# High-Frequency Artifacts-Resistant Image Watermarking Applicable to Image Processing Models
## 2 Preliminaries and Proposed Method
### Method Overview  
As mentioned previously, existing generative model watermarking techniques [17; 19] suffer from noticeable high-frequency artifacts in the frequency domain, which compromise the overall concealment of the embedded watermark. In response to this challenge, we  
Figure 1: Visual examples of paint transfer and de-raining. The left column (**a–d**) depicts paint transfer, while the right column (**e–h**) illustrates de-raining. (**a**) Ground-truth images from dataset [27], (**b**) carrier images generated by generative network [29], (**c**) marked images generated by method [19], (**d**) marked images generated by method [17], (**e**) ground-truth images from dataset [28], (**f**) carrier images generated by generative network [28], (**g**) marked images generated by method [19], (**h**) marked images generated by method [17]. The bottom part of the images presents the corresponding DCT heatmaps (the heatmap is the average of the corresponding test dataset).  
introduce an innovative image watermarking framework. At its core, this framework revolves around bypassing the watermark embedding network to mitigate the inherent high-frequency artifacts caused by CNNs. We design a frequency perturbation generation network to create frequency perturbations, which are then incorporated into the carrier image to achieve watermarking. Finally, the watermark is extracted from the marked image using a watermark extraction network.  
Our proposed framework comprises two primary components: a frequency perturbation generation network \(F\), and a watermark extraction network \(E\). As illustrated in Figure 2, the frequency generation network takes fixed watermarks as input and generates frequency perturbations. Given a \(256\times 256\times 3\) carrier image (i.e., the image generated by the generating network to be protected), we target the central \(128\times 128\times 3\) portion of its frequency domain as the low-frequency component. To insert a frequency perturbation into this low-frequency area, we create a \(128\times 128\times 3\) perturbation and incorporate it into the carrier image's frequency domain to achieve the watermarking. Importantly, the frequency domain perturbation introduced only affects the \(128\times 128\times 3\) low-frequency region at the center of the carrier image's frequency domain. Thus, our approach effectively embeds the frequency domain perturbation into the carrier image's low-frequency component. By controlling the embedding location of the frequency domain perturbation, we selectively modify the carrier image's low-frequency regions while leaving the high-frequency regions unaltered. This targeted strategy effectively mitigates the high-frequency artifacts commonly associated with the watermark embedding process. Moreover, by bypassing the watermark embedding network, we ensure that the carrier image remains free from the high-frequency artifacts introduced by CNNs. Finally, through joint training, the watermark extraction network is trained to accurately retrieve the watermark from marked images.