Title: On the Coexistence and Ensembling of Watermarks
Venue: NeurIPS 2025
Accepted: yes
Keywords: Watermarking

Ensembling

Machine Learning
Abstract: Watermarking, the practice of embedding imperceptible information into media such as images, videos, audio, and text, is essential for intellectual property protection, content provenance and attribution. The growing complexity of digital ecosystems necessitates watermarks for different uses to be embedded in the same media. However, to detect and decode all watermarks, they need to coexist well with one another. We perform the first study of coexistence of deep image watermarking methods and, contrary to intuition, we find that various open-source watermarks can coexist with only minor impacts on image quality and decoding robustness. The coexistence of watermarks also opens the avenue for ensembling watermarking methods. We show how ensembling can increase the overall message capacity and enable new trade-offs between capacity, accuracy, robustness and image quality, without needing to retrain the base models.


Peer reviews:
{"IS_META_REVIEW": false, "comments": "SUMMARY:\nThis paper provides a pioneering investigation into the coexistence and ensembling of watermarking methods, demonstrating that multiple watermarks can coexist in a single image with minimal impact on image quality and decoding accuracy.\n\nSTRENGTHS AND WEAKNESSES:\nStrengths:\n1. The paper offers a unique contribution by exploring the coexistence of multiple watermarks within the same image, a topic not previously studied, challenging the assumption that overlapping watermarks would overwrite each other.\n\n2. The paper conducts extensive experiments to validate the coexistence of different watermarks and proposes an effective method for watermark ensembling using strength control and error-correcting codes.\n\n3. The writing of this paper is generally good and easy to understand.\n\nWeaknesses:\n\n1. The authors in this work did not present complete scientific innovation; instead, it focuses more on engineering improvements and exploration, as strength clipping and error correction are relatively mature techniques. I am somewhat concerned about whether the authors have demonstrated sufficient scientific innovation in this work.\n\n2. The authors are encouraged to provide some theoretical justification as to why most watermarking methods can coexist. Additionally, they could offer paradigms, such as which types of watermarking integrations tend to yield better results. For example, it would be helpful to investigate whether watermarks using different hiding techniques, such as frequency and spatial domains, are more easily integrated. This would aid in the design of future watermarking methods.\n\n3. For the initially embedded watermark, the second watermark added actually serves as a form of degradation. Have the authors considered jointly training the encoding and decoding processes of the first and second watermarks? This might lead to better coexistence results.\n\nOverall, I consider this to be an excellent paper. The authors offer an original and insightful perspective on the problem of watermark coexistence, demonstrating strong innovation and solid research groundwork.\n\nQUESTIONS:\nPlease refer to the weakness.\n\nLIMITATIONS:\nyes", "TITLE": "Official Review", "RECOMMENDATION": 6, "REVIEWER_CONFIDENCE": 5, "CLARITY": 4, "IMPACT": 4, "ORIGINALITY": 4, "DATE": "2025-07-03"}

{"IS_META_REVIEW": false, "comments": "SUMMARY:\n- This paper presents the first investigation into the coexistence of multiple DL based image watermarks in a single image \n- The paper challenges the assumption that sequentially applying watermarks would overwrite previous signals\n- Primary contribution: Empirically demonstrates that many pairs of existing open source watermarking methods can coexist with minor degradation in decoding accuracy for each watermark with little impact on image quality. Experiments across 8 watermarking techniques are presented to support this.\n- Another contribution of the paper: Proposes ensembling as a post training tool for modifying watermarking systems by combining different watermarks (sequentially or in parallel) plus techniques like strength clipping and ECCs. \n- The work highlights practical use cases ex: 'super watermark' for identifying the correct decoder and 'multi actor provenance chains' for attribution.\n\nSTRENGTHS AND WEAKNESSES:\nStrengths\n------------\n- The finding that different watermarks can coexist to an unexpected degree is a significant discovery and opens a new direction for research.   \n- The empirical investigation about the coexistence is extensive and sound in many ways:\n   - 8 methods are tested from classical frequency based techniques (DwtDct, DwtDctSvd) to multiple modern deep learning approaches (HiDDeN, RivaGAN, RoSteALS, SSL, TrustMark B, TrustMark Q). \n   - The results (Table 1) provide strong evidence for the coexistence phenomenon. \n   - Reports full secret accuracy rather than the bit accuracy which is a great choice because it better reflects the practical utility of a watermark. \n   - The analysis is rigorous - exploring boundary conditions of coexistence, noting that a method cannot coexist with itself (Table 1) and that methods from the same family also overwrite each other. \n- Further, The paper is well written and easy to follow\n\n\nWeaknesses\n---------------\n- The paper's robustness tests are conducted against image augmentations that are specific to the training protocols of the models being tested ex: RivaGAN augmentations for RivaGAN, SSL augmentations for SSL etc in Appendix D. These does not seem like a realistic scenario where an attacker would use more potent attacks for ex: the evaluation is missing modern watermark removal techniques like diffusion based attacks, which have been shown to be highly effective. The authors could also use standard benchmarks like WAVES that include more diverse and challenging set of attacks.\n- The analysis only uses PSNR as the metric for image quality. This is a flaw as the paper's main argument about ensembling involves finding a trade off between increased capacity and decreased quality. A small drop in PSNR like 2 db could correspond to a (perceptually) significant and unacceptable level of visual artifacts. Evaluation using more perceptually relevant metrics such as LPIPS or SSIM, or a user study would be helpful.\n- The ensembling is not shown to be a consistently better strategy. For ex: Figure 6 where applying ECC to a single strong model (TrustMark Q) yields better performance across the accuracy-quality spectrum than ensembling it with a weaker one (RivaGAN). The contribution is more an exploration of the trade off space than a new SOTA technique. It is not clear under which conditions ensembling is the best choice.\n\nQUESTIONS:\nFollowing the order of the weakness section above:\n- How do the coexistence and ensembling results hold up against a standardized benchmark of more potent and modern attacks like diffusion based attacks? Showing non trivial resilience to these attacks would be very helpful to support robustness claims.\n- Results with re-evaluation on more perceptually metrics like LPIPS or SSIM would be helpful. Presenting that the observed quality degradation is perceptually minimal for a significant capacity gain would also be useful.\n - Can the authors more clearly describe the conditions under which ensembling provides a pareto improvement? A clearer characterization of the regime where ensembling is the better choice would be helpful.\n\nLIMITATIONS:\nYes", "TITLE": "Official Review", "RECOMMENDATION": 4, "REVIEWER_CONFIDENCE": 5, "CLARITY": 3, "IMPACT": 3, "ORIGINALITY": 3, "DATE": "2025-07-05"}

{"IS_META_REVIEW": false, "comments": "SUMMARY:\nThis paper presents the first comprehensive study of the coexistence of multiple watermarking methods within a single image. Contrary to the common assumption that one watermarking method would overwrite others, the authors empirically demonstrate that multiple watermarking methods can coexist with minor accuracy and quality degradation. The paper further proposes watermark ensembling, a post-training model modification technique that combines different watermarking methods to improve capacity and adjust trade-offs among capacity, robustness, accuracy, and image quality. Through extensive experiments using both classical and deep learning-based watermarking algorithms, the authors show that ensembling opens new avenues for watermark adaptation without retraining. This work challenges the assumption of exclusive image-channel occupation and suggests a new direction in watermark design and application.\n\nSTRENGTHS AND WEAKNESSES:\nStrengths \nThis article raises a very interesting question, one that we rarely consider in our normal work.\n\n1. This is the first study to systematically evaluate the coexistence of watermarking methods. The finding that multiple watermarks can be decoded from the same image significantly advances our understanding of deep watermarking.\n\n2. The authors benchmark a wide range of watermarking methods (e.g., HiDDeN, RivaGAN, SSL, TrustMark) in pairwise combinations and provide a large empirical matrix showing coexistence results.\n\n3. A geometric explanation is provided to intuitively explain why watermark coexistence may occur, supported by experimental data.\n\nWeaknesses\n1. Ensembling is shown to improve weak models, but often fails to outperform strong models in all metrics. This limitation is acknowledged but makes ensembling less compelling as a general-purpose solution.\n\n2. The increased inference cost from ensembling two models is not quantitatively analyzed. While suggestions such as distillation are mentioned, no concrete evidence is provided.\n\nQUESTIONS:\nAfter reading this article, I understand the author's attempts to achieve watermark coexistence, but I still have the following questions I would like the author to answer.\n\n1. A curious point in Table 1 is the presence of an extraction accuracy of 0, which is rare for a multibit watermark, as the accuracy should be about 50% to be reasonable when the watermarked signal is completely erased. And 0% means that the extracted watermark is the bitwise inverse of the original watermark, which is also unusual for the same method embedding different random watermarks; therefore, the authors should add a note about this.\n\n2. From the results of the experiments, many of the current watermarking methods actually embed the watermark in a different feature space, thus enabling coexistence in the realization. Then, suppose we manually construct different orthogonal feature spaces (e.g., FFT), and constrain the same watermarking method on different orthogonal feature spaces, can the same watermarking method realize coexistence?\n\n3. The authors tested robustness by embedding both watermarks before testing robustness. However, as shown in Fig. 1, the distortions of the watermarked image may be sequentially superimposed, and the feature space corresponding to the watermarked signal of watermark 1 may be shifted towards the feature space corresponding to watermark 2 after some distortion, and then embedding watermark 2 will erase the signal of watermark 1 to a greater extent.\n\nLIMITATIONS:\nyes", "TITLE": "Official Review", "RECOMMENDATION": 4, "REVIEWER_CONFIDENCE": 5, "CLARITY": 3, "IMPACT": 3, "ORIGINALITY": 3, "DATE": "2025-07-05"}

{"IS_META_REVIEW": false, "comments": "SUMMARY:\nThis paper presents the first systematic study of deep image watermark coexistence, challenging the prevailing intuition that watermarks from different methods inevitably interfere with one another. The study demonstrates that combining multiple watermarking methods using ensemble techniques can enhance overall performance. This approach enables capacity expansion and optimization of quality robustness without the need for model retraining.\n\nSTRENGTHS AND WEAKNESSES:\nStrengths\n1.\tThis study provides the first in-depth examination of image watermark coexistence, addressing a novel and intellectually compelling research question.\n\n2.The work demonstrates significant potential by showing how intelligently combining different watermarking methods through ensemble techniques can substantially improve overall watermark performance metrics.\n\nWeaknesses\n1.The presentation of the paper is poor; the main content is overly reliant on dense textual analysis, which makes the narrative hard to follow. The authors should consider adding more visualizations to support the analysis and move less important findings to the appendix.\n\n2.The study primarily focuses on experimental observations of watermark coexistence but offers only a naive use of ensembling, lacking deeper theoretical insights or more effective strategies for watermark performance enhancement.\n\nQUESTIONS:\n1.The authors argue that watermark coexistence implies orthogonal or non-overlapping perturbation spaces. However, they do not analyze the actual perturbation directions across methods. Why didn't the authors perform spectral or subspace overlap analysis of the residuals to empirically support this hypothesis?\n\n2.The paper primarily investigates pairwise coexistence between two watermarking methods. Have the authors considered whether similar coexistence holds when three or more watermarking methods are applied sequentially or in parallel? Is there evidence that the observed compatibility generalizes to higher-order combinations, or do interference effects compound beyond pairwise interactions?\n\nLIMITATIONS:\n1.While the study shows that different watermarks can coexist in the same image, it lacks a deeper understanding of why this happens. The explanation based on orthogonal perturbation subspaces is mostly qualitative, without empirical analysis of residual directions or interference patterns.\n\n2.The paper only considers pairwise combinations of watermarking methods. It remains unclear whether similar coexistence holds when three or more methods are applied. This limits the practical relevance for multi-actor pipelines where multiple watermarks may accumulate.\n\n3.In addition, the ensembling strategy is relatively naive. It relies on simple residual averaging or sequential application, without any learning-based coordination or optimization. As a result, the full potential of watermark coexistence is not fully explored.", "TITLE": "Official Review", "RECOMMENDATION": 4, "REVIEWER_CONFIDENCE": 3, "CLARITY": 3, "IMPACT": 2, "ORIGINALITY": 3, "DATE": "2025-07-05"}

{"IS_META_REVIEW": false, "comments": "SUMMARY:\nThe paper investigates whether multiple image watermarks can co-exist in a single image without interfering with each other's decodability. The authors find that many watermarking algorithms can coexist with minor degradation to image quality and decoding robustness. Hence, they introduce watermark ensembling, combining multiple watermarking models to improve message capacity and explore new trade-offs between capacity, image quality, robustness, and accuracy.\n\nSTRENGTHS AND WEAKNESSES:\nThe authors address a very interesting, timely, and real-world (and well-motivated!) challenge of whether multiple watermarking methods can co-exist on the same image. The questions they pose are relevant and can make a direct impact as to how we think of watermark deployment. They addresses real-world scenarios where multiple actors (creators, publishers, model providers) may add their own watermarks. They test a wide range of watermarking methods and combination strategies. I particularly appreciated the focus on open-source methods, allowing reproduction of their results and encouragement of use of these watermarking methods.\n\nThat said, there are some downsides of the paper as of now that should be addressed by the authors before publication. It is not clear from the paper, which dataset was used for the comparison of the co-existence of the different watermarking methods, and generally the  paper would benefit from a more in-depth description of the methodology of this part. This also includes a better presentation of the results in Table 1, which is hard to read and to compare the different results (maybe a matrix plot, e.g., https://matplotlib.org/stable/api/_as_gen/matplotlib.pyplot.matshow.html) could help here? Besides the fact that the watermarks *can* co-exist, and that it is indeed still possible to retrieve them, it would be good to extend a bit on the rest of the impact of multiple watermarks, such as describing (in the main paper) more the quality decrease (quantitatively) as well as at least an intuition as to whether  watermark coexistence makes the watermarks more vulnerable to removal or spoofing. Overall the paper would benefit from stronger theoretical grounding - the empirical coexistence is surprising, but no strong theoretical framework explains why it occurs or how to design for/against it.\n\nQUESTIONS:\n* How resilient are coexisting watermarks to removal attacks or adversarial perturbations? Can you conduct experiments testing whether watermark removal tools (e.g., generative inpainting, adversarial attacks) are more effective against coexisting watermarks?\n* See above review\n\nLIMITATIONS:\nYes", "TITLE": "Official Review", "RECOMMENDATION": 4, "REVIEWER_CONFIDENCE": 3, "CLARITY": 2, "IMPACT": 4, "ORIGINALITY": 3, "DATE": "2025-07-05"}