MetaSeal: Defending Against Image Attribution Forgery Through Content-Dependent Cryptographic Watermarks
Authors: Tong Zhou
Ruyi Ding
Gaowen Liu
Charles Fleming
Ramana Rao Kompella
Yunsi Fei
Xiaolin Xu
Shaolei Ren
Venue: Accepted by TMLR ()

Abstract: The rapid growth of digital and AI-generated images has amplified the need for secure and verifiable methods of image attribution. While digital watermarking offers more robust protection than metadata-based approaches—which can be easily stripped—current watermarking techniques remain vulnerable to forgery, creating risks of misattribution that can damage the reputations of AI model developers and the rights of digital artists. These vulnerabilities arise from two key issues: (1) content-agnostic watermarks, which, once learned or leaked, can be transferred across images to fake attribution, and (2) reliance on detector-based verification, which is unreliable since detectors can be tricked. We present MetaSeal, a novel framework for content-dependent watermarking with cryptographic security guarantees to safeguard image attribution. Our design provides (1) forgery resistance, preventing unauthorized replication and enforcing cryptographic verification; (2) robust, self-contained protection, embedding attribution directly into images while maintaining resilience against benign transformations; and (3) evidence of tampering, making malicious alterations visually detectable. Experiments demonstrate that MetaSeal effectively mitigates forgery attempts and applies to both natural and AI-generated images, establishing a new standard for secure image attribution.

Published in Transactions on Machine Learning Research (02/2026)
MetaSeal: Defending Against Image Attribution Forgery
Through Content-Dependent Cryptographic Watermarks
Tong Zhou Northeastern University
zhou.tong @northeastemneddy
Ruyi Ding Northeastern University
ding.rrggShhorteesseee...t
Gaowen Liu
goolin@ciscoocoom
Cisco
Charles Fleming
chftemin@ciisco.com
Cisco
Ramana Rao Kompella Cisco
rkompell@cisco.com com
Yunsi Fei Northeastern University
w.fei@hortheasterr.cd
Xiaolin Xu Northeastern University
z.m.@northeastemm.cd edu
Shaolei Ren
shaolei@rcc..om edu
University of California, Réverside
Reviewed on OpenReview: https: openreview. net/ forum? id 8t.3rmCff dJ
Abstract
The rapid growth of digital and Al-generated images has amplified the need for secure and verifiable methods of image attribution. While digital watermarking offers more robust protection than metadata-based approaches which can be easily stripped current water- marking techniques remain vulnerable to forgery, creating risks of misattribution that can damage the reputations of AT model developers and the rights of digital artists. The vul- nerabilities of digital watermarking arise from two key issues: (1) content-agnostic water- marks, which, once learned or leaked, can be transferred across images to fake attribution, and (2) reliance on detector- based verification, which is unreliable since detectors can be tricked. We present MetaSeal, novel framework for content-dependent watermarking with cryptographic security guarantees safeguard image attribution. Our design provides (1) forgery resistance, preventing unrite replication and enforcing eryptographic verification; (2) robust self-containee protection, embedding attribution directly into images while maintaining robustness against benign transformations; and (3) evidence of tampering, making malicious alterations visually delectable. Experiments demonstrate that MetaSeal effectively mitigates forgery attempts and applies to both natural and AI- generated images, establishing a new standard for secure image attribution. Code available at: httpps///gihubb.cc///oooooooooop

---

Published in Transactions on Machine Learning Research (02/2026)
1 Introduction
As digital content creation and sharing accelerate, especially with the rise of Al-generated content. (AIGC). securing the attribution of visual content has become essential for the entire digital ecosystem (Wang et al.
2024 Zhao et al. 2025; Knott et al.) 2024). For content creators, the lack of reliable attribution mothods opens the door for bad actors to fake their creations, causing financial loss (Korus) 2017 Lindley 2020). For AI model developers, misattribution of Al-generated content can lead to reputation damage, as they are often held accountable for the outputs of their models (Jovanović et al.) Zhou et al. 2024). Notably, emerging regulations such the EU AI Act explicitly assign accountability to AI developers for harmful misleading content generated by their models (TSACA 2024), raising the stakes for accurate attribution.
In response, mntaddatabassd methods and watermarking techniques are widely used to identify the source of images. However, metadata- based methods, such as the C2PA standard (Rosenthol 2022). are fragile; metadata can be stripped or corrupted through common processes like reformatting or transmission, leaving content without any traceable attribution (Korus] 2017). Digital watermarking, contrast, offers more robust protection by embedding information directly into images (Zhu et al. 2018 Fernandez et al., 2023
Zhang et al. 2024).
However, existing watermarking methods fall short of supporting reliable image attribution. Current tech- niques are mostly designed for two distinct purposes: copyright protection and image authentication. Copyright-oriented watermarking focuses on robustness, aiming to ensure that the watermark survives ad- versarial removal attempts. These tochniques have been adapted for detecting AIGC by embedding pre- defined watermarks either through post-processing (Xu et al. 2025) or directly during content generation (in-processing) (Fernandez et al.] 2023; Wen et al., 2023). In contrast. authentication watermarking empha- sizes fragility, aiming to detect any modification made to image (Lu & Liao 2001 Zhang et al.) 2024 Sander et al.] 2025). Attribution, however, introduces a fundamentally different requirement: the system must prevenl images from being falsely linked to incorrecl sources. Unfortunately, recent studies have shown that even state-of-the-art methods remain highly vulnerable to forgery attacks (Saberi et al. 2024 Yang
et al. 2024a), which undermines their ability to ensure trustworthy attribution, as illustrated in Fig.
This vulnerability stems from two key factors: (1)
Developer: Alice
This image
the use of content-agmostic watermarks and (2) reliance on delector-based verification. Content-
ganerated by Alice.
Genorata Image
agnostic watermarks, such as fixed patterns, ap- ply the same watermark to all images, regardless of their unique content (Bui et al. 2023 Wen et al.) 2023). This approach leaves watermarks susceptible to forgery, as these image-indenee indeeeneet patterns can be extracted and replicated across unrelated images, falsely implying attribution (Yang et al. 2024a.. Be- sides, the reliance on detector-based source iden- tification is inherently weak since these detectors are vulnerable to adversarial attacks (Saberi et al.) 2024). Attackers can craft small, imperceptible modifications that can cause the detector falscly recognize an irrelevant image as an authentic water- marked one. Such forgery atlacks not only weaken security guarantees but also erode trust in attribution outcomes.
Datect Watermark
Embed Watermark
Misup
g Forgery
This HARMFUL image is generated by Alice!
Attacks
MISATTRIBUTION
Harmful Image
Figure 1: Attackers can forge watermarked images that falsely attribute harmful or manipulated content to a model, risking developer reputation.
These failures highlight two critical open questions for designing watermarking schemes for attribution:
What to embed to ensure the watermark is bound securely to its rightful source?
How to embed and verify to prevent forgery?
Addressing these questions is essential to advance watermarking schemes from general-purpose purpose protection mechanisms toward robust and accountable attribution systems.
2

---

Published in Transactions on Machine Learning Research (02/2026)
This work: We propose MetaSeal, an image attribution watermark that provides innovative solutions to the aforementioned fundamental questions under lorgery-centric threat model. Our key insight is that, to escape the forgery trap, the reliable attribution requires both content-dependent watermarking and cryptographic verification guarantees, with the attribution information being self-contained and provable. Specifically, we generale watermarks tailored to image contents using digital signalures and embed them directly into the image. By employing cryptographic verification instead of conventional detectors, MetaSeal enhances security and effectively mitigates the risk of forgery attacks.
Embedding content-dependent watermarks that support cryptographic verification poses significant technical challenges. A critical requirement is achieving perfect signature extraction accuracy-an an area where current embedding techniques often fall short, particularly when the embedding capacity is large (Fernandez et al. 2023 Zhu et al., 2018), as demonstrated in Sec. 3.2 Moreover, cryptographic verification depends on the integrity of the digital signature (Schneider Chang 1996). However, images are often subjected to various transformations, which can compromise the embedded signature's validity. For real-world applicability, the watermark must remain resilient to benign transformations, such JPEG compression, to ensure its effectiveness and practicality,
To address these challenges, MetaSeal provides a principled integration of semantic binding with crypto- graphic verification and exact extraction. First, it generates content-dependent signatures that encapsulate the image's semantic information, ensuring the watermark is tied to the content rather than pixel details. This design ensures the watermark remains consistent under benign transformations that preserve the im- age's semantics while being invalidated by malicious perturbations revealed by tampering evidence. Second, to enhance extraction performance, MetaSeal transforms cryptographic signatures into visually meaning- ful patterns (e.g., QR codes) and employs invertible embedding and extraction process. This approach improves the robustness and accuracy of signature recovery, ensuring the watermark remains intact and functional even under challenging conditions. Our contributions are summarized as follows:
We introduce MetaSeal, an image attribution watermark that explicitly addresses the foundational questions of what embed and how embed/ /eeedd/rrrfyy under a forgery-centric threat model, by binding content-dependent cryptographic signatures directly into images.
2. We present a publicly verifiable attribution framework through the proposed Visual Attribution Signature. By integrating asymmetric eryptography into watermarking, MetaSeal enables any third party to verify attribution using a public key, without relying on secret detectors or private verifi- cation.
3. MetaSeal maintains robustness against benign (e.g., compression) transformations to certain extent while providing lampering evidence of malicious perturbations through visual artifacts.
4. MetaSeal achieves perfect extraction accuracy with payloads 88x larger than baseline methods, maintaining promising image quality and supporting both natural and Al-generated content, ad- vancing reliable image attribution.
2 Background
2.1 Image Attribution
Securing image attribution has grown increasingly critical with the rise of ATGC. Two primary approaches, i.e., beeaddta-baasd methods and watermarking, offer varying levels of effectiveness in addressing this chal- lenge. Metadata-basee methods, such as those standardized by C2PA (Rosenthol 2022). embed verification information directly into image files. This typically involves creating digital signature using a private key to sign a hash of the content, with the corresponding public key used for verification by comparing the decrypled hash to a newly computed one (Tonkin & Allinson 2006).. Although effective in preserving integrity under ideal conditions, these methods are highly fragile. Metadata can be easily lost during format conversions or minor odits, rendering the attribution unverifiable. In contrast, watermarking techniques embed verification information into the image's pixel (Begum & Uddin 2020), providing greater resilience across transformations, and becoming a more robust solution for content attribution.
3

---

Published in Transactions on Machine Learning Research (02/2026)
Besides, some methods have been proposed superficially for AIGC attribution, which train classifiers that exploit distributional differences across generative models (Yu et al. 2019 Girish et al. 2021 Sha et al. 2023). While effective for distinguishing between models, these approaches offer no verifiable proof and are limited to AIGC attribution. In contrast, our approach offers a gencral-purpose image attribution framework that not limited AIGC and provides strong, oryptographically verifiable evidence of provenance, making it applicable across broad range of use cases.
2.2 Image Watermarking
Watermarking lechniques differ significantly in design goals, depending on whether they are used for copyright protection, image authentication, or image attribution. Table summarizes the differences across these goals, highlighting distinctions in detection mothodology, robustness roquirements, and security risks. More related works and discussions on image watermarking are provided in Sec.
Copyright protection Watermarking for copyright protection primarily aims to assert ownership and resist removal. Traditional methods based on signal processing techniques (c.g., DWT-DCT) embed watermarks in frequency domains to achieve robustness against common manipulations (Barni al., 2001 Cox el al. 2007 More recent deep tearning-bssed approaches, such as HiDDeN (Zhu et al. 2018)) and RivaGAN (Zhang et al. 2019), use encoder-decoder architectures and adversarial training embed fixed-length bitstreams (typically under 100 bits) that survive wide range of distortions.
Besides, some image watermarking methods have been proposed specifically for detecting ATGC-that is, embedding watermarks into generated images to identify whether they were produced by a particular model (Wen et al.) 2023 Fernandez et al. 2023 Yang et al. 2024b). By emphasizing robustness against removal, such methods resemble copyright protection watermarks, implicitly treating the model owner as the copyright holder. Typically, they embed fixed, model-specific watcrmarks through modifying model woights [Fernandez et al. 2023 Kim et al.] 2024) or the generation process (Wen al. 2023 Yang al.j 2024b). However, their content-agnostic design introduces critical security risk: attackers carry out forgery at- tacks by extracting and transplanting the watermark onto unrelated images, lcading to misattribution (Yang) et al.) 2024a Saberi et al., 2024). By overlooking this risk, such methods cannot be considered reliable attribution watermarks. This issue is especially concerning because model owners do not legally hold the copyright to generated content, yet they may still held accountable for malicious generations.
Authentication Authentication watermarking schemes are intentionally designed be fragile, breaking when the watermarked content undergoes unauthorized modifications. This fragility serves as integrity check mechanism. Verification typically requires access to embedding secrets or reference watermarks for comparison. For instance, classical authentication watermarks are often embedded in specific wavelet coef- ficient locations, where the location secrets will be revealed during the authentication process (Lu & Liao. 2001 Beyond basic authentication, advanced mothods for tampering localization have been developed (Hur-
Table 1: Comparison of watermarking goals: Copyright Protection, Authentication, and Attribution.
Aspect
Copyright Protection
Authentication
Attribution (Ours)
Assert ownership detect
Trace rightful creator source
Objective
Detect Modification
AIGC
Compare with pre-defined watermarks with error toler- ance
Detection
Check integrity via exact match with ground truth
Extract proof then apply
Method
cryptographic verification
Any party with public verifi- cation keys
Detection Entity
Content owner
Content Recipient
Robust against benign trans- formation but not semantic tampering
High robustness against re- moval attacks
Robustness
High sensitivity to editing
Attackers aim to remove wa- termark to erase ownership
Attackers modily content while evading detection
Atlackers forge watermark to misattribute ownership
Security Risk
4

---

Published in Transactions on Machine Learning Research (02/2026)
rah et al. 2019 Kamili et al. 2020 Zhang et al. 2024 Sander et al. 2025 that not only detect modifications but also precisely identify which regions of an image have been altered. These techniques provide detailed information about the modifications when authenticity is compromised, offering more comprehensive in- tegrity assessment than simple binary authentication.
Attribution Unlike copyright protection watermarks, which aim to assert ownership, attribution water- marks are designed to prove the rightful creator or source of an image, addressing a distinct and critical security risk: forgery attacks. There exists inherent trade-off between robustness and unforgeability: increasing robustness to tenaffommations/rmmmooo attacks expands the space of modified images that suc- cessfully verify, which can inadvertently increase the risk of misattribution. Thus, attribution watermarking requires different balance than copyright protection prioritizing forge-resistance while maintaining sufficient robustness for legitimate use cases, rather than maximizing robustness against all possible removal attacks. This watermark can be used to regulate the image generation models to tell a malicious image is really generated from it. To improve trustworthiness, should offer public verifiability.
Besides, for image attribution, removing the watermark merely renders the attribution mechanism ineffective, preventing identification of the image's source. This limitation poses minimal harm to image generation service providers or digital artists, especially since removal attempts typically compromise image quality, making the altered content less valuable or usable. A more significant threat lies in forgery attacks that deceive watermark verifiers into classifying unauthorized images as authentically generated by a specific source. Such attacks could lead to service providers being falsely accused of inadequate safety mechanisms or enable bad actors to counterfeit an artist's work, potentially causing financial harm. Thus, forgery attacks pose more severe consequences than removal attacks in this context, highlighting the need to strengthen watermarking mechanisms against forgery.
2.3
Content-ddpendent Techniques
One of the key vulnerabilities prior watermarking schemes their content-agnostic nature, where the watermark embedded in one image can be extracted and transplanted into another to create falsely au- thenticated content. One mitigation is to make the watermark content-dependent, creating intrinsic link between the watermark and the specific image content.
Content-dependencc can be achieved using various hashing techniques, including cryptographic hashes like MD5/SHA-225 (Sobti & Geetha 2012), or perceptual image hashes such as NeuralHash (Farid 2021). Cryp- tographic hashes require exact bit matches to validate, making them suitable for strict authentication but overly sensitive to benign modifications. In contrast, perceptual image hashes are designed to produce similar hash values for visually similar images. However, perceptual hashing remains vulnerable to adver- sarial manipulation, as researchers have demonstrated methods to create hash collisions between visually dissimilar images (Struppck et al. 2022).
In addition, these hashing approaches normally require external storage and are not self-contained within the image itself. Even when embedded as watermarks, they primarily serve for content authentication rather than attribution (Roy et al. 2023 Hussan et al.) 2002)). hash can verify that content has not been altered, but cannot independently establish who created it or which system generated it. Overall, these techniques cannot be directly applied to image watermarking to achieve reliable attribution.
3 Preliminaries
3.1
Watermark Forgery
We categorize common watermark forgery attacks by the modality of their strategies: whether they exploit the embedding process (replay attacks), estimate and reuse the watermark signal (mixup altacks), or directly attack the detection mechanism (PGD attacks).
Replay Attacks. Attackers in this case can be dishonest watermark verifiers who know everything required for detection, including the embedding algorithm E(T, w), the detection algorithm D(T), the secret. key (if
5

---

Published in Transactions on Machine Learning Research (02/2026)
any), and the embedding locations. Given legitimate watermarked image Iu EII, the attacker
extracts the watermark w and re-embeds it into different image I' to lorge T. = E(T', w)), such that D( = True. Content-agnostic schemes are especially vulnerable, like DCT-based watermarking (Cox
ct al. 2007): as the static watermark w transferable across images.
Mixup Attacks. Attackers first estimate the watermark signal by computing the average residual between n watermarked images Ly and their original versions 1:
n i
D n
11)
(1)
The extracted signal d then added to a new image I' to lorge a walermarked version:
L = I'
(2)
Such attacks effective when the watermark is additive and not tightly bound to the original content et al. 2025
Xu
For generative watermarking schemes like Tree-Ring Wen et al. 2023 the attacker can prompt the gener-
ative model to synthesize a white noise image ynolse Saberi et al. 2024 The corresponding watermarked
output /noise is then linearly blended with a clean image I':
i Xinoise + +11
where À E [] controls the mixing ratio. The forged image I may pass the watermark detector with D(I)= True.
PGD Attacks. These attacks exploit the vulnerability of watermark detectors that are implemented as deep neural networks. Specifically, an allacker aims to manipulate the input image in a minimally perceptible way such that the detector outputs an incorrect prediction. Given a clean, unwatermarked image 7, the attacker uses the Projected Gradient Descent (PGD) algorithm (Madry et al. 2018) to construct an adversarial carefully optimized to induce a misclassification by the
example ladv I 5, where the perturbation detector. Formally, the attacker solves the following optimization problem:
min L CD(L +), subject to 5
|00|00 Se
(4)
where L is the loss function (typically cross-entropy): y the target label desired by the attacker (e.g., y to indicate watermarked image in binary classification, y y= when using ground-truth -ruth watermark bit strings), and bounds the perturbation magnitude (e.g., in the fx norm) to ensure imperceptibilitty
Such adversarial perturbations are often visually indistinguishable from the original image but can reliably mislcad the detector into producing incorrect results, such as detecting a watermark where none exists. These attacks have been demonstrated to be effective under both white-box and black-box threat models (Saberi
et al. 2024 Zhao al.] 2025), highlighting the need for trustworthiness in neural watermark detectors.
3.2 Limitation of Prior Works
One of the key aspects to defend against. forgery attacks via watermarking is to incorporate a cryptographic signature, which in turn requires the watermarking method to support a large embodding capacity. However, we found that current basedd methods struggle to meet this requirement.
Here, use HiDDeN (Zhu et al. 2018 representative learning- based image watermarking framework, as concrete example to demonstrate this limitation. HiDDeN consists of an end-to-end trainable pipcline comprising an encoder, decoder, and a noise layer. It is trained to minimize message recovery error, maximize image fidelity (i.e., ensure that the image quality does not degrade significantly due to watermark embedding), and enhance robustness against various transformations. Given a cover image I E #xCCC and a binary message m E (0, 1)*, the encoder embeds m into to generate a watermarked image Ig- The decoder attempis to recover the message from possibly distorted version of In.. Detection is typically performed

---

Published in Transactions on Machine Learning Research (02/2026)
by decoding message m from the watermarked image and comparing it to the expected message m; the image is considered watermarked if the bit error rale (BER) is below a certain threshold T:
R Σ
BER(m, m) = h.
1m
F mal ST, m, = 1(p(m,,) 2 0.5).
(5)
where p(m)) is the predicted logit of fhe It originally only supports small payload, e-g,, a message length of 30 bits.
Considering that cryptographic signature is typi- cally larger than 512 bits, we test whether HiDDeN can be adapted to support such large payload, enabling integration of cryptographic signatures to enhance security against forgery. However, as illus- trated in Fig. 2 HiDDeN fails to converge on ac- curate message recovery when trained with mes- sage of 512 bits. While image fidelity continues to improve during training, the BER remains high, in- dicating a fundamental limitation embedding ca- pacity. Furthermore, existing approaches such as Stable Signature (Fernandez et al. 2023) and HiD- DeN only support the embedding and extraction of fixed watermark (i.e., fixed set of message bits) once trained. If the message changes, the model requires retraining or fine-tuning, Since cryptographic signatures are content-dependen and unique to each instance, this approach is impractical for signature integration, as it is infeasible to retrain the model for every new signature.
Less
Bitwise Ecror
0.28
M m W
0,5006
Bitwiss Brrur Rate
Loss Valne
M
0,5000
0.26
0,4905
10
Epoch
Figure 2: Training performance of HiDDeN with 512- bit messages: loss optimizes image fidelity while recov- ery accuracy remains low (unconverged BER).
4 Problem Formulation
4.1 Threat Model
Attackers. We consider attackers whose objective is to forge watermarks onto unrelated images in order to lalsely claim authorship or misrepresent the provenance content. Such allackers may aim to undermine the credibility of creators or model developers by linking their names malicious or low-quality works, or fake some creators' work with valid watermarks for financial gain. We assume the attacker has full knowledge of the watermarking algorithm, including the embedding and detection procedures, and access to set of watermarked samples. However, the adversary does not possess internal parameters of the encoder or decoder models (i.e., operates under a gray-box threat model). This is a reasonable assumption since watermarking algorithms are typically open-sourced, while encoder mcoder/dccoode /decoder models are commonly deployed as black-box services on cloud platforms for practical usage.
Protectors. Protectors focus on ensuring reliable attribution by securely linking content to its rightful creator generator through robust watermarks. The watermark must withstand benign transformations, maintaining its integrity under non-adversarial conditions. Crucially, it must also provide forgery resistance, preventing adversaries from successfully embedding convincing but unauthorized watermarks into unrelated content.
4.2 Design Requirements
We outline the primary requirements for building a reliable watermarking framework for image attribution:
Content Dependency: The watermark must be tied the content of each image to prevent easy estimation and reuse across unrelated images. This ensures that attribution remains tightly coupled to the image's inherent characteristics.

---

Published in Transactions on Machine Learning Research (02/2026)
Embed
Semantic
DW11
InvBlock
Inv BloBlokk
hvBloock
Extraction
INN
Watermarked
M: "A bird is perched on rock."
Original Image
DWNT
Image
Transformations
Extract
Sign Encode
BRG Secrets V
Decode and Verify
Transformed Image
pk
Figure 3: The inference process of MetaSeal. Embedding: Semantic featuree are extracted to generate a cryptographic signature using the private key sk, which is encoded into a visual pattern and embedded into the image using an invertible neural network (INN, trained with Eq. 15). The resulting watermarked image may undergo transformations such as JPEG compression. Extraction: The embedded sccret recovered using the same INN and then decoded to verify altribution using the public key pk. The secret is embedded in the frequency domain using discrete wavelet transform (DWT) and Inverse Wavelet Transform (IWT) for improved robustness and imperceptibility.
Cryptographic Verification: The watermark should provide cryptographic guarantees, allowing mathematically secure verification to protect against forgery attacks. This approach eliminates reliance vulnerable sreector-based systems and ensures attribution integrity.
Self-Contained Attribution: All necessary allribution information should be embedded directly into the image, avoiding external dependencies such metadata that be stripped or corrupted. This ensures the attribution remains intact even after common image transmissions.
4.3 Challenges
To meet these requirements, cryptographic signatures offer a promising foundation since the signature is dependent on the content and provides a cryptographic security guarantce. However, two key challenges must be addressed:
Challenge 1: Content Dependency vs. Robustness. How can the watermark be made content- dependent to prevent forgery, yet robust against benign transformations? Watermarks that tightly coupled to image content reduce the risk of being copied across unrelated images. However, if the dependency is too strict-such as signing pixel-level details-the watermark may become fragile, breaking under benign transformations. A practical solution must balance these factors: ensuring the watermark remains valid under standard modifications, but invalid under adversarial changes that alter the image's meaning.
Challenge Payload Size vs. Extraction Accuracy. How can the cryptographic signature's large payload be precisely extracted while balancing embedding capacily and extraction accuracy? Cryptographic signatures often involve significant amount of data, which challenges existing embedding techniques to achieve both high capacity and precise extraction. The trade-off between embedding capacity and extraction accuracy is critical, as inaccuracies in extraction could compromise the validity of cryptographic verification.
5 Image Attribution Watermark: MetaSeal
To safeguard image altribution via watermarking, we propose MetaSeal, which addresses two fundamental questions illustrated in Fig. First, regarding what to embed, we advocate for the use of cryptographic signatures to create content-dependent watermarks, moving away from fixed patterns. These signatures ensure the watermark is tied the image content, mitigating forgery attacks. Second, regarding how to embed/ verify, emphasize the critical need for exact secret. extraction. To achieve this, transform

---

Published in Transactions on Machine Learning Research (02/2026)
cryptographic signatures into meaningful visual patterns, enhancing robustness against benign transforma- tions. For verification, instead of relying on binary detectors (Saberi et al. 2024 statistical tests (Wen) et al. 2023), ; we adopt an invertible process of the embedding mechanism to retrieve the embedded crypto- graphic signature from the watermarked image, promoting precise verification.
The remainder of this section is organized as follows: We overview the proposed scheme in Sec. 5.1 then we
present how our solutions overcome the identified challenges in Sec. 5.2 and Sec. 5.3 to complete our schemne.
5.1 Visual Attribution Signature
We propose cryplographically grounded attribution scheme that integrates digital signature algorith into image watermarking via structured visual patterns. Unlike metadata, which is fragile and easily stripped, our method embods signatures directly into images as spatially redundant visual structures (e.g., QR codes). This self-trained design improves the effectiveness of watermark verification.
Definition (Visual Attribution Signature). Let RxxWx3 denote an inpul image and M = f(I) be the semantic features extracted by function f. The visual attribution signature consists of the following components:
KeyGen(1*)) - (sk, pk): Gencrates public-private key pair under a cryptographic scheme, where X is the securily parameler.
Sign(sk, M) + 8: Compules the digital signolure S for M using the privale key sk.
PatternEncll (M - V: Encodes M and S into a structured binary pollern V E 10,1)
Embed(I, I Embeds V into to produce a watermorked image I*
Extract(I") + V: Extracts an estimated pattern V from a potentially modified image I'.
PatternDecl V) + (Λ S): Decodes V to get recovered message-signatur pair (A,,S).
Verifu(pk, M, $) (true, false): Accepts if S is valid signature of M under the public key pk.
Crucially, unlike conventional digital signatures that assume direct access to the signed message M and verify S by checking if pk(S) = M, watermarking complicates this process. Since embedding alters the image, the extracted features may not match the original, i.e., f(I*) * f(I) M is not guaranteed (Korus, 2017 Pairoze et a.l), making M inaccessible from I alone via f. To ensure correct verification, our scheme requires exact recovery of both M and S, i..., M = . and Š = S, such that pk(š) M. To achieve this, we jointly encode (M, into visual pattern V via PatternEne, shifting the verification requirement to accurate visual pattern extraction, while f(I') z M can be used as supplementary verification.
In our work, in small, visually compact area. This makes them ideal for embedding large payloads. Also, it includes built-in error correction mechanisms that allow for data recovery even if part of the code is damaged or obscured, and it supports easy and reliable scanning by machines like smartphones.
QR code the visual pattern V since it store significant amount of information
This security guarantee of the proposed visual attribution signature against forgery attacks follows directly from the existential unforgeability of the underlying digital signature scheme (c.g., ECDSA) (Goldwasscr et al. 1988). We provide further analysis and demonstrations of resistance to adaptive forgery atlacks in Sec. 6.5
Beyond cryptographic soundness, our structured visual pattern design offers significant advantages over tra- ditional bit-wise embedding approaches. First, it achieves superior error resilience through both local spatial correlation and global error correction codes, enabling robust signature recovery. Second, the structured pattern provides built-in rodundancy to support error correction. The detailed analysis is presented in Ap- pendix A Furthermore, the decoded pattern could provide visual feedback indicating tampering attempts (see Sec. 6.4
9

---

Published in Transactions on Machine Learning Research (02/2026)
5.2 Semantic Extraction
To address Challenge 1, the ideal feature extractor should satisfy two complementary properties:
a) Content Dependency:
The extracted features semantic content, ensuring that images with genuinely different semantics yield different features:
= = f() should uniquely characterize each image's
if (1) # Sem(12) = f(4) f(12),
(6)
where Sem(-) denotes the semantic content of the image.
b) Transformation Robustness:
The features should remain invariant under benign transformations T(-) (e.g., compression, resizing, or color shifts) while changing under adversarial manipulations A(-) that alter semantics:
((T(T)) = S(A()) J(T).
By distinguishing semantic differences from superficial transformations, balances robustness and security: if M is too coarse, it risks reuse across unrelated images; if it too tied pixel-level details, it breaks under benign edits. By focusing semantics, method distinguishes malicious manipulations from benign changes while minimizing the risk of watermark reuse (see Sec. 6.5
To realize this, we implement f using an image-to-test text model that maps visual content to a deterministic textual description, which serves as the high-level semantic summary M and is more invariant to benign image transformations than pixel-level features. Specifically, we decompose f into an encoder mncoderddcoodr architecture:
M faee (f))
where Sene is a vision model that extracts high-level visual features, and Saee is a language model that generates a textual description. This architecture ensures that M captures semantic content while being robust to pixel-level variations. In practice, f can be instantiated as a pre-trained image captioning model. When integrated with our visual signature scheme, this semantic representation provides a robust basis for attribution: it mitigates forgery by enforcing content dependency while remaining effective under common benign transformations.
5.3 Invertible Embedding and Extraction
To address Challenge Embed must support large payload seamlessly integrate into the original image I. Additionally, Extract is expected to be the inverse of Embed, ensuring accurate retrieval of the secret V. To achieve these properties, identify invertible neural networks (INNs) as promising solution.
INNs rely on bijective transformations to ensure perfect input reconstruction through invertible blocks (In- vBlocks), ) a distinct advantage over traditional neural networks where operations are rarely reversible (Jing et al. 2021 Xing et al., 2021; Xiao et al. 2020). While this reversibility has been exploited to achieve high-capacity steganography (Xing et al.] 2021 Lu et al. 2021) and imperceptible watermarking (Ma et al., 2022), leverage it here for different purpose: enabling exact recovery of large, structured attribution signatures required for public cryptographic verification, while inherently providing editing localization tampering evidence.
Within each invertible block i, the inputs include the image component I and the secret V The forward (embedding) operation of block defined as:
ri+1_ 1' + doV").
(9)
pi+1 = V o exp (a(p(ri+11)) + (n(tt)),
(10)
where o(-), p(-), and n7()) are learnable modules (e.g., convolutional or dense layers), @ denotes element-wise multiplication, and is sigmoid- clamping function to stabilize scaling. The design ensures that both the image and the secret can be perfectly recovered using the inverse operation:
Vi = (yit1_ - n(( @ exp ( a(p((t+)))) _ = 1+|1_ o(V)).
(11)
(12)
10

---

Published in Transactions on Machine Learning Research (02/2026)
To better understand how it works in our framework, let go denote the INN parameterized by 8. The forward embedding process using the INN is simplified as:
- ((",))=9(([VV) (),V,,
(13)
where 1* represents the watermarked image, and denotes the residual information that cannot be seamlessly embedded into I due to the high hiding capacity. The residual is always modcled as an imago-agnostic
Gaussian distribution, ensuring that I" alone suffices for accurate recovery (Jing et al. 2021 Xiao et al.
2020
To improve robustnees under practical scenarios where I* may undergo transformations, the reverse operation incorporates these transformations T. The extraction process is expressed as:
(i.V = 99 (T)
(14)
where 0o denotes the inverse process of the INN, z is an auxiliary variable that samples from a Gaussian dis- tribution, serving as a complementary component for accurale recovery. Here, V is the extracted watermark secrets and 7 approximates the original image T. The transformations T include common operations such as identity (no transformation), Gaussian noise, and JPEG compression. Incorporating these transformations into model training, akin to noisy layers in Zhu et al. (0018), enhances resilience real-world degradation.
Furthermore, to ensure the embedding process remains imperceptible and preserves the quality of the water- marked image, the visual signature is embedded in the frequency domain using the discrete wavelet transform (DWT). Specifically, the INN takes two inputs: the spatial domain cover image I and the structured spatial secret V (the QR code). Inside the network, T is decomposed into frequency sub-bands. The INN learns a reversible mapping that distributes the information of the spatial QR code into the frequency features of J. This frequency-domain embedding allows the signal to remain imperceptible in the pixel domain while be- ing robustly preserved. During extraction, the INN inverts this transformation, aggregating the distributed froquency signals back into the coherent spatial structure of the original QR code. This approach reduces distortions compared to pixel-domain embedding and enhances the imperceptibility of the watermark.
The LVN is trained using a composite loss function designed to simultaneously optimize the recovery per- formance of the embedded visual signature and preserve the quality of the watermarked image. The loss function defined as:
Lo = Aemb || 1-1 Aree IV - V11
(15)
where Aemb and Arve are weighting factors balancing the embedding distortion and watermark extraction loss.
Moreover, due to the bijective nature of INNs, any perturbation applied to the watermarked image I" directly propagates the extracted secret, resulting in corresponding artifacts. This effect, observed in [Zhang et al. (2024) and illustrated in Fig. 8 reflects the inherent localization property of INNs, which can be leveraged as evidence of tampering.
6 Experiments
6.1 Experimental Setups
Datasets and Models. We use the DIV2K dataset [Agustsson Timofte 2017 to train the INN for wa- termarking embedding and extraction, which contains 800 high-quality 2K resolution images in the training set, and 100 in the validation set. The architecture of INN follows Jing al. (021), which has 16 invertible blocks (see Appendix B). For the feature extractor, we leverage pre-trained image captioning model from Huggingface, which uses ViT model (Dosovitskiy et al. 2021) ) as the vision encoder and GPT2 (Radford et al. 2019 as the language decoder. For evaluation, we test our method on real images from DIV2K vali- dation dataset, COCO (Lin et al.) 2014), and ATGG images generated by stable difflusion (Rombach et al. 2022). The resolution of the images in our experiments is set to 512x512.
Settings. We use the QR code encoding and decoding for PatternEne and PatternDee, respectively. The QR code of the visual signature in our experiments includes 53x53 modules. For the digital signature
11

---

Published in Transactions on Machine Learning Research (02/2026)
Table 2: Evaluation of image quality and recovery accuracy on DIV2K and COCO datasets.
DIV2K
COCO
Payload
PSNRT
SSIM
RecAce 1
PSNR1
SSIM1
RocAoc 1
HIDDeN
1x
37.42 + 2.57
0.987 + 0.03
0.959 + 0.04
37.15 + 2.78
0.988 + 0.02
0.972 + 0.04
RivaGAN
1x
40.43 + 0.30
0.984 + 0.01
0.992 = 0.04
40.54 + 0.27
0.979 + 0.01
0.998
0.02
WAM
1x
33.49
1.53
0.985 = 0.01
1.000 = 0.00
35.53 = 1.65
0.971 = 0.01
1.000 = 0.00
DwtDetSvd
16x
35.49
3.06
0.975
0.01
0.994 1 0.02
38.11
2.94
0.973 1 0.01
0.999
0.01
MetaSeal (Ours)
88x
34.40
1.97
0.965
0.01
1.000 + 0.00
34.91 1 2.31
0.963
0.01
1.000 + 0.00
algorithm, we use Elliptic Curve Digital Signature Algorithm (ECDSA) with P-256 curve (Hankerson & Menezes] 2021), resulting 512-bit signature. For training the INN, the weights for the loss terms are set Aemd = and Arec = 1. We employ the Adam optimizer with an initial learning rate of 1 x 10 All experiments are conducted on an NVIDIA L40S GPU.
Comparison Methods. It is worth noting that there exists a vast array of image watermarking meth- ods, making exhaustive comparison infeasible. Therefore, we focus on comparing with several representa- tive/SOTA methods, including Dwt (Cox al. 2007) (used in the official Stable Diffusion model), HiDDeN (Zhu et al. 2018). RivaGAN (Zhang et al. 22019). WAM (Sander et al., (025). and Stable Signa- ture (Fernandez et al., 2023). The first four methods are post-hoc techniques that can be applied to any image, whereas Stable Signature is specifically designed for generative images, embedding the watermark during image generation. It is important to note that cach method supports a different payload capacity and it cannot. be adjusted lo the same large payload as MetaSeal without compromising its effectiveness. The limitations of other watermarking techniques have been discussed in the Sec. B
Evaluations We use the Pcak Signal-to-Noise Ratio (PSNR) and Structural Similarity Index (SSIM) measure the quality of the watermarked image (Hore & Ziou 2010). In addition, recovery accuracy (RecAcc)
quantifies the percentage of successfully recovered watermark secrets. For comparison methods that all use bit strings secrets, it is calculated as:
N Σ 1(b = &.) 100%,
RecAccia
(16)
N
where 6, is the decoded bit and b, is the ground truth. For MetaSeal, the secret is visual structured pattern, where the recovery accuracy is calculated as:
RecAAepatterr
I(T, = 1.5)) x 100%.
(17)
HXW
where x W is the pattern resolution. We also report verification accuracy (VerAcc), which reflects whether the extracted secret can correctly confirm image attribution. For our method, which embeds cryptographic signatures, VerAce is defined as the proportion of successfully verified signatures, requiring exact recovery to satisfy cryptographic validation.
6.2 Balance Between Payload and Accuracy
To demonstrate MetaSeal achieves a good tradc-off between payload size and recovery/verification accuracy, we evaluate its performance on diverse datasets and compare with multiple watermarking methods, shown in Tab and Tab3] Existing approaches, such HiDDeN, use fixed-length bitstreams (typically <100 bits), resulting in minimal payloads. Specifically, in our experiments, HiDDeN embeds 32-bit secret in a 512 x 512 image, yielding a payload of ~ x 10-4 bit per pixel, which we normalize as the baseline for comparison.
In contrast, MetaSeal introduces a paradign-shifting approach by designing visual signatures encoded in QR codes. Our payload calculation, defined as the ratio of embedded modules to total image pixels, demonstrates 88x increase compared to HiDDeN, RivaGAN, and WAM. As shown in Fig. 4 MetaSeal achieves the
12

---

Published in Transactions on Machine Learning Research (02/2026)
Table 3: Evaluation of image quality and recovery accuracy on AIGC dataset.
Payload
PSNR
SSIM
RecAce
IHDDeNN
1x
33.79 = 3.36
0.989 + 0.01
0,966 + 0.04
RivaGAN
1x
40.65 + 0.23
0.981 = 0.01
0.966
0.06
WAM
1x
34.04 + 1.77
0.986 + 0.01
1.000 + 0.00
Stable Signature
1,5x
27.81 + 2.26
0.916 + 0.03
0.982 + 0.03
DwtDetSvd
16x
34.95 + 2.83
0.973 + 0.01
0.994
0.02
MetaSeal (Ours)
34.43 =
0.965 0.01
1.000 0.00
best secret recovery accuracy at the largest payload, whereas other methods experience low recovery accuracy as the payload increases. For HiDDeN, the recovery accuracy drops from 0.987 to around 0.5 when secret message length increases from 32 bits to 512 bits, as shown Fig. 2 Moreover, MetaSeal consistently delivers perfect secret extraction, as quantified by RecAcc. This accurate recovery enables perfect verification accuracy for non-transformed watermarked images, as shown in Fig where verification accuracy drops drastically for DwtDctSvd under the same payload.
Notably, this increased payload capacity does not significantly compromise image quality. MetaSeal surpasses Stable Signature's performance AIGC datasets and achieves comparable quality to DwiDetSvl DIV2K method already integrated into Stable Diffusion's image watermarking system (Rombach et al.) 2022). Also, its image quality is slightly better than WAM on most cascs, which can also achieve perfect recovery accuracy but only supports small payload. The visual performance of MetaSeal for both embedding and extraction is demonstrated Fig.
Recovery Accuracy
1.00
WAM
Dwt
MetaSeal
40
Recovery Accurasy
1.0
0.8
6,979
1.000
1,000
1.000
0.966
0,558
1,000
1.000
-1.0
-.88
Acpuracc
RivGAN
38
PSNR (dB)
0.98
Better
0.6
0.530
0,625
0.4
36
0.2
6,250
0.518
0.2
0.96
HiDDeN
0.207
34
0.0
0.0
DIV2K
COCO
20
40
60
80
Payload Rate
DwiDetSed (16x (Beckce)
DwtDctSvd (16x) (Vesled)
Dewteetii (Bsx] (ieccaa))
Dwtiittie (88x) (Naetad
StataSeal (B8K) (Reckee))
MetaSeel (BEx) (Veekee)
Figure 4: MetaSeal achieves the best per- formance between payload and recovery accuracy DIV2K.
Figure 5: As the payload increases for DwtDetSvd, its VerAoe drops significantly, while MetaSeal maintains perfect recovery and verification accuracy.
By leveraging the inherent resilience of structured visual signatures and invertible em- bedding strategies, MetaSeal achieves superior balance between payload capacity and recovery/ verifi- cation accuracy, while maintaining image quality comparable to real-world watermark implementation.
Takeaway 1:
6.3 Robustness against Benign Transformations
As discussed in Sec. 2.2 robustness against watermark removal attacks, including transformations or adver- sarial modifications that could erase the watermark, is not primary objective for altribution watermarks. In fact, such robustness implies tolerance to modifications, which contradicts the goal of attribution water- marking: to signal tampering and invalidate attribution when meaningful changes occur. Therefore, unlike prior methods that prioritize resistance to editing and removal, MetaSeal is designed to remain robust only under benign Imusformations.. We also provide its performance under removal attacks in the Appendix C
To ensure attribution survives standard usage, Fig. 7 quantifies verification accuracy under five types of transformations: brightness adjustment, contrast variation, blurring, Gaussian noise, and JPEG compression (with scaling and cropping in Appendix D). MetaSeal maintains stable verification accuracy within tolerance
13

---

Published in Transactions on Machine Learning Research (02/2026)
Original Image/
Watermarked Image /
Difference |-r|x10
Extracted Secrets
Original Image
Watermarked Image
Difference
Extracted
11
Secrets
DIV2K
COCO
AIGC
Figure 6: The visual performance MetaSeal for both embodding and extraction across different datasets.
Verihcation Acruary (99)
Vociflcation Accurrry (%)
32.
Veriltaaton Accumit
Wi
PSivic (103))
Veriltration Accuracy
Psints (alt)
PONT (otb)
201
-310
Veritccation
g
05 10
15
Brighmess Innersiry
Controxt Insensity
Blur Intersity
Noise Intensity
JPEG Quality
Figure 7: MetaSeal performance under varying distortion intensities. The red star denotes the performance when the transformation not added (baseline). Each panel plots verification accuracy (blue line, left axis) and the cover image PSNR (orange line, right axis) alongside the distortion intensity for brightness, contrast, blur, noise, and JPEG compression.
thresholds: blur deviation 0.7, noise variance < 0.05, and JPEG factor > 84. It is highly resilient to brightness reduction (down to 20%) and contrast reduction (10%) but is sensitive to excessive enbancement beyond 110% of baselinc. This sensitivity arises because brightness enhancement amplifics high-frequency noise, which compromises watermark recovery.
Notably, MetaSeal maintains high verification accuracy (blue curves) when distortion magnitudes remain low, even these transformations degrade the visual quality of the watermarked images (orange curves). We further visualize MetaSeal's performance under these transformations, well as horizontal flipping, in Appendix D As shown in Fig. 7 transformations may introduce artifacts in extracted secrets, but QR codes remain accurately decodable.
This robustness stems primarily from the design of the visual signature and the trained INN. The visual signature, converted into meaningful patterns like QR codes, acts as specialized encoding scheme that can tolcrate minor errors, enhancing recovery reliability. Mcanwhile, the INN enhances robustness to be- nign Iransformations by embedding the signature in the frequency domain and incorporating noise layers during training, leading to minimal impact due to moderate benign transformations. Together, these com- ponents enable our scheme to support reliable verification even when images undergo typical, non-malicious Iransformations.
6.4 Sensitivity to Perturbations
When watermarked images undergo malicious perturbations, such image editing, MetaSeal demonstrates intentional sensitivity by reflecting these changes in the recovered visual signature. As shown in Fig
14

---

Published in Transactions on Machine Learning Research (02/2026)
editing the watermarked image results in corresponding artifacts in the recovered visual signature. This correlation occurs because the embedded visual signature experiences the same editing operations as the image itself, making modifications visibly detectable. Besides, we also observe that the degree of tamper- ing impacts decoding accuracy: major edits (e.g., introducing more than 10% pixel-level changes) often result in decoding failure. Interestingly, when the extracted QR code exhibits partially intact square mod- ules suggosinng successful embedding by the oracle INN but subsequent manipulation-thin can serve as visual evidence of tampering. In our design, tampering artifacts serve as an interpretability feature assessed by human inspection, but could be further leveraged by training binary classifier for automatic detection.
The ability to reveal pixel-level changes tied to specific perturbations via INN enables localization of tam- pering, which is also demonstrated in (Zhang et al. (2024). This characteristic highlights MetaSeal's 's dual advantages: not only verifies attribution but also provides concrete evidence of tampering attempts. This represents a significant advancement. over traditional watermarking methods, which typically embed fixed bits and produce only binary verification results.
Takeaway 2: MetaSeal resolves the tension between content dependency and robustness by embedding a semantic-awaro visual manattrr-uniqucle tied to image content content-using using an invertible network trained with frequeney-domain embedding and noise augmentation. This design ensures that the watermark remains stable under benign transformations yet fragile malicious perturbations that alter content semantics, achieving reliable attribution without sacrificing tamper sensitivity.
6.5 Anti-forgery Demonstration
6.5.1 Current Forgery Attacks
We demonstrate that MetaSeal is resilient to broad range of forgery attacks, including current forgery attacks discussed in Sec. 3.1 For replay attacks, even if attackers know the detection mechanism, they cannot forge valid signatures ures due to the use of asymmetric cryplography. Specifically, the secrets in MetaSeal are signed with a private key securely held by the model owner or content creator. As a result, attackers cannot generate valid signatures for unrelated images. Moreover, mixup attacks rely on estimating a ground truth watermark by aggregating residuals from multiple watermarked images. However, in MetaSeal, the watermark is content-dependent and varies across images. This prevents attackers from estimating valid signature for specific target image, rendering such attacks ineffective.
For PGD attacks, MetaSeal avoids the weakness of binary detectors that directly classify images as water- marked, which makes them susceptible to adversarial perturbations (Saberi et al. 2024). Instead, MetaSeal uses an INN only to roconstruct the embedded secret, while verification is performed through cryptographic validation of the recovered secret. Thus, the INN merely a reconstruction tool, and the secret- bound to the private dey-uutimateel decides validity. Since attackers lack the private key, they cannot generate valid secrets, making adversarial attacks effective against CNN-basod detectors ineffective against our scheme.
Moreover, recent works have proposed forgery allacks largeting biffus,on-based, content-agnostic watermarks that embed fixed or model-specific signals (Müler et al. 2025 Jain et al. 2025). enabling watermark estima- tion, cancellation, or forgery from limited observations. These attacks are not directly applicable to MetaSeal due to fundamental differences in watermark design. In contrast, MetaSeal embeds content-de neneent-depeneen cryp- tographic signatures, such that each image carries a unique signed message; consequently, attacks that rely on reusing or estimating a fixed watermark signal do not directly transfer. This distinction highlights an inherent limitation of prior watermark designs and motivates the need for attribution mechanisms tailored to forgery-resittant settings.
6.5.2 Adaptive Forgery
We consider a stronger adversary who obtains valid visual signature V from a watermarked image I* and attempts to transplant it into different image Ta with similar content, i.e., f(T*) R s(Ta). It reflects
15

---

Published in Transactions on Machine Learning Research (02/2026)
(a) No Editing
(b) Moderate Editing
(c) Major Editing
Waternrkel Images
RIP
Recovered Secrets
(a) Weighted Mixup
(b) Substitute INN
Figure 9: Robustness to adaptive forgery. Attacks fail to produce decodable secrets.
Figure 8: Sensitivity of MetaSeal to editing, The recovered secrets provide visual tampering evidence.
adaptive threat model in which the attacker maintains semantic consistency to evade content-dependent checks.
Weighted Mixup. In this attack, the adversary blends the extracted visual signature V into an unmarked image la via weighted mixup. Since succossful attack must maintain imperceptible watermark, apply weight of 0.05. The extracted secrets from the forged image are shown in Fig, ((a,, where the oracle INN fails to recover valid QR code, demonstrating the ineffectiveness of this attack.
Substitute INN. We further consider an even stronger threat: an attacker trains a substitute INN using access to the full Training dataset, including original images and their corresponding secrets. The atlacker then uses this substitute model to embed V into new image Ia- As shown in Fig. 9 the extracted signature from the forged image fails verification producing an unreadable QR code. This failure occurs because MetaSeal relies invertibility between embedding and extraction paths, which only holds when both use the same trained weights. Due to training randomness and architectural differences, the substitute INN cannot replicate the oracle LNN's embedding behavior.
Takeaway MetaSeal ensures anti-forgery security through: 1) Cryptographic Binding: Forgery without access to the private key sk is computationally infeasible due to the security of ECDSA. 2) Content Dependency: The watermark is semantically bound to the image content f(),, preventing reuse across different images. 3) Invertibility Isolation: The INN-based embedding is non-replicable due to model-specific parameters, mitigating substitute model attacks.
7 Discussion
7.1 Impact of Semantic Granularity
To develop content-dependent watermarks, we leverage semantic extraction, where the level of granularity influences the trade-off between security and robustness benign transformations. highly detailed se- mantic description significantly roduces the risk of watermark reuse, enhancing sccurity. However, incrcased detail also leads a larger payload, increasing the density of QR codes and making accurate watermark recovery more challenging after benign transformations. Conversely, if the semantic representation is too simple, e.g., only identifying the main object, the watermark may remain valid for other images containing the same object, increasing the risk of false positives.
We conducted experiments to analyze how semantic granularity affects watermark robustness through its impact on QR code density. Our bascline implementation uses a QR code module of 53 53. When the semantic description becomes more fineggriine,, incorporating additional image details, the required payload increases, necessitating denser QR codes. To quantify this effect, tested denser QR code configuration
16

---

Published in Transactions on Machine Learning Research (02/2026)
Veriiication Accurary (90
22.5
30.0
60
-20
27.5
-01
PSNN
20-
15
20
20
0.1
1.5 Brightnese Intensity
0.5
10
2.0
0.5
1.0
1.5
0.1
0.5
1.0
1.5
2,3
0.07
0.01
0.06
0.08
0.10
150
90
Controst Intensity
Blur Intensity
Noise Intensity
JPEG Intemsity
Figure 10: MetaSeal performance under varying distortion intensities with different payload. The solid line denotes a small payload while the dotted line denotes a large payload.
(85 x 85 modules) that accommodates more detailed semantic descriptions. As illustrated in Fig. 10 while the denser QR code maintains perfect verification accuracy for unmodified images, shows reduced resilience benign transformations compared the sparser baseline configuration.
7.2 Scalability and Efficiency
Our method is resolution-agnoslic and can be ap- plied images of varying resolutions without re- training. As shown in Table 4 MetaSeal achieves perfect recovery and verification accuracy across all tested resolutions. Notably, both PSNR and SSIM improve as the image resolution increases. This trend arises because the embedded secret QR code has a fixed number of modules, mak- ing the relative payload smaller in larger im- ages. As result, the watermark introduces less perceptual distortion, enhancing image quality while maintaining exact signature reconstruction. Moreover, we quantify the computational overhead of watermarking by measuring embedding and veri- fication times across different image resolutions (Ta- ble As shown in the results, both embodding and verification times increase with resolution, reflecting the higher computational cost of processing larger images. Embedding time increases more sharply than verifi- cation time, primarily due to the computational cost of semantic extraction and visual signature generation using the private key. However, embedding and verification remain efficient even at high resolutions (c.g.. <1s for one x024x 1024 image), demonstrating the practicality of MetaSeal for real-world implementation.
Table 4: Performance across different resolutions
Dataset
Metric
256x
1024x 1024
2048
PSNR 32.13
36.89
39.08
SSIM
0.9342
0.9772
0.9845
DIV2K
RecAAe
1.000
1.000
1.000
Verdoc
1.000
1.000
1.000
PSNR
32.58
38.54
40.69
SSIM
0.9315
0.9821
0.9890
COCO
RecAoe
1.000
1.000
1.000
Ver
1.000
1.000
1.000
PSNR
30.46
39.00
40.50
SSIM
0.9293
0.9736
0.9774
AIGC
RecAoe
1.000
1.000
1.000
Ver.Ace
1.000
1.000
1.000
7.3 Limitations and Future Works
While MetaSeal provides strong security guarantees through cryplographic signa- tures and content-dependenn design, sev- eral open challenges remain, leaving room for improvement. One limitation is the relatively large payload. Unlike prior methods that embed short binary mes- sages (c.g., 32 bits), MetaSeal uses a cryptographic signature, lypically several hundred bits in length. This increased payload can sometimes slightly degrade visual quality, as reflected in lower PSNR and SSIM scores compared to methods optimized for imperceptibility. The use of high-contrast. black-and-white QR codes further contributes visible arti- facts. Another factor is the optimization of robustness in the INN through the use of noisy layers. While this improves resilience to benign transformations such compression and blurring, it leads to watermarks
Table 5: Watermarking computational overhead: Embedding and verification time (seconds) per batch (16 images) across resolu- tions.
Resolution
256x258
512x512
1024x 1024
2048 x 2048
Embedding (s)
1.291
1.515
3.667
15.198
Verification
0.028
0.184
0.861
9.289
17

---

Published in Transactions on Machine Learning Research (02/2026)
being embedded primarily in the mid-frequenny domain. Although this design enhances robustness, it also degrades PSNR compared to high-frequency embedding, which-while less visible- is too fragile for reliable attribution (see Appendix Dj. This reflects an inherent trade-off between robustness and imperceptibility. A promising direction for future work is to explore alternative visual encoding schemes. For example, adopting softer patterns or low-contrast colored codes could reduce visual artifacts while maintaining the robustness and docodability of the embedded signature. Another limitation is that the current robustness to benign transformations is limited. Improving robustness benign transformations inevitably compromises invis- ibility and increases overall tolerance, which may expand the set of modified images that still verify and thus raise the risk of misattribution. How to achieve selective robustness, i.e., strong robustness to certain benign transformations while remaining semsitive to others, remains an important and unresolved challenge for future work.
8 Related Works
Recent efforts have explored content-dependent watermarking for checking image authenticity. For example, Evennou et al. (Evennou et al. 2024) encode a semantic textual description of the image and verify authentic- ity by comparing it with decoded semantics. Similarly, Arabi et al. (Arabi et al. 2025) embed text prompts into diffusion -generatd images by perturbing the initial noise, and then compare the recovered noise with image semantics for verification. While both methods address image authenticity, they require access to the secret key at verification time, limiting them to private or rami-trusted settings without public verifiability, Besides, there are a few works that have addressed forgery attacks in specific domains. Bileve (Zhou et al. 2024) targets spoofing in language watermarking, but is not applicable to image content. Methods like (Gunn ltt al.) propose watermarking strategies specifically for diffusion-generrteed images, offering limited general- ity for real-world photographs or other generative models. EditGuard (Zhang et al. 2024 improves tamper detection using dual watermarks one for binary verification and one for localization embedded via INNs. However, both are fixed and image-agnostic, making them susceptible to pross-image forgery and lacking semantic binding. WAM (Sander et al. 2025) focuses on localization with high recovery rate but is limited to 32-bit payloads. Neither approach supports high-bit payloads or cryplographic attribution. While Gaus- sian Shading (Yang et al., 2024b) incorporates cryptographic techniques, its goal is distribution- preserving sampling using ChaCha20 ciphers. It does not address attribution, forgery resistance, or public verification, because it embeds fixed, random watermark bits rather than content-dependent attribution information, and relies on symmetric oryptographic primitives, which require keeping the secret. key private. As a result, the verification process cannot be made publicly verifiable without compromising security.
Other closely related lines of work include fingerprinting. steganography, and watermarking with INNs. Fingerprinting approaches (Yu et al. 2022 Kim et. al. 2024) achieve attribution by modilying model weights so that generated images exhibit identifiable characteristics, rather than embedding secrets directly into images, and typically support only limited payloads (~~188 bits). Steganography methods (Jing et al.) 2021
Lu et al. 2021) prioritize covert communccation, emphasizing large payloads and resistance to steganalysis; however, they are typically fragile even to benign transformations and do not aim to support attribution or verification. INN-based watermarking methods such as Ma et al. (2022) and EditGuard [Zhang et al. (2024) leverage invertibility for improved extraction or tamper localization, but embed fixed, content-agnostic bit strings, making them vulnerable to replay and cross-image forgery.
In summary, while prior work has made progress in isolated aspects such as content-dependdence, robustness, or tamper Detection-MetaSealll is the first to integrate semantic binding, cryptographic verification, public verifiability, and visual signature design into a unified framework.
9 Conclusion
This paper presents MetaSeal, a reliable and cryptographically verifiable framework for image attribution. Unlike prior watermarking methods that rely on fixed patterns or detoctor-basod verification, MetaSeal in- troduces content-dependent signatures encoded as structured visual patterns and embodded using invertible neural networks. This design achieves three key goals: binding attribution to image semantics, enabling
18

---

Published in Transactions on Machine Learning Research (02/2026)
exact signature recovery, and ensuring public verifiability without metadata. Our empirical results demon- strate that MetaSeal scales to high-capacity payloads while maintaining perfect verification accuracy and strong image quality. It remains robust to benign transformations yet sensitive to malicious edits, providing not only forgery resistance but also visual evidence of tampering. Morcover, MetaSeal withstands adaptive allacks, benefiting from the cryplographic unforgeability of signatures and the non-replicability of invert- ible embedding. By integrating semantic binding, cryptographic security, and structured visual encoding, MetaSeal offers a practical and provable defense against image misattribution via forgery attacks.
References
Eirikur Agustsson and Radu Timofte. Ntire 2017 challenge on single image super-resolution: Dataset and study. Proceedings of the TEEE conference on computer vision and pattern recognition workshops, pp- 126 135, 2017.
Kasra Arabi, R Teal Witter, Chinmay Hegde, and Niv Cohen. Seal: Semantic aware image watermarking. In Proceedings of the IEEE/CVE International Conference on Computer Vision, pp. 16196-16205, 2025.
Mauro Barni, Franco Bartolini, and Alessandro Piva. Improved wavelet-based watermarking through pixel-
wise masking. IEEE transactions on image processing, 10(5):783-794) -91, 2001.
Mahbuba Begum and Mohammad Shorif Uddin. Digital image watermarking techniques: a review. Infor- mation, 11(2):110, 2020.
Tu Bui, Shruti Agarwal, Ning Yu, and John Collomosse, Rosteals: Robust steganography using autoencoder latent space. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pp. 933 942, 2023.
Ingemar Cox, Matthew Miller, Jeffrey Bloom, Jessica Fridrich, and Ton Kalker. Digital watermarking and steganography. Morgan kaufmann, 2007.
Alexey Dosovitskiy, Lucas Beyer, Alexander Kolesnikov, Dirk Weissenborn, Xiaohua Zhai, Thomas Un- terthiner, Mostafa Dehghani, Matthias Minderer, Georg Heigold, Sylvain Gelly, Jakob Uszkoreit, and Neil Houlsby. An image is worth 16x16 words: Transformers for image recognition scale. In International Conference Learning Representations, 2021. URL
Gautier Evennou, Vivien Chappelier, Fwa Kijak, and Teddy Furon. Swift: Semantic watermarking for image forgery thwarting. In 2024 IEEE International Workshop on Information Forensics and Security (WIFS), pp. 1-6. IEEE, 2024.
Jaiden Fairoze, Guillermo Ortiz-Jimenez, Mel Vecerik, Somesh Jha, and Sven Gowal. On the difficulty of constructing robust and publicly-detectable watermark. In The 28th International Conference on Artificial Intelligence and Statistics.
Hany Farid. An overview of perceptual hashing. Journal of Online Trust and Safety, 1(1), 2021.
Pierre Fernandez, Guillaume Couairon, Hervé Jégou, Matthijs Douze, and Teddy Furon. The stable sig- nature: Rooting watermarks in latent diffusion models. In Proceedings of the IEEE/CVF International Conference on Compuler Vision, pp. 22466 22472,2777777 2023.
Sharath Girish, Saksham Suri, Sai Saketh Rambhatla, and Abhinav Shrivastava. Towards discovery and attribution of woon-world gan generated images. In Proceedings of the IEEE/CVF international conference on computer vision, pp. 14094-14103, 2021.
Shafi Goldwasser, Silvio Micali, and Ronald L Rivest. A digital signature scheme secure against adaptive chosen-message attacks. SIAM Journal on computing, 17(2):281-300) 1988.
Sam Gunn, Xuandong Zhao, and Dawn Song. An undetectable watermark for generative image models. The Thirleenth International Conference Learning Representattios.
19

---

Published in Transactions on Machine Learning Research (02/2026)
Darrel Hankerson and Alfred Menezes. Elliptic curve cryptography. In Encyclopedia of Cryptography, Security and Prisacy, pp- 1-2. Springer, 2021.
Alain Hore and Djemel Ziou. Image quality metries: Psnr vs. ssim. In 2010 20th. international conference on pattern recognition, pp. 2366-2369. IEEE, 2010.
Nasir N Hurrah, Shabir A Parah, Nazir A Loan, Javaid A Sheikh, Mohammad Elhoseny, and Khan Muham- mad. Dual watermarking framework for privacy protection and content authentication of multimedia. Future generation computer Systems, 94:654-6753 673, 2019.
Muzamil Hussan, Shabir Parah, Aiman Jan, and GJ Qureshi. Hash-based image watermarking technique for lamper detection and localization. Health and Technology, 12(2):385-400 2022.
ISACA. Understanding the eu ai act: Requirements and next steps, May 2024. URL isaca.
Anubhay Jain, Yuya Kobayashi, Naoki Murata, Yuhta Takida, Takashi Shibuya, Yuki Mitsufuji, Niv Cohen, Nasir Memon, and Julian Togelius. Forging and removing latent-noise diffusion watermarks using a single image. arXiv preprint 0rXiv2250420011, 2025.
Junpeng Jing, Xin Deng, Mai Xu, Jianyi Wang, and Zhenyu Guan. Hinet: Deep image hiding by invertible network. In Proceedings of the IEEE/CVF international conference computer vision, pp. 4733-4743 2021.
Nikola Jovanović, Robin Staab, and Martin Vechev. Watermark stealing in large language models. In Forty-first International Conference on Machine Learning.
Asra Kamili, Nasir N Hurrah, Shabir A Parah, Ghulam Mohiuddin Bhat, and Khan Muhammad. Dwf- cat: Dual watermarking framework for industrial image authentication and tamper localization. IEEE Transactions on Industrial Informatics, ((1)):518-5517 2020.
Changhoon Kim, Kyle Min, Maitreya Patel, Sheng Cheng, and Yezhou Yang. Wouaf: Weight modulation for user attribution and fineerprintigg in text-to-image diffusion models. In Proceedings of the IEEE/CVP Conference on Computer Vision and Pattern Recognition, pp. 1974-8983, 2024.
Alistair Knott, Dino Pedreschi, Toshiya Jitsuzumi, Susan Leavy, David Eyers, Tapabrata Chakraborti, Andrew Trotman, Sundar Sundareswaran, Ricardo Baeza- Batza-Yates, Przemyslaw Biecek, al. Ai content detection in the emerging information ecosystem: new obligations for media and tech companies. Ethics and information technology, 26(4): 14, 2024.
Pawel Korus. Digital image integrity-a survey of protection and verification techniques. Digital Signal Processing, 11:1-26,44 2017.
Tsung- Yi Lin, Michael Maire, Serge Belongie, James Hays, Pietro Perona, Deva Ramanan, Piotr Dollár, and C. Lawrence Zitnick. Microsoft coco: Common objects in context. In Computer Vision-ECCV 2014: 19th European Conference, Zurich, Swilzerlund, Seplember 6-12, 2014, Proceedings, Parl V 13, pp. 740 755. Springer, 2014.
Jade Lindley.
Preventing art forgory and fraud through emerging technology: application of regulatory pluralism model. In Research handbook on art and law, pp. 160 176. Edward Elgar Publishing, 2020.
Yepeng Liu, Yiren Song, Hai Ci, Yu Zhang, Haofan Wang, Mike Zheng Shou, and Yuheng Bu. Image watermarks are removable using controllable regeneration from clean noise. In The Thirteenth International Conference on Learning Representations, 2025. URL httph::t/////t attp:p///pppaaeeeees.ssee//rrrra
Chun-Shien Lu and H-YM Liao. Multipurpose watermarking for image authentication and protection. JEEE transactions on image processing, 10(10):1579-1555 15922, 2001.
20

---

Published in Transactions on Machine Learning Research (02/2026)
Shao-Ping Lu, Rong Wang, Tao Zhong, and Paul L Rosin. Large-capacity image steganography based invertible neural networks. In Proceedings of the IEEE/CVE conference on compuler vision and pattern recognition, pp. 10816 10022,, 2021.
Rui Ma, Mengxi Guo, Yi Hou, Fan Yang, Yuan Li, Huizhu Jia, and Xiaodong Xie. Towards blind watermark- ing: Combining invertible and non-invertible mechanisms. In Proceedings of the 30th ACM International Conference on Multimedia, pp. 1532-1542, 2022.
Aleksander Madry, Aleksandar Makelov, Ludwig Schmidt, Dimitris Tsipras, and Adrian Vladu. Towards deep learning models resistant to adversarial attacks. In International Conference on Learning Representations, 2018. URL httts:://operreviiiiiie http://ww...ettrrrmmmdddd/d/111
Andreas Müller, Denis Lukovnikov, Jonas Thietke, Asja Fischer, and Erwin Quiring. Black- box forgery attacks semantic watermarks for diffusion models. In Proceedings of the Computer Vision and Pattern Recognition Conference, pp. 20937 20946, 2025.
Alec Radford, Jeffrey Wu, Rewon Child, David Luan, Dario Amodei, Πlya Sutskever, et al. Language models are unsupervised multitask learners. OpenAl blog, 1(8):9, 2019.
Robin Rombach, Andreas Blattmann, Dominík Lorenz, Patrick Esscr, and Björn Ommer. High-rcsoltton
image synthesis with latent diffusion models. In Proceedings of the IEEE/CVF conference on compuler vision and pattern recognition, pp. 10684-10695, 2022.
Leonard Rosenthol. C2pa: the world's first industry standard for content provenance (conference presenta- tion). In Applications of Digital Image Processing XLV, volume 12226, pp. 122260P. SPIE, 2022.
Moumita Roy, Dalton Meitei Thounaojam, and Shyamosree Pal. A perceptual hash based blind- watermarking scheme for image authentication. Expert systems with applications, 227:120237, 2023.
Mehrdad Saberi, Vinu Sankar Sadasivan, Keivan Rezaei, Aounon Kumar, Atoosa Chegini, Wenxiao Wang, and Soheil Feizi. Robustness of Al-image detectors: Fundamental limits and practical attacks. In The Twelfth International Conference Learning Represenlations, 2024. URL httpp:://pperrevee..
forum?id=dLokaiKEi.
Tom Sander, Pierre Fernandez, Alain Durmus, Teddy Furon, and Matthijs Douze. Watermark anything with localized messages. In International Conference on Learning Representations (ICLR), 2025.
Mare Schneider and Shih-Fu Chang. A robust content based digital signature for image authentication. In Proceedings of 3rd IEEE international conference on image processing, volume 3, pp. 227 230. IEEE, 1996.
Zeyang Sha, Zheng Li, Ning Yu, and Yang Zhang. De-fake: Detection and attribution of fake images generated by text-to-image generation models. In Proceedings of the 2023 ACM SIGSAC conference on computer and communications security, pp. 3418 3432, 2023.
Rajeev Sobti and Ganesan Geetha. Cryptographic hash functions: a review. International Journal of Computer Science Issues (IJCSI), (2)):66,, 2012.
Lukas Struppek, Dominik Hintersdorf, Daniel Neider, and Kristian Kersting. Learning to break deep per- ceptual hashing: The use case neuralbash. In Proceedings of the 2022 ACM Conference on Fairness, Accountability, and Transparency, pp. 58-69, 2022.
Emma Tonkin and Julie Allinson. Signed metadata: method and application. In Proceedings of the Inter- national Conference on Dublin Core and Metadata Applications. Dublin Core Metadata Initiative, 2006.
Tao Wang, Yushu Zhang, Shuren Qi, Ruoyu Zhao, Zhihua Xia, and Jian Weng. Security and privacy on generative data in aige: A survey. ACM Computing Surveys, 57(4))133, 2024.
Yuxin Wen, John Kirchenbauer, Jonas Geiping, and Tom Goldstein. Tree-rings watermarks: Invisible fin- gerprints for diffusion images. In Thirth-seventh Conference on Neural Information Processing Systems, 2023. URL htttpp///oopaaeevveeeeee/rrrrrrr
21

---

Published in Transactions on Machine Learning Research (02/2026)
Mingqing Xiao, Shuxin Zheng, Chang Liu, Yaolong Wang, Di He, Guolin Ke, Jiang Bian, Zhouchen Lin, and Tie Yan Liu. Invertible image rescaling. In Compuler Vision -CCC 2020: 16th European Conference, Glasgow, UK, August 23 28, 2020, Proceedings, Part 1 16, pp. 126 144. Springer, 2020.
Yazhou Xing, Zian Qian, and Qifeng Chen. Invertible image signal processing. In Proceedings of the IEEE/CVF conference on computer vision and pattern recognition, pp. 6287-6296, 2021.
Rui Xu, Mengya Hu, Deren Lei, Yaxi Li, David Lowe, Alex Gorevski, Mingyu Wang, Emily Ching, and
Alex Deng. Invismark: Invisible and robust watermarking for ai-generated image provenance. In 2025 IEEE/CVF Winter Conference on Applications of Computer Vision (WACV), pp. 909-918. IEEE, 2025.
Pei Yang, Hai Ci, Yiren Song, and Mike Zheng Shou. Can simple averaging defeat modern watermarks?
In The Thirly-eighth Annual Conference on Neural Informalion Processing Systems, 2024a. URL https:
//openreview wwteeviiewwneeeetee
Zijin Yang, Kai Zeng, Kejiang Chen, Han Fang, Weiming Zhang, and Nenghai Yu. Gaussian shading: Provable performance-losleess image watermarking for diffusion models. Tn Proceedings of the IEEE/CVP Conference on Computer Vision and Pattern Recognition, pp. 12162 12171, 2024b.
Ning Yu, Larry S Davis, and Mario Fritz. Attributing fake images to gans: Learning and analyzing gan fingerprints. In Proceedings of the IEEE/CT /CFF international conference on computer vision, pp. 7556-7566. 2019.
Ning Yu, Vladislav Skripniuk, Dingfan Chen, Larry Davis, and Mario Fritz. Responsible disclosure of generative models using scalable fingerprinting. In International Conference on Learning Representations (ICLR), 2022.
Kevin Alex Zhang, Lei Xu, Alfredo Cuesta- Infante, and Kalyan Veeramachaneni. Robust invisible video watermarking with attention. arXiv preprint MXX::1909.01283, 2019.
Xuanyu Zhang, Runyi Li, Jiwen Yu, Younin Xu, Weiqi Li, and Jian Zhang. Editguard: Versatile image wa- termarking for tamper localization and copyright protection. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pp. 11964 11974, 2024.
Xuandong Zhao, Kexun Zhang, Zihao Su, Saastha Vasan, Tlya Grishchenko, Christopher Kruegel, Giovanni Vigna, Yu-Xiang Wang, and Lei Li. Invisible image watermarks are provably removable using generative ai. Advances in neural information processing systems, 37:8643 8672, 2024.
Xuandong Zhao, Sam Gunn, Miranda Christ, Jaiden Fairozo, Andres Fabroga, Nicholas Carlini, Sanjam Garg, Sanghyun Hong, Milad Nasr, Florian Tramer, Somesh Jha, Lei Li, Yu-Xiang Wang, and Dawn Song. SoK: Watermarking for AT-Generated Content In 2025 IEEE Symposium on Security and Privacy (SP), pp. 2621 2639, Los Alamitos, CA, USA, May 2025. IEEE Computer Society. doi: 10.11177 2025.00178. URL https:://dot www.ocootteeeessiiiir....o.. wwwp:/iiiiittttttoooooooo 111.//00..199//11157 2025. 00178
Tong Zhou, Xuandong Zhao, Xiaolin Xu, and Shaolei Ron. Bileve: Securing text provenance in large language models against spooling with bi-level signature. In The Tighty-eighth Annual Conference on Neural Information Processing Systems, 2024.
Jiren Zhu, Russell Kaplan, Justin Johnson, and Li Fei-Fei, Hidden: Hiding data with deep networks. In European Conference on Computer Vision, 2018. URL https:://pp: semanticscholar. wwwps/cchhhoaaaooo///oooo httg//CrpussD:: 50784854
A Analysis of Structured Visual Embedding
This section provides an intuitive and probabilistic analysis of why structured visual embedding is better suited for cryptographic attribution than conventional bit-wise watermarking. We emphasize that the anal- ysis is not a formal security proof, but justification of the design choice underlying our Visual Attribution Signature.
22

---

Published in Transactions on Machine Learning Research (02/2026)
Limitations of bit-wise embedding. Consider cryptographic signature S E {0, 1) with N 512. In bit-wise watermarking, correct verification requires near-perfect recovery of all bits (Cox et al. 2007 Zhu et al. 2018 Fernandez et al. 2023). Let Pe denote the per-bit error probability under benign image transformations. The probability of successful extraction is
(su(ssccess)
II p(b: b.)= =1 pc)
(18)
Even for modest error rate Pe 0.01, this yields (0.99) 0.006, demonstrating that bit-wisc embedding is intrinsically fragile when scaled cryplographic payload sizes.
Structured visual embedding. Instead of treating the signature independent bits, our method rep- resents it structured visual pottern V E {0, (0,1) with explicit spatial organization and redundancy. This converts extraction from fragile bit-recovery problem into pattern-ocoddngg problem, yielding two key advantages.
1) Local redundancy via spatial structure. Due to structural regularity, neighboring elements in are statistically correlated. Let (ii) denote the spatial neighborhood of element i. Then
P(b. b. ((())) p(b: = b,),
(19)
reflecting the fact that local consistency can be exploited during decoding. This form of redundancy is inherent to the visual structure and does not arise independent bit-wise embedding.
2) Global error tolerance via structured decoding. In our implementation, the visual pattern instanti- ales a QR-style code with Reed Solomon (RS) error correction. Let (n, ki d) denote the RS parameters, with coro--correction capability = L(d 1)/2]. Assuming a symbol error rate Ps, the probability of successful dccoding
Σ
Ppatteru (success)
p.)
(20)
Unlike bit-wise decoding, failure occurs only when errors exceed a global threshold, yielding graceful degra- dation rather than catastrophic failure.
While error-corecctng codes can principle be applied to any fingerprint, bit-wise watermarking still requires exact recovery of the encoded bitstream from noisy image features, which remains the dominant failure mode. In contrast, structured visual embedding integrates redundancy, spatial correlation, and decoding geometry at the visual level, enabling reliable recovery even when individual elements corrupted. This distinction is critical for cryptographic verification, which tolerates no bit errors. This analysis explains why structured visual embedding fundamentally alters the robustness capacity trade-off, making large, oryptographically meaningful payloads feasible. It provides the design rationale for MetaSeal 's visual attribution signature, rather than a formal cryptographic guarantee.
B Invertible Neural Networks
The architecture of INN has 16 invertible blocks. Each of them are composed of three modules: Φ(-), p(-), and n()). These modules are built. by dense blocks, which has better representation ability than convolutional blocks and residual blocks, as demonstrated in Jiin et al. (021). In particular, iven an input feature map x E Hx the block consists of five convolutional layers. Each of the first four layers has output channels and is followed by LeakyReLU activation. The input to each convolutional layer is the concatenation of the original input and all preceding intermediate features, forming progressively richer
23

---

Published in Transactions on Machine Learning Research (02/2026)
Watermarked image
Recovered secret
With regenerate attack
Recovered secret
PSNR:35.55
PSNR:23. SSIM: 0.909
Figure 11: Left: Image watermarked with MetaSeal and its recovered secret. Right: Apply a regeneration attack (Zao et al. 2024 to the watermarked image and its recovered secret.
representations. Formally, the block can be described as:
fl [eatyReLLU(CConssxx(
f2 Leakyyel..(CConvvslll (x; fil))
f3 Leaky ([x, f2))
f4 = LeakyReLU f1, f3)))
= ConVaxa f, f2, f3, f4])
Hero, [.] denotes channel-wise concatenation. The final output y has the same number of channels as the desired output dimension. To stabilize training, the weights of the final convolution layer are initialized zero, ensuring the block initially behaves like identity mapping.
The INN used in MetaSeal is lightweight, with only 4 million parameters, making it computationally efli- cient and easy to integrate into existing systems. Its compact size enables seamless deployment in resource- constrained environments and allows it to be embedded into image generation pipelines for real-time wa- termarking with minimal overhead. This efficiency distinguishes from larger encoder-decoder models and makes it suitable for scalable applications such as online content creation platform-level attribution enforcement.
C
Performance under Regeneration Attack
Here we evaluate the behavior of MetaSeal under advanced watermark removal attacks (Zhao et al., 2024 Liu
ct al. 2025 Specifically, Fig. [1 reports results under regeneration attack based diffusion models (Zhao et al. 2024 After regeneration, the recovered visual signature is no longer scannable, and attribution verification fails. This outcome is expected: Regeneration fundamentally rewrites the image through an iterative diffusion process, which disrupts the invertible embodding structure lcarned by the INN. As a result, the extracted secret is no longer intact and fails cryptographic verification.
We further observe that successful removal via regeneration comes substantial perceptual cost. Compared to the unwatermarked image, the original watermarked image has PSNR dB and SSIM 0.965, whereas the regenerated image degrades to 23.23 dB PSNR and 0.909 SSIM. This degradation indicates that the attack trades attribution removal for a significant loss in image fidelity, reducing the practical value of the manipulated content.
D
More Results of Transformations
Here we add more evaluations against common transformations, as shown in Fig. 12 For scaling, the verification accuracy remains perfect (100%) across scale factors 2.0, 1.5, and 1.0, demonstrating strong resilience upscaling. However, accuracy drops when the scale reduced further. This indicates that excessive downscaling can severely distort or crase the watermark signal. For random cropping, verification accuracy exhibits gradual degradation the crop ratio increases. Starting from 96.97% at 5% crop, the
24

---

Published in Transactions on Machine Learning Research (02/2026)
Effect of Scaling
Vorification Accuracy (%)
Effect of Cropping
Verification Accuracy
100
100
50
50
2.0
1.5
1.0
0.05
0.10
0.15
0.20
0.25
Scale
Crop Ratio
Figure 12: The resilience of MetaSeal against scaling and random cropping.
30.99/0.831
25.58/0.623
12.44/0.4021
22.06/0.749
20.22/0.830
35.34/0.926
Watermarked Images
Recoveree vered
Secrets
(a) JPEG
(b) Noise
(c) Flip
(d) Contrast
(c) Brightness
(1) Blur
Figure Evaluation of secret recovery from watermarked images under benign Transformations. The PSNR/SSIM displayed for cach image compared with the unwatermarked image. The top row shows watermarked images subjected lo different transformations, while the bottom displays the recovered secrets (QR codes) under each transformation. One can scan these QR codes to test the consistency of the recovered secrets.
accuracy declines to 82.83% at a 25% crop. These results suggest that the watermark maintains robustness under moderate cropping but becomes vulnerable when a substantial portion of the image is removed.
Furthermore, we visualize the recovered secrets from wa- termarked images subjected to various transformations. We apply a set of transformations with detailed parame- ter settings provided in Tab. [6] The visualization results, shown in Fig. 13 demonstrate that our method consis- tently retrioves accurate information from the extracted QR codes, even when transformations degrade the qual- ity of the recovered secrets. Notably, despite distortions such compression and noise, the encoded information remains decodable, highlighting the resilience of our approach against common image modifications. This robustness ensures that our watermarking system remains reliable in practical deployment scenarios where images undergo benign processing or distribution-related alterations.
Table 6: Transformation parameters.
Transformation
Parameter
Flip
Horizontal Flip
Brightness
brightness brightness_factore1..2 faccto=11.2 contrast, 1titrass_factor11.555
Contrast
Gaussian Blur
kernel_eize-s size=3,, sigma=0.5
Gaussian Noise
mean=0, std=1, intensity=O..
JEPG
Q=90
E Effect of Noisy Layers
We examine the effect of training the INN model with noisy layers. Fig. compares the frequency-domain decompasition of watermarked images produced with and without noisy layers during training. When noisy
25

---

Published in Transactions on Machine Learning Research (02/2026)
Watermarked Image
LL (Approximation)
LH (Horizontal Detail)
HL (Vertical Detail)
HH (Diagonal Detail)
PSNR:35.58/ SSIM: 0.965
(a) With noisy layers
Watermarked Image
LL (Approximation)
LH (Horizontal Detail)
HL (Vertical Detail)
HH (Diagonal Detail)
PSNR:36.59/ SSIM: 0.965
(b) Without noisy layers
Figure 14: Wavelet decompasition of watermarked images (a) with and (b) without noisy layers during training. Without noisy layers, the watermark tends to concentrate in the high-frequency bands (HH), making it more imperceptible but fragile. In contrast, noisy layers promole embedding the mid-frequency bands (particularly HL), enhancing robustness to benign transformations the cost of slightly increased perceptibility (lower PSNR).
layers are used, watermark energy is more prominently concentrated in the mid-frequency bands (especially the HL component), which enhances robustness to common image transformations such as compression. In contrast, without noisy layers, the watermark is more uniformly distributed or biased toward high-frequency regions (HH), which may improve imperceptibilitty but leads to poor resilience under benign distortions. Specifically, cannot resist compression with any factors, Lee, with even bit compression (Q=99), the verification accuracy will drop to 0. This fragility highlights critical limitation: while high-frequency em- bedding may yield imperceptible watermarks, it fails to survive even the slightest benign transformation. In worl-world scenarios, robustness to benign transformations is essential for reliable attribution. This observa- tion illustrates the inherent trade-off between robustness and invisibility. In our implementation, the PSNR dropped a little bit after adding noisy layers to improve robustness. However, this degradation is barely ob- served by human perceptions, while the resulting improvement in robustness against benign transformations is substantial.
26


Reviews:
[{"review_id": "skERIayAZT", "reviewer": "Reviewer_jAXW", "summary": "", "questions": "", "limitations": "", "rating": null, "confidence": null, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "Yes", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "paper_topic_and_main_contributions": "", "excitement": null, "reproducibility": null, "ethical_concerns": "", "main_review": "", "summary_of_the_paper": "", "summary_of_the_review": "", "strength_and_weaknesses": "", "limitations_and_societal_impact": "", "review_text": "", "summary_of_contributions": "The paper proposes MetaSeal, a content-dependent watermarking framework for reliable image attribution that targets two key weaknesses of prior approaches: content-agnostic watermarks and detector-based verification that can be attacked. MetaSeal derives semantic features from the image, digitally signs them, encodes the signature into a QR code, and embeds this pattern into the image using an invertible neural network so the secret can be recovered precisely and verified cryptographically with a public key. Experiments on natural and AI-generated images show perfect extraction/verification at much larger payloads than common baselines, robustness to benign transformations (e.g., JPEG), sensitivity to malicious edits with visible tamper evidence, and strong resistance to replay, mixup, PGD-style, and adaptive forgery attempts.", "claims_and_evidence_yn": "Yes", "claims_explanation": "Strengths include a principled cryptographic design that tightly binds attribution to image semantics, enabling high-capacity yet exact watermark recovery, along with a thorough empirical evaluation that probes multiple dimensions (image quality, robustness to benign transformations, tamper sensitivity, and resistance to several forgery/adaptive attack settings).", "audience_yn": "Yes", "audience_explanation": "Researchers working on trustworthy AI, digital watermarking, and content provenance would be interested in this paper’s findings, as it addresses forgery-resistant image attribution with cryptographic guarantees and empirical evaluation relevant to both natural and AI-generated images.", "requested_changes": "1. Some of the theoretical presentation feels like \"decorative math.” The paper largely restates the standard definition of cryptographic unforgeability without clearly connecting it to the watermarking setting. Similarly, the analysis in Sec. 5.4 is fairly superficial and does not provide much additional insight beyond a high-level comparison. I’m completely fine with omitting it or moving it to the appendix.\n\n\n2. The paper’s discussion of robustness versus forgery resistance in Sec. 2 is not entirely accurate. As currently written, it seems to imply that attribution watermarking does not require robustness to strong removal attacks, which may not hold under realistic threat models. Indeed, there is an inherent trade-off between robustness and unforgeability: increasing tolerance to transformations can enlarge the set of modified images that still verify, potentially raising the risk of misattribution. It may be better to frame the distinction as requiring a different balance (and threat-model-dependent prioritization) rather than suggesting robustness is largely unnecessary.\n\n\n3. It is unclear how the method performs under regeneration-style watermark removal attacks (see references below). Some similar plots as in Sec. 6.5.2 would be enough to help us understand the robustness of the proposed approach in this new challenge. \n\nZhao, Xuandong, Kexun Zhang, Zihao Su, Saastha Vasan, Ilya Grishchenko, Christopher Kruegel, Giovanni Vigna, Yu-Xiang Wang, and Lei Li. \"Invisible image watermarks are provably removable using generative AI.\" Advances in neural information processing systems 37 (2024): 8643-8672.\n\nLiu, Yepeng, Yiren Song, Hai Ci, Yu Zhang, Haofan Wang, Mike Zheng Shou, and Yuheng Bu. \"Image watermarks are removable using controllable regeneration from clean noise.\" arXiv preprint arXiv:2410.05470 (2024).\n\n\n\nMinor point: \nIn Eq. (5), the indicator function is confusingly written. I believe the intended meaning is to count an error when the predicted bit crosses the 0.5 threshold but disagrees with the ground-truth bit (i.e., $\\mathbf{1}[\\mathbf{1}(p(\\hat m_i)\\ge 0.5)\\neq m_i]$). The current form does not express this clearly/correctly and should be rewritten.", "broader_impact_concerns": "N/A", "additional_comments": "", "extra_scores": {}, "extra_text": {}}, {"review_id": "bYtwwJlDYX", "reviewer": "Reviewer_WbRx", "summary": "", "questions": "", "limitations": "", "rating": null, "confidence": null, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "No", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "paper_topic_and_main_contributions": "", "excitement": null, "reproducibility": null, "ethical_concerns": "", "main_review": "", "summary_of_the_paper": "", "summary_of_the_review": "", "strength_and_weaknesses": "", "limitations_and_societal_impact": "", "review_text": "", "summary_of_contributions": "The paper proposes a method for watermarking that enables attribution of images to their creator or source by combining cryptographic signatures with a content-dependent message. To my knowledge, the overall method is novel:\n\nAn image caption and its cryptographic signature are encoded in a QR code. Embedding and detection of watermarks are achieved by an invertible neural network that maps an image together with its caption and cryptographic signature in QR code format to a watermarked image (plus a noise term that encodes the lost information). \n\nThe proposed method thereby addresses robustness to forgery in several ways. Firstly, tampered images can be detected by use of the invertible neural network, as tampering leads to a degradation of the QR codes. Secondly, the matching key can decode the cryptographic signature to authenticate the message. Since the message depends on the content, the reuse of watermarks on new (possibly harmful) data can be detected. By combining these capabilities, the approach is interesting in certain use cases.\n\n&nbsp; \n\n**Strengths:** \n+ The content dependence of the watermark ensures that attempts to reuse the watermark on unrelated images can be detected. \n+ The model is shown to be robust to forgery. An interesting experiment illustrates how tampering of watermarked images becomes visually apparent in form of corrupted QR codes. \n+ The watermarking is a post-hoc method, making it applicable to both natural and AI-generated content (rather than being restricted to generated content).\n+ The experimental section demonstrates strong attribution performance for long message lengths. \n\n&nbsp; \n\n**Weaknesses:**\n- The method is not placed well into related work in several ways: (i) It does not acknowledge existing work on watermarking that similarly use invertible neural networks. (ii) Limitations of prior work discuss only those of a selectively chosen list of baselines. (iii) The experimental section has a selected list of baselines \n- The robustness of the method is very limited\n- The theoretical analysis does not provide meaningful theoretical insights into the proposed method\n\n&nbsp; \n\n**Discussion of perceived weaknesses:**\n\n*Related work:*\n\n- The proposed solution is not positioned within the broader literature on fingerprinting, which similarly allow to attribute content to specific users or models. Most importantly, although the paper highlights invertible neural networks as a key choice for achieving strong performance with large capacity, it does acknowledge prior work that uses invertible networks for watermarking, e.g. [1-3]. In particular, [3] also use invertible neural networks for embedding large capacity messages into images, and it builds upon earlier “high-capacity” solutions that hide entire images inside other ones.\n- Similarly, the Section 3.2 (“Limitations of previous work”) compares to “Hidden” a method suggested in 2018 and, to my knowledge, the first paper on watermarking to jointly train an encoder and a decoder. There exist more recent methods with larger capacity, e.g. [2-4], so the stated limitations of previous work seem to apply only to a selectively chosen list of baselines. \n- The experimental section also compares against a restricted list of models, most of which are older approaches. There is an emphasis on the high-capacity of the proposed method. However, the only recent baseline, WAM, is designed for retrieval of the watermark from any segment of the image, and it therefore does not target high-capacity watermarking.\n\n[1] Ma et al, Towards Blind Watermarking: Combining Invertible and Non-invertible Mechanisms (ACM Multimedia 2022)\n\n[2] Jing et al, Hinet: Deep image hiding by invertible network (ICCV 2021) \n\n[3] Lu et al, Large-capacity image steganography based on invertible neural networks. (CVPR 2021)\n\n[4] Yu et al, Responsible disclosure of generative models using scalable fingerprinting (ICLR 2022)\n\n&nbsp; \n\n*Robustness:*\n\n+ The experiments show limited robustness to natural perturbations. For example, even small payloads fail under jpeg compression at 80% compression and additive noise of only 0.06 is sufficient to break the watermark. By construction, the proposed method is also likely not robust under cropping, but this is not investigated. \nDue to its use of a neural network, the method may also lack robustness to adversarial examples. Finally, because the watermark only adds minimal distortions to an existing image, the approach is not robust under noise-denoising strategies\n\n&nbsp; \n\n*Theoretical analysis:*\n\n+ Section 5.4 promises to offer a theoretical analysis of the method and its design choices. However, the arguments in Part 1 seem unclear and appear to refer to the use of QR codes, which are not introduced until the experimental section. It is also no explained whether Equation (17) follows from a concrete derivation or is presented merely as an intuition.  Part 2 discusses the inherent error correction of QR codes (again, which are not mentioned as part of the methodology), but these properties are not specific to the proposed method: Fingerprints can always incorporate error correction mechanisms.", "claims_and_evidence_yn": "No", "claims_explanation": "While most claims are well-supported, there are the following issues related to the above mentioned weaknesses.\n\n**Positioning of paper and contribution:**\n\nGiven the above, it remains unclear why the paper claims being “*the first image attribution watermark that provides innovative solutions to these fundamental questions*”. The discussion of limitations of related work and experimental section do not seem to survey a fair acknowledgement and comparison to existing work.  The method could be better positioned with a more complete review of related work and a fairer and a more modest discussion of the advantages.\n\n**Robust against benign transformation**\n\nThe method is advertised as being robust, in particular against benign transformations. The experiments do not support this claim (see discussion of weaknesses). \n\nIn addition, the paper argues that other methods that rely on detector-based verification can be tricked. However, the proposed method also relies on an (invertible) neural network and might therefore also be vulnerable to adversarial examples. Elsewhere, the paper suggests that robustness to adversarial removal of the watermark would imply “*tolerance to modifications, which contradicts the goal of attribution*” and that removal of watermarks poses minimal harm. To the latter, I disagree:  Adversarial attacks (PGD) can preserve image quality and content while removing attribution, enabling the removal of watermarks from harmful content or to evade copyright-related attribution.", "audience_yn": "Yes", "audience_explanation": "The topic of watermarking and detection of forgery are very active research topics in the machine learning community and there is a great interest in new methodologies.", "requested_changes": "**Major:**\n\nBased on my discussion above, I suggest the following changes as critical: \n\n+ The paper should acknowledge similar approaches in prior work, e.g. by incorporating (at least some of) the above-named papers on watermarking using invertible networks and large capacity watermarking techniques. The paper should work out the contributions relative to existing work. \n+ The paper should tone down its claims on robustness. \n+ The method should be fairly classified in the existing literature in terms of robustness and capacity.\n+ The paper should either introduce the use of QR codes in the methodology or formalize what generalization the author’s have in mind and clarify Part 1 in the theoretical analysis.\n\n**Minor:**\n\n+ Definition 2 lacks an explanation of its notation\n+ In Tables 2 and 3, the best entry in each column should be in bold, not just the best performance of the proposed method", "broader_impact_concerns": "No concerns", "additional_comments": "", "extra_scores": {}, "extra_text": {}}, {"review_id": "p3CAsf68jI", "reviewer": "Reviewer_pFdn", "summary": "", "questions": "", "limitations": "", "rating": null, "confidence": null, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "Yes", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "paper_topic_and_main_contributions": "", "excitement": null, "reproducibility": null, "ethical_concerns": "", "main_review": "", "summary_of_the_paper": "", "summary_of_the_review": "", "strength_and_weaknesses": "", "limitations_and_societal_impact": "", "review_text": "", "summary_of_contributions": "This paper suggests a publicly verifiable watermark that is attached to the content of the watermarked images. They embed the watermark using a discrete wavelet transform (DWT). An INN (Invertible Neural Network) is used to embed the image together with the watermark in a way that will be later detectable, with some robustness to removal transformations. After recovery of the embedded signal, in the form of a QR code, the watermark is validated in terms of spatial integrity and relation to the content of the images. Empirical experiments validate the watermark's robustness to removal attacks and reasonable robustness to forgery attacks.\n\nMain Strengths:\n1. The problem of making a publicly verifiable watermark that is attached to the content is interesting, and important.\n2. The breakdown of watermark usages to Copyright protection, Authentication, Attribution, is nice. I also liked Sec.3.2.\n3. Empirical evaluation validates the claim about resistance to some forgery and removal attacks.\n\nMain weaknesses:\n1. Reading the paper end to end, a lot of the details remain unclear to me. It was not clear to me what about the INN make the watermark robust (unlike \"regular\"  adversarial training)\n2. While the paper does have merit, imprecise use of language often results in exaggerated claims.\n3. No GitHub code is attached for reproducibility purposes", "claims_and_evidence_yn": "Yes", "claims_explanation": "Most technical claims about robustness are empirically evaluated. Yet, some claims in the intro are too far reaching (see \"Additional Comments\").", "audience_yn": "Yes", "audience_explanation": "I think the study of  publicly verifiable watermark that is attached to the content is relevant to the TMLR community. Yet, in order for future research to use this work, it is most likely needs to be:\n(i) Explained in a clearer way\n(ii) Be accompanied with a code for reproducibility purposes.", "requested_changes": "Please see \"Additional Comments\" below.\n\nMost importantly, I find that one of the key contributions (the INN) lacks clarity. I'm uncertain both about its usage and about why it represents \"the right solution\" for this particular application. While I'm willing to accept that it performs well empirically, I would benefit from a clearer explanation of the theoretical or practical motivations behind this architectural choice.\n\nAdditionally, I believe several sections of the manuscript would benefit from improved clarity and accuracy of claims.\n\nFinally, regarding the detection aspect, I'm unclear about how the QR code can be successfully inferred when portions of it have been cropped. Specifically, how does the verifier determine which bits are encoded in which locations when part of the code is missing?", "broader_impact_concerns": "N/A", "additional_comments": "1. What \"IWT\" stands for? (Figure 3).\n2. Claims such as \"We propose MetaSeal, the first image attribution watermark that provides innovative solutions to these fundamental questions\" are not accurate (as can also be seen by the works brought by the authors in Sec. 8)\n3. For citations, please use the conference /  journal version of each cited paper when available (rather than the arXiv one)\n4. Some sentence are unclear, E.g.:\n- \"To realize this, we implement f using an image-to-text model that maps visual content to a deterministic textual description. Specifically, we decompose f into an encoder–decoder architecture” (not clear, especially the role of the text there).\n- Most of Sec. 5.4\n- \"While Gaussian Shading (Yang et al., 2024b) incorporates cryptographic techniques, its goal is distribution-preserving sampling using ChaCha20 ciphers. It does not address attribution, forgery resistance, or public verification” - why it does not address attribution?\n5. \"To address these challenges, MetaSeal introduces two key innovations. First, it generates content-dependent signatures that encapsulate the image’s semantic information, ensuring the watermark is tied to the content rather than pixel details.\". Again, while this work has some merit, none of this parts are truly novel w.r.t. to pervious methods (and not even the combination of these)\n6. Fig. 3 can be made much clearer. E.g., what is the loss and function of the INN there?\n7. It is not clear how the very clean QR codes (e.g., Fig.6) are related to the DWT embedding.\n8.  Claims such as “Forgery without access to the private key sk is computationally infeasible due to the security of ECDSA” ; “The INN-based embedding is non-replicable due to model-specific parameters, stopping substitute model attacks. “- are too strong, especially when works such as [2,3] are not evaluated (let alone new attacks not yet invented). \n9. Figure 11 - the left plot is not clear to me. The closer the scale is to 1 the lower the accuracy? I thought 1 means the not perturbing the image at all.\n2. Overall the the public/private verification part seems to be essential to you contribution and I would recommend emphasizing it better\n\n\n[1] Müller, A., Lukovnikov, D., Thietke, J., Fischer, A., & Quiring, E. (2025). Black-box forgery attacks on semantic watermarks for diffusion models. In Proceedings of the Computer Vision and Pattern Recognition Conference (pp. 20937-20946).\n‏\n[2] Jain, A., Kobayashi, Y., Murata, N., Takida, Y., Shibuya, T., Mitsufuji, Y., ... & Togelius, J. (2025). Forging and Removing Latent-Noise Diffusion Watermarks Using a Single Image. arXiv preprint arXiv:2504.20111.‏", "extra_scores": {}, "extra_text": {}}]

Author rebuttal:

Decision: Accept (poster)