Achieving Resolution-Agnostic DNN-based Image Watermarking: A Novel Perspective of Implicit Neural Representation

Venue: acmmm_org_ACMMM_2024_Conference
Published: 2024-04-06 15:14:13

Abstract: DNN-based watermarking methods are rapidly developing and delivering impressive performances. Recent advances achieve resolution-agnostic image watermarking by reducing the variant resolution watermarking problem to a fixed resolution watermarking problem. However, such a reduction process can potentially introduce artifacts and low robustness. To address this issue, we propose the first, to the best of our knowledge, Resolution-Agnostic Image WaterMarking (RAIMark) framework by watermarking the implicit neural representation (INR) of image. Unlike previous methods, our method does not rely on the previous reduction process by directly watermarking the continuous signal instead of image pixels, thus achieving resolution-agnostic watermarking. Precisely, given an arbitrary-resolution image, we fit an INR for the target image. As a continuous signal, such an INR can be sampled to obtain images with variant resolutions. Then, we quickly fine-tune the fitted INR to get a watermarked INR conditioned on a binary secret message. A pre-trained watermark decoder extracts the hidden message from any sampled images with arbitrary resolutions. By directly watermarking INR, we achieve resolution-agnostic watermarking with increased robustness. Extensive experiments show that our method outperforms previous methods with significant improvements: averagely improved bit accuracy by 7\%$\sim$29\%. Notably, we observe that previous methods are vulnerable to at least one watermarking attack (e.g. JPEG, crop, resize), while ours are robust against all watermarking attacks.

Main paper: 
 introduction: 
 Invisible digital watermarking [35] is a technology for safeguarding intellectual property in multimedia [2, 13, 14] . Early research focused on directly modifying pixel values, wherein the lowest bit was altered to watermark images [5] . To enhance the robustness against various attacks, transformations were employed to conceal data in the frequency domain [34] . Although these traditional methods can watermark images of different resolutions, they rely on analyzing hand-crafted image features for designing watermarking techniques. With the continuous advancement of deep learning, researchers have discovered that DNN-based watermarking methods exhibit remarkable effectiveness in analyzing image features, consequently enhancing their robustness [15, 18, 19, 46] . In these DNN-based approaches, the watermark message requires expansion for subsequent interactions with images. While HiDDeN [46] and TSDL [18] directly duplicate the watermark information, increasing redundancy but lacking error correction capabilities, resulting in suboptimal robustness. To enhance the robustness, MBRS [15] incorporates a message processor module to augment error correction capabilities, thereby improving robustness. However, the message processor module constrains the image resolution that the model can watermark, i.e., the entire framework has to be retrained before it can be applied to watermark images with different resolutions.A recent work DWSF [12] tackles the above issue by reducing the variant resolution watermarking problem to a fixed resolution watermarking problem (referred to as a reduction process) by leveraging block selection. DWSF randomly selects fixed-size blocks, which are further embedded with the secret message. The watermarked areas are first identified during extraction, and then the embedded message from these blocks is extracted. However, the bit accuracy drops fast once the extraction identifies a false watermarked block position or the watermarked block is cropped. Our experiment in Section 5.4 confirms this. Besides, we also observe artifacts of watermarked images generated by DWSF (Figure 2 ). Recognizing these limitations of the DWSF's reduction process, we take a step further to ask: can we watermark images with arbitrary resolutions without relying on such a reduction process?To address this issue, we propose a novel perspective of watermarking images in function space; namely, we watermark the image's implicit neural representation (INR). In this paper, we propose our Resolution-Agnostic Image WaterMarking (RAIMaRK) method, which is the first INR-based watermarking approach. An INR, as a continuous representation of the image, outputs corresponding pixel values based on the given coordinates. By watermarking the INR, we can generate watermarked images of different resolutions through sampling. The watermark information is adaptively distributed across these images and can be verified with our watermark decoder, effectively addressing the limitations of previous frameworks. Furthermore, unlike previous approaches, which watermark multiple times for multiple resolutions, we only need to watermark once to get watermarked INR, and images with arbitrary resolution can be obtained by sampling from the watermarked INR, as depicted in Figure 1 , which significantly reduces computational overhead in image transmissions.RAIMaRK comprises three key stages, as shown in Figure 3 . In stage 1, we generate the implicit neural representation by fitting it with an arbitrary-resolution image. Stage 2 involves pre-training a decoder that is independent of the image and capable of extracting watermarks from images of any resolution. In stage 3, we first generate a pre-defined message. Then, we embed the watermarks into the INR by fine-tuning the model using the pre-trained decoder to ensure the same message can be obtained from images sampled by the same INR. We obtain watermarked images of different resolutions during testing by feeding different parameters to the sampler. Our contributions are summarized as follows:• We propose the first, to the best of our knowledge, robust, invisible, and resolution-agnostic watermarking framework RAIMaRK to protect images based on the implicit neural representation (INR). of different resolutions. Additionally, our method exhibits enhanced resistance against both non-geometric and geometric attacks. 
related work 2.1 implicit neural representation: 
 Unlike explicit representations, which require explicit equations or rules to describe the object or function, implicit representations leverage neural networks to learn a mapping between inputs and outputs. In the context of computer vision, implicit neural representations (INRs) are often used in 3D shape modeling [20] , scene reconstruction [28] , and semantic segmentation [16] . The neural network takes a point in the space as input and produces a scalar value as output. Implicit neural representation represents continuous signals parameterized by multi-layer perceptrons (MLPs). Early work used activation functions like ReLU and Tanh, common in machine learning [1, 22, 23, 26] . Unlike the signed distance function (SDF) in 3D space, where INR represents a continuous distance function, the pixel points of the image are discrete. If we use INR to represent an image, there are high and low-frequency regions. These activation functions are not effectiveeffective enough. Thus, periodic nonlinearities are introduced into the INR. SIREN [27] pioneeringly applied sine transform to the input coordinates, enabling INRs to fit complicated signals, which solves the problem that traditional activation functions cannot simultaneously accommodate both high and low-frequency features.Traditional watermarking. As a powerful means of copyright protection, digital watermarking becomes a popular area of research in real-world scenarios [7, 10, 21, 30, 31, 39] . Initial studies focused on direct changes to the pixel values of images in the spatial domain, such as the least significant bit (LSB) [6, 36] . Although LSB can achieve high invisibility with small changes in pixel values, its robustness against noises is weak. To solve this problem, researchers focused on the transformation domains, such as the Discrete Cosine Transform (DCT) [3, 25] , the Discrete Fourier Transform (DFT) [29, 32] , and the Discrete Wavelet Transformation (DWT) [9, 38] . DNN-based watermarking. Since it is difficult for traditional methods to resist different attacks comprehensively, DNN-based watermarking emerged as computing power has increased dramatically. Zhu et al. [46] proposed HiDDeN for image watermarking, the first end-to-end DNN-based image watermarking framework. Liu et al. [18] proposed a Two-stage Separable Deep Learning (TSDL) framework that solved the gradient transfer problems in non-differentiable noise. MBRS [15] utilized the mini-batch strategy and combined real and simulated JPEG compression in training. Ma et al. [19] first incorporate an Invertible Neural Network (INN) into an embedding process, achieving excellent invisibility and robustness performance.However, the above method gradually adds a condition to the watermark: the image resolution is fixed. This makes these watermarking methods poorly generalizable in resolution. Facing the problem of different image resolutions in real issues, Guo et al. [12] proposed DWSF based on selecting blocks so that a fixedresolution watermarking framework can be used for images of other resolutions. Bui et al. [4] proposed a scaling-based watermarking approach. They first watermarked the images based on a specific resolution to get the residuals of the watermark. Then, the residuals are scaled and summed to the original image, thus obtaining the watermarked image. Generative model watermarking. In the case of watermarking images produced by generative models, some works processed watermarking the training set on which the model is trained [41] . To prevent multiple instances of watermarking on the generative model, some work went closer to model watermarking, merging the watermarking process and the generation process [42, 45] . The watermarking process is carried out throughout the model training process using these methods. They also have the same problem as the previous approach, and training the model is highly time and arithmetic-intensive. The stable signature [11] showed that a quick fine-tuning of the latent decoder part of the generative model can achieve a good watermarking performance. Their work gave a good scheme for watermarking in models. It is not limited to generative models but can also be used in other models, such as the implicit neural representation. 
preliminaries 3.1 implicit neural representation: 
 Implicit neural representation can be used as a continuous representation of an image. We can define the function 𝐹 𝑖𝑚 : R 2 ↦ → R 3 , which maps a two-dimensional index (𝑥, 𝑦) to a three-dimensional pixel value (𝑟, 𝑔, 𝑏). A handy function 𝐹 𝑖𝑚 uses fully-connected networks with the formulation:EQUATIONwhere W 𝑖 and b 𝑖 are weight and bias matrix of the 𝑖-th networks and 𝜙 is the non-linear activation function between networks. 𝜙 can be ReLU [23] , Tanh [1] or sinusoidal activation function used in SIREN [27] . SIREN can better handle image details thanks to the smoothness of the sinusoidal function.We define a sampler S (𝐻,𝑊 ) , which samples INR into a 𝐻 × 𝑊 image. For the height side, there are 𝐻 indexes. For the width side, there are 𝑊 indexes. Combining height and width coordinates, we get 𝐻 × 𝑊 indexes:EQUATIONwhere 𝑖 = 0, 1, . . . , 𝐻 -1 and 𝑗 = 0, 1, . . . ,𝑊 -1. The sampler contains width and height indexes uniformly distributed in the range [-1, 1). We input all indexes (𝑥, 𝑦) and get corresponding (𝑟, 𝑔, 𝑏) values. Finally, we get the sampled image by filling the image with the corresponding RGB values. Based on the continuous function property of INR, we can get the corresponding RGB values by inputting any coordinates into INR. Therefore, for consistency, in our setup, we set the coordinates of both the height and width of the samples to [-1, 1). 
method: 
 In this section, we give an insight into our RAIMaRK, a resolutionagnostic blind image watermarking framework. Figure 4 shows the architecture of three stages in RAIMaRK. Unlike the end-to-end watermarking approach, our framework embeds the watermark into the INR. No matter what resolution images are sampled from the model, these images come with their watermarks. Our framework is divided into three stages. First, we create the implicit neural representation of a given image 𝐹 𝑖𝑚 . Then, we pre-train the watermark decoder D. Finally, we fine-tune 𝐹 𝑖𝑚 to get the watermarked function space image 𝐹 𝑤𝑚 , such that all images sampled from 𝐹 𝑤𝑚 have a given secret message through D.In this stage, we choose the sine function as the activation function of the INR. The structure of INR is introduced in Section 3.1, and we initialize each sine neuron's weights before training. We set𝑤 𝑖 ∼ U (- √ 6/𝑛, √ 6/𝑛),where 𝑛 is the number of inputs of the neuron and U means uniform distribution, which ensures that the input of each sine activation is Gauss distributed with a standard deviation of 1. Specifically, for the first layer of 𝐹 𝑖𝑚 , combined with the periodicity of the sine function, we expect the output of the first neuron to span over multiple periods. Thus, we set the weight distribution of the first layer as 𝑤 ∼ U (-𝑤 0 /𝑛, 𝑤 0 /𝑛) and set 𝑤 0 = 30.Afterward, we create the INR by following the previous conditions. We define the height and width of the given image 𝐼 𝑜 as 𝐻 and 𝑊 . In the data processing part, to satisfy the requirements of the sampler, the first thing to do is to normalize index data into range [-1, 1), which means for any index (ℎ, 𝑤), the transformation is:EQUATIONThe horizontal and vertical pixel distribution density is related to 𝐻 and 𝑊 . Then, after transformation, we assume, at a certain index (𝑥, 𝑦), the RGB value of the original image is (𝑟 𝑜 , 𝑔 𝑜 , 𝑏 𝑜 ), which is the ground truth value. 𝐹 𝑖𝑚 receives the same index (𝑥, 𝑦) as input and outputs the corresponding RGB value (𝑟, 𝑔, 𝑏). We must minimize the difference between (𝑟, 𝑔, 𝑏) and (𝑟 𝑜 , 𝑔 𝑜 , 𝑏 𝑜 ) for a single pixel. Then, we apply a sampler S (𝐻,𝑊 ) on 𝐹 𝑖𝑚 and recover the image 𝐼 𝐹 that is predicted by 𝐹 𝑖𝑚 . To make the predicted image similar to the original image, the loss function applies mean squared error (MSE) on 𝐼 𝐹 and 𝐼 𝑜 :EQUATIONWe robust decoder, we discard watermark encoder E and keep watermark decoder D for fine-tuning.Formally, E receives a cover image 𝐼 𝑜 ∈ R 3×𝐻 ×𝑊 and an 𝑛-bit message 𝑀 ∈ {0, 1} 𝑛 . E outputs a residual image 𝐼 𝑟 which is the same resolution as 𝐼 𝑜 . Then, we add a strength factor 𝛼 when creating the watermarked image 𝐼 𝑤 = 𝐼 𝑜 + 𝛼 • 𝐼 𝑟 , which controls the encoding strength. After applying different noises onto the watermarked image, we get the noised image 𝐼 𝑛 = N (𝐼 𝑤 ). D extracts an 𝑛-bit message 𝑚 = D (𝐼 𝑤 ). The final message 𝑀 ′ = 𝑠𝑔𝑛(𝑚) is the sign of 𝑚. We can calculate the accuracy by comparing 𝑀 and 𝑀 ′ . The loss function we choose is Binary Cross Entropy (BCE) between the original message 𝑀 and the extracted message 𝑚:EQUATION)where 𝜎 is the Sigmoid activation function, 𝑀 𝑖 and 𝑚 𝑖 are the 𝑖-th bit of original and decoded message.Since we discard E afterward, the watermark invisibility is not considered in this stage. Thus, in the loss function, we consider the differencce between the original and decoded message and ignore the difference between 𝐼 𝑜 and 𝐼 𝑤 .Watermarking INR is different from the end-to-end approach. In this approach, there is not a watermark embedding process. For each image generated, it comes directly from the sampling of INR.Here, we need to handle the 𝐹 𝑖𝑚 created in the previous step for watermarking. We define the fine-tuned INR as 𝐹 𝑤𝑚 to distinguish it from the clean INR 𝐹 𝑖𝑚 . We fine-tune 𝐹 𝑤𝑚 such that the image sampled from 𝐹 𝑤𝑚 contains a specific message 𝑚 that can be extracted by D. In the fine-tuning process, because in practice, we have many clean INRs to fine-tune, we lock all the parameters of D so that all fine-tuned INRs can extract the correct message from the same decoder D. First, we generate a pre-defined message 𝑚 = (𝑚 1 , . . . , 𝑚 𝑛 ) ∈ {0, 1} 𝑛 for a given INR 𝐹 𝑖𝑚 . We need to save this message and use the same message during validation and testing. Then, we feed the fine-tuning INR 𝐹 𝑤𝑚 to a sampler S (𝐻,𝑊 ) that outputs an image 𝐼 𝑠 ∈ R 3×𝐻 ×𝑊 . Moreover, 𝐼 𝑠 is the image with watermarks. During training, we change the resolution of 𝐻 and 𝑊 and add samples of different resolutions to improve generalization. The noise layers distort the sampled image 𝐼 𝑛 = N (𝐼 𝑠 ), and the pre-trained decoder extracts a message 𝑚 ′ = D (𝐼 𝑛 ). The loss function of the message part is the BCE between extracted message 𝑚 ′ and predefined message 𝑚:EQUATION)Another objective is to improve the invisibility between 𝐼 𝑠 and 𝐼 𝑜 . Here, since the resolution of our original image is determined, we need to generate clean images of the corresponding resolution when comparing other resolutions. We adopt 𝐼 𝑜 = S (𝐻,𝑊 ) (𝐹 𝑖𝑚 ) for comparison. The loss function of the image part is the MSE between 𝐼 𝑠 and 𝐼 𝑜 :EQUATIONThus, 𝐹 𝑤𝑚 is optimized by minimizing the total loss L. We add coefficients 𝜆 𝑚𝑠𝑔 and 𝜆 𝑖𝑚𝑔 for both parts of losses:EQUATION)Since watermarked images tend to suffer from various distortions in real-life scenarios, we added a noise layer in the training process to enhance the robustness of our model. The details of all noises we used in our method are shown in Table 1 . We classify the noise into differentiable or non-differentiable depending on its realization. Differentiable noise means that after applying themselves to watermarked images, we can typically perform the reverse process when training. Moreover, with non-differentiable noises like JPEG compression, the backward propagation fails to produce the corresponding gradient because of the saving and reading of the images.Here, we choose Forward ASL [44] , which is compatible with nondifferentiable noises. Forward ASL first calculates the difference between noised image 𝐼 𝑛 and watermarked image 𝐼 𝑤 , 𝐼 𝑑𝑖 𝑓 𝑓 = 𝐼 𝑛 -𝐼 𝑤 .Here, 𝐼 𝑑𝑖 𝑓 𝑓 has no gradient. The new noised image 𝐼 ′ 𝑛 = 𝐼 𝑤 + 𝐼 𝑑𝑖 𝑓 𝑓 is the input of the decoder. The non-differentiable noise does not participate in the gradient propagation during the backward process. Therefore, the gradient can be back-propagated through the noise layer. 
experiments: 
 In this section, we conduct experiments on the effectiveness and robustness of our proposed framework RAIMaRK. First, we introduce the experimental settings of our process. Then, we show our results in two aspects. First, We validate the performance of our proposed method on the same test dataset and the exact resolution from two perspectives: invisibility and robustness. In terms of robustness, we test it against non-geometric attacks and geometric attacks. Another aspect is that we demonstrate our method's generalization by showcasing the watermark's invisibility and robustness at different resolutions. We show the generalizability of our method by testing three chosen resolutions in a fine-tuned process and three other resolutions commonly used on the screen. We choose the resolutions used during our fine-tuning process and three commonly used resolutions on screens for testing.Our RAIMaRK chooses COCO [17] as the dataset for all three phases. PyTorch implements the framework [24] and executes on Ubuntu 22.04 with an Intel Xeon Gold 5318Y CPU and an NVIDIA A100 GPU.When creating INR, we use images whose resolution is 256×256 to fit the implicit neural representation. We choose Adam optimizer with a learning rate of 1 × 10 -4 . We train 𝐹 𝑖𝑚 for about 5000 epochs. The difference between the two images, 𝐼 𝐹 and 𝐼 𝑜 , is invisible to the naked eye.We select 10000 images from the COCO dataset in the decoder pre-training process. The input image resolution is set to 256 × 256. We set the message length to 30 to maintain consistency with the subsequent fine-tuning. The optimizer is Lamb [40] with learing rate of 1 × 10 -2 . We choose CosineLRScheduler [37] to schedule the learning rate, which decays to 1 × 10 -6 . This process is done in 500 epochs.In the fine-tuning process, to ensure invisibility and robustness over different resolutions, we fine-tune the INR in three samples, 256 × 256, 384 × 384, and 512 × 512. We utilize Adam optimizer with a learning rate of 5 × 10 -5 . We fine-tune the INR under nongeometric attacks and geometric attacks. Our choice for the coefficients 𝜆 𝑚𝑠𝑔 and 𝜆 𝑖𝑚𝑔 are 5 × 10 5 and 3 × 10 3 . We fine-tune 500 epochs and choose the best-performing model as the watermarked INR 𝐹 𝑤𝑚 .The two main indicators for our watermarking model are robustness and invisibility. For different watermarked INR 𝐹 𝑤𝑚 in testing, robustness is measured by the accuracy between pre-defined message 𝑚 and the extracted message 𝑚 ′ . We can get the 𝐴𝑐𝑐𝑢𝑟𝑎𝑐𝑦 (%) by calculating the bit error rate (BER):EQUATION)where ⊕ is the exclusive or operation between bits.For the invisibility, we measure the item peak signal-to-noise ratio (PSNR). We suppose 𝐼 𝑜 and 𝐼 𝑤 are original images and watermarked images.EQUATION)where 𝑀𝐴𝑋 𝐼 is the maximum possible pixel value of the image and 𝑀𝑆𝐸 is the mean squared error.Our baseline for comparison are [46] , [18] , [15] and [12] . All these methods are DNN-based watermarking frameworks, and their authors open-source their code. [46] , [18] and [12] can extract message from image of any resolution. We can train their author's open-source code directly. For [15] , MBRS can only accept fixedresolution input images. So, when the watermarked image is distorted by cropping or resizing, we need to scale it to its original resolution. In this section, we compare our method with the SOTA methods, HiDDeN [46] , TSDL [18] , MBRS [15] and DWSF [12] . Since the input image resolution of each method and message length vary, we choose message length 𝑛 = 30 for a fair comparison, and the image resolution is 256 × 256. Therefore, we train SOTA methods and test all methods in these conditions. Table 2 shows the detailed invisibility and robustness results.In this section, we focus on the watermarked images produced by the five methods and show the visual quality of watermarked images. The comparison of visual quality is shown in Figure 5 . We calculate the residual image between original and watermarked images 𝐼 𝑟 = |𝐼 𝑤 -𝐼 𝑜 |. Moreover, we calculate the greyscale image 𝐼 𝑔 :EQUATIONwhere 𝐼 𝑟 𝑅 , 𝐼 𝑟 𝐺 and 𝐼 𝑟 𝐵 are red, green and blue channels of 𝐼 𝑟 . Then we normalize 𝐼 𝑔 :EQUATION)where 𝐼 𝑚𝑎𝑥 = 1 for floating-number images and 𝐼 𝑚𝑎𝑥 = 255 for uint8 images. Then, we can measure where the methods embed watermarks by 𝐼 𝑚 . As a result, in the 𝐼 𝑚 , the brighter the place, the higher the intensity of the embedded watermark, and the darker the place, the lower the intensity of the embedded watermark.Based on the residual image 𝐼 𝑟 , we can see that RAIMaRK outperforms other methods in invisibility at a resolution of 256 × 256. For example, our method achieves 39.61dB PSNR, while the largest PSNR of the previous method only achieves 37.45 dB. Notably, when the block size is large, and image resolution is low, DWSF achieves relatively lower PSNR than RAIMaRK because DWSF adds a relatively larger perturbation within the block. In contrast, RAIMaRK adds a relatively more minor global perturbation.To show that our RAIMaRK is resistant to various distortions simultaneously, we fine-tune our model with a random noise layer and a random sampler. We also train models of other methods using their default strategy and replace the noise layers with ours. The noise layers include GN(𝜎 = 0.05), MF(𝑘 𝑠 = 7), Jpeg(𝑄 = 50), Crop(𝑠 = 0.25), Resize(𝑝 = 0.5) and Resize(𝑝 = 2.0). We choose two parameters of Resize, which are zooming in and out. When we test, we add an Identity() layer, which adds no noise to the watermarked image. As shown in Table 2 , our model performs better than other models in all these distortions. HiDDeN is weak in JPEG compression. MBRS and DWSF are weak in cropping attacks. In particular, our method achieves 100% accuracy for Identity, Median Filter, and Resize distortions. However, our model also shows weakness in the cropping attack, which accounts for the special watermarking method of our framework. Our model increases the intensity of watermarking the highfrequency part and reduces the intensity of the low-frequency part.We observe that previous works are vulnerable to at least one image attack. For example, DWSF is vulnerable to cropping attack because its bit accuracy drops to 51.33 under cropping attack. The reason is that DWSF only hides watermarks within selected blocks. Once selected blocks are cropped, the watermark cannot be verified. MBRS is also vulnerable to cropping attack because a specific region of the watermarked image only hides part of the binary message. Once the region is cropped, the part of the binary message it hides cannot be recovered from other image regions.In this section, we conduct experiments on different samples to test our model's invisibility and robustness and show its generalization. We also compare our model with the baseline approach to further demonstrate the advantages of our model.In our method, we fine-tune our model under three different resolutions and six different noises. Randomly selecting from the resolutions and noises makes the convergence of the model uncertain. The convergence trend may be more towards a specific resolution or noise, dramatically affecting generalizability.Thus, we refine the stochastic strategy for the fine-tuning process. We expect the model to converge in a more balanced way for various scenarios. Here, we cross-combine different resolutions and noises and get all (𝑟𝑒𝑠𝑜𝑙𝑢𝑡𝑖𝑜𝑛, 𝑛𝑜𝑖𝑠𝑒) pairs as a set 𝑆 0 . In each epoch, we get a clone 𝑆 ′ 0 of 𝑆 0 . When fine-tuning, we randomly choose a pair from 𝑆 ′ 0 and remove the pair from 𝑆 ′ 0 . When the pair 𝑆 ′ 0 is empty, we finish an epoch of fine-tuning. 5.5.2 Results on invisibility and Robustness. In this section, we analyze the invisibility and robustness of our model on six different samples: 128 × 128, 256 × 256, 512 × 512, 480 × 854 (480p), 720 × 1280 (720p) and 1080 × 1920 (1080p).Section 5.5.3 shows the invisibility results. For robustness, we divide the attack into two categories: non-geometric attacks (Figure 6a ) and geometric attacks (Figure 6b ). Our method maintains a high standard in all non-geometric attacks, which keeps over 99% regardless of the image resolution. In geometric attacks, zooming in and out has little effect on accuracy. The accuracy of the cropping attacks is more significant than 99%. From the results above, we observe no performance degradation when the watermarked INR is smapled to larger resolution images.Compare with Other Methods. This section compares our method with other methods in varied resolutions. The training settings are 30-bit messages, and the image resolution is the abovementioned six resolutions. For MBRS, their encoders utilized a message processor module, which fixed the resolution of the images, making it impossible to watermark images of other resolutions. HiDDeN and TSDL processed messages repeatedly to handle watermarking images of any resolution. DWSF achieved variant resolution watermarking through block selection.Table 3 shows the results of five methods, in which we only compare MBRS at the trained resolution, while the other three methods are compared at all resolutions. We can observe that RAIMaRK and DWSF outperform previous watermarking methods. In most cases, RAIMaRK achieves higher bit accuracy while DWSF achieves higher PSNR. The reason is that DWSF only adds perturbation within the selected block, leaving the unselected region unchanged. However, this makes it vulnerable to cropping attacks. Once the block is falsely identified or cropped, its watermark cannot be verified, thus DWSF has low bit accuracy. RAIMaRK has higher robustness when compared with DWSF because RAIMaRK adds a global perturbation, which makes the watermark survive various attacks. This is why RAIMaRK has a relatively low PSNR compared to DWSF. However, RAIMaRK still achieves higher than 39dB PSNR, and previous work already clearly indicated that 37dB PSNR is enough to provide good visual quality in practice [8, 33, 43] . 
conclusion: 
 In this paper, we have shown that reducing the variant resolution watermarking problem to the fixed resolution watermarking problem introduces artifacts and low robustness in image watermarking. To address this issue, we have proposed RAIMaRK to solve the variant resolution image watermarking by watermarking the implicit neural representation(INR) of the image. Different from previous methods, RAIMaRK does not rely on the previous reduction process by directly watermarking the continuous signal instead of image pixels. Watermarked images with arbitrary resolutions can be sampled from the watermarked implicit neural representation. Extensive experiments have demonstrated that our framework shows promising results. Overall, INR can express various multimedia resources, and our watermarking scheme provides a novel perspective to inspire subsequent resolution-agnostic watermarking frameworks.  
 
 Appendix:  


Decision: The reviewers are mostly satisfied with the rebuttal and recognize that the authors contribute to the issue of resolution-independent deep image watermarking.
The manuscript is recommended to be accepted, and the authors are expected to include the responses in the rebuttal into the revised version.

Reviews: review: paper_summary: paper_summary: This paper proposes a framework called resolution-agnostic image watermarking (RAIMaRK). It can watermarking based on implicit neural representation (INR). The method does not rely on the previous reduction process by directly watermarking the continuous signal instead of image pixels.
strength_weakness: strength_weakness: This manuscript proposes an interesting deep-learning watermarking scheme. The idea of INR watermarking has not been explored for DNN-based watermarking as far as I know. In experiments, the proposed model demonstrates good visual quality and robustness under attacks, particularly in scenarios involving images of different resolutions.
limitations: limitations: The manuscript is well structured, but the clarity of some details of the proposed method is not very good. The experimental evaluation could be further improved.  The manuscript introduces that the watermark message is fixed and pre-defined in Figure 3 and Section 4.3. Does this mean that for a fixed INR, only specific fixed messages can be watermarked? In comparison with previous methods, the original methods of HiDDeN, TSDL, MBRS, and DWSF were conducted at a resolution of 128x128, while the experiments in the manuscript selected 256x256 Will this be beneficial to the proposed method? The manuscript should consider the impact of message length on performance and discuss how the proposed approach performs in terms of computational efficiency. Is the proposal robust to severe geometric attacks (e.g. large angle rotation, padding, flipping) and hybrid attacks (e.g. rotation and scaling, cropping and rotation)? Additionally, the manuscript could also explore the limitations or potential drawbacks of the proposed method, which would provide a more balanced view of the work.
paper_summary: paper_summary: This paper presents an innovative image watermarking method called RAIMaRK, which is based on Implicit Neural Representation to achieve resolution-agnostic image watermarking. This approach circumvents the issues of artifacts and robustness that traditional methods may face when dealing with images of varying resolutions. The paper is well-written with clear logic and thorough experimental design.
strength_weakness: strength_weakness: It is the first watermarking framework based on INR, offering a novel perspective on addressing image watermarking challenges. The method watermarks the continuous signal directly rather than image pixels, effectively tackling the resolution variance problem and significantly enhancing watermark robustness. The authors employ advanced deep learning techniques and validate the effectiveness of their method through extensive experiments.  Experimental results show that RAIMaRK has improved bit accuracy by an average of 7% to 29% and demonstrated excellent resistance to various watermarking attacks.
limitations: limitations: While the paper provides an overall framework and experimental results, further elaboration on some implementation details may be needed for experiment reproduction.
paper_summary: paper_summary: This paper proposes a resolution-agnostic image watermarking (RAIMaRK) framework. The resolution-agnostic watermarking is achieved by directly watermarking the INR (implicit neural representation) of an image instead of the image pixels. The paper demonstrates the effectiveness and robustness of the proposed method through extensive experiments and comparisons with state-of-the-art methods, and the obvious improvement in performance is shown.
strength_weakness: strength_weakness: 1. The proposed RAIMaRK framework achieves resolution-agnostic watermarking, which is not restricted by the size of images and meets the demand for watermarking images with different resolutions. 
2. The paper proposes to watermark images using the implicit neural representation of images, which gives new possibilities when designing the watermarking framework.
3. The paper provides comprehensive experiments to demonstrate its superior performance compared to SOTA methods, both in terms of invisibility and robustness. The obvious improvement can be seen.
limitations: limitations: 1. More evaluation results under more kinds of distortions and more parameters of distortions should be further provided to fully illustrate the robustness of the proposed method. In Table 2 of this paper, to illustrate the robustness of the proposed method, just one kind of Noise is used (GN), and just one Filter is used (MF), which is not enough to show the robustness against Noise and Filter. More kinds of Noise and Filter should be used. For example, Poisson Noise, SP Noise, Box Blur, Gaussian Filter, etc., should be also considered. Besides, the tested parameter of each distortion includes just one situation. More parameters should be considered, such as JPEG(40, 60, 70, 80), MF(3*3, 5*5), etc.
2. Ablation studies about different components of the method should be further provided to show the effectiveness of different components. For example, if the watermark decoder is not pre-trained and it is trained together in the later process, will the performance be better? 
3. More examples of the output of the proposed method and comparative methods should be shown to illustrate the result of real outputs. In this paper, the shown example is limited, so it can not be well-illustrated that the watermark can be embedded without explicitly harming the visual quality of the cover image.