification: The training and test details are provided in Sec. 4.1 and Appendix C.
Guidelines:
The answer NA means that the paper does not include experiments.
The experimental setting should be presented the core the paper to a level detail that is necessary appreciate the results and make sense of them.
The full details can be provided either with the code, appendix, or as supplemental material.
7. Experiment statistical significance
Does the paper report error bars suitably and correctly defined or other appropriate information about the statistical significance of the experiments?
Question:
Answer: [Yes]
The main evaluation metrics (PSNR, SSIM, and Bit Accuracy) exhibit neg- ligible variance across multiple runs in our setting, they are deterministic nearly deterministic given fixed seeds and models. As such, we did not include error bars, since their inclusion would not significantly affect the interpretation of the results or the validity of the main claims.
Justification:
Guidelines:
The answer NA means that the paper does not include experiments.
15

---

The authors should answer "Yes" if the results are accompanied by error bars, confi- dence intervals, or statistical significance tests, least for the experiments that support the main claims of the paper.
The factors of variability that the enror bars are capturing should be clearly stated (for example, train/test split, initialization, random drawing of some parameter, or overall
with given experimental conditions).
The method for calculating the error bars should be explained (closed form formula, call to a library function, bootstrap, etc.)
The assumptions made should be given (e.g., Normally distributed errors).
It should be clear whether the error bar is the standard deviation or the standard error of the mean.
is OK to report 1-sigma error bars, but one should state it. The authors should preferably report a 2-sigma error bar than state that they have 96% CI, if the hypothesis of Normality of errors is not verified.
For asymmetric distributions, the authors should be careful not to show in tables or figures symmetric error bars that would yield results that out of range (e.g. negative error rates).
If error bars are reported in tables or plots, The authors should explain in the text how they were calculated and reference the corresponding figures or tables in the text.
8. Experiments compute resources
For each experiment, does the paper provide sufficient information on the com- puter resources (type of compute workers, memory, time of execution) needed reproduce the experiments?
Question:
Answer: [Yes]
Justification: The type of compute workers, memory and time of execution are reported in Table 2.
Guidelines:
The answer NA means that the paper does include experiments.
The paper should indicate the type of compute workers CPU or GPU, internal cluster, or cloud provider, including relevant memory and storage.
The paper should provide the amount of compute required for each of the individual experimental runs as well as estimate the total compute.
The paper should disclose whether the full research project required more compute than the experiments reported in the paper (e.g., preliminary failed experiments that didn't make it into the paper).
9. Code ethics
Question: Does the research conducted in the paper conform, in every respect, with the NeurlPS Code of Ethics https: : http//euuriipeeee/eeee/e httpppublic/thicsuuuueeeee
Answer: [Yes]
Justification: Our research conforms with NeurIPS Code of Ethics and we provide impact statement in Appendix B.
Guidelines:
The answer NA means that the authors have reviewed the NeurIPS Code of Ethics.
If the authors answer No, they should explain the special circumstances that require deviation from the Code of Ethics.
The authors should make sure to preserve anonymity (e.g.. if there is special consid- eration due to laws or regulations their jurisdiction).
10. Broader impacts
Question: Does the paper discuss both potential positive societal impacts and negative societal impacts of the work performed?
Answer: [Yes]
Justification: We provide impact statement in Appendix B.
16

---

Guidelines:
The answer NA means that there is no societal impact of the work performed.
If the authors answer NA or No. they should explain why their work has no societal impact or why the paper does not address societal impact.
Examples of negative societal impacts include potential malicious unintended uses (e.g., disinformation, generating fake profiles, surveillance), fairness considerations (e.g., deployment of technologies that could make decisions that unfairly impact specific groups), privacy considerations, and security considerations.
The conference expects that many papers will be foundational research and not tied partieular applications, let alone deployments. However, if there is direct path any negative applications, the authors should point it out, For example, it is legitimate to point that improvement in the quality of generative models could be used to generate deepfakes for disinformation. On the other hand, it is not needed to point out that a generic algorithm for optimizing neural networks could enable people train models that generate Deepfakes faster.
The authors should consider possible harms that could arise when the technology is being used as intended and functioning correctly, harms that could arise when the technology is being used as intended but gives incorrect results, and harms following from (intentional or unintentional) misuse of the technology.
If there are negative societal impacts, the authors could also discuss possible mitigation strategies (e.g., gated release of models, providing defenses in addition attacks, mechanisms for monitoring misuse, mechanisms to monitor how system learns from feedback over time, improving the efficiency and accessibility of MI...
11. Safeguards
Does the paper deseribe safeguards that have been put in place for responsible release of data or models that have a high risk for misuse (e.g., pretrained language models, image generators, or scraped datasets)?
Question:
Answer: [NA]
Justification: This paper poses such risks.
Guidelines:
The answer NA means that the paper poses such risks.
Released models that have high risk for misuse or dual-use should be released with necessary safeguards to allow for controlled use of the model, for example by requiring that users adhere to usage guidelines or restrictions to access the model or implementing safety filters.
Datasets that have been scraped from the Internet could pose safety risks. The authors should describe how they avoided releasing unsafe images.
We recognize that providing effective safeguards is challenging, and many papers do not require this, but we encourage authors to take this into account and make best faith effort.
12. Licenses for existing assets
Question: Are the creators or original owners of assets (e.g., code, data, models), used in the paper, properly credited and are the license and terms of use explicitly mentioned and properly respected?
Answer: [Yes]
Justification:
We cited existing datasets and pre-trained models we used.
Guidelines:
The answer NA means that the paper does not use existing assets.
The authors should cite the original paper that produced the code package or dataset.
The authors should state which version of the asset used and, possible, include URL.
The name of the license (c.g., CC-BY 4.0) should be included for each asset.
17

---

For scraped data from a particular source (e.g., website). the copyright and terms of service of that souree should be provided.
assets are released, the license, copyright information, and terms use in the package should be provided. For popular datasets, paperswi thcode. com comdaatasets has curated licenses for some datasets. Their licensing guide can help determine the license of dataset.
For existing datasets that are re-packaged, both the original license and the license of the derived asset (if it has changed) should be provided.
If this information is not available online, the authors are encouraged to reach out to the asset's s creators.
13. New assets
Question: Are new assets introduced in the paper well documented and is the documentation provided alongside the assets?
Answer: [NA]
Justification:
This paper does not release new assets.
Guidelines:
The answer NA means that the paper does not release new assets.
Researchers should communicate the details of the dataset/code/mmodel as part of their submissions via structured templates. This includes details about training, license, limitations, etc.
The paper should discuss whether and how consent obtained from people whose asset is used.
At submission time, remember to anonymize your assets (if applicable). You can either create an anonymized URL or include an anonymized zip file.
14. Crowdsourcing and research with human subjects
Question: For crowdsourcing experiments and research with human subjects, does the paper include the full text of instructions given participants and screenshots, if applicable, as well as details about compensation (if any)?
Answer: [NA]
Justification:
This paper does not involve crowdsourcing or research with human subjects.
Guidelines:
The answer NA means that the paper does not involve crowdsourcing nor research with human subjects.
Including this information in the supplemental material is fine, but if the main contribu- tion of the paper involves human subjects, then as much detail as possible should be included in the main paper.
According to the NeurlPS Code of Ethics, workers involved in data collection, curation, or other labor should be paid at least the minimum wage in the country of the data collector.
15. Institutional review board (IRB) approvals equivalent for research with human subjects
Question: Does the paper describe potential risks incurred by study participants, whether such risks were disclosed to the subjects, and whether Institutional Review Board (IRB) approvals (or an equivalent approval/review based on the requirements of your country or institution) were obtained?
Answer: [NA]
Justification:
This paper does not involve crowdsourcing or research with human subjects.
Guidelines:
The answer NA means that the paper does not involve crowdsoureing nor research with human subjects.
18

---

Depending on the country in which research is conducted, IRB approval (or equivalent) may be required for any human subjects research. If you obtained IRB approval, you should clearly state this in the paper.
We recognize that the procedures for this may vary significantly between institutions and locations, and we expect authors to adhere to the NeurIPS Code of Ethics and the guidelines for their institution.
For initial submissions, do not include any information that would break anonymity (if' applicable), such as the institution conducting the review.
16. Declaration of LLM usage
Does the paper describe the usage of LLMs if is an important, original, or non-standard component of the core methods in this research? Note that if the LLM is used only for writing, editing, or formatting purposes and does not impact the core methodology, scientific rigorousness, originality of the research, declaration is not required.
Question:
Answer: [NA]
Justification: No LLMs were used as part of the core methodology or experimental pipeline. Any of LLMs was limited writing assistance and did not impact the scientific contri- butions or originality of the research.
Guidelines:
The answer NA means that the core method development in this research does not involve LLMs as any important, original, or non-standard components.
Please refer to our LLM policy (https: http://eeerr.ppeee cc/ cc/Comfeerecces/0225/// for what should or should not be described.
19

---

A Limitations
Despite the relatively high PSNR and SSIM of the watermarked images produced by our method, noticeable artifacts are still present in some cases. To address this issue, we explored multiple approaches and ultimately adopted a JND-based method [23] to effectively suppress artifacts (as shown in Appendix D.I). Nevertheless, some images still exhibit visible artifacts after watermark embedding, particularly in smooth background regions. This issue also present WAM [20] and reflects common limitation in local watermarking methods, possibly arising from the inherent trade-off between imperceptibilitty and local robustness. Our focus this work to propose a mask mechanism, rather than to exhaustively pursue visual
watermarking framework centered quality improvements. We have not further explored advanced strategies such as improved loss functions, auxiliary modules for visual enhancement, more effective algorithms for watermark strength modulation. These aspects are left for future work to enhance the practicality and visual fidelity of our method.
B Impact Statement
We propose a simple, efficient, and flexible image watermarking framework whose core component, a masking mechanism, can be easily integrated into existing watermarking models. This mechanism enhances both the functionality and robustness of watermarking systems, significantly improving their practicality real-world scenarios. The support for local watermark extraction allows reliable recovery of watermark information even when large portions of the image are tampered with. This is particularly valuable for forensic verification in areas such as misinformation mitigation and evidence integrity analysis. The ability to localize watermark regions enables systems to identify precisely which parts of an image contain embedded signals, facilitating transparent content attribution and enabling fair decision-maie making in legal and copyright-related contexts. Furthermore, local watermark embedding allows protection of specific regions within an image, which is useful when only certain parts require ownership marking when content from multiple sources needs independent tracking and licensing. By improving spatial controllability while maintaining low computational cost and compatibility with existing architectures, our approach makes robust and fine-graine watermarking more accessible and deployable across diverse applications.
C
More Details
C.1
Training
C.1.1 Details
All images are resized and center-cropped to 256 x 256 during training. Training is conducted for 100k steps with a batch size of on single NVIDIA A6000 GPU. We use the AdamW optimizer with learning rate of x 10-4, and apply cosine learning rate scheduler with 2k warm-up up steps. We adopt an easy-to-hare training strategy inspired by TrustMark [2]. During the first 0.5k steps, the mask is set to full (i.e., all ones) and no distortion is applied. From step 0.5k to 1k, we introduce all types of masks. After 1K steps, distortions are added. The encoder loss weight Benc is fixed at 1, while the decoder loss weight Blee is initially set to 20 and linearly decayed to 0.2 over the first 5k steps. The mask loss weight a is set to 0.5. The IND module in the encoder introduced and tuned starting from step 5k, with the scaling factor μ set to 1.
During fine-tuning with adaptive attacks, VAE-based distortions are applied with a 50% probability, while the original distortion types are retained for the remaining 50%. The hyperparameters are set as follows: Ssec 0.3, learning rate x 10-4 and the quality levels for Bmshj18 and Cheng20 are both set to 5.
C.1.2 Distortions
Valuemetric Distortions. During training, valuemetric robustness enhanced by randomly sam- pling from a set of ten common distortions: JPEG Compression, Gaussian Filter, Gaussian Noise, Median Filter, Salt&Pepper Noise, Resize, Brightness, Contrast, Hue, and Saturation. The distortion parameters are set as follows:
20

---

JPEG Compression: quality factor = 50.
Gaussian Filter: kernel size 1, sigma = 5.
Gaussian Noise: mean 0, standard deviation 0.1.
Median Filter: kernel size = 5.
Papper Noise: noise ratio 0.1.
Geometric Distortions. To improve geometric robustness, we randomly sample from three typical geometric transformations: Rotation, Perspective, and Horizontal Flip. The specific configurations
are:
Rotation: angle sampled from --90%, ]
Perspective: distortion scale sampled from [0.1,
Horizontal Flip: parameters.
C.2 Evaluation
C.2.1 Resolution Scaling
Algorithm I is adapted from the resolution scaling method described in TrustMark [2). This algorithm enables a watermark model trained on images with a fixed resolution to be applied at arbitrary resolutions without sacrificing performance.
Algorithm 1: Resolution scaling watermark embedding on arbitrary resolution images
Input: Original image x, [binary watermark vector w]
Output: Watermarked image y
Data: Embedding network trained on the resolution of m X n
H, W <- x.height, x.width
2 X f- x/127.5- 1:
// Normalize to range [-1, 1]
<- interpolate (x, (m, n))
4 r f E(x, w) - x
// residual image
interpolate(r, (H, W))
6 y t clamp(x + -1, 1)
y y 127. 127.5
C.2.2 Distortions
Valuemetric Distortions. We apply ten types of valuemetric distortion with the following parameter settings evaluate robustness:
JPEG Compression: quality factor 60.
Gaussian Filter: kernel size 1, sigma = 3.
Gaussian Noise: mean = 0, standard deviation = 0.05.
Median Filter: kernel size = 3.
Palt&repper Noise: noise ratio 0.05.
Resize: scaling factor = 0.5.
Brightness Adjustment: range (0.7, 1.3).
Contrast Adjustment: range (0.7, 1.3).
Hue Adjustment: range (-0.1, 0.1).
Saturation Adjustment: range (0.7, 1.3).
21

---

We apply three types of geometric distortion with the following parameter settings evaluate robustness:
Geometric Distortions
Rotation: angle sampled from ,-30", 33%)
Perspective: distortion scale sampled from 0.3).
Horizontal Flip: no parameters.
C.2.3 Global and Local Watermarking Comparison
Evaluation Setup. For global watermarking, we sample 1,000 images from the MS-COCO 2014 validation We report PSNR and SSIM to assess visual quality, and Bit Accuracy measure watermark extraction performance. For local watermarking, we construct comprehensive evaluation from all 41,000 images the validation split. We divide the dataset into 12 subsets based on the ratio of masked area to the full image: 1-5%, 5-10%, 10-20%, .... 80-90%, 90-95%, and 95 15-99%. From each subset, 400 images are randomly selected. To simulate both inpainting and outpainting scenarios, we also include inverted masks, i.e., if the original mask covers a-b% of the image, the inverted mask covers (100- -1000 of 9,600 for evaluation.
(100-a) a.%. %. This yields 800 image-mask pairs per subset and a total
Embedding Strategy. Baselines and Mask Wa-DWM-D embed watermarks across the entire image, but the unmasked regions are replaced with the original image to localize the watermark. MaskWM-ED embeds watermark bits only within the masked region and similarly restores the unmasked parts, ensuring true region-specific watermarking.
C.2.4 Multi- multi-Watermark Embedding Setup
Figure illustrates the spatial arrangement of the five non-overlapping masked regions used in multi-watermark experiments. These regions are fixed the center, top-left, top-right, bottom- left, and bottom-right of the image, forming a checkerboard-likk. layout when all five are active. Unlike WAM, which allocates 10% of the image area each region, we restrict each region 5%, making the watermark extraction task more challenging. For each configuration (I water- marks), we randomly sample 400 images from the MS-COCO 2014 validation set. During evaluation, we use OpenCV's cv2. connectedComponeet segment the predicted mask into disjoint compo- nents, enabling region-wise watermark extraction and scoring.
Figure 6: Checkerboard-like arrangement of masked regions for multi-watermart embedding. Different colors indicate regions where different watermarks bits embedded, while black re- gions contain no embedded information.
D
More Results
D.1 Effects of Different Visual Quality Enhancement Methods
Our experiments demonstrate that using only an MSE loss in the pixel space to constrain the difference between the watermarked and original images (referred as the Base version) already yields high PSNR and SSIM scores. However, despite the favorable metrics, the resulting images often contain visible artifacts that may compromise perceived visual quality. To address this issue, we investigate several enhancement strategies: (1) incorporating a GAN [9] loss, (2) adding a perceptual constraint via LPIPS [29] loss in the feature space, and (3) modulating the watermark signal using Just Noticeable Difference (JND) [23] module. We conduct experiments on the MaskWM-DD variant, but the findings similarly hold for M-s.WM-EED.
As shown in Figure 7, when the weights of the GAN and LPIPS losses are low, they fail to effectively suppress artifacts. Increasing these weights reduces artifacts but adversely affects the performance
22

---

Base
GAN (0.001)
GAN (0.01)
LLPIPS (0.01)
LPIPS (0.05)
UND
Ros-caal
MMCCH
Witermakeed
Original
Residul
Waternariedd
Original
Residual
Watemarke
Original
Resilus
Watermrrke
Original
Residial
Watermakee
Original
Figure 7: Visualization results of watermark using different visual quality enhancement methods. Zoom in to see more details. The numbers in parentheses indicate the corresponding loss weights. For example, GAN (0.001) means the GAN loss is assigned weight of 0.001 in the total loss function, i.e., Lioaal = Benc Lene + Bace + 0.001 and LPIPS (0.01) indicates that the LPIPS loss weighted by 0.01, i.e., Lene LMSE (Lrm Lorig) + 0.01CLPIPE To ensure fair comparison, we adjust either the strength of the added watermark residual or the JND modulation coefficient to maintain comparable PSNR and SSIM across different settings.
23

---

No Distorton
Veluemetric Distortons
Geometric Distortions
1.00
0.50
0.90
0.50
0.70
0.70
0.70
0.60
011
02
02
64
05
04
07
01
02
00
04
0.5
06
07
08
69
62
02
9.4
65
1.00
1.00
1.00
0.00
0.60
01 02
03
5.4
3.5
08 0.5
61.
02
0.4
59
0.5 3.4
6.5
Water mar.oraroo Area (19)
Watermakked.oo Ario (46)
Watemmared Area (16)
Dame
-GAN [01)
+GAN]5.00)
-LPIPS (D.3))
LLPIS (0.05)
A3D
Figure 8: Local watermark extraction and localization performance of MaskWM-D trained with different visual quality enhancement methods.
of local watermark extraction and localization, illustrated in Figure 8. In contrast, applying JND- based modulation proves more effective: it significantly reduces visible artifacts while maintaining performance comparable to the Base version. These findings suggest that, unlike global perceptual losses such as GAN or LPIPS, JND offers a more adaptive and content-aware modulation strategy. effectively suppresses visual artifacts while preserving the watermark's integrity, making a practical choice for visual quality enhancement.
D.2 Results under Specific Distortions
See Figure 9, Figure 10, Figure 11.
D.3
Scalability to Different Watermark Bit Lengths
See Figure 12.
D.4
Enhancing Robustness against Adaptive Attacks via Fast Fine-tuning
See Figure 13.
D.5
Importance of Localization before Extracting Local Watermarks
See Figure 14.
D.6
Visualization Results of Global and Local Watermark Embedding
See Figure 15.
24

---

JPEG
Gouesinn Filler
Noise
1.00
1.00
1.00
0.50
0.00
0.50
0..00
0.50
0.80
20
70
Wateer mar Area (19)
Watermakeed Area (96)
Watemarrid Area (86)
Papper
1.00
1.00
0.50
0.90
0.50
0.00
0.00
0.80
0.70
0.70
0.70
0.60
0.00
0.60
0.50
0.90
0.50
Wisterarked
Wattemorood Arws (1)
Brighnnes
Hue
0.60
0.60
0.50
0.90
0.50
50
(96)
(%)
Saturation
Rotation
Horizontal Fiip
20
30
40
50
50
10
50
20
30
40
50
70
20
30
20
30
40
50
70
Wister moatee Ares (9))
Viserrmakeed Area (96)
Watremarred Ares (9))
Per spective
1.00
0.60
0.00
0.70
20
40
50
70
10
Water mal and Area (19)
Figure 9: Watermark extraction performance under various specific distortions.
25

---

JPEG
Goussin Filler
Noise
1.00
0.85
0.80
0.80
0.40
20
Water mar Aura (19)
Watermakied Area (96)
Watermaried Area (86)
Papper
1.00
1.00
2.00
0.00
0.40
0.40
0.40
Wathemmriod
Widtrmarked Armn
Wathemarrond Arws (1)
Brightnes
1.00
3.00
0.60
0.50
0.50
0.00
50
(16)
(%)
Saturation
Rotation
Horizonta Flip
0.80
Wasemmrredd
0.60
0.50
0.50
0.80
0.20
10
20
30
40
50
50
10
60
35
20
30
40
50
70
20
20
30
40
50
70
80
50
Wister mea Ares (9))
Wistrrarkedd Area (96)
Watremarved Arms (9))
Per spective
0.00
Masermafidd
0.60
0.20
20
40
50
70
10
Water mal and Avea (19)
Figure 10: Localization performance of the watermarked under various specific distortions.
26

---

JPEG
Gauesinn Filler
Nose
1.00
Unwatemmates
0.25
0.20
20
10
mnstermarkeaa Area (1)
Watermakedd Area (96
Watemarred Area (56)
Pappe
1.00
1.00
3.00
0.50
0.00
0.00
0.80
0.80
0.80
0.70
Uneatemated
0.80
Wlatemmrionn
Widtrmarked Armn
Wathemorrodd (1)
Brightnes
Hue
1.00
1.00
1.00
0.60
0.90
0.90
0.00
0.00
0.00
0.70
0.70
0.70
0.00
0.00
0.00
0.50
0.90
0.60
0.30
30
50
(96)
(%)
Saturation
Rotation
Hor Fiip
0.00
Unsetemaradd.oe
0.75
0.70
0.70
0.60
0.60
0.60
0.50
0.50
0.50
0.40
0.40
0.40
0.30
0.30
0.30
0.20
0.20
10
20
30
40
50
30
10
80
50
35
20
30
40
50
70
20
80
10
20
30
40
50
70
80
Waste monked Ares (9)
Wisteraakeed Area (96)
Watremarred Ares (94)
Per spective
0.60
0.50
0.40
0.30
0.20
20
37
40
50
70
10
Watarmaroon Avea (19)
Figure 11: Localization performance of the unwatermarked area under various specific distortions.
27

---

No Distorton
Veluemetic Distortons
Geometric Distortions
0.80
0.00
0.80
0.70
0.70
0.70
Watermorted
Wistrmakeed Arom
Wattemarrod
MaxDAMO
MaskMRR-
VSM
1.00
0.50
0.00
0.00
0.80
0.80
0.80
0.70
50
Figure 12: Watermark extraction performance of MaskWM-D and Mask with different bits length. We also show the results of WAM for comparison.
7050
1:00
1.0
ManilWee (100m)
TOunt
Figure 13: The effect of VAE fine-tuning the robustness of MaskWM. Fine-tuning the VAE en- hances robustness against VAE attacks, with minimal impact on original robustness performance.
Distortin
Valuemetric
BrAcouncyy
0.75
0.75
0.75
20
40
50
70
23
30
20
20
50
40
50
80
Watermarked Are. (99)
Watermarkedd. Areo (96)
Waltmmaridd Ares, (56)
Figure 14: Watermark extraction performance using different masking strategies during decoding.
D.7
Visualization Results of Localization
See Figure 16, Figure 17, Figure 18, Figure 19.
D.8
Visualization Results of Multiple Watermarks Embedding
See Figure 20.
28

---

Original
Watermarked
Residual
Original
Watermarked
Residual
Mask
Global Watermarking
Local Waterrarkkngg köng
MaskWM-D
MuskWM-ED
Figure 15: Visualization results of global watermark embedding using MaskWM-D and local
watermark embedding using MaskWM-ED. The residual image is acquired by 10 4m Lorig for observation, highlighting the residual more clearly. The same residual visualization strategy applied in the following figures as well.
29

---

Tampered
EdisGarrd-C EditGuard-D
Clean
ON
SP Voine
Original
Resine
Berghines
Contrast
Saturation
Pespective Hetbonntal Rotatoon
Inpainting: man helmet riding a horse next trees.
Figure 16: Visualization results of watermark localization using different methods. The inpainting results are obtained by applying silee--iifiiio--iipaee [17] to the masked regions for content reconstruction.
30

---

Tampered
EdisGardd-C
EditGuard-D
Clean
GF
ON
SP Voine
Original
Resine
Rotation
Perpective Horbonntal
Inpainting: green train going up tracks, lots trees around.
Figure 17: Visualization results of watermark localization using different methods. The inpainting results are obtained by applying stable- mable-diffusion222 2-ripaiion--i [17] to the masked regions for content reconstruction.
31

---

Tampered
Clesn
MF
SP Noise
Original
Resine
Banghtmess
Contrast
Saturation
Rotation
Penppetiiee Herbonntal
Outpainting: cat sitting a small bowl on the table.
Figure 18: Visualization results of watermark localization using different methods. The outpainting results are obtained by applying stable -iffisiio-ff--iiii 2-inpainting [17] to the masked regions for content reconstruction.
32

---

Tampered
EdiGGard-CC EditGuardDD
Clesn
MF
SP Voine
Original
Resine
POT
Saturation
Rotatoon
Perpective Hetbonntl
FOR
Outpainting: group of zebra standing on top of grass covered hillside.
Figure 19: Visualization results of watermark localization using different methods. The outpainting results are obtained by applying stable- soelle-ifffsioon-2211 2-inpainting [17] to the masked regions for content reconstruction.
33

---

Original
Watermarked
Residual
Distected
GT
Pred
Clean
Jpeg
GP
GN
MP
SP Noisz
Resine
Brightnes
Contrntt
Hie
Saturation
Roration
Perspaerivve Horizental Flip
Figure 20: Visualization of multi-watermal embedding and localization results, In the GT column, different colors in the mask indicate different watermark messages.
34


Reviews:
[{"review_id": "6KTworEBeY", "reviewer": "Reviewer_4ngb", "summary": "The authors propose an image watermarking method that allows for localized message embedding and detection. In contrast to the prior work Watermark Anything, which performs binary pixel-level detection and message decoding followed by clustering on decoded messages to localize watermarked regions (meaning localization emerges as a consequence of training for pixel-level detection/decoding), the proposed method is trained to natively perform localization through the use of masks.\n\nTraining:\n\n* After embedding, random masks are applied to limit the watermark to specific image regions while preserving the original image content outside those regions.\n* At detection time, the detector is passed both a masked image containing only the watermarked region (from which it is trained to decode the message) and the entire partially-watermarked image (from which it is trained to predict a localization mask).\n* In the MaskMark-D variant, the embedder is not aware of the mask and thus must learn to embed global information that is still recoverable from (potentially small) masked regions. In the MaskMark-ED variant, the embedder is aware of the mask and thus learns to concentrate watermark information more locally and embed additional information to aid localization.\n\n\nInference:\n\n* The detector first predicts a localization mask; this mask is then applied to the image, which is decoded to obtain the watermark message\n\nThe proposed method outperforms existing post-hoc image watermarking methods, including Watermark Anything, in watermark localization and in accurately extracting local watermark messages under standard image distoritons.", "questions": "* Can the authors more clearly indicate which evaluated image distortions were not seen by the model at training time? This kind of generalizability is important for evaluating the robustness of watermarking methods", "limitations": "Yes.", "rating": 5, "confidence": 4, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": 3, "clarity": 3, "significance": 3, "originality": 2, "strengths_and_weaknesses": "__Strengths__\n\n* The proposed method is an interesting alternative to the localization scheme from Watermark Anything.\n\n* The proposed method performs competitively with or better than many existing post-hoc methods in global embedding (Table 1) and local embedding (Figure 3), especially with small watermarked regions. This does not seem to come with a significant tradeoff in SSIM/PSNR, on which the proposed method outperforms Watermark Anything.\n\n* The proposed method does not require an adversarial discriminator or \"perceptual\" loss for the embedder, just a simple MSE loss. The proposed JND modulation approach appears to effectively mitigate the perceptible artifacts that arise from MSE-only training, as illustrated in Appendix D.\n\n* Overall, the proposed approach seems to present a straightforward improvement over Watermark Anything, which as far as I can tell is considered state of the art for localized image watermarking.\n\n\n__Weaknesses__\n\n* Terminology: I'm not sure that VAE attacks can be considered \"adaptive\". This term was coined for adversarial attacks performed with knowledge of an adversarial defense (https://arxiv.org/abs/2002.08347, NeurIPS 2020). However, the authors here appear to be fine-tuning their watermark against specific VAE attacks and then evaluating on these same attacks, which is the opposite of \"adaptive\" -- the defense is being conducted with specific knowledge of the attack, not the other way around! \"Adaptive\" attacks would leverage specific knowledge of the watermarking method, and could include e.g. adversarial optimization-based attacks against a surrogate or actual detector network.\n\n* The proposed method presumably shares the inherent robustness limitations of existing post-hoc image watermarks, which are vulnerable against generative \"purification\" attacks (https://arxiv.org/abs/2306.01953, NeurIPS 2024). These differ somewhat from the VAE attacks considered by the authors in that they typically perform partial noising/denoising with a diffusion model, and have been shown to be effective in removing both watermarks and other \"imperceptible\" image perturbations (https://arxiv.org/abs/2406.12027). It is discouraging that the authors apparently considered a small number of VAE attacks (with the advantage of fine-tuning) without considering known stronger attacks.\n\n* There is currently another published watermarking method with the name MaskMark [1]. On the one hand, the other work is in the audio domain rather than the image domain. On the other hand, both methods are neural network-based post-hoc watermarks that leverage some form of \"masking,\" end-to-end training, distortion layer, etc. I would strongly recommend a name change.\n\n\n[1] Patrick O’Reilly, Zeyu Jin, Jiaqi Su, and Bryan Pardo. Maskmark: Robust neural watermarking for real and synthetic speech. In International Conference on Acoustics, Speech and Signal Processing (ICASSP), 2024", "was_revised": true, "final_justification": "In their rebuttal, the authors addressed many of the concerns raised in my review. The additional experiments against purification attacks show higher than expected robustness. While it would be nice to see additional experiments with actual \"adaptive\" attacks that leverage knowledge of the specific method, clarifying the terminology is a good step. Overall, I feel that this work will be of interest to researchers working on post-hoc localized watermarking.", "rebuttal": "# Author Response (Reviewer 4ngb)\nDear reviewer, thank you very much for your careful review of our paper and thoughtful comments. We hope the following responses can help address your concerns. \n\n___\n\n**W1:** I'm not sure that VAE attacks can be considered \"adaptive\".\n\n**A1:** Thank you for pointing this out! We agree that our use of the term \"adaptive\" was inappropriate in this context, and we appreciate the opportunity to clarify. \n- What we intended to convey is that users can adapt the model to specific attack scenarios by fine-tuning it with particular distortions included in the distortion layer. In this sense, the model becomes robust to specific attacks through targeted fine-tuning.\n- Therefore, the term \"adaptive\" here refers to the model being fine-tuned to adaptively enhance its robustness against specific attacks, rather than describing the attacks themselves as adaptive. This is a writing issue on our part, we should not have placed \"adaptive\" in front of \"attacks.\"\n- To avoid confusion, we will revise our terminology and replace \"adaptive\" with \"specific\" when referring to this type of robustness enhancement via fine-tuning.\n\n___\n\n**W2:** The proposed method presumably shares the inherent robustness limitations of existing post-hoc image watermarks, which are vulnerable against generative \"purification\" attacks.\n\n**A2:** Thank you for highlighting this important class of attacks. We agree that generative “purification” attacks, such as partial noising/denoising using diffusion models, pose a serious challenge for post-hoc watermarking methods.\n- To address this, we conducted evaluations of both the default and VAE fine-tuned versions of MaskMark-D and MaskMark-ED under such purification attacks. Specifically, we used Stable Diffusion v1.5 with an empty prompt, applied 20 steps of forward noising to the watermarked image, and then performed denoising to generate the purified output.\n- As shown in Table 1, the default model (without fine-tuning) is indeed vulnerable to such generative purification. However, the VAE fine-tuned variant demonstrates strong robustness even against this unseen purification attack, indicating great generalization.\n- We hypothesize that this is due to the underlying similarity between VAE-based regeneration attacks and diffusion-based purification: they both aim to reconstruct the input while removing imperceptible signals. As such, incorporating differentiable VAE corruption during training provides a practical and effective proxy that enhances robustness against a broader class of generative purification attacks.\n\n**Table 1. Watermark extraction accuracy under generative \"purification\" attacks across different watermarked area ratios.**\n|        Model / Watermarked Area (%)       |  1~5  |  5~10 | 10~20 | 20~30 | 30~40 | 40~50 | 50~60 | 60~70 | 70~80 | 80~90 | 90~95 | 95~99 |\n|:------------------:|:-----:|:-----:|:-----:|:-----:|:-----:|:-----:|:-----:|:-----:|:-----:|:-----:|:-----:|:-----:|\n|     MaskMark-D     | 0.507 | 0.528 | 0.566 | 0.602 | 0.627 | 0.637 | 0.667 | 0.671 | 0.685 | 0.689 | 0.695 | 0.715 |\n|  MaskMark-D-VAE-FT | 0.515 | 0.582 |  0.67 | 0.753 | 0.811 | 0.843 | 0.872 | 0.898 | 0.924 | 0.934 | 0.945 | 0.947 |\n|     MaskMark-ED    | 0.542 | 0.606 | 0.639 | 0.658 | 0.652 | 0.661 | 0.653 | 0.644 | 0.625 | 0.610 | 0.599 | 0.581 |\n| MaskMark-ED-VAE-FT | 0.616 | 0.750 | 0.838 | 0.905 | 0.928 | 0.945 | 0.947 | 0.960 | 0.969 | 0.967 | 0.974 | 0.976 |\n\n___\n\n**W3:** I would strongly recommend a name change.\n\n**A3:** Thank you for your great suggestion! We were not aware of the name overlap with the audio watermarking method. We appreciate your suggestion and will revise the name in the next revision or the camera-ready version to avoid confusion.\n\n___\n\n**Q1:** Can the authors more clearly indicate which evaluated image distortions were not seen by the model at training time?\n\n**A1:** Thank you for highlighting this important aspect of robustness evaluation. We agree that assessing generalizability to unseen distortions is critical for a thorough understanding of a watermarking method’s reliability.\n- We list in Table 2 and Table 3 the distortion types that were not seen during training, along with their corresponding results, as originally reported in the main paper.\n- To further address your concern, we conducted additional evaluations (Table 4 and Table 5), where we increased the intensity of certain test-time distortions beyond the levels seen during training. Although these distortions are of the same types, their extreme variants were never encountered by the model, and thus can be considered unseen in a broader sense.\n- Across both types of evaluation, MaskMark demonstrates strong robustness, indicating its generalizability to distortions beyond those encountered during training.\n\n**Table 2. Watermark extraction accuracy of MaskMark-D under distortions not seen during the training stage across different watermarked area ratios.**\n|       Distortions / Watermarked Area (%)       |  1~5  |  5~10 | 10~20 | 20~30 | 30~40 | 40~50 | 50~60 | 60~70 | 70~80 | 80~90 | 90~95 | 95~99 |\n|:-----------------------:|:-----:|:-----:|:-----:|:-----:|:-----:|:-----:|:-----:|:-----:|:-----:|:-----:|:-----:|:-----:|\n|      Resize   (0.5)     | 0.907 | 0.991 | 0.999 | 1.000 | 1.000 | 1.000 | 1.000 | 1.000 | 1.000 | 1.000 | 1.000 | 1.000 |\n| Brightness ([0.7, 1.3]) | 0.896 | 0.989 | 0.999 | 1.000 | 1.000 | 1.000 | 1.000 | 1.000 | 1.000 | 1.000 | 1.000 | 1.000 |\n|  Contrast ([0.7, 1.3])  | 0.905 | 0.991 | 0.999 | 1.000 | 1.000 | 1.000 | 1.000 | 1.000 | 1.000 | 1.000 | 1.000 | 1.000 |\n|    Hue ([-0.1, 0.1])    | 0.821 | 0.950 | 0.987 | 0.999 | 0.998 | 0.999 | 0.999 | 0.999 | 0.999 | 0.999 | 1.000 | 1.000 |\n| Saturation ([0.7, 1.3]) | 0.897 | 0.988 | 0.999 | 1.000 | 1.000 | 1.000 | 1.000 | 1.000 | 1.000 | 1.000 | 1.000 | 1.000 |\n\n**Table 3. Watermark extraction accuracy of MaskMark-ED under distortions not seen during the training stage across different watermarked area ratios.**\n|       Distortions / Watermarked Area (%)       |  1~5  |  5~10 | 10~20 | 20~30 | 30~40 | 40~50 | 50~60 | 60~70 | 70~80 | 80~90 | 90~95 | 95~99 |\n|:-----------------------:|:-----:|:-----:|:-----:|:-----:|:-----:|:-----:|:-----:|:-----:|:-----:|:-----:|:-----:|:-----:|\n|      Resize   (0.5)     | 0.947 | 0.997 | 0.999 | 1.000 | 1.000 | 1.000 | 1.000 | 1.000 | 1.000 | 1.000 | 1.000 | 1.000 |\n| Brightness ([0.7, 1.3]) | 0.943 | 0.997 | 0.999 | 1.000 | 1.000 | 1.000 | 1.000 | 1.000 | 1.000 | 1.000 | 1.000 | 1.000 |\n|  Contrast ([0.7, 1.3])  | 0.947 | 0.997 | 1.000 | 1.000 | 1.000 | 1.000 | 1.000 | 1.000 | 1.000 | 1.000 | 1.000 | 1.000 |\n|    Hue ([-0.1, 0.1])    | 0.894 | 0.983 | 0.996 | 0.999 | 0.999 | 0.999 | 0.999 | 0.999 | 0.999 | 0.997 | 0.999 | 0.997 |\n| Saturation ([0.7, 1.3]) | 0.942 | 0.996 | 0.999 | 1.000 | 1.000 | 1.000 | 1.000 | 1.000 | 1.000 | 1.000 | 1.000 | 1.000 |\n\n**Table 4. Watermark extraction accuracy of MaskMark-D under stronger-than-training distortions across different watermarked area ratios.**\n|        Distortions / Watermarked Area (%)       |  1~5  |  5~10 | 10~20 | 20~30 | 30~40 | 40~50 | 50~60 | 60~70 | 70~80 | 80~90 | 90~95 | 95~99 |\n|:------------------------:|:-----:|:-----:|:-----:|:-----:|:-----:|:-----:|:-----:|:-----:|:-----:|:-----:|:-----:|:-----:|\n|        JPEG   (40)       | 0.631 | 0.779 | 0.870 | 0.919 | 0.955 | 0.970 | 0.979 | 0.985 | 0.989 | 0.991 | 0.993 | 0.995 |\n|  Gaussian Filter (2, 7)  | 0.895 | 0.988 | 0.999 | 1.000 | 1.000 | 1.000 | 1.000 | 1.000 | 1.000 | 1.000 | 1.000 | 1.000 |\n| Gaussian Noise (0, 0.13) | 0.787 | 0.941 | 0.990 | 0.998 | 0.999 | 1.000 | 1.000 | 1.000 | 1.000 | 1.000 | 1.000 | 1.000 |\n|     Median Filter (7)    | 0.871 | 0.982 | 0.998 | 0.999 | 1.000 | 1.000 | 1.000 | 1.000 | 1.000 | 1.000 | 1.000 | 1.000 |\n| Salt&Pepper Noise (0.13) | 0.549 | 0.639 | 0.785 | 0.893 | 0.950 | 0.976 | 0.990 | 0.995 | 0.997 | 0.998 | 0.999 | 0.999 |\n|  Rotation ([-100, 100])  | 0.543 | 0.603 | 0.680 | 0.754 | 0.801 | 0.837 | 0.868 | 0.904 | 0.929 | 0.944 | 0.942 | 0.949 |\n| Perspective ([0.1, 0.6]) | 0.590 | 0.667 | 0.742 | 0.807 | 0.849 | 0.881 | 0.903 | 0.937 | 0.948 | 0.959 | 0.965 | 0.975 |\n\n**Table 5. Watermark extraction accuracy of MaskMark-ED under stronger-than-training distortions across different watermarked area ratios.**\n|        Distortions / Watermarked Area (%)       |  1~5  |  5~10 | 10~20 | 20~30 | 30~40 | 40~50 | 50~60 | 60~70 | 70~80 | 80~90 | 90~95 | 95~99 |\n|:------------------------:|:-----:|:-----:|:-----:|:-----:|:-----:|:-----:|:-----:|:-----:|:-----:|:-----:|:-----:|:-----:|\n|        JPEG   (40)       | 0.842 | 0.962 | 0.990 | 0.997 | 0.998 | 0.999 | 0.999 | 0.999 | 0.999 | 0.999 | 0.999 | 0.999 |\n|  Gaussian Filter (2, 7)  | 0.943 | 0.996 | 0.999 | 1.000 | 1.000 | 1.000 | 1.000 | 1.000 | 1.000 | 1.000 | 1.000 | 1.000 |\n| Gaussian Noise (0, 0.13) | 0.905 | 0.988 | 0.999 | 1.000 | 1.000 | 1.000 | 1.000 | 1.000 | 1.000 | 1.000 | 1.000 | 1.000 |\n|     Median Filter (7)    | 0.925 | 0.994 | 0.999 | 1.000 | 1.000 | 1.000 | 1.000 | 1.000 | 1.000 | 1.000 | 1.000 | 1.000 |\n| Salt&Pepper Noise (0.13) | 0.680 | 0.864 | 0.954 | 0.985 | 0.993 | 0.996 | 0.998 | 0.998 | 0.998 | 0.999 | 0.999 | 0.999 |\n|  Rotation ([-100, 100])  | 0.564 | 0.643 | 0.720 | 0.792 | 0.837 | 0.882 | 0.909 | 0.928 | 0.943 | 0.947 | 0.965 | 0.965 |\n| Perspective ([0.1, 0.6]) | 0.643 | 0.741 | 0.807 | 0.875 | 0.913 | 0.931 | 0.946 | 0.960 | 0.968 | 0.967 | 0.973 | 0.975 |"}, {"review_id": "uDy2B7kb1J", "reviewer": "Reviewer_Umwi", "summary": "The paper introduces MaskMark, a novel framework for image watermarking, designed to address limitations in existing methods. MaskMark offers two variants:\n\n- MaskMark-D: This variant supports global watermark embedding, watermark localization (identifying where the watermark is present), and local watermark extraction. It achieves this by incorporating a simple masking mechanism during the decoding stage. During training, the decoder learns to localize and extract watermarks from specific regions based on various applied masks. MaskMark-D is particularly useful for applications like tamper detection.\n\n- MaskMark-ED: This variant extends MaskMark-D by integrating the masking mechanism into both the encoding and decoding stages. This enables local watermark embedding and extraction, which significantly enhances robustness against regional attacks by guiding the encoder to embed the watermark in designated local regions.\n\nMaskMark operates within the classical training paradigm of image watermarking. Through extensive experimentation, the authors demonstrate that MaskMark achieves state-of-the-art performance in global and local watermark extraction, watermark localization, and multi-watermark embedding. Notably, it outperforms leading existing baselines, including WAM (Watermark Anything Model). The framework also boasts high computational efficiency, being 15 times faster to train than WAM, and offers flexibility as its robustness can be fine-tuned by simply adjusting the distortion layer.", "questions": "- Clarify what part of the method was taken from WAM, what is novel. JND and the Lama masks come from WAM too right?\n- What does \"4. Lack of native local embedding: WAM embeds watermarks globally and then crops for local focus,\nintroducing embedding losses that reduce extraction robustness.\" mean?\n- Is the method robust to moving a watermarked object inside the image or changing its proportions? WAM is.", "limitations": "yes", "rating": 5, "confidence": 4, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": 3, "clarity": 3, "significance": 3, "originality": 2, "strengths_and_weaknesses": "Strengths\n\n- State-of-the-Art Performance: MaskMark achieves superior performance in various watermarking tasks. It specifically outperforms strong baselines like WAM in local watermarking scenarios.\n\n- High Computational Efficiency: training time significantly lower (15x faster) than that of WAM, and has fewer parameters\n\nWeaknesses\n\n- Limited Novelty: The idea is very similar to that of Watermark Anything in terms of goal, but also in terms of approach. For instance, the authors use the masks from Lama similarly to what is done in WAM. Overall it appears like a WAM+, but with limited novelty, or at least not highlighted enough.", "was_revised": true, "final_justification": "see rebuttal", "rebuttal": "# Author Response (Reviewer Umwi)\nDear Reviewer, thank you very much for your careful review of our paper and thoughtful comments. We hope the following responses can help clarify potential misunderstandings and alleviate your concerns.\n\n___\n\n**W1&Q1:** The idea is very similar to that of Watermark Anything in terms of goal, but also in terms of approach. Clarify what part of the method was taken from WAM, what is novel.\n\n**A:** We appreciate your concerns and the opportunity to clarify the novelty and positioning of our method relative to WAM.\n\nIt is true that the only components we share with WAM are the JND module and the use of LaMa masks.\n- These choices were indeed inspired by WAM; however, they are neither core components nor novel contributions of either method.\n- Both are long-standing tools commonly used in image editing [1][2][3] and watermarking research [4][5][6], and we incorporated them purely as standard building blocks.\n\nOur key contributions go well beyond these shared elements, in both functionality and architectural design:\n\n- **Native Local Watermark Embedding: A Functional Innovation.**\n    - Unlike WAM, which lacks native support for local watermark embedding, MaskMark is specifically designed for this functionality. While WAM embeds a global watermark and then applies post-hoc cropping to simulate local watermark embedding (which introduces signal loss and robustness issues), MaskMark embeds the watermark directly into designated regions by conditioning encoder on a spatial mask. This results in **improved robustness and precise regional protection**.\n- **Fundamental Differences in Core Design Philosophy.**\n    - The core idea of WAM is to **treat watermark extraction as a pixel-wise semantic segmentation problem**. Each pixel independently carries bits of the watermark, which are later averaged during inference. This creates several challenges:\n        - Extracting meaningful information from individual pixels is inherently difficult, leading to **slow convergence, high training complexity, and limited capacity for longer watermark messages** (as noted in the WAM paper).\n        - The final extraction relies on a **non-trainable and naive** voting/averaging mechanism across pixels, which cannot be optimized end-to-end and performs poorly when the watermarked region is small or per-pixel accuracy is low.\n    - In contrast, MaskMark is fundamentally built around **spatially-aware encoding and decoding**. The encoder and decoder are both guided by a spatial mask, enabling the system to:\n        - Embed and extract information across multiple pixels within a localized region, which **lowers training difficulty and allows extension to longer messages**.\n        - Train all components end-to-end, including both mask prediction and region-wise watermark embedding/extraction, avoiding WAM’s reliance on non-trainable inference heuristics. This leads to **improved robustness in local watermark extraction**.\n\nIn summary, while we acknowledge WAM as an important prior work, MaskMark introduces a functionally novel capability (native local embedding) and is built upon a substantially different architectural philosophy. These distinctions are crucial for achieving improved efficiency and robustness.\n\n**References**\n1. Instructdiffusion: A generalist modeling interface for vision tasks. CVPR, 2024.\n2. Paint by example: Exemplar-based image editing with diffusion models. CVPR, 2023.\n3. Inpaint anything: Segment anything meets image inpainting. Arxiv, 2023.\n4. Color image watermarking based on orientation diversity and color complexity. Expert Systems with Applications, 2020.\n5. Pattern complexity-based JND estimation for quantization watermarking. Pattern Recognition Letters, 2020.\n6. Towards perceptual image watermarking with robust texture measurement. Expert Systems with Applications, 2023. \n\n___\n\n**Q2:** What does \"4. Lack of native local embedding: WAM embeds watermarks globally and then crops for local focus, introducing embedding losses that reduce extraction robustness.\" mean?\n\n**A2:** Thank you for the question. This comment refers to a limitation of WAM in supporting localized watermark embedding.\n- WAM performs watermark embedding over the entire image globally. To simulate a local watermark, WAM must embed a global watermark first and then crop the image to retain only the protected region. The remaining (unprotected) regions are replaced post hoc with the corresponding clean (non-watermarked) content from the original image.\n- This process inherently causes the loss of watermark signal in cropped-out regions and creates inconsistencies at the region boundaries, which ultimately reduces the robustness and reliability of watermark extraction.\n\n___\n\n**Q3:** Is the method robust to moving a watermarked object inside the image or changing its proportions?\n\n**A3:** Thank you for raising this interesting and challenging attack scenario that combines both valuemetric and geometric distortions, namely, the MoveAndResize attack.\n- We have evaluated this setting as follows: a watermarked region (as defined by the segment mask) is cropped and resized using a random scale factor sampled from the range (0.5, 1.2). This resized patch is then pasted onto a different, non-watermarked image, and watermark extraction is performed on the composite.\n- Evaluation results for MaskMark-D, MaskMark-ED, and WAM under this setting are shown in Table 1 below.\n    - We observe that when the watermarked region is small, the default version of MaskMark may underperform. However, as the region size increases, MaskMark consistently outperforms WAM.\n    - By incorporating the MoveAndResize distortion into the training pipeline and fine-tuning the model for just 50k steps, we achieved significant improvements in robustness (see the FT version in Table 1). In this adapted setting, MaskMark surpasses WAM across all region sizes.\n    - WAM appears to suffer from a performance bottleneck when dealing with large watermarked regions. This is due to limited performance of its mask prediction, which hinders complete and precise recovery of the watermarked region for extraction. In contrast, MaskMark does not exhibit this issue.\n\n**Table 1. Watermark extraction accuracy under the MoveAndResize attack across different watermarked area ratios.**\n|      Model / Watermarked Area (%)     |  1~5  |  5~10 | 10~20 | 20~30 | 30~40 | 40~50 | 50~60 | 60~70 | 70~80 | 80~90 | 90~95 | 95~99 |\n|:--------------:|:-----:|:-----:|:-----:|:-----:|:-----:|:-----:|:-----:|:-----:|:-----:|:-----:|:-----:|:-----:|\n|       WAM      | 0.541 | 0.601 | 0.677 | 0.722 | 0.743 | 0.770 | 0.762 | 0.744 | 0.791 | 0.751 | 0.758 | 0.760 |\n|   MaskMark-D   | 0.519 | 0.533 | 0.584 | 0.652 | 0.675 | 0.723 | 0.775 | 0.769 | 0.834 | 0.824 | 0.852 | 0.854 |\n|  MaskMark-D-FT | 0.551 | 0.627 | 0.742 | 0.848 | 0.895 | 0.945 | 0.973 | 0.980 | 0.989 | 0.996 | 0.996 | 0.998 |\n|   MaskMark-ED  | 0.523 | 0.549 | 0.613 | 0.677 | 0.700 | 0.769 | 0.803 | 0.809 | 0.860 | 0.849 | 0.857 | 0.870 |\n| MaskMark-ED-FT | 0.662 | 0.787 | 0.896 | 0.960 | 0.977 | 0.992 | 0.996 | 0.998 | 0.999 | 0.999 | 0.999 | 1.000 |"}, {"review_id": "Vqnc3tcUag", "reviewer": "Reviewer_oDY7", "summary": "This paper introduces MaskMark, a simple and efficient framework for image watermarking that supports both global and local watermark embedding, localization, and extraction through two variants: MaskMark-D and MaskMark-ED. It achieves state-of-the-art performance while being significantly faster than prior methods like WAM, and can be easily adapted to different robustness requirements.", "questions": "1. Following weakness 1.  Can the author provide ablation studies for investigating the functionality of different model components? \n2. Similar to HiDDeN and other classical image watermarking methods, WAM learns a residual map and embeds it into the cover image at the pixel level, while MaskMark concatenates the watermark feature map with the cover image in the channel dimension. Is this concatenation a key design to ensure better performance for MaskMark?\n3. Following weakness 2. Can the authors provide theoretical analysis or insights on why the proposed method can achieve better performance than the selected baselines?\n4. WAM achieves multiple watermarks since the ViT decoder is a per-pixel-based message decoder, which can decode multiple watermarks simultaneously. Regarding MaskMark message decoder is one-dimensional bit-stream decoding. How can MaskMark achieve multiple watermarks under such settings?", "limitations": "yes", "rating": 5, "confidence": 5, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": 3, "clarity": 3, "significance": 3, "originality": 3, "strengths_and_weaknesses": "Strengths:\n1. MaskMark achieves state-of-the-art performance in global and local watermark extraction, watermark localization, and multi-watermark embedding.\n2. MaskMark provides two variants: MaskMark-D and MaskMark-ED for robustness. Both methods can support up to 128-bit message embedding.\n3. The training of MaskMark is efficient to finish within one day, outperforming existing baselines such as WAM.\n4. The paper is well-written and easy to follow, with a clear model architecture and training process, which helps facilitate reproducibility.\n\nWeakness:\n1. There is a lack of ablation studies, which limits the ability to identify the components for enhancing the model's performance.\n2. There is a lack of theoretical analysis of why the proposed MaskMark method can outperform the existing localized watermarking baselines such as WAM and Editguard.", "was_revised": true, "final_justification": "The replies solve my concerns. Though there is no deeper theoretical analysis, the empirical results are very solid and are enough to explain the good performance. So I decided to maintain my rating.", "rebuttal": "# Author Response (Reviewer oDY7)\nDear Reviewer, thank you very much for your careful review of our paper and thoughtful comments. We hope the following responses can help address your concerns.\n\n___\n\n**W1&Q1:** Can the author provide ablation studies for investigating the functionality of different model components?\n\n**A:** Thank you for your great suggestion. We agree that ablation studies are important for understanding which components contribute to performance. In our case, MaskMark intentionally builds upon standard architectural components widely used in image watermarking. Specifically:\n- **Encoder: CNN + U-Net + JND.**\n    - The CNN + U-Net combination is a classical structure for watermark embedding [1][2][3][4] and we did not introduce any novel architectural modifications or attempt alternative variants here.\n    - The JND module, adopted from WAM, is used solely to enhance the visual quality of the watermarked image. We provide an ablation study on the effect of the JND module in Appendix D.1.\n- **Decoder: CNN + U-Net + $\\text{U}^2$-Net.**\n    - Similarly, the CNN + U-Net stack is also a standard structure used for watermark extraction [1][4].\n    - The only additional component is a lightweight $\\text{U}^2$-Net used for mask prediction. We explored different configurations, including varying the size of $\\text{U}^2$-Net and replacing it with a larger U-Net, but observed minimal impact on performance. As such, we selected the small variant of $\\text{U}^2$-Net for efficiency, which proved to be sufficiently effective.\n\nOverall, MaskMark’s strength lies not in the specific architectural choices, but in the mask mechanism itself. Because it is independent of the underlying backbone architecture, MaskMark remains flexible and easily transferable to other model designs.\n\n**References**\n1. Sepmark: Deep separable watermarking for unified source tracing and deepfake detection. ACM MM, 2023.\n2. Robust-wide: Robust watermarking against instruction-driven image editing. ECCV, 2024.\n3. Trustmark: Universal watermarking for arbitrary resolution images. Arxiv, 2023.\n4. Editguard: Versatile image watermarking for tamper localization and copyright protection. CVPR, 2024.\n\n___\n\n**Q2:** Similar to HiDDeN and other classical image watermarking methods, WAM learns a residual map and embeds it into the cover image at the pixel level, while MaskMark concatenates the watermark feature map with the cover image in the channel dimension. Is this concatenation a key design to ensure better performance for MaskMark?\n\n**A2:** Thank you for this insightful observation. We would like to clarify that both the **residual map embedding** and the **channel-wise concatenation** you mentioned are standard practices in neural network-based image watermarking methods (including ours), and occur at different stages of the watermark embedding process. **Therefore, the channel-wise concatenation is not a key design choice unique to MaskMark, nor is it the main reason for its performance gains.**\n- **Residual map embedding** typically occurs after fusing the watermark information with the cover image to generate the encoded image, and **serves as the final step in producing the watermarked image**.\n    - Specifically, once the encoder outputs an encoded image, the residual map is computed as:\n$$I_\\text{res} = I_\\text{enc} − I_\\text{cover},$$\nwhere $I_\\text{res}$ is the residual map, $I_\\text{enc}$ is the encoded image and $I_\\text{cover}$ is the cover image.\nThen, the final watermarked image is produced by:\n$$I_\\text{wm} = I_\\text{cover} + \\alpha \\times I_\\text{res}.$$\nwhere $I_\\text{wm}$ is the watermarked image and $\\alpha$ is a tunable strength factor balancing robustness and visual quality.\n    - This operation actually takes place inside the JND module in Figure 1 of the paper, rather than during the initial concatenation of $𝑓$. The residual map is further modulated by JND and then multiplied by the JND coefficient before being embedded into the cover image to produce the final watermarked image.\n- **Channel-wise concatenation**, on the other hand, **occurs at the early stage of the watermark encoder, before fusion begins**.\n    - Specifically, watermark information (either in the form of a repeated message map or an extracted feature map) is concatenated with the cover image or its intermediate features along the channel dimension.\n    - This fused tensor is then passed through the encoder (e.g., a U-Net) to produce the encoded image. This strategy is widely used in prior works such as HiDDeN, MBRS, and even WAM itself, and is **not a key design innovation of MaskMark**.\n\n___\n\n**W2&Q3:** Can the authors provide theoretical analysis or insights on why the proposed method can achieve better performance than the selected baselines?\n\n**A:** Thank you for the insightful question. While our paper focuses on empirical results, we provide here a conceptual and architectural analysis of why MaskMark achieves superior performance compared to prior baselines across three categories: global watermarking, localized watermarking, and watermark localization methods.\n\n- **Compared to Global Watermarking Methods (e.g., StegaStamp, TrustMark).**\n    - Global watermarking methods are not designed to support localized watermark extraction, which is discussed in Lines 134–140 of the paper.\n- **Compared to WAM (Localized Watermarking Method).**\n    - The core idea of WAM is to **treat watermark extraction as a pixel-wise semantic segmentation problem**. Each pixel independently carries bits of the watermark, which are later averaged during inference. This creates several challenges:\n        - Extracting meaningful information from individual pixels is inherently difficult, leading to slow convergence, high training complexity, and limited capacity for longer watermark messages (as noted in the WAM paper).\n        - The final extraction relies on a **non-trainable and naive** voting/averaging mechanism across pixels, which cannot be optimized end-to-end and performs poorly when the watermarked region is small or per-pixel accuracy is low.\n    - In contrast, MaskMark is fundamentally built around spatially-aware encoding and decoding. The encoder and decoder are both guided by a spatial mask, enabling the system to:\n        - Embed and extract information across multiple pixels within a localized region, which **lowers training difficulty and allows extension to longer messages**.\n        - Train all components end-to-end, including both mask prediction and region-wise watermark embedding/extraction, avoiding WAM’s reliance on non-trainable inference heuristics. This leads to **improved robustness in local watermark extraction**\n- **Compared to EditGuard (Watermark Localization Method).**\n    - EditGuard embeds two separate types of signals: a 1D copyright watermark and a 2D fragile localization watermark to achieve watermark localization. This dual embedding comes with trade-offs:\n        - The addition of a second watermark signal increases visual distortion and complexity.\n        - Ensuring robustness of both the copyright and localization watermarks simultaneously is difficult and may involve conflicting optimization objectives, limiting the achievable performance.\n    - The watermark localized by MaskMark serves as a copyright watermark, which allows robustness and traceability to be ensured simultaneously. This leads to a higher potential performance upper bound and minimal impact on visual quality.\n\n___\n\n**Q4:** WAM achieves multiple watermarks since the ViT decoder is a per-pixel-based message decoder, which can decode multiple watermarks simultaneously. Regarding MaskMark message decoder is one-dimensional bit-stream decoding. How can MaskMark achieve multiple watermarks under such settings?\n\n**A4:** Thank you for your question. While WAM uses a per-pixel ViT decoder to directly extract multiple watermarks, our approach handles multi-watermark decoding differently but effectively.\n- As detailed in Appendix C.2.4, MaskMark predicts a mask containing multiple spatially disjoint regions in a single forward pass. We then use OpenCV’s *cv2.connectedComponents* to segment this predicted mask into separate connected components, each corresponding to a distinct embedded watermark. Each segmented region is then processed independently by our one-dimensional bitstream decoder to extract its associated watermark message. This design enables MaskMark to support multiple watermarks simultaneously despite using a 1D decoder."}, {"review_id": "sYSOiRm1vN", "reviewer": "Reviewer_E8Tv", "summary": "This submission presents a still image watermarking technique that is able to localize regions containing a watermark signal and decode the hidden message. There are two variants: 1. Embedding the watermark over the whole image. 2. Embedding the watermark in critical regions of the image. As a side product, the method is able to retrieve up to 5 different watermarks inside one image.", "questions": "- What explains the better performances (w.r.t. to all metrics - complexity, robustness, message lengths) compared to WAM?\n\n- The editing processes included in the augmentation layer are stronger than the attacks considered for benchmarking robustness. Why? Although I agree that one does not need extreme robustness, I am wondering about the robustness limits of the proposed method. It would be a good idea to consider another setting with stronger attacks.", "limitations": "One limitation is that the watermark is visible. However, I am a watermark professional trained to spot these kinds of artefacts (without pretending to be a golden eye). This technique is typically not suitable when watermarking artworks (museum high definition scans, Hollywood movies etc).\n\nThe authors mention this limitation in App. A.\n(BTW: 39dB is **not** a \"*relatively high PSNR*\", line 450)\n\nAnother limitation concerns reproducibility. The authors claim that \"*information is sufficient to reproduce the main experimental results and verify the paper’s core claims, even without access to the code or data*\". I have my doubts. The architecture is not detailed enough.\nI acknowledge that the authors are willing to provide the code if accepted.", "rating": 6, "confidence": 5, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": 4, "clarity": 4, "significance": 4, "originality": 4, "strengths_and_weaknesses": "# Strengths\n\n- S1. Very well written\n- S2. Awesome performances\n- S3. Beat WAM\n\n# Weakness\n\n- W1. Lack of detail about decoding multiple watermarks in one image. WAM has a specific procedure for this scenario, i.e. the DBSCAN clustering. The submission does not say anything.\n- W2. A section detailing the main difference with WAM (architecture, training procedure...). At some point, it looks like too good to be true.", "was_revised": true, "final_justification": "Thanks for the authors' clear reply. I have no more concerns. I am even more confident with keeping my score.", "rebuttal": "# Author Response (Reviewer E8Tv)\nDear Reviewer, thank you very much for your careful review of our paper and thoughtful comments. We hope the following responses can help address your concerns.\n\n___\n\n**W1:** Lack of detail about decoding multiple watermarks in one image.\n\n**A1:** We appreciate your feedback. As described in Appendix C.2.4, MaskMark handles multiple watermarks by first predicting a segmentation mask that may contain multiple disjoint regions. To separate these, we apply OpenCV’s *cv2.connectedComponents*, which identifies and isolates each connected region. Each region is then decoded independently using the watermark decoder. This region-wise decoding approach parallels WAM's use of DBSCAN in purpose, although our segmentation-based method avoids the need for additional clustering.\n\n___\n\n**W2&Q1:** A section detailing the main difference with WAM (architecture, training procedure...). What explains the better performances (w.r.t. to all metrics - complexity, robustness, message lengths) compared to WAM?\n\n**A:** Thank you for the suggestion. Below we summarize the main differences between MaskMark and WAM in terms of core design principles, model architecture, and training procedures, and explain why these differences lead to better performance across complexity, robustness, and message length.\n\n- **Core Design Principles.**\n    - The core idea of WAM is to **treat watermark extraction as a pixel-wise semantic segmentation problem**. Each pixel independently carries bits of the watermark, which are later averaged during inference. This creates several challenges:\n        - Extracting meaningful information from individual pixels is inherently difficult, leading to **slow convergence, high training complexity, and limited capacity for longer watermark messages** (as noted in the WAM paper).\n        - The final extraction relies on a **non-trainable and naive** voting/averaging mechanism across pixels, which cannot be optimized end-to-end and performs poorly when the watermarked region is small or per-pixel accuracy is low.\n    - In contrast, MaskMark is fundamentally built around spatially-aware encoding and decoding. The encoder and decoder are both guided by a spatial mask, enabling the system to:\n        - Embed and extract information across multiple pixels within a localized region, which **lowers training difficulty and allows extension to longer messages**.\n        - Train all components end-to-end, including both mask prediction and region-wise watermark embedding/extraction, avoiding WAM’s reliance on non-trainable inference heuristics. This leads to **improved robustness in local watermark extraction**\n- **Model Architecture.**\n    - The WAM architecture is heavily weighted toward the decoder, as its main challenge lies in extracting bits from individual pixels. It uses a VQGAN-based encoder and a ViT-Base decoder, resulting in a highly asymmetric and heavy design.\n    - MaskMark adopts the classical symmetric design commonly used in prior watermarking literature. Both the encoder and decoder use U-Net backbones, resulting in a lightweight and balanced architecture. Importantly:\n        - Unlike WAM, MaskMark decouples bit extraction and mask prediction. A lightweight $\\text{U}^2$-Net is added in parallel to the decoder as a dedicated mask predictor, which improves optimization stability and convergence.\n        - This design is **backbone-agnostic** and highly flexible — MaskMark can easily adapt to different base architectures or be scaled up/down depending on the use case.\n- **Training Procedure.**\n    - WAM employs a **two-stage** training scheme: the first stage optimizes watermark extraction, while the second stage aims to improve the visual quality of the watermarked image. This is necessary because pixel-level bit decoding is extremely hard, and **optimizing both objectives simultaneously in the first stage can cause conflicts**. However, this adds substantial training overhead.\n    - MaskMark uses a **single-stage** training pipeline, similar to traditional watermarking methods. Both watermark extraction accuracy and visual quality are optimized jointly from the start. This leads to: **simplified training, faster convergence, and lower computational cost**.\n\n___\n\n**Q2:** It would be a good idea to consider another setting with stronger attacks.\n\n**A2:** We appreciate your suggestion to consider a setting with stronger attacks.\n- In response, we increased the distortion strength beyond what the model was exposed to during training and conducted evaluation under these more challenging conditions.\n- As shown in Table 1 and Table 2, MaskMark consistently maintains strong extraction accuracy under these stronger attacks. This demonstrates the generalizability and robustness of our method, even when facing distortions that exceed the training distribution.\n\n**Table 1. Watermark extraction accuracy of MaskMark-D under stronger-than-training distortions across different watermarked area ratios.**\n|        Distortions / Watermarked Area (%)       |  1~5  |  5~10 | 10~20 | 20~30 | 30~40 | 40~50 | 50~60 | 60~70 | 70~80 | 80~90 | 90~95 | 95~99 |\n|:------------------------:|:-----:|:-----:|:-----:|:-----:|:-----:|:-----:|:-----:|:-----:|:-----:|:-----:|:-----:|:-----:|\n|        JPEG   (40)       | 0.631 | 0.779 | 0.870 | 0.919 | 0.955 | 0.970 | 0.979 | 0.985 | 0.989 | 0.991 | 0.993 | 0.995 |\n|  Gaussian Filter (2, 7)  | 0.895 | 0.988 | 0.999 | 1.000 | 1.000 | 1.000 | 1.000 | 1.000 | 1.000 | 1.000 | 1.000 | 1.000 |\n| Gaussian Noise (0, 0.13) | 0.787 | 0.941 | 0.990 | 0.998 | 0.999 | 1.000 | 1.000 | 1.000 | 1.000 | 1.000 | 1.000 | 1.000 |\n|     Median Filter (7)    | 0.871 | 0.982 | 0.998 | 0.999 | 1.000 | 1.000 | 1.000 | 1.000 | 1.000 | 1.000 | 1.000 | 1.000 |\n| Salt&Pepper Noise (0.13) | 0.549 | 0.639 | 0.785 | 0.893 | 0.950 | 0.976 | 0.990 | 0.995 | 0.997 | 0.998 | 0.999 | 0.999 |\n|  Rotation ([-100, 100])  | 0.543 | 0.603 | 0.680 | 0.754 | 0.801 | 0.837 | 0.868 | 0.904 | 0.929 | 0.944 | 0.942 | 0.949 |\n| Perspective ([0.1, 0.6]) | 0.590 | 0.667 | 0.742 | 0.807 | 0.849 | 0.881 | 0.903 | 0.937 | 0.948 | 0.959 | 0.965 | 0.975 |\n\n**Table 2. Watermark extraction accuracy of MaskMark-ED under stronger-than-training distortions across different watermarked area ratios.**\n|        Distortions / Watermarked Area (%)       |  1~5  |  5~10 | 10~20 | 20~30 | 30~40 | 40~50 | 50~60 | 60~70 | 70~80 | 80~90 | 90~95 | 95~99 |\n|:------------------------:|:-----:|:-----:|:-----:|:-----:|:-----:|:-----:|:-----:|:-----:|:-----:|:-----:|:-----:|:-----:|\n|        JPEG   (40)       | 0.842 | 0.962 | 0.990 | 0.997 | 0.998 | 0.999 | 0.999 | 0.999 | 0.999 | 0.999 | 0.999 | 0.999 |\n|  Gaussian Filter (2, 7)  | 0.943 | 0.996 | 0.999 | 1.000 | 1.000 | 1.000 | 1.000 | 1.000 | 1.000 | 1.000 | 1.000 | 1.000 |\n| Gaussian Noise (0, 0.13) | 0.905 | 0.988 | 0.999 | 1.000 | 1.000 | 1.000 | 1.000 | 1.000 | 1.000 | 1.000 | 1.000 | 1.000 |\n|     Median Filter (7)    | 0.925 | 0.994 | 0.999 | 1.000 | 1.000 | 1.000 | 1.000 | 1.000 | 1.000 | 1.000 | 1.000 | 1.000 |\n| Salt&Pepper Noise (0.13) | 0.680 | 0.864 | 0.954 | 0.985 | 0.993 | 0.996 | 0.998 | 0.998 | 0.998 | 0.999 | 0.999 | 0.999 |\n|  Rotation ([-100, 100])  | 0.564 | 0.643 | 0.720 | 0.792 | 0.837 | 0.882 | 0.909 | 0.928 | 0.943 | 0.947 | 0.965 | 0.965 |\n| Perspective ([0.1, 0.6]) | 0.643 | 0.741 | 0.807 | 0.875 | 0.913 | 0.931 | 0.946 | 0.960 | 0.968 | 0.967 | 0.973 | 0.975 |\n\n___\n\n**L1:** One limitation is that the watermark is visible.\n\n**A1:** Thank you for pointing this out. As also acknowledged in Appendix A, we recognize that our current method may produce visible artifacts under close inspection by trained professionals. Addressing this limitation, especially for high-fidelity applications such as artworks or cinematic content, is part of our ongoing and future work.\n\n___\n\n**L2:** Another limitation concerns reproducibility.\n\n**A2:** Thank you for raising this concern. We understand the importance of reproducibility and fully agree that providing code is essential for verifying our claims. If the paper is accepted, we will release **all code, pretrained models, and implementation details**, ensuring full reproducibility of our results."}, {"review_id": "yBnS2IkBHd", "reviewer": "Reviewer_fV1g", "summary": "This paper introduces MaskMark, a framework for image watermarking with two variants: MaskMark-D for global/local watermark extraction and tamper detection, and MaskMark-ED for fine-grained local watermarking with enhanced robustness. The method leverages a masking mechanism during training to enable flexible watermark localization and extraction, achieving state-of-the-art performance in accuracy, efficiency, and adaptability while preserving image quality.", "questions": "Elaborate the genuine technical novelties. Explicitly characterize the scenarios where the masking strategy provides unique advantages beyond what could be achieved through existing robustness techniques.\n\nThe paper shows impressive results against localized attacks, but real-world adversaries often combine multiple attack types. Does MaskMark maintain its superiority under such composite attacks, and does the proposed architecture have inherent limitations against certain attack combinations?", "limitations": "yes", "rating": 4, "confidence": 3, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": 3, "clarity": 3, "significance": 2, "originality": 2, "strengths_and_weaknesses": "While the paper correctly identifies meaningful limitations in current watermarking techniques, the proposed solutions represent relatively incremental improvements over existing approaches. For instance, the core masking mechanism in MaskMark shares conceptual similarities with prior work on robustness against random cropping (Ref. [30]), essentially adapting established training paradigms through modified masking strategies rather than introducing fundamentally novel architectures or methodologies.", "was_revised": true, "final_justification": "Based on the original manuscript and the authors' responses, I have no major concerns regarding this paper.", "rebuttal": "# Author Response (Reviewer fV1g)\nDear Reviewer, thank you very much for your careful review of our paper and thoughtful comments. We hope the following responses can help address your concerns.\n\n___\n\n**Q1** Elaborate the genuine technical novelties. Explicitly characterize the scenarios where the masking strategy provides unique advantages beyond what could be achieved through existing robustness techniques.\n\n**A1:** Thank you for raising this important point. Below, we elaborate on the genuine technical novelties introduced by MaskMark and characterize the unique scenarios where our masking strategy provides clear advantages over prior watermarking techniques and robustness mechanisms.\n\n**Functional Innovation: Native Local Watermark Embedding.**\n- MaskMark is, to our knowledge, the **first method to introduce a spatial mask during the encoding phase to enable native local watermark embedding**.\n- While WAM and other global watermarking methods can embed a global watermark and then applies post-hoc cropping to simulate local watermark embedding (which introduces **signal loss and robustness issues**), MaskMark embeds the watermark directly into designated regions by conditioning encoder on a spatial mask. This results in **improved robustness and precise regional protection**.\n\n**Methodological Innovation: A Unified Mask Mechanism Enabling Multiple Functions.**\n- Beyond native local embedding, the introduced mask mechanism provides **a unified design that enables multiple watermarking functionalities**: local watermark extraction, watermark localization and multi-watermark embedding and extraction.\n- While existing methods may achieve some of these functions individually, they typically rely on **task-specific architectures or ad-hoc procedures**, and **cannot achieve all three simultaneously within a single coherent framework**. Moreover, their performance or efficiency also tends to fall short compared to ours. Below, we explain the advantages of our approach.\n    - **Compared to Global Watermarking Methods that Use Crop as a Distortion.** Some global watermarking methods (e.g., HiDDeN, MBRS) introduce Crop as a distortion during training to improve robustness. However, our mask mechanism differs fundamentally in both its role and effectiveness:\n        - **Persistent Throughout Encoding and Decoding:** The mask is not just a training-time augmentation but a central component in both the encoder and decoder during training and inference. This persistent guidance enables the model to learn true spatial awareness and region-specific signal embedding/extraction.\n        - **Supports Learnable “Locate-then-Extract” Decoding:** Our decoder includes a dedicated mask prediction module, allowing the model to first locate the watermark region and then extract the message from that region only. This significantly reduces interference from unmarked areas and improves decoding robustness. We empirically validate this in Sec. 4.5 (“Importance of Localization before Extracting Local Watermarks”).\n        - **Improves Embedding Signal Concentration:** Because the encoder/decoder is always guided by a mask, the watermark signal is learned to be concentrated within the specified region, rather than being diluted across the entire image. In contrast, global methods that see cropped distortions during training still tend to spread the watermark signal across the full image due to the global decoding objective. This limits their true robustness to local extraction, especially when the marked region is small.\n    - **Compared to WAM (Localized Watermarking Method).**\n        - While WAM simultaneously supports local watermark extraction, watermark localization, and multi-watermark embedding and extraction, its design introduces several challenges.\n            - The core idea of WAM is to **treat watermark extraction as a pixel-wise semantic segmentation problem**. Each pixel independently carries bits of the watermark, which are later averaged during inference.\n            - Extracting meaningful information from individual pixels is inherently difficult, leading to **slow convergence, high training complexity, and limited capacity for longer watermark messages** (as noted in the WAM paper).\n            - The final extraction relies on a **non-trainable and naive** voting/averaging mechanism across pixels, which cannot be optimized end-to-end and performs poorly when the watermarked region is small or per-pixel accuracy is low.\n        - In contrast, MaskMark is fundamentally built around spatially-aware encoding and decoding. The encoder and decoder are both guided by a spatial mask, enabling the system to:\n            - Embed and extract information across multiple pixels within a localized region, which **lowers training difficulty and allows extension to longer messages**.\n            - Train all components end-to-end, including both mask prediction and region-wise watermark embedding/extraction, avoiding WAM’s reliance on non-trainable inference heuristics. This leads to **improved robustness in local watermark extraction**\n    - **Compared to EditGuard (Watermark Localization Method).**\n        - EditGuard embeds two separate types of signals: a 1D copyright watermark and a 2D fragile localization watermark to achieve watermark localization. This dual embedding comes with trade-offs:\n            - The addition of a second watermark signal increases visual distortion and complexity.\n            - Ensuring robustness of both the copyright and localization watermarks simultaneously is difficult and may involve conflicting optimization objectives, limiting the achievable performance.\n        - The watermark localized by MaskMark serves as a copyright watermark, which allows robustness and traceability to be ensured simultaneously. This leads to a higher potential performance upper bound and minimal impact on visual quality.\n\n___\n\n**Q2:** Does MaskMark maintain its superiority under such composite attacks, and does the proposed architecture have inherent limitations against certain attack combinations?\n\n**A2:** We appreciate your question regarding robustness under composite attacks, which indeed reflect more realistic adversarial scenarios.\n- To evaluate this, we conducted extensive experiments where combinations of multiple distortions were applied to the watermarked images.\n    - We considered a total of 13 distortions: 10 valuemetric distortions (JPEG Compression, Gaussian Filter, Gaussian Noise, Median Filter, Salt & Pepper Noise, Resize, Brightness, Contrast, Hue and Saturation) and 3 geometric distortions (Rotation, Perspective and Horizontal Flip).\n    - During evaluation, we randomly selected and applied between 1 to 5 of these distortions to simulate composite attacks.\n- As shown in Table 1, MaskMark maintains strong performance even as the number of combined distortions increases.\n    - While there is a natural drop in extraction accuracy with more severe corruption, the results remain at a high level across all combinations tested.\n    - Importantly, we did not observe any inherent architectural limitations or specific attack combinations under which MaskMark fails disproportionately, further demonstrating its robustness and practical utility in real-world settings.\n\n**Table 1. Watermark extraction accuracy of MaskMark-D under varying numbers of random combined distortions across different watermarked area ratios.**\n| Number of Random Combined Distortions / Watermarked Area (%) |  1~5  |  5~10 | 10~20 | 20~30 | 30~40 | 40~50 | 50~60 | 60~70 | 70~80 | 80~90 | 90~95 | 95~99 |\n|:---------------------------------------:|:-----:|:-----:|:-----:|:-----:|:-----:|:-----:|:-----:|:-----:|:-----:|:-----:|:-----:|:-----:|\n|                    1                    | 0.803 | 0.907 | 0.946 | 0.969 | 0.981 | 0.989 | 0.992 | 0.995 | 0.998 | 0.998 | 0.999 | 0.999 |\n|                    2                    | 0.710 | 0.799 | 0.869 | 0.910 | 0.916 | 0.931 | 0.944 | 0.953 | 0.962 | 0.965 | 0.967 | 0.974 |\n|                    3                    | 0.621 | 0.707 | 0.772 | 0.825 | 0.846 | 0.861 | 0.877 | 0.891 | 0.899 | 0.895 | 0.898 | 0.903 |\n|                    4                    | 0.573 | 0.644 | 0.686 | 0.729 | 0.756 | 0.769 | 0.785 | 0.802 | 0.815 | 0.816 | 0.855 | 0.833 |\n|                    5                    | 0.538 | 0.575 | 0.617 | 0.654 | 0.666 | 0.697 | 0.706 | 0.712 | 0.730 | 0.728 | 0.739 | 0.754 |\n\n**Table 2. Watermark extraction accuracy of MaskMark-ED under varying numbers of random combined distortions across different watermarked area ratios.**\n| Number of Random Combined Distortions / Watermarked Area (%) |  1~5  |  5~10 | 10~20 | 20~30 | 30~40 | 40~50 | 50~60 | 60~70 | 70~80 | 80~90 | 90~95 | 95~99 |\n|:---------------------------------------:|:-----:|:-----:|:-----:|:-----:|:-----:|:-----:|:-----:|:-----:|:-----:|:-----:|:-----:|:-----:|\n|                    1                    | 0.871 | 0.945 | 0.967 | 0.982 | 0.990 | 0.995 | 0.996 | 0.998 | 0.999 | 0.999 | 1.000 | 1.000 |\n|                    2                    | 0.783 | 0.866 | 0.921 | 0.945 | 0.954 | 0.963 | 0.968 | 0.973 | 0.975 | 0.978 | 0.974 | 0.978 |\n|                    3                    | 0.701 | 0.803 | 0.852 | 0.893 | 0.906 | 0.923 | 0.923 | 0.929 | 0.937 | 0.929 | 0.922 | 0.926 |\n|                    4                    | 0.639 | 0.744 | 0.777 | 0.820 | 0.834 | 0.851 | 0.858 | 0.857 | 0.871 | 0.869 | 0.883 | 0.856 |\n|                    5                    | 0.592 | 0.657 | 0.707 | 0.750 | 0.766 | 0.779 | 0.789 | 0.793 | 0.799 | 0.799 | 0.790 | 0.787 |"}]

Author rebuttal:

Meta-review: # Summary

This paper presents MaskMark, an image watermarking framework that enables localized message embedding and detection. In contrast to previous approaches, MaskMark is explicitly trained to perform native localization through the use of spatial masks.

The authors propose two variants of the method, differing in whether the embedder is informed of the mask. When informed, the embedder can focus the watermark on specific regions, thereby improving robustness against localized attacks.

At inference time, the detector predicts a localization mask, applies it to the image, and then extracts the watermark from the masked region.

Extensive experiments demonstrate that MaskMark outperforms existing methods in terms of localization accuracy, both local and global message extraction, robustness to image distortions, and support for multiple watermarks.

# Recommendation 

All reviewers were enthusiastic about the paper, and I share their positive assessment. I therefore recommend acceptance.

I encourage the authors to incorporate the reviewers’ feedback and points raised during the rebuttal discussion when preparing the final version of the paper.
Decision: Accept (poster)