jean-is/trustmark-onnx

TrustMark Q, as ONNX

The encoder and decoder of TrustMark, Adobe's open-source image watermark, variant Q, exactly as Adobe publishes them for its Rust and JavaScript code at https://cai-watermark.adobe.net/watermarking/trustmark-models/. Nothing here is changed; this copy exists so the files can be fetched at a fixed revision.

File	Bytes	SHA-256
encoder_Q.onnx	17,312,208	19b3d1b25836130ffd78775a8f61539f993375d1823ef0e59ba5b8dffb4f892d
decoder_Q.onnx	47,401,222	ee3268f057c9dabef680e169302f5973d0589feea86189ed229a896cc3aa88df

Both take and give float32 tensors:

• Encoder: onnx::Concat_0, the cover image, [1, 3, 256, 256] in −1…1; onnx::Gemm_1, the 100 payload bits, [1, 100]. It returns image, [1, 3, 256, 256].
• Decoder: image, [1, 3, 256, 256] in −1…1. It returns output, [1, 100]; a bit is set where its value is above 0.

C2PA's soft-binding algorithm list names this variant com.adobe.trustmark.Q. The payload's error correction and schema are TrustMark's own; see its data schema.

Jean uses it to watermark the pictures it makes on a person's own device, as the EU AI Act's Article 50(2) asks.

On ONNX Runtime's WebGPU backend, use preferredLayout: 'NCHW' for the encoder. With the default channels-last layout, ONNX Runtime's convolution misreads its first layer's 6 input channels, in every browser.

Licence

MIT, © 2023 Adobe, for the code and the models alike (see LICENSE). The TrustMark models were trained on licensed Adobe Stock images, as Adobe states. TrustMark is described in Bui et al., TrustMark: Universal Watermarking for Arbitrary Resolution Images, arXiv:2311.18297.