Title: Mask Image Watermarking
Venue: NeurIPS 2025
Accepted: yes
Keywords: image watermarking
Abstract: We present MaskWM, a simple, efficient, and flexible framework for image watermarking. MaskWM has two variants: (1) MaskWM-D, which supports global watermark embedding, watermark localization, and local watermark extraction for applications such as tamper detection; (2) MaskWM-ED, which focuses on local watermark embedding and extraction, offering enhanced robustness in small regions to support fine-grined image protection. MaskWM-D builds on the classical encoder-distortion layer-decoder training paradigm. In MaskWM-D, we introduce a simple masking mechanism during the decoding stage that enables both global and local watermark extraction. During training, the decoder is guided by various types of masks applied to watermarked images before extraction, helping it learn to localize watermarks and extract them from the corresponding local areas. MaskWM-ED extends this design by incorporating the mask into the encoding stage as well, guiding the encoder to embed the watermark in designated local regions, which improves robustness under regional attacks. Extensive experiments show that MaskWM achieves state-of-the-art performance in global and local watermark extraction, watermark localization, and multi-watermark embedding. It outperforms all existing baselines, including the recent leading model WAM for local watermarking, while preserving high visual quality of the watermarked images. In addition, MaskWM is highly efficient and adaptable. It requires only 20 hours of training on a single A6000 GPU, achieving 15× computational efficiency compared to WAM. By simply adjusting the distortion layer, MaskWM can be quickly fine-tuned to meet varying robustness requirements.


Peer reviews:
comments: SUMMARY:
This paper introduces MaskMark, a framework for image watermarking with two variants: MaskMark-D for global/local watermark extraction and tamper detection, and MaskMark-ED for fine-grained local watermarking with enhanced robustness. The method leverages a masking mechanism during training to enable flexible watermark localization and extraction, achieving state-of-the-art performance in accuracy, efficiency, and adaptability while preserving image quality.

STRENGTHS AND WEAKNESSES:
While the paper correctly identifies meaningful limitations in current watermarking techniques, the proposed solutions represent relatively incremental improvements over existing approaches. For instance, the core masking mechanism in MaskMark shares conceptual similarities with prior work on robustness against random cropping (Ref. [30]), essentially adapting established training paradigms through modified masking strategies rather than introducing fundamentally novel architectures or methodologies.

QUESTIONS:
Elaborate the genuine technical novelties. Explicitly characterize the scenarios where the masking strategy provides unique advantages beyond what could be achieved through existing robustness techniques.

The paper shows impressive results against localized attacks, but real-world adversaries often combine multiple attack types. Does MaskMark maintain its superiority under such composite attacks, and does the proposed architecture have inherent limitations against certain attack combinations?

LIMITATIONS:
yes
TITLE: Official Review
CLARITY: 3
IMPACT: 2
ORIGINALITY: 2
DATE: 2025-06-24

{"IS_META_REVIEW": false, "comments": "SUMMARY:\nThis submission presents a still image watermarking technique that is able to localize regions containing a watermark signal and decode the hidden message. There are two variants: 1. Embedding the watermark over the whole image. 2. Embedding the watermark in critical regions of the image. As a side product, the method is able to retrieve up to 5 different watermarks inside one image.\n\nSTRENGTHS AND WEAKNESSES:\n# Strengths\n\n- S1. Very well written\n- S2. Awesome performances\n- S3. Beat WAM\n\n# Weakness\n\n- W1. Lack of detail about decoding multiple watermarks in one image. WAM has a specific procedure for this scenario, i.e. the DBSCAN clustering. The submission does not say anything.\n- W2. A section detailing the main difference with WAM (architecture, training procedure...). At some point, it looks like too good to be true.\n\nQUESTIONS:\n- What explains the better performances (w.r.t. to all metrics - complexity, robustness, message lengths) compared to WAM?\n\n- The editing processes included in the augmentation layer are stronger than the attacks considered for benchmarking robustness. Why? Although I agree that one does not need extreme robustness, I am wondering about the robustness limits of the proposed method. It would be a good idea to consider another setting with stronger attacks.\n\nLIMITATIONS:\nOne limitation is that the watermark is visible. However, I am a watermark professional trained to spot these kinds of artefacts (without pretending to be a golden eye). This technique is typically not suitable when watermarking artworks (museum high definition scans, Hollywood movies etc).\n\nThe authors mention this limitation in App. A.\n(BTW: 39dB is **not** a \"*relatively high PSNR*\", line 450)\n\nAnother limitation concerns reproducibility. The authors claim that \"*information is sufficient to reproduce the main experimental results and verify the paper’s core claims, even without access to the code or data*\". I have my doubts. The architecture is not detailed enough.\nI acknowledge that the authors are willing to provide the code if accepted.", "TITLE": "Official Review", "RECOMMENDATION": 6, "REVIEWER_CONFIDENCE": 5, "CLARITY": 4, "IMPACT": 4, "ORIGINALITY": 4, "DATE": "2025-06-24"}

{"IS_META_REVIEW": false, "comments": "SUMMARY:\nThis paper introduces MaskMark, a simple and efficient framework for image watermarking that supports both global and local watermark embedding, localization, and extraction through two variants: MaskMark-D and MaskMark-ED. It achieves state-of-the-art performance while being significantly faster than prior methods like WAM, and can be easily adapted to different robustness requirements.\n\nSTRENGTHS AND WEAKNESSES:\nStrengths:\n1. MaskMark achieves state-of-the-art performance in global and local watermark extraction, watermark localization, and multi-watermark embedding.\n2. MaskMark provides two variants: MaskMark-D and MaskMark-ED for robustness. Both methods can support up to 128-bit message embedding.\n3. The training of MaskMark is efficient to finish within one day, outperforming existing baselines such as WAM.\n4. The paper is well-written and easy to follow, with a clear model architecture and training process, which helps facilitate reproducibility.\n\nWeakness:\n1. There is a lack of ablation studies, which limits the ability to identify the components for enhancing the model's performance.\n2. There is a lack of theoretical analysis of why the proposed MaskMark method can outperform the existing localized watermarking baselines such as WAM and Editguard.\n\nQUESTIONS:\n1. Following weakness 1.  Can the author provide ablation studies for investigating the functionality of different model components? \n2. Similar to HiDDeN and other classical image watermarking methods, WAM learns a residual map and embeds it into the cover image at the pixel level, while MaskMark concatenates the watermark feature map with the cover image in the channel dimension. Is this concatenation a key design to ensure better performance for MaskMark?\n3. Following weakness 2. Can the authors provide theoretical analysis or insights on why the proposed method can achieve better performance than the selected baselines?\n4. WAM achieves multiple watermarks since the ViT decoder is a per-pixel-based message decoder, which can decode multiple watermarks simultaneously. Regarding MaskMark message decoder is one-dimensional bit-stream decoding. How can MaskMark achieve multiple watermarks under such settings?\n\nLIMITATIONS:\nyes", "TITLE": "Official Review", "RECOMMENDATION": 5, "REVIEWER_CONFIDENCE": 5, "CLARITY": 3, "IMPACT": 3, "ORIGINALITY": 3, "DATE": "2025-06-30"}

{"IS_META_REVIEW": false, "comments": "SUMMARY:\nThe paper introduces MaskMark, a novel framework for image watermarking, designed to address limitations in existing methods. MaskMark offers two variants:\n\n- MaskMark-D: This variant supports global watermark embedding, watermark localization (identifying where the watermark is present), and local watermark extraction. It achieves this by incorporating a simple masking mechanism during the decoding stage. During training, the decoder learns to localize and extract watermarks from specific regions based on various applied masks. MaskMark-D is particularly useful for applications like tamper detection.\n\n- MaskMark-ED: This variant extends MaskMark-D by integrating the masking mechanism into both the encoding and decoding stages. This enables local watermark embedding and extraction, which significantly enhances robustness against regional attacks by guiding the encoder to embed the watermark in designated local regions.\n\nMaskMark operates within the classical training paradigm of image watermarking. Through extensive experimentation, the authors demonstrate that MaskMark achieves state-of-the-art performance in global and local watermark extraction, watermark localization, and multi-watermark embedding. Notably, it outperforms leading existing baselines, including WAM (Watermark Anything Model). The framework also boasts high computational efficiency, being 15 times faster to train than WAM, and offers flexibility as its robustness can be fine-tuned by simply adjusting the distortion layer.\n\nSTRENGTHS AND WEAKNESSES:\nStrengths\n\n- State-of-the-Art Performance: MaskMark achieves superior performance in various watermarking tasks. It specifically outperforms strong baselines like WAM in local watermarking scenarios.\n\n- High Computational Efficiency: training time significantly lower (15x faster) than that of WAM, and has fewer parameters\n\nWeaknesses\n\n- Limited Novelty: The idea is very similar to that of Watermark Anything in terms of goal, but also in terms of approach. For instance, the authors use the masks from Lama similarly to what is done in WAM. Overall it appears like a WAM+, but with limited novelty, or at least not highlighted enough.\n\nQUESTIONS:\n- Clarify what part of the method was taken from WAM, what is novel. JND and the Lama masks come from WAM too right?\n- What does \"4. Lack of native local embedding: WAM embeds watermarks globally and then crops for local focus,\nintroducing embedding losses that reduce extraction robustness.\" mean?\n- Is the method robust to moving a watermarked object inside the image or changing its proportions? WAM is.\n\nLIMITATIONS:\nyes", "TITLE": "Official Review", "RECOMMENDATION": 5, "REVIEWER_CONFIDENCE": 4, "CLARITY": 3, "IMPACT": 3, "ORIGINALITY": 2, "DATE": "2025-06-30"}

{"IS_META_REVIEW": false, "comments": "SUMMARY:\nThe authors propose an image watermarking method that allows for localized message embedding and detection. In contrast to the prior work Watermark Anything, which performs binary pixel-level detection and message decoding followed by clustering on decoded messages to localize watermarked regions (meaning localization emerges as a consequence of training for pixel-level detection/decoding), the proposed method is trained to natively perform localization through the use of masks.\n\nTraining:\n\n* After embedding, random masks are applied to limit the watermark to specific image regions while preserving the original image content outside those regions.\n* At detection time, the detector is passed both a masked image containing only the watermarked region (from which it is trained to decode the message) and the entire partially-watermarked image (from which it is trained to predict a localization mask).\n* In the MaskMark-D variant, the embedder is not aware of the mask and thus must learn to embed global information that is still recoverable from (potentially small) masked regions. In the MaskMark-ED variant, the embedder is aware of the mask and thus learns to concentrate watermark information more locally and embed additional information to aid localization.\n\n\nInference:\n\n* The detector first predicts a localization mask; this mask is then applied to the image, which is decoded to obtain the watermark message\n\nThe proposed method outperforms existing post-hoc image watermarking methods, including Watermark Anything, in watermark localization and in accurately extracting local watermark messages under standard image distoritons.\n\nSTRENGTHS AND WEAKNESSES:\n__Strengths__\n\n* The proposed method is an interesting alternative to the localization scheme from Watermark Anything.\n\n* The proposed method performs competitively with or better than many existing post-hoc methods in global embedding (Table 1) and local embedding (Figure 3), especially with small watermarked regions. This does not seem to come with a significant tradeoff in SSIM/PSNR, on which the proposed method outperforms Watermark Anything.\n\n* The proposed method does not require an adversarial discriminator or \"perceptual\" loss for the embedder, just a simple MSE loss. The proposed JND modulation approach appears to effectively mitigate the perceptible artifacts that arise from MSE-only training, as illustrated in Appendix D.\n\n* Overall, the proposed approach seems to present a straightforward improvement over Watermark Anything, which as far as I can tell is considered state of the art for localized image watermarking.\n\n\n__Weaknesses__\n\n* Terminology: I'm not sure that VAE attacks can be considered \"adaptive\". This term was coined for adversarial attacks performed with knowledge of an adversarial defense (https://arxiv.org/abs/2002.08347, NeurIPS 2020). However, the authors here appear to be fine-tuning their watermark against specific VAE attacks and then evaluating on these same attacks, which is the opposite of \"adaptive\" -- the defense is being conducted with specific knowledge of the attack, not the other way around! \"Adaptive\" attacks would leverage specific knowledge of the watermarking method, and could include e.g. adversarial optimization-based attacks against a surrogate or actual detector network.\n\n* The proposed method presumably shares the inherent robustness limitations of existing post-hoc image watermarks, which are vulnerable against generative \"purification\" attacks (https://arxiv.org/abs/2306.01953, NeurIPS 2024). These differ somewhat from the VAE attacks considered by the authors in that they typically perform partial noising/denoising with a diffusion model, and have been shown to be effective in removing both watermarks and other \"imperceptible\" image perturbations (https://arxiv.org/abs/2406.12027). It is discouraging that the authors apparently considered a small number of VAE attacks (with the advantage of fine-tuning) without considering known stronger attacks.\n\n* There is currently another published watermarking method with the name MaskMark [1]. On the one hand, the other work is in the audio domain rather than the image domain. On the other hand, both methods are neural network-based post-hoc watermarks that leverage some form of \"masking,\" end-to-end training, distortion layer, etc. I would strongly recommend a name change.\n\n\n[1] Patrick O’Reilly, Zeyu Jin, Jiaqi Su, and Bryan Pardo. Maskmark: Robust neural watermarking for real and synthetic speech. In International Conference on Acoustics, Speech and Signal Processing (ICASSP), 2024\n\nQUESTIONS:\n* Can the authors more clearly indicate which evaluated image distortions were not seen by the model at training time? This kind of generalizability is important for evaluating the robustness of watermarking methods\n\nLIMITATIONS:\nYes.", "TITLE": "Official Review", "RECOMMENDATION": 5, "REVIEWER_CONFIDENCE": 4, "CLARITY": 3, "IMPACT": 3, "ORIGINALITY": 2, "DATE": "2025-07-02"}