arXiv CSopen access

"Training robust watermarking model may hurt authentication!'' Exploring and Mitigating the Identity Leakage in Robust Watermarking

1

“Training robust watermarking model may hurt authentication!” Exploring and Mitigating the Identity Leakage in Robust Watermarking

arXiv:2605.09646v1 [cs.CR] 10 May 2026

Xinyu Zhang1,2,3 , Ziping Dong1,2 , Qingyu Liu1,2 , Yuan Hong4,∗ , Zhongjie Ba1,2,∗ , and Kui Ren1,2 1 State Key Laboratory of Blockchain and Data Security, Zhejiang University 2 Hangzhou High-Tech Zone (Binjiang) Institute of Blockchain and Data Security 3 Tongyi Lab, Alibaba Group 4 University of Connecticut

✦

Abstract—The rapid advancement of generative AI has underscored the critical need for identifying image ownership and protecting copyrights. This makes post-processing image watermarking an essential tool—it involves embedding a specific watermark message into an image, with successful verification if a similar message can be decoded from the watermarked image. However, this method is susceptible to both adversarial attacks that manipulate the watermarked image to yield an unverified message upon decoding, and the proposed identity leakage-related attacks (e.g., forging watermarked images). The threat of identity leakage is particularly exacerbated in both empirical and certified robust watermarking methods. To defend against the aforementioned attacks, we propose W-IR, the first image watermarking framework that simultaneously incorporates identity protection and robustness. To enhance model robustness, we introduce a novel randomized smoothing technique as part of a robust watermarking, that offers certified robustness against perturbations across two distinct transformation spaces: pixel-level and coordinatelevel. Moreover, to further mitigate identity leakage, we propose a new strategy based on residual information loss, aimed at minimizing the mutual information between the residual and watermarked images. Our work strikes a superior balance between robustness and identity leakage mitigation. Extensive experiments demonstrate that our W-IR framework achieves high certified accuracy for authenticity while effectively reducing identity leakage. 1 Index Terms—Post-processing image watermarking, Adversarial attack, Identity leakage attacks, Randomized smoothing, Mutual information, Identity protection.

1

I NTRODUCTION

With the rapid advancement and widespread adoption of generative AI technologies like DALL·E [1] and Stable Diffusion [2], the generation of high-quality, commercially valuable images has become increasingly prevalent. In this scenario, deep learning-based post-processing image watermarking [3], [4], [5] emerges as a crucial tool for copyright protection, ownership tracking, and identification [6], [7], and is widely adopted in real-world applications [8], ∗ Corresponding author: Zhongjie Ba and Yuan Hong.

Emails: {xinyuzhang53, zhongjieba}@zju.edu.cn, [email protected]. 1. The code is available at https://github.com/holdrain/W-I-R.

Robustness Threat: Adversarial perturbations

W-IR: Watermarking with Identity Protection and Robustness Empirical Robustness

0000

Adversarial Noise

A

1111 A: Authentication

Residual Information Loss

Certified Robustness Exacerbate

New Identity Protection Threat: Identity leakage A

Identity Forgery Attack 0000

0000 Residual Image

1000 0100 0010 0001

W-ER W-CR

0000 A

Identity Extraction Attack

0000

Forge watermark images! Decipher watermark messages!

Figure 1: Our main contributions are: (1) the discovery of identity leakage and corresponding attacks in postprocessing watermarking (which are exacerbated in the robust case), and (2) W-IR: robust watermarking with mitigated identity leakage. [9]. Among these techniques, the industry [10], [11] favors invisible watermarks [12], [3] due to their ability to preserve visual fidelity while resisting straightforward removal attempts [13]. Invisible image watermarking can assist in verifying the image copyright through a three-step process— embedding a unique and imperceptible copyright watermark message into an image with an encoder network to produce a watermarked image, extracting the message with a decoder network, and verifying the match with the original watermark message through a verification function. The integration of the decoder network and the verification function is termed watermarking authentication. Similarly, invisible image watermarking enables creators to track illegal distribution channels by embedding and authenticating unique secret watermarks for each channel. Recent studies have revealed that deep learning-based post-processing watermarking techniques are susceptible to adversarial attacks [14], [15], [16]. Adversaries can alter watermarked images in ways that are imperceptible to humans, but cause the decoder network to extract the message incorrectly, leading to authentication failure [17]. However, these attacks focus solely on robustness vulnerabilities, leaving the vulnerabilities related to identity leakage (especially critical in invisible watermarks) and the relationship between robustness and identity leakage largely unexplored.

2

Table 1: Comparison of different types of image watermarking defenses against identity leakage attacks. Method

Identity leakage threat

Detection Type [18]

Baseline (no protection) Linking & forgery & extraction One watermark per image Forgery & extraction Crypto-based† Forgery & extraction W-IR (Ours) Mitigated all attacks

Blind Non-blind Non-blind Blind

Required storage

Key management

Computational Cost

Watermarked image only Universal watermark message [19] Low Original & watermarked image Image-specific watermark message Low Original & watermarked image Universal key [20] High∗ Watermarked image only Universal watermark message Low

† For example, watermark message t = func(HMAC(key, original image)).

∗ Additional watermark message computation cost for encoding and authentication.

R

Clean Model

Robust Training

R

A I

R A

I

W-IR

A I

Figure 2: Visualization for the three-facet performance (A – Authenticity, R – Robustness, I – Identity Protection) of three types of watermarking strategies. In this paper, we uncover a new serious threat to watermarking: identity leakage. This vulnerability allows adversaries to forge watermarked images carrying the genuine watermark message of a target user without ever decoding the watermark itself (i.e., identity forgery attacks), using only a single image. Different from existing attacks that alter watermarked images directly, this attack crafts fake watermarked images to deceive watermark authenticity models. Further, adversaries can decipher the specific watermark message bit by bit by reasonably accessing the watermark embedding services (i.e., identity extraction attacks). This attack enables more accurate forgeries of watermarked images that deceive watermark authenticity verification, severely compromising ownership tracking and identification, particularly in critical scenarios like police evidence authentication. This phenomenon arises primarily due to the decoder network’s proficiency in accurately extracting watermark messages from watermarked and residual images, as illustrated in Figure 1. Here, the residual image is defined as the difference between the watermarked image and the original one, and can be estimated using methods such as low-pass filtering [21] and Variational Autoencoder (VAE) [8]. To address the aforementioned vulnerabilities, we introduce W-IR, the first image watermark framework that integrates identity protection with robustness. W-IR can be universally combined with both empirical robustness (W-ER) and certified robustness (W-CR), as illustrated in Figure 1. To enhance watermark robustness, researchers have developed various empirical defenses, including the integration of image augmentation [4], [22] and adversarial training [3] into the training phases of encoder and decoder networks. However, they are broken by adaptive or stronger attacks [17], [16]. Certified defenses [23] end the catand-mouse game between attacks and defenses primarily for classification models, and offers provable robustness guarantees against adversarial perturbations. Among them, randomized smoothing (RS) [24], [25] is the state-of-the-art and widely adopted due to its applicability to any model and its ability to achieve acceptable accuracy and efficiency on large-scale datasets (see Section 2.3). Motivated by the

success of RS in image classification, we aim to adapt it to counter adversarial perturbations in image watermarking, a largely unexplored field. We formulate the watermark authenticity, which encompasses the decoder network and verification function, as a classification model. Building on this model, we propose a novel randomized smoothing method to ensure certified robustness for image watermarking against two forms of image perturbations: modifying the pixel values and/ or pixel coordinates. Specifically, we model image perturbations as combinations of pixel and coordinate transformations and then offer provable robustness guarantees within the respective pixel and coordinate spaces. More crucially, while robust training bolsters model resistance against adversarial attacks, it simultaneously greatly exacerbates identity leakage (see Figure 2). This is because robust training methods (e.g., adversarial training and randomized smoothing) incorporate noise to counter adversarial perturbations, inadvertently enhancing the decoder network’s capacity for extracting messages. For instance, we observe that the residual images obtained from robust models contain more watermark messages than those from normally trained (clean) models. As also illustrated in Figures 5 and 10, residual images corresponding to the same message are closer on robust models than clean models. To further enhance identity protection in robust watermarking, we theoretically analyze the mutual information to sufficiently preserve the identity information in watermarked images while reducing the watermark message in residual images. Although crypto-based methods (e.g., watermark message t = func(HMAC(key, original image))) can mitigate identity linking attacks, they remain vulnerable to identity forgery and extraction attacks while incurring high storage and computational overhead (see Table 1). The mutual information estimation, however, is still a wellknown challenging problem [26], [27]. Inspired by [28], we further use variational inference to derive residual information loss (see Section 5) to fit this mutual information objective but without explicitly estimating it. Figure 2 visualizes the performance improvement of our W-IR on authenticity, robustness, and identity protection/leakage. Therefore, our main contributions are as follows: • We explore various vulnerabilities in post-processing watermarking techniques, particularly the risks of identity leakage that may be exacerbated by robust models. • We introduce W-IR, the first image watermarking framework that ensures both identity protection and robustness. W-IR can be universally integrated with different robustness methods, e.g., empirical robustness (W-ER) and certified robustness (W-CR). Specifically, we develop a certified robust watermarking method that addresses pixel and coordination-level image perturbations. To protect identity, we mathematically

3 Message Reconstruction Loss (

Embedding Phase

)

11001101 Message

11001101 Message

Encoder Network

Perturbation Layer

Decoder Network Robustness-enhanced Watermark Image

Original Image

Original image

Watermark Image

Watermark Image

11001101 Decoded Message

Success Verify

11001101

Failure

Message

Figure 4: Authentication phase of image watermarking. Discriminator

L2 Residual Regularization (

[Original Image, Watermark Image]

) Adversarial Loss (

LPIPS Perceptual Loss (

Decoder Network

Encoder Network

11001101 Decoded Message

Watermark Image

Authentication Phase

)

)

Figure 3: Training phase of image watermarking. formulate a mutual information objective that preserves necessary identity information in watermarked images while effectively discarding it in residual images. • We evaluate the proposed identity leakage attacks and the W-IR defenses (W-ER and W-CR) on multiple datasets and post-processing watermarking methods. The results show that the three attacks can achieve high success rates. Further, our W-IR largely reduces the attack performance (providing identity protection) without compromising robustness.

2

P RELIMINARIES

2.1

Post-processing Image Watermarking

Image watermarking is a technique employed to embed a unique identifier (e.g., signal, pattern, information) into an image. This process asserts ownership, protects intellectual property, tracks provenance, and provides authentication proof. The generic neural network-based post-processing watermarking process comprises four modules: encoder, image-enhancement module, decoder, and visual quality augmentation module (see Figure 3). The encoder embeds a watermark message into an original image, transforming it into a watermarked image. The robustness-enhancement module performs data augmentation to empirically increase the watermark’s resilience against various perturbations (e.g., geometric transformations, filters, compression). The decoder retrieves the embedded message from the robustness-enhanced watermarked image. Finally, the visual quality augmentation module maintains the imperceptibility of the watermark by minimizing its impact on the original image’s visual fidelity, thereby preserving its aesthetic quality for human observers or computational analysis. Training Phase: Encoder-Decoder Optimization. Formally, given the original image x and an n-bit binary string representing the watermark message t (e.g., 11001101), the encoder network E obtains the watermarked image as w = E(x, t). The perturbation layer lp then obtains the image-enhanced watermarked image w̃ = lp (w) and the decoder network D extracts the message from it. After deriving the decoded message, the decoder and encoder use a message reconstruction loss LM to derive the loss LM (D(lp (E(x, t))), t). Besides the reconstruction loss, there is also the visual quality loss to improve the image’s visual fidelity. Usually, L2 residual regularization loss LR (E(x, t), x) and LPIPS perceptual loss [29], [30]

LP (E(x, t), x) are used to calculate the difference between the watermarked image and the original image. It is also possible to construct an additional discriminator for distinguishing the original watermarked image and calculating the adversarial (discriminator) loss LA (E(x, t), x) [3]. The weighted sum of these loss components is used to update the encoder and decoder: L = ηM LM + ηR LR + ηP LP + ηA LA

(1)

Authentication Phase: Extracting and Verifying the Watermark. Once the encoder and decoder have been trained, given an original image x and watermark message t (i.e., n-bit 01 string), the encoder can embed the watermark message into the image to produce a watermarked image w = E(x, t), as shown in Figure 4. During the authentication phase, when the watermarked image is fed into the decoder, a string of information tD with the same length as t is obtained as tD = D(w). The bit accuracy is calculated by counting the number of matching positions between tD and t. If the bit accuracy exceeds a certain threshold τ , the watermark is considered to be decoded correctly and verified successfully, which can be formulated as V (tD , t, τ ) = 1. Otherwise, the decoding is deemed incorrect, V (tD , t, τ ) = 0. The threshold τ is often determined by the false positive rate and the length of t [31], [32], [17]. 2.2

Watermarking Adversarial Perturbation

Adversarial attacks on image watermarking involve slight modifications to a watermarked image to generate a perturbed watermarked image (aka. adversarial example) during the authentication phase [17]. These modifications are imperceptible to human observers but can deceive the decoder, resulting in low bit accuracy and failed verification. A direct way for generating adversarial perturbation on watermarked images is adding random noise, such as Gaussian noise, to the watermarked image. Another type of adversarial perturbation is created through transforming the images, while preserving their semantics [33], e.g., affine transformation [33], [34]. A third type of method is based on more refined and purposeful perturbations, e.g., precisely adjusting the perturbation on each image pixel via an optimization algorithm [17]. Rule-based adversarial perturbation, including random noise and semantic transformation, is intuitive and easy-toimplement, which is the main focus of the paper. 2.3

Randomized Smoothing for Classification

Randomized smoothing is a widely adopted defense strategy that offers provable robustness guarantees to classifiers against adversarial examples [24], [35], [36], [37], [38]. This technique is distinguished by its applicability across various

4

2

Component 2

Component 2

4 0 2 4

4 2 0 2 4 6

2 1 0 1 2 3 4 Component 1

(Mean)

One or more images from the user

Precise residual images

Images Watermark not owned images by the user

Decoder API

0010 Same as the target user

Figure 6: Identity forgery attacks.

5 4 3 2 10 1 2 3 Component 1

Figure 5: Cluster results of residual images from four users on HiDDeN. Datasets: left-COCO and right-CelebA. The intra-cluster distances of the four secret watermarks are (a)[0.78, 0.83, 0.94, 0.78] and (b)-[1.17, 0.86, 0.98, 1.13]. classifier architectures and its ability to maintain satisfactory accuracy with large models and large-scale datasets. The rationale behind this method involves incorporating noise into the classifier’s training and inference phases, which effectively smooths the decision boundaries and mitigates steep transition areas exploited by adversarial examples. Initially, the randomized smoothing defines a base classifier h, which assigns an input x to a label y from the label set Y . Then a smoothed classifier g is constructed based on h by incorporating random noise ϵ, sampled from an application-dependent distribution, into x. Mathematically, g(x) = arg maxc∈Y P(h(x + ϵ) = c). Finally, the certified robustness, in the form of certified radius, can be derived based on g . Particularly, pA , pB ∈ [0, 1], the highest and second highest probabilities outputted by P(h(x + ϵ)), are first calculated, and the corresponding classes are denoted as yA and yB . Then g consistently has an accurate prediction yA for x with the adversarial perturbation δ falling within the certified radius R, i.e., g(x + δ) = yA , ∀||δ||p ≤ R, where || · ||p is an ℓp norm. R is often determined by the variance of the noise ϵ and the pA , pB . A larger R implies that h (or g ) is more certified robust.

can publish w on the Internet. When authentication for copyright or ownership is required, the user sends both the watermarked image w and the secret watermark t to the third-party provider. The provider subsequently returns a result indicating whether the secret matches the watermarked image, with responses categorized as ”yes”/ ”no”. Note that users typically maintain consistent secret watermarks for practical management purposes, with secret watermark t serving as their identity representation. Additionally, we evaluate scenarios involving secret watermark modifications to ensure comprehensive analysis. 3.2

Threat Model

In this section, we present critical identity leakage vulnerabilities. Adversaries may execute an identity forgery attack, that uses one image from a target user to create counterfeit watermarked images without decoding the secret watermark and a more potent identity extraction attack, that accurately retrieves the secret watermark. These attacks compromise watermark-based image copyright protection and ownership traceability, particularly in invisible watermarks.

We consider an adversary aiming to forge watermarked images and extract the target user’s identity using only a single image. While we focus on the challenging single-image scenario, using multiple images from the same target user can improve attack success rates. The adversary’s goals are twofold: 1) to perform an identity forgery attack by crafting watermarked images that appear to carry the user’s secret watermark; and 2) to execute an identity extraction attack to recover user’s secret watermark to produce more accurate forged watermarked images. Both attacks fundamentally undermine watermark authentication by maliciously misattributing images to users who did not generate them. The adversary possesses the same black-box encoder access capability as benign users but lacks knowledge of users’ secret watermarks. We assume the adversary can access the watermarked images from users, each with their unique secret watermark, e.g., downloaded from the Internet. The adversary can obtain the corresponding residual images z , using watermark removal techniques such as VAE [8] and low-pass filters[21]. For defense, we consider the third-party watermarking provider as the defender with legitimate ownership of watermarking models [17]. The defender’s capabilities encompass the training of encoder-decoder networks, for which we propose an identity protection-enhanced training strategy (see Section 5) to mitigate user identity leakage.

3.1

3.3

3 I DENTITY L EAKAGE

P ROTECTION

T HREAT:

I DENTITY

System Model

We consider a practical scenario in which a user or entity uses watermarking technology for copyright protection and ownership identification of their images [39]. The process generally involves two parties: the user (or entity), who seeks to safeguard their images, and a third-party watermarking service provider that exclusively offers black-box watermark embedding and authentication services. Initially, the user selects a secret watermark message t (i.e., n-bit binary string) to serve as a unique identifier and submits t with the clean image x to the third-party service provider. The provider then embeds t into x and returns the watermarked image w to the user. Upon receiving w, the user

Identity Leakage Attacks

Observation. We observe that residual images from the same user exhibit consistent watermark patterns. To demonstrate this, we extract salient features from residual images from four users using t-SNE [40] dimensionality reduction, and subsequently apply k -means clustering [41] to identify image clusters that share similar watermark characteristics. As shown in Figure 5, images from the same user form coherent clusters, indicating that the residual images preserve stable and user-specific watermark patterns rather than mere random noise. This reveals that substantial watermark-related information is exposed in the residual domain, which we later exploit to mount practical attacks.

5

0010 Image from target user

Encoder API

:

Adversay's clean image

Figure 7: Illustration of forging watermarked images and attack effect on StegaStamp. PSNR(↑) and SSIM(↑) represent the image quality. Forged bit accuracy represents the accuracy of secret watermark decoding from the forgery image. Identity Forgery Attacks. Given a set of m (m ≥ 1) images from the target user, the adversary can launch identity forgery attacks. Since residual images contain both secret watermarks and image content, directly overlaying a single residual image onto a clean image can already produce a forged watermarked image, but often at the cost of noticeable visual artifacts. Drawing from previous collusion attacks [42], averaging multiple images embedded with the same secret watermark can estimate and remove the watermark from the image. Thus, adversaries can further neutralize image content by averaging residual images from the same user, resulting in a more precise residual image. As depicted in Figure 6, the adversary overlays ζ times of precise residual images on an original image to obtain the forged watermarked image. Figure 7 illustrates the effect of overlaying varying numbers of residual images on a clean original image and the corresponding bit accuracy of watermark decoding and authentication. The results imply that even a single residual image retains the primary secret watermark and allows the decoder network to correctly decode much of the embedded message. Moreover, as the number m of averaged residual images increases, the visual quality of the forged images improves. Identity Extraction Attacks. Given one watermarked image from the target user, the adversary can illicitly decode a n-bit secret watermark by accessing the watermark embedding services fewer than 2 × n times. This attack arises from the inadvertent inclusion of watermark information in the residual image; the closer the secret watermark is to a given image, the more similar the corresponding residual images become. For instance, when applying 100 secret different watermarks to the same image, the Pearson correlation Algorithm 1 Identity Extraction Algorithm Require: Target user’s watermarked image wtg and its residual image ztg , clean image x, secret watermark length n, encoder E . 1: t ← a bit string of length n initialized to all ‘0’ 2: for ι = 1 to n do ▷ Iterate over each bit 3: Set t′ ← t, and t′ [ι] ← 1 4: wt ← E(x, t), wt′ ← E(x, t′ ) ▷ Watermarked image 5: zt ← wt − x, zt′ ← wt′ − x ▷ Residual image 6: distt ← ∥zt , ztg ∥, distt′ ← ∥zt′ , ztg ∥ ▷ Euclidean distance 7: if distt′ < distt then 8: t ← t′ ▷ Update t[ι] ← 1 9: end if 10: end for 11: Output: Extracted secret watermark message t.

（For each

>

Residual image :

）

Extract Watermark images Residual images

Figure 8: Identity extraction attack. coefficient (∈ [−1, 1]) [43] between the secret watermark distance and the residual image distance series may reach as high as 0.95 on StegaStamp (CelebA), indicating a strong positive correlation between these two sequences. As illustrated in Figure 8 and Algorithm 1, to determine whether the ι-th bit of the target user’s watermark is 0 or 1, the adversary sends two pairs, (x, t) and (x, t′ ), to the watermark service provider, where x is a clean image, and t and t′ differ only in the ι-th bit. After obtaining the residual images zt and zt′ for their own watermarked image, the adversary can decide whether the ι-th bit of the target user’s watermark corresponds to t or t′ by evaluating which of the residual images zt or zt′ is closer to the target user’s residual image.

4

R OBUSTNESS E XACERBATES I DENTITY L EAK -

AGE

In this section, we first present two robust watermarking approaches: an empirically robust method (see Section 4.1) and a certified robust method (see Section 4.2), both designed to defend against adversarial attacks. Next, we discuss how robust watermarking may inadvertently exacerbate identity leakage (see Section 4.3).

4.1

Empirically Robust Watermarking

These methods typically integrate adversarial training [3], [4], [44], [22] into the encoder and decoder’s training phases to defend against adversarial attacks. We use two representative open-sourced robust watermarking, referred to as W-ER: 1) StegaStamp+ 2 [4] improves model robustness through a perturbation layer including various distortions (e.g., perspective warp, Gaussian noise, JPEG compression) to approximate distortions in real printing and photography. 2) HiDDeN+ [3] enhances invisibility via a discriminator and incorporates a noise simulation layer (e.g., Gaussian noise, JPEG compression) to bolster robustness against real-world perturbations.

4.2

Certified Robust Watermarking

In this section, we first introduce the notations used in the paper, followed by the formulation of image watermark authentication as a classification model. We then formalize adversarial watermarks as a transformation of image pixels or/and coordinates. Finally, we introduce W-CR as the solution to certify watermarking against such adversarial watermarks.

6

Table 2: Frequently used notations Term

Description

X ⊆ Rd Original image space T ⊆ {0, 1}n Secret watermark message space W ⊆ Rd Watermarked image space Z ⊆ Rd Residual image space V ⊆ R2d Coordinate space W ⊕ V ⊆ Rd Pixel space situated at coordinate space τ ⊆R Verification (tolerance) threshold D :W ⊕V →T The decoder model fV : T × T × R → {0, 1} The watermark verification function h : (W ⊕ V) × T × R → {0, 1} The watermark authentication model ϕ(w, u) : W × U Pixel trans. with parameter u on w θ(v, r) : V × R Coordinate trans. with parameter r on v fI : W × V → W The interpolation function ⟨i, j⟩ x-axis and y -axis of coordinates n Length of the secret watermark message d Size of original (watermarked) image δ Perturbations of pixel/coordinate space R Certified radius

4.2.1

Watermark Authenticity Formulation

Notations. We denote the set of all possible original images as X , the set of all possible secret watermark messages as T , and the set of all watermarked images as W . For each original image x ∈ X and secret watermark t ∈ T , there exists a corresponding watermarked image w ∈ W . We use V = {v = ⟨i, j⟩} to denote the image’s coordinate space, where i and j represent the coordinates along the x-axis and y -axis of a pixel in the image. Then, a coordinated watermarked image can be defined as w ⊕ v , which means the pixels w positioned at coordinates v 3 . We introduce a decoder model D : W ⊕ V → T , where for any watermarked image w, the decoder extracts an estimated secret watermark denoted as tD = D(w ⊕ v). We denote the verification function as fV : T × T × R → {0, 1}. The function V (tD , t, τ ) evaluates the match between the decoded secret watermark tD and the original secret watermark t. This function outputs 1 (indicating a verification success) if the correspondence between tD and t meets or exceeds the threshold τ , and 0 otherwise, signifying a verification failure. We formalize the watermark authentication phase as follows. Definition 1 (Watermark Authentication). We define the watermark authentication model as h : (W ⊕ V) × T × R → {0, 1}, which combines both the decoding and verification steps. Specifically, it first applies the decoder D to a watermarked image w, to extract a decoded message. The decoded message is then assessed in conjunction with the original secret watermark t and a predefined tolerance threshold τ via the verification function V . Consequently, the model h evaluates the congruence between the decoded message and t, factoring in the threshold τ , denoted as below: h(w ⊕ v, t, τ ) = fV (D(w ⊕ v), t, τ ), (2) where a value of 1 signifies a successful match, and a value of 0 indicates a mismatch. 2. We use StegaStamp and HiDDeN to identify clean watermarking methods that do not incorporate empirically robustness training. We use StegaStamp+ and HiDDeN+ to signify watermarking methods that include empirically robustness training, as detailed in [4] and [3]. 3. For ease of description, we will interchangeably use w and w ⊕ v to denote a watermarked image.

Figure 9: Ruled-based perturbations. Left to right: original image and coordinates, Gaussian noisy image and coordinates, and affine transformed image and coordinates. Note that the input image space of h (W ⊕ V ⊆ Rd ) is consistent with W , and the training process of h (including decoder D and verification function fV ) aligns with the classic training of the encoder-decoder watermarking framework. Table 2 shows the commonly used notations. 4.2.2

Adversarial Watermarking Formulation

Recall that a watermarked image comprises image pixels w and coordinates v . Perturbing images can be the pixel-level (ϕ) and coordinate-level (θ) modifications. Considering the pixel of a given image (w), the effect of a perturbation on transformation is mathematically denoted as:

w′ ⊕ v = ϕ(w)

(3)

In this scenario, without alterations to the coordinates, the resultant image pertains solely to the pixel values. Conversely, image coordinate transformation produces new pixel positions (v ′ ), potentially not aligning precisely with the original image’s coordinates. We introduce the interpolation function fI (w, v ′ ) [45], [46], which is commonly employed to estimate the pixel values based on the neighboring pixels. This coordinate transformation is expressed as:

w ⊕ v ′ = fI (w, θ(v))

(4)

Next, we present examples depicted in Figure 9 and offer precise definitions for ϕ and θ corresponding to the perturbations. Gaussian Noise. It adds Gaussian noise as the perturbation to image pixels w, denoted as

ϕG (w, σ) = w + α, α ∼ N (0, σ 2 I)

(5)

where α ∼ N (0, σ 2 I) denotes Gaussian distribution with mean 0 and variance σ . The process generates and inject the noise for each pixel, which adhere to N (0, σ 2 I). Affine Transformation. It relocates image coordinates v to v ′ via a combination of linear transformations (such as scaling, rotation, shearing, and translation). This can be mathematically represented as θF (v, β) as follows 

θF (v, β) =

β1 i + β2 j + β3 β4 i + β5 j + β6



, β ∼ N (0, σ 2 I6 )

(6)

where N (0, σ 2 I6 ) denotes that each component in β is independently distributed according to a Gaussian distribution with a mean of 0 and a variance of σ . We consider modifications within either the pixel or coordinate space, as each of them represents a typical adversarial perturbation on watermarking in practice[17], [33].

7

4.2.3 W-CR Framework I. Overview and Certification Goal. By framing watermark authentication as a binary classification model, we can apply the certified robustness framework from image classification. This involves transforming perturbations to watermarked images into pixel and coordinate spaces (see Section 4.2.2) to ensure certified robustness for various operations in each space (see Section 4.2.3). Since operations that perturbed watermarked images affect either pixel space or coordinate space, any adversary is essentially adjusting pixel transformation u or coordinate transformation r. Our goal is to ensure the watermark authentication model’s robustness against attacks defined by u or r. Specifically, for pixel or coordinate transformation, u we aim to identify a set of pixel parameters Sadv ⊆ U or r coordinate parameters Sadv ⊆ R, such that the model h’s prediction remains consistent for any u or r:

h(w ⊕ v, t, τ ) = h(ϕ(w, u), t, τ ) h(w ⊕ v, t, τ ) = h(fI (w, θ(v, r)), t, τ )

u ∀u ∈ Sadv r ∀r ∈ Sadv

(7) (8)

II. Certified Robustness. By leveraging pixel or coordinate transformations, we construct a new type of transformation smoothed watermark authentication model g from an arbitrary base watermark authentication model h. Specifically, this transformation-smoothed model g is designed to predict the class with the highest probability returned by h when the input for watermark authentication, i.e., w ⊕ v , is perturbed via the pixel or coordinate transformation. The definitions of pixel and coordinate transformation smoothed watermark authentication models are shown below. Definition 2 (Pixel Transformation Smoothed Watermark Authentication). Let ϕ : W ×U → W be a pixel transformation, and let h : (W ⊕V)×T × R → {0, 1} be an arbitrary base watermark authentication model. Taking random variables ϵ ∼ Pϵ from U , we define pixel transformation smoothed watermark authentication model gϕ : (W ⊕ V) × T × R → {0, 1} as gϕ (w ⊕ v, t, τ ) = arg max P(h(ϕ(w, ϵ), t, τ )) (9) y∈{0,1} Definition 3 (Coordinate Transformation Smoothed Watermark Authentication). Let θ : V × R → V be a coordinate transformation, fI : W × V → W be an interpolation function, and let h : (W ⊕ V) × T × R → {0, 1} be an arbitrary base watermark authentication model. Taking random variables ρ ∼ Pρ from R, we define coordinate transformation smoothed watermark authentication model gθ : (W ⊕ V) × T × R → {0, 1} as

gθ (w ⊕ v, t, τ ) = arg max P(h(fI (w, θ(v, ρ)), t, τ ))

(10)

y∈{0,1}

To ensure certified robustness for the transformationsmoothed watermark authentication model against the two perturbations, we refer to methods proven for the image classification [24], [45], [46], [47]. We adopt common types of noise, such as Gaussian and uniform distributions, to formulate pixel transformations ϕ and coordinate transformations θ. We then describe the certification theorems against these perturbations. Certified Robustness to Gaussian Noise. Gaussian noise only changes the image pixel values, without affecting the

pixel coordinates. We invoke Theorem 1 (binary case) in [24] and adapt it to our pixel transformation smoothed watermark authentication, as detailed below: Theorem 1. Let ϕG : W × U → W be the pixel transformation based on Gaussian noise ϵ ∼ N (0, σ 2 I). Let gϕG be the smoothed watermark authentication model from a base watermark authentication model h as in Eq. 9, and suppose pA ∈ ( 12 , 1] satisfies P(h(ϕ(w, ϵ), t, τ )) ≤ pA . Then gϕG (ϕG (w, δG ) ⊕ v, t, τ ) = cA for all ∥δG ∥2 < RG , where

RG = σΦ−1 (pA )

(11)

Per Eq. 5, ϕG indicates the addition of noise to the pixels. Thus δg represents the distance at the pixel level between the original and perturbed images. Theorem 1 states that gϕG can defend against adding Gaussian noise perturbations as long as the addition noise ∥δG ∥2 < RG in Eq. 11. We observe that the certified radius RG is larger when the noise level σ is higher and/ or pA is larger. Certified Robustness to Affine Transformation. Affine transformation only alters the image coordinate with the parameter owning six components (i.e., β = [β1 , · · · , β6 ]) applying to the coordinate. We invoke Theorem 1 in [46] and adapt it to our (binary) coordinate smoothed watermark authentication, as detailed below: Theorem 2. Let θF : V × R → V be the coordinate transformation based on Gaussian noise ρ ∼ N (0, σ 2 I6 ). Let gθF be the smoothed watermark authentication model from a base model h as in Eq. 10, and suppose pA ∈ ( 12 , 1] satisfies P(h(fI (θF (v, ρ)), t, τ )) ≤ pA . Then gθF (w ⊕ θF (v, δF ), t, τ ) = cA for all ∥δF ∥2 < RF , where

RF = σΦ−1 (pA )

(12)

As indicated by Eq. 6, θF represents the linear transformation of x-axis and y -axis, i.e., v = ⟨i, j⟩, by the parameter list β . Then δF denotes the distance of the coordinate transpP 2 formation coefficients, denoted as ∥δF ∥2 = κ βκ [46]. Theorem 2 states that gθF can defend against affine perturbations as long as the condition about δF in Eq. 12 satisfies. We observe that the certified radius RF is larger when the uniform noise level σ is higher and/ or pA is larger. 4.2.4

Practical Algorithms

Training. Note that, though we combine decoding and verification into a single function h, the verification function is parameter-free. During the training phase, we update only the decoder D (and encoder E ). The training process is akin to classical robust watermarking training [4], [3]. We introduce perturbations solely within the perturbation layer. Receiving a watermarked image output from the encoder, we obtain the corresponding pixel value w and pixel coordinate v . Then we perturb images through transformations applied to either the pixel transformation ϕ(w, u) or the coordinate transformation θ(v, r). Finally, we feed these new images into the decoder to train and update the watermark’s encoder and decoder. Certification. The overall process of the certification is similar to the classical randomized smoothing in [24]. As described in Algorithm 2, we first obtain the watermarked

0

0 1 2

0

1 2 3 4 Component 1

(a) COCO

2 4 6

4

2

Component 2

2

1

Component 2

2 Component 2

Component 2

8 4 0 2 4 3 2 1 0 1 2 3 4 Component 1

(b) CelebA

2 0 2 4

2 0 2 4 6 8 10 Component 1

(c) COCO

4

2 0 2 4 Component 1

6

(d) CelebA

Figure 10: The cluster results for residual images on HiDDeN under empirical (10a and 10b) and certified (10c and 10d) robust models. The intra-cluster distances are as follows: (a)-[0.77, 0.79, 0.80, 0.72], (b)-[0.85, 1.06, 1.00, 0.89], (c)-[0.66, 0.68, 0.60, 0.86], (d)-[0.64, 0.62, 0.58, 0.62]. image, which comprises image pixels w and coordinate v . Then we utilize pixel transformation ϕP or coordinate transformation θP on the image and draw N0 samples to formulate an initial guess for yA . The input parameters for h, i.e., w, v, t, τ , are as specified in Eq. 2. We then employ a larger number of sample sets to calculate an estimate of pA . Finally, we certify robustness on N samples and output the robust prediction.

4.3

Identity Leakage Exacerbation

Clean v.s. Robust: Both empirically and certified robust watermarking methods are more susceptible to identity leakage risks than clean models. As illustrated in Figure 10, the clustering effect on residual images under robust models (i.e., the effectiveness of identity linking attacks) outperforms that of clean models in Figure 5, characterized by the reduced intra-cluster distances and increased inter-cluster distances. Similarly, as Figure 11 shows, the capacity of residual images under robust models to forge watermarked images also exceeds that of clean models. The decoded accuracy of the forged bit accuracy is significantly higher than that of the clean model in Figure 7. Moreover, the Pearson correlation coefficients for empirical and certified robust models are 0.96 and 0.97, which is higher than that for clean models. This indicates a stronger correlation between the residual image distance and the secret watermark distance, which results in a higher success rate for watermark extraction attacks. These observations indicate that in order to mitigate the impact of adversarial perturbations on watermarked images, the encoder network embeds a greater number of secret watermarks into the images, leading to residual images that contain a greater quantity of secret watermarks. Furthermore, incorporating noise during the robust training process enhances the decoder network’s capacity to decode perturbed images correctly. This inadvertently enhances the decoder’s ability to extract messages from residual images. Empirically Robust (W-ER) v.s. Certified Robust (W-CR): The degree of identity leakage differs between W-ER and WCR methods due to variations in training noise magnitude and combination, making it inappropriate to rank their robustness uniformly. Figure 10 shows that the W-CR leads to greater identity leakage than the W-ER (HiDDeN+ ). Conversely, Figure 11 shows that the W-CR yields less identity leakage than the W-ER (StegaStamp+ ).

Figure 11: Forging watermarked images on StegaStamp under empirical (top) and certified (bottom) robust models.

5

M ITIGATING I DENTITY L EAKAGE

During the embedding, the secret watermark t is incorporated into the watermarked image w via the encoder network. Ideally, per the Information Bottleneck (IB) principle, w should retain all the information from both the secret watermark t and the clean image x. However, identity extraction attack results (see Section 6.2) reveal that secret watermark t can be deciphered by a simple operation: the residual difference between w and x. This means that the watermark information t inadvertently flows into the residual image z . Residual Information Objective min

max

x

w

Optimal Residual Information

x

z t

t

z w

Figure 12: Information content of feature representations. To address the issue, we introduce the residual information objective from the information theory perspective, as shown in Figure 12. Particularly, our two tasks in mitigating identity leakage are: 1) ensuring that w retains all of t (sufficiency of w for t), which involves maximizing the mutual information between w and t; 2) ensuring that z does not contain any information about t, which involves minimizing the mutual information between z and t. Note that the absence of t in z does not indicate that t is also absent in w. This distinction arises from the fact that the transmission of information does not occur solely through subtraction. By combining these two tasks, our residual information objective will be converted to:

max I(w; t) − I(z; t),

(13)

where the mutual information I(A; B) between two variables A and B is defined as: Z p(A, B) I(A; B) = p(A, B) log dAdB. (14) p(A)p(B) However, many studies have shown that mutual information cannot be directly calculated in high-dimensional space. Alternatively, it is approximated using neural estimators [26], [27], [48]. To deal with the estimation of mutual information in Eq. 13, we introduce the following theorem:

9

11001101 Message

Encoder Network

Distortion Layer

Decoder Network

11001101 Decoded Message 11001101

Watermarked Image

Residual Message

Original image Residual Information Loss (

Residual Image

)

Figure 13: Identity leakage mitigation in watermarking. Theorem 3. Eq. 13 can be estimated as follows: max I(w; t) − I(z; t) ⇐ max fKL [Pw ∥Pz ] − fKL [Pz ∥Pw ], (15)

where Pw = p(t|w), Pz = p(t|z) denote the probability distributions, and fKL represents the KL divergence. Proof. Detailed proof is deferred to Appendix A. With it, we define the Residual Information Loss as: LRIL = min Ew∼EE (W|T ,X ) {fKL [Pz ∥Pw ] − fKL [Pw ∥Pz ]}, (16) E

where E denotes the parameters of the encoder network, as shown in Figure 13. Pw and Pz are the probabilities of extracting identity information (via secret t) from w and z , respectively. Both Pw and Pz can be parameterized via a decoder D, and the expectation is approximated via a batch of samples. Due to the range and asymmetry of KL divergence, the estimate (in Eq. 13) ranges from [0, +∞]. Upon continuously optimizing for this estimate and updating the encoder E , the identity information in w will be retained to the maximum extent, while that in z will approach 0. In this way, we can obtain a sufficient watermarked image with minimized residual identity information, i.e., an optimal watermarked image. In Appendix C, we describe the complete training process of the W-IR, which incorporates the designed loss LRIL .

6

E XPERIMENTS

6.1

Experimental Setup

Datasets. We utilized two widely recognized datasets for training and testing our watermarking models: CelebAHQ (abbreviation CelebA) [49] and MS-COCO (abbreviation COCO) [50]. CelebA is a high-resolution face image dataset, while COCO is a large-scale dataset supporting tasks such as object detection, segmentation, key-point detection, and captioning. On CelebA, we allocate 24, 000 images for training, 6, 000 for validation, and 2, 000 for testing. On COCO, we select 10, 000 images for training, 5, 000 images for validation, and 1, 000 images for testing. All images were rescaled to a resolution of d = 128 × 128 pixels.

Gaussian noise or affine transformation. For additive Gaussian noise, we set the variance σ ∈ {0.1, 0.25, 0.5}. For affine transformation, following the setup in [46] on the large-scale dataset (i.e., ImageNet), we set the noise intensity to be σ ∈ {0.01, 0.02, 0.03} in β ∼ N (0, σ 2 I6 ) 4 . We first train our watermarking model without noise for 500 epochs to obtain the clean vanilla model. Subsequently, we additionally train 100 epochs on the noisy data to obtain the robust model (i.e., W-CR), except with the highest noise magnitude (i.e., σ = 0.5 in additive Gaussian noise and σ = 0.03 in affine transformation) where we trained 200 epochs. Without otherwise mentioned, we consider that W-CR includes the designed residual information loss. Identity Leakage Attacks. For identity forgery attacks, we evaluate two settings: each user has either m = 1 or m = 30 watermarked images. We set the multiplicative coefficient to ζ = 1. The m = 1 setting demonstrates that a single watermarked image is already sufficient to forge a watermark, while the m = 30 setting further improves the visual quality of the forged images. For identity forgery attacks targeting individual watermarked images and identity extraction attacks, we set m = 1, where each user possesses a single watermarked image while maintaining other parameters unchanged. Evaluation Metrics. We use PSNR (Peak Signal-to-Noise Ratio) and SSIM (Structural Similarity Index) to measure the visual quality after embedding secret watermarks. For authentication, we report the bit accuracy and accuracy of the model in the clean test set used for vanilla training (clean vanilla) and certified robust training (clean (bit) accuracy). For robustness, we evaluate certified accuracy, defined as the fraction of the test samples verified correctly and certified robust. We randomly select 500 examples from the test set in each dataset. For each example, we used N0 = 100 samples to select the most likely prediction yA , and N = 105 samples to estimate the lower confidence limit pA . We set α = 0.001 for certification, meaning at least 99.9% confidence. For identity linking attacks, we use the silhouette score, the average of the silhouette coefficients for all samples [51]. The silhouette coefficient ∈ [−1, 1] evaluates the degree of similarity between an object and its cluster compared to other clusters. A high value indicates better overall clustering performance. To evaluate the success of identity forgery attacks, we utilize the forged bit accuracy of forgery images and the forged accuracy of forgery images. To evaluate the success of the identity extraction attack, we use attack bit accuracy to measure the rate at which the extracted secret watermark matches the target secret watermark.

Watermarking Methods. We use two representative opensource invisible watermarking schemes for our experiments: StegaStamp[4] and HiDDeN[3]. For the secret watermark, we set its length to be n = 100 bits and bit values are random. During the clean model training, we did not use the noise layer. All other parameters follow the default settings unless otherwise noted [3], [4].

Identity Forgery Attack. Table 3 illustrates the effectiveness of identity forgery attacks across various models and

Robust Training. For empirically robust methods StegaStamp+ and HiDDeN+ , we adhered to the noise settings specified in [4] and [3]. For the certified robust method W-CR, we train each scheme against additive

4. We observed challenges on achieving convergence during adversarial training with larger perturbations, possibly due to this not being used in the original adversarial training procedures of HiDDeN and StegaStamp.

6.2

Results on Identity Leakage Attacks

In this section, we compare the identity leakage results under clean models, empirically robust models (W-ER w/o LRIL ), and certified robust models (W-CR w/o LRIL ).

10

Table 3: Forged bit accuracy under the m = 30 setting. A lower value (↓) indicates the model leaks fewer identities. The bold indicates the model with the most identity leakage. Dataset (Model)

W-CR w/o LRIL Clean W-ER vanilla w/o LRIL Noise(σ ) Gaussian noise Noise(σ ) Affine

Table 5: Attack bit accuracy under different settings. A lower value (↓) indicates the model leaks fewer identities. The bold indicates the model with the most identity leakage. Dataset (Model)

W-CR w/o LRIL Clean W-ER vanilla w/o LRIL Noise(σ ) Gaussian noise Noise(σ ) Affine

COCO 66.54% (StegaStamp)

98.99%

0.10 0.25 0.50

91.10% 95.22% 96.66%

0.01 0.02 0.03

81.34% 77.97% 81.79%

COCO 83.00% (StegaStamp)

97.00%

0.10 0.25 0.50

90.00% 92.00% 96.00%

0.01 0.02 0.03

93.00% 89.00% 82.00%

CelebA 84.80% (StegaStamp)

100.0%

0.10 0.25 0.50

98.61% 98.74% 92.13%

0.01 0.02 0.03

94.29% 95.39% 91.56%

CelebA 76.00% (StegaStamp)

98.00%

0.10 0.25 0.50

88.00% 91.00% 93.00%

0.01 0.02 0.03

88.00% 81.00% 78.00%

COCO (HiDDeN)

54.46%

55.93%

0.10 0.25 0.50

56.23% 55.94% 58.97%

0.01 0.02 0.03

64.90% 54.56% 56.50%

COCO (HiDDeN)

63.00%

66.00%

0.10 0.25 0.50

69.00% 75.00% 69.00%

0.01 0.02 0.03

65.00% 58.00% 59.00%

CelebA (HiDDeN)

57.48%

58.78%

0.10 0.25 0.50

61.21% 57.58% 59.28%

0.01 0.02 0.03

57.73% 57.97% 59.09%

CelebA (HiDDeN)

67.00%

69.00%

0.10 0.25 0.50

80.00% 74.00% 80.00%

0.01 0.02 0.03

68.00% 69.00% 60.00%

Table 4: Forged bit accuracy under the m = 1 setting. A lower value (↓) indicates the model leaks fewer identities. The bold indicates the model with the most identity leakage. Dataset (Model)

W-CR w/o LRIL Clean W-ER vanilla w/o LRIL Noise(σ ) Gaussian noise Noise(σ ) Affine

COCO 67.93% (StegaStamp)

95.44%

0.10 0.25 0.50

79.82% 91.23% 95.07%

0.01 0.02 0.03

73.12% 69.93% 69.35%

CelebA 83.32% (StegaStamp)

100.0%

0.10 0.25 0.50

97.95% 97.94% 87.65%

0.01 0.02 0.03

91.60% 93.57% 89.26%

COCO (HiDDeN)

53.3%

62.93%

0.10 0.25 0.50

62.92% 64.01% 62.35%

0.01 0.02 0.03

55.72% 57.37% 59.84%

CelebA (HiDDeN)

55.15%

68.93%

0.10 0.25 0.50

74.46% 68.48% 60.15%

0.01 0.02 0.03

58.01% 57.89% 59.57%

datasets, revealing that nearly all models are susceptible to some extent of identity forgery. Under StegaStamp, both WER and W-CR show a significant degree of identity leakage, which is predominantly higher than that observed in clean models. Conversely, under HiDDeN, although models employing W-ER and W-CR show increased robustness, their forgery bit accuracy resembles that of the clean model, particularly at high-level noise. This phenomenon is due to the introduction of noise during training, which undermines the authentication performance (see clean bit accuracy in Table 6), leading to decreased accuracy of the decoder compared to the clean model. Table 4 demonstrates the effectiveness of identity forgery attacks using a single watermarked image per user. We evaluate the forgery bit accuracy averaged over 1000 experimental iterations. The results reveal that even with just one watermarked image, almost all models exhibit some degree of identity leakage. Moreover, models under robustness training generally show more severe identity leakage compared to clean models. At the model level, consistent with previous findings, StegaStamp demonstrates more significant privacy leakage than HiDDeN. Identity Extraction Attack. Table 5 illustrates the effects of identity extraction attacks under various settings (using only one watermarked image). The results indicate that all models are at risk of secret watermark leakage, with attack bit accuracy (reflecting the extent of identity leakage) increasing under robust training compared to the

clean model. Moreover, under Stegastamp, the watermark extraction bit accuracy of W-ER and W-CR exceeds 90%, highlighting a substantial risk of identity leakage. Notably, the bit accuracy presented in Table 5 is generally higher than the values shown in Table 3. The difference is because identity extraction attacks directly compare the extracted secret watermark to the ground truth watermark, without relying on the decoder for decoding. As a result, bit accuracy remains high in instances of reduced decoder efficiency (e.g., under Gaussian noise on HiDDeN). Impact of Different Parameters (m, ζ , Distance). To investigate the impact of various parameters on identity leakage, we explored the variations in forged bit accuracy under different numbers of users (m), multiplicative coefficients (ζ ), and distances between secret watermark pairs. To explore the effect of m and ζ , we selected four sets of parameter combinations. The results are shown in Figure 14. Generally, increasing m results in higher forged bit accuracy. When m = 30, the accuracy is comparable to, or even surpasses, that obtained with m = 100. Similarly, increasing ζ leads to higher forged bit accuracy; however, as illustrated in Figure 7 this also results in a greater loss of image quality. Consequently, in our primary experiments, we have selected the settings m = 30 and ζ = 1, which represent a balanced trade-off between the effectiveness of the attack and the preservation of image quality.

6.3

Robustness Enhancement in W-IR

I. Robustness Enhancement in W-ER: The robustness of StegaStamp+ and HiDDeN+ has been assessed in [4], [3], revealing that both methods demonstrate significant enhancements in robustness after adversarial training. Subsequent studies have further evaluated and compared the robustness of these two watermarking techniques. For instance, research findings [52], [53] indicate that StegaStamp+ exhibits superior robustness compared to HiDDeN+ . II. Robustness Enhancement in W-CR: Here we report the certified robustness results of W-CR without the designed LRIL . Please refer to Appendix F for detailed robustness results of W-CR with LRIL . The results indicate that our LRIL maintains the certified robustness of W-CR without LRIL .

11

Table 6: Certified robustness, authentication effectiveness, and visual quality of W-CR without residual information loss LRIL . Clean vanilla

W-CR: Affine transformation

PSNR↑ SSIM↑

Clean Clean Noise Clean Clean Certified Noise Clean Clean Certified PSNR↑ SSIM↑ PSNR↑ SSIM↑ Bit Acc.↑ Acc.↑ (σ ) Bit Acc.↑ Acc.↑ Acc.↑ (σ ) Bit Acc.↑ Acc.↑ Acc.↑

COCO (StegaStamp)

30.79

0.9314

99.82%

100.0%

0.10 0.25 0.50

27.22 23.97 19.92

0.8835 0.8217 0.7241

99.99% 100.0% 100.0%

100.0% 100.0% 100.0%

96.60% 98.80% 99.40%

0.01 0.02 0.03

28.24 27.18 26.03

0.9111 0.9013 0.8948

99.98% 99.99% 99.99%

100.0% 100.0% 100.0%

94.60% 94.80% 95.80%

CelebA (StegaStamp)

31.39

0.9360

99.97%

100.0%

0.10 0.25 0.50

30.01 25.60 19.48

0.9089 0.8485 0.6509

100.0% 100.0% 99.90%

100.0% 100.0% 100.0%

100.0% 100.0% 100.0%

0.01 0.02 0.03

33.33 32.89 30.57

0.9505 0.9489 0.9412

99.99% 100.0% 100.0%

100.0% 100.0% 100.0%

100.0% 100.0% 100.0%

COCO (HiDDeN)

32.84

0.9418

83.40%

100.0%

0.10 0.25 0.50

27.66 24.09 21.76

0.8500 0.7659 0.7009

81.48% 79.01% 74.60%

99.67% 99.92% 100.0%

100.0% 100.0% 100.0%

0.01 0.02 0.03

29.65 29.59 29.59

0.9140 0.9106 0.9100

82.76% 81.09% 80.04%

100.0% 100.0% 100.0%

100.0% 100.0% 100.0%

CelebA (HiDDeN)

35.51

0.9604

88.89%

100.0%

0.10 0.25 0.50

26.24 22.52 20.85

0.8104 0.7131 0.7011

86.90% 80.01% 85.09%

100.0% 100.0% 100.0%

100.0% 100.0% 100.0%

0.01 0.02 0.03

32.08 31.67 32.10

0.9426 0.9423 0.9428

89.87% 88.37% 87.58%

100.0% 100.0% 100.0%

100.0% 100.0% 100.0%

Average

32.63

0.9424

93.02%

100.0%

24.11

0.78157

90.58%

99.97%

99.57%

30.24

0.9258

92.47%

100.0%

98.77%

al

Em

10

ic pir

Ga

u

0. anssi

25

Ga

u

0. anssi

50

0. anssi

u

Ga

i Aff

1 0.0 ne-

i Aff

2 0.0 ne-

03

i Aff

0. ne-

Models

Figure 14: Impact of m and ζ on COCO (StegaStamp). Certified Robustness Results. Table 6 summarizes the robustness, authentication, and visual quality of W-CR against additive Gaussian noise and affine transformation on different datasets, models, and noise magnitudes. To our knowledge, W-CR is the first scheme in the domain of post-processing image watermarking that offers provable robustness against pixel value and coordinate perturbations. We have the following key observations: 1) Compared to the clean model, W-CR sacrifices only a marginal bit accuracy and nearly no clean accuracy. In addition, it achieves nearly 100% certified accuracy: the average certified accuracy of W-CR stands at 99.57% and 98.77% under additive Gaussian noise and affine transformations across all datasets and models, respectively. 2) Comparing different datasets, CelebA outperforms COCO in terms of model robustness, authentication performance, and visual quality. This is due to the larger scale of CelebA and the uniformity of its image content (i.e., all are face images), which facilitates model convergence. 3) As the noise magnitude increases, there is a decline in the authentication performance and visual quality. However, different from classic classification where model accuracy is significantly impacted by robust training, the clean (bit) accuracy of watermarking is less affected by robust training, though with a slight decrease in watermarked image quality. Certified Accuracy under Different Radii. Figures 15 and 18 depict the impact of certified radii at varying noise magnitudes on the certified accuracy against additive Gaussian noise and affine transformation. The results show the certified accuracy decreases as the radius increases, and it drops to 0 abruptly at a certain threshold of the radius. Moreover, increasing the noise magnitude is shown to enlarge the certified radius. At the same radius, higher magnitudes

1.0 0.8 0.6 0.4 0.2 0.0

0

1

radius

2

3 = 0.1 = 0.25 = 0.5

0

1

radius

2

3

1.0 0.8 0.6 0.4 0.2 0.0

= 0.1 = 0.25 = 0.5

certified accuracy

= 0.1 = 0.25 = 0.5

1.0 0.8 0.6 0.4 0.2 0.0

0

1

radius

2

3 = 0.1 = 0.25 = 0.5

certified accuracy

an

Cle

1.0 0.8 0.6 0.4 0.2 0.0

certified accuracy

m = 1, = 0.5 m = 1, = 1 m = 30, = 1 m = 100, = 1

Forged Bit Accuracy

1.0 0.9 0.8 0.7 0.6 0.5 0.4

certified accuracy

Dataset (Model)

W-CR: Additive Gaussian noise

0

1

radius

2

3

Figure 15: Certified accuracy at different radii against additive Gaussian noise. Datasets: left-COCO and right-CelebA; Models: top-StegaStamp and bottom-HiDDeN. noise achieves the highest certified accuracy; however, this is at the expense of image quality (see PSNR and SSIM in Table 6). We also observe that on HiDDeN, a 100% certified accuracy under various radii is achieved across datasets, perturbations, and noise levels. This implies the test images for certification are all certified robust under the considered setting on HiDDeN. 6.4

Identity Protection in W-IR

According to the results in Section 6.2, W-ER (w/o LRIL ) shows no significant variation in identity leakage across different noise levels. Consequently, we analyze the effects of LRIL on identity protection under low-level noise, which exhibited the best authentication effectiveness. Table 7 illustrates the effectiveness of our proposed residual information loss LRIL , in mitigating identity leakage across various settings. The findings indicate that LRIL effectively reduces identity leakage under three types of attacks involving clean models, W-ER, and W-CR. Among these models, the clean model provides the highest identity protection; however, it lacks robustness enhancement. Notably, W-CR (w/ LRIL ) achieves a level of identity protection comparable to or even exceeding that of the clean model (w/o LRIL ). For instance, in identity linking attacks, the average silhouette score for W-CR under Gaussian noise is 0.4181, indicating the second-highest level of identity protection. This suggests that W-CR maintains robustness without increasing identity

12

Table 7: Comparison of clean, W-ER, and W-CR for identity leakage, with and without LRIL . A lower value (↓) indicates less identity leakage. The bold and blue indicate the highest and second-highest levels of identity protection. Clean vanilla

W-ER

W-CR: Gaussian noise

W-CR: Affine

Metrics

Dataset (Model)

w/o LRIL

w/ LRIL

w/o LRIL

w/ LRIL

w/o LRIL

w/ LRIL

w/o LRIL

w/ LRIL

Identity forgery attack: Forged bit accuracy (↓)

COCO (StegaStamp) CelebA (StegaStamp) COCO (HiDDeN) CelebA (HiDDeN)

65.44% 84.80% 54.46% 57.48%

61.48% 76.75% 50.68% 50.76%

98.99% 100.0% 55.93% 58.78%

94.89% 95.00% 55.45% 58.40%

91.10% 98.61% 56.23% 61.21%

88.42% 92.95% 50.13% 46.46%

81.34% 94.29% 64.90% 57.73%

71.18% 92.96% 53.93% 52.60%

Average

65.55%

59.92%

78.43%

75.93%

76.79%

69.49%

74.57%

67.67%

Identity extraction attack: Attack bit accuracy (↓)

COCO (StegaStamp) CelebA (StegaStamp) COCO (HiDDeN) CelebA (HiDDeN)

83.00% 76.00% 63.00% 67.00%

79.00% 74.00% 61.00% 61.00%

97.00% 98.00% 66.00% 69.00%

83.00% 78.00% 64.00% 65.00%

90.00% 88.00% 69.00% 80.00%

86.00% 81.00% 65.00% 70.00%

93.00% 88.00% 65.00% 68.00%

90.00% 78.00% 62.00% 64.00%

Average

72.25%

68.75%

82.50%

72.50%

81.75%

75.50%

78.50%

73.50%

leakage compared to clean vanilla, successfully balancing identity protection with robustness. In the case of W-ER, although identity leakage is typically highest w/o LRIL , our proposed LRIL significantly mitigates this leakage. For example, under the identity extraction attack, the average attack bit accuracy of W-ER w/ LRIL is comparable to that of clean models (w/o LRIL ).

7

R ELATED W ORK

7.1

Image Watermarking

Post-processing Methods embed the watermark message into images after generation. Conventional digital image watermarking predominantly relies on image processing techniques to embed watermark messages in the images’ spatial or transform domain [33]. In spatial domain watermarking, the watermark message is embedded by making slight adjustments to pixel values. For instance, Chopra et al. [54] propose embedding messages to the least significant bit of pixel values. Frequency domain watermarking requires transforming images from the spatial to the frequency domain. Al-Haj et al. [55] combine DWT with DCT techniques to capitalize on both methods’ advantages, which is employed by open-source generative model Stable Diffusion [8]. However, these methods show vulnerability against image perturbations such as JPEG compression and additive noise [32], [17], [3], [56]. Neural networks enhance post-processing methods by improving robustness and visual quality, often using encoder-decoder architectures for effective watermark embedding and extraction [4]. For instance, Zhu et al. [3] introduce a discriminator to enhance invisibility and a noise simulation layer to bolster robustness against mimic realworld perturbations. Fang et al. [57] apply invertible neural networks to watermarking, leveraging their performance in image generation and high-resolution tasks to achieve high quality watermarked images. Jia et al. [22] propose MBRS to enhance robustness against JPEG compression by incorporating real and simulated JPEG compression during training. In-processing Methods are commonly utilized in generative AI detection and traceability, where the watermark message is embedded directly during the image generation process. Inspired by model fingerprinting, Yu et al. [58] propose embedding artificial fingerprints (i.e., watermark messages) into the training data of generative models, demonstrating that these watermark messages transfer from the training

data to the model’s output. Yu et al. [59] and Lukas et al. [31] streamline the process by embedding watermark messages directly into model weights and fine-tuning pretrained generative models. Fernandez et al. [32] achieve lower training overhead by fine-tuning only the decoder part of stable diffusion. Wen et al. [60] embed watermarks directly in the Fourier space of latent variables in a diffusion model, with extraction via diffusion inversion. However, inprocessing methods are limited in their application to nongenerated images, primarily applicable to the detection of AI-generated content [33] and model intellectual property protection[61]. 7.2

Image Watermarking Adversarial Attacks

Tampering Attacks manipulate the watermarked image using different transformations to prevent the correct decoding of the watermark message. An effective and straightforward method involves applying rule-based transformations to the watermarked image and enhancing the attack’s effectiveness by adjusting the transformation parameters. For example, Tancik et al. [4] incorporate noise layers such as crop, Gaussian blur, affine, etc. to simulate real-world interferences to images. Ma et al. [44] include additional operations like hue adjustment and dropout to enhance robustness. These attacks can generate numerous adversarial examples by setting various transformation parameters at a low cost, without the knowledge of watermarking neural networks [33]. Another approach involves employing finely tuned optimization algorithms to search for adversarial perturbations. For instance, Jiang et al. [17] propose to use PGD [62] and HopSkipJump [63] to search for adversarial examples. An et al. [33] and Hu et al. [64] trained surrogate models simulating a watermark decoder to determine the presence of a watermark in an image. However, they typically involve algorithms of higher complexity, requiring additional time for model training and adversarial examples generation [65]. Reconstruction Attacks aim to recreate images without watermarks based on the content of watermarked images. These attacks view the addition of a watermark message as noise, which can be removed from the watermarked image using well-trained reconstruction models, such as super-resolution models [31], image compression models[66], [67], [68], and pre-trained Denoising Diffusion Implicit Model [69], [33]. However, these methods heavily rely on the reconstruction capability of the models and often

13

fail to remove the watermark while maintaining acceptable visual quality [31], [32].

[16] M. Saberi, V. S. Sadasivan, K. Rezaei, A. Kumar, A. Chegini, W. Wang, and S. Feizi, “Robustness of ai-image detectors: Fundamental limits and practical attacks,” arXiv preprint arXiv:2310.00076, 2023. [17] Z. Jiang, J. Zhang, and N. Z. Gong, “Evading watermark based 8 C ONCLUSION detection of ai-generated content,” in Proceedings of the 2023 ACM SIGSAC Conference on Computer and Communications Security, 2023, We reveal that post-processing image watermarking is vulpp. 1168–1181. nerable to both adversarial attacks and identity leakage– [18] W. Wan, J. Wang, Y. Zhang, J. Li, H. Yu, and J. Sun, “A compreadversaries can exploit leaked identity information to craft hensive survey on robust image watermarking,” Neurocomputing, vol. 488, pp. 226–247, 2022. watermarked images that fool the watermark owner (even [19] Z. Jiang, M. Guo, Y. Hu, and N. Z. Gong, “Watermark-based with invisible watermarks). Additionally, we observe that detection and attribution of ai-generated content,” arXiv preprint robust models can exacerbate such identity leakage. To arXiv:2404.04254, 2024. address the issues, we develop W-IR, the first image wa- [20] P. V. Sanivarapu, K. N. Rajesh, K. M. Hosny, and M. M. Fouda, “Digital watermarking system for copyright protection and autermarking framework that ensures both identity protecthentication of images using cryptographic techniques,” Applied tion and robustness. We perform extensive experiments to Sciences, vol. 12, no. 17, p. 8724, 2022. demonstrate the effectiveness of the identity leakage attack [21] M. Kutter, S. V. Voloshynovskiy, and A. Herrigel, “Watermark copy attack,” in Security and Watermarking of Multimedia Contents II, vol. and the efficacy of our W-IR in providing robustness and 3971. SPIE, 2000, pp. 371–380. identity protection. [22] Z. Jia, H. Fang, and W. Zhang, “Mbrs: Enhancing robustness of dnn-based watermarking by mini-batch of real and simulated jpeg compression,” in Proceedings of the 29th ACM international R EFERENCES conference on multimedia, 2021, pp. 41–49. [23] L. Li, T. Xie, and B. Li, “Sok: Certified robustness for deep neural [1] “Dall·e 3 — openai,” https://openai.com/index/dall-e-3/, 2024. networks,” in 2023 IEEE symposium on security and privacy (SP). [2] “Stable diffusion 3 — stability ai,” https://stability.ai/news/ IEEE, 2023, pp. 1289–1310. stable-diffusion-3, 2024. [24] J. Cohen, E. Rosenfeld, and Z. Kolter, “Certified adversarial ro[3] J. Zhu, R. Kaplan, J. Johnson, and L. Fei-Fei, “Hidden: Hiding data bustness via randomized smoothing,” in international conference on with deep networks,” in Proceedings of the European conference on machine learning. PMLR, 2019, pp. 1310–1320. computer vision (ECCV), 2018, pp. 657–672. [25] D. Zhang, M. Ye, C. Gong, Z. Zhu, and Q. Liu, “Black-box certifica[4] M. Tancik, B. Mildenhall, and R. Ng, “Stegastamp: Invisible hytion with randomized smoothing: A functional optimization based perlinks in physical photographs,” in Proceedings of the IEEE/CVF framework,” Advances in Neural Information Processing Systems, conference on computer vision and pattern recognition, 2020, pp. 2117– vol. 33, pp. 2316–2326, 2020. 2126. [5] C. Zhang, P. Benz, A. Karjauv, G. Sun, and I. S. Kweon, “Udh: [26] B. Poole, S. Ozair, A. Van Den Oord, A. Alemi, and G. Tucker, “On variational bounds of mutual information,” in International Universal deep hiding for steganography, watermarking, and light Conference on Machine Learning. PMLR, 2019, pp. 5171–5180. field messaging,” Advances in Neural Information Processing Systems, [27] M. I. Belghazi, A. Baratin, S. Rajeshwar, S. Ozair, Y. Bengio, vol. 33, pp. 10 223–10 234, 2020. A. Courville, and D. Hjelm, “Mutual information neural estima[6] “Meta, google, and openai promise the white tion,” in International conference on machine learning. PMLR, 2018, house they’ll develop ai responsibly - the verge,” pp. 531–540. https://www.theverge.com/2023/7/21/23802274/ [28] X. Tian, Z. Zhang, S. Lin, Y. Qu, Y. Xie, and L. Ma, “Farewell artificial-intelligence-meta-google-openai-white-house-security-safety, to mutual information: Variational distillation for cross-modal 2024. person re-identification,” in Proceedings of the IEEE/CVF Conference [7] A. Ray and S. Roy, “Recent trends in image watermarking techon Computer Vision and Pattern Recognition, 2021, pp. 1522–1531. niques for copyright protection: a survey,” International Journal of [29] J. Johnson, A. Alahi, and L. Fei-Fei, “Perceptual losses for real-time Multimedia Information Retrieval, vol. 9, no. 4, pp. 249–270, 2020. style transfer and super-resolution,” in Computer Vision–ECCV [8] R. Rombach, A. Blattmann, D. Lorenz, P. Esser, and B. Ommer, 2016: 14th European Conference, Amsterdam, The Netherlands, October “High-resolution image synthesis with latent diffusion models,” in 11-14, 2016, Proceedings, Part II 14. Springer, 2016, pp. 694–711. Proceedings of the IEEE/CVF conference on computer vision and pattern [30] R. Zhang, P. Isola, A. A. Efros, E. Shechtman, and O. Wang, recognition, 2022, pp. 10 684–10 695. “The unreasonable effectiveness of deep features as a perceptual [9] S. Dathathri, A. See, S. Ghaisas, P.-S. Huang, R. McAdam, J. Welbl, metric,” in Proceedings of the IEEE conference on computer vision and V. Bachani, A. Kaskasoli, R. Stanforth, T. Matejovicova et al., “Scalpattern recognition, 2018, pp. 586–595. able watermarking for identifying large language model outputs,” [31] N. Lukas and F. Kerschbaum, “{PTW}: Pivotal tuning watermarkNature, vol. 634, no. 8035, pp. 818–823, 2024. ing for {Pre-Trained} image generators,” in 32nd USENIX Security [10] “Watermark detection for amazon titan image generator Symposium (USENIX Security 23), 2023, pp. 2241–2258. now available in amazon bedrock.” [Online]. Available: [32] P. Fernandez, G. Couairon, H. Jégou, M. Douze, and T. Furon, “The https://aws.amazon.com/about-aws/whats-new/2024/04/ stable signature: Rooting watermarks in latent diffusion models,” watermark-detection-amazon-titan-image-generator-bedrock/ in Proceedings of the IEEE/CVF International Conference on Computer ?nc1=h ls Vision, 2023, pp. 22 466–22 477. [11] Y. Mehdi, “Announcing microsoft copilot, your everyday [33] B. An, M. Ding, T. Rabbani, A. Agrawal, Y. Xu, C. Deng, S. Zhu, ai companion - the official microsoft blog,” 9 2023. A. Mohamed, Y. Wen, T. Goldstein et al., “Benchmarking the [Online]. Available: https://blogs.microsoft.com/blog/2023/09/ robustness of image watermarks,” arXiv preprint arXiv:2401.08573, 21/announcing-microsoft-copilot-your-everyday-ai-companion/ 2024. [12] R. B. Wolfgang and E. J. Delp, “A watermark for digital images,” in [34] R. Ma, M. Guo, Y. Hou, F. Yang, Y. Li, H. Jia, and X. Xie, Proceedings of 3rd IEEE International Conference on Image Processing, “Towards blind watermarking: Combining invertible and nonvol. 3. IEEE, 1996, pp. 219–222. invertible mechanisms,” in Proceedings of the 30th ACM Interna[13] X. Zhao, K. Zhang, Z. Su, S. Vasan, I. Grishchenko, C. Kruegel, tional Conference on Multimedia, 2022, pp. 1532–1542. G. Vigna, Y.-X. Wang, and L. Li, “Invisible image watermarks [35] M. Lecuyer, V. Atlidakis, R. Geambasu, D. Hsu, and S. Jana, are provably removable using generative ai,” Advances in Neural “Certified robustness to adversarial examples with differential Information Processing Systems, vol. 37, pp. 8643–8672, 2024. privacy,” in 2019 IEEE symposium on security and privacy (SP). [14] I. J. Goodfellow, J. Shlens, and C. Szegedy, “Explaining and IEEE, 2019, pp. 656–672. harnessing adversarial examples,” in International Conference on Learning Representations, 2015. [36] J. Jia, B. Wang, X. Cao, and N. Z. Gong, “Certified robustness of community detection against adversarial structural perturbation [15] L. Engstrom, B. Tran, D. Tsipras, L. Schmidt, and A. Madry, via randomized smoothing,” in Proceedings of The Web Conference “Exploring the landscape of spatial robustness,” in International 2020, 2020, pp. 2718–2724. conference on machine learning. PMLR, 2019, pp. 1802–1811.

14

[37] B. Wang, J. Jia, X. Cao, and N. Z. Gong, “Certified robustness of graph neural networks against adversarial structural perturbation,” in Proceedings of the 27th ACM SIGKDD Conference on Knowledge Discovery & Data Mining, 2021, pp. 1645–1653. [38] X. Zhang, H. Hong, Y. Hong, P. Huang, B. Wang, Z. Ba, and K. Ren, “Text-crs: A generalized certified robustness framework against textual adversarial attacks,” in 2024 IEEE Symposium on Security and Privacy (SP). IEEE Computer Society, 2023, pp. 53–53. [39] W. Ding, Y. Ming, Z. Cao, and C.-T. Lin, “A generalized deep neural network approach for digital watermarking analysis,” IEEE Transactions on Emerging Topics in Computational Intelligence, vol. 6, no. 3, pp. 613–627, 2021. [40] L. Van der Maaten and G. Hinton, “Visualizing data using t-sne.” Journal of machine learning research, vol. 9, no. 11, 2008. [41] K. Krishna and M. N. Murty, “Genetic k-means algorithm,” IEEE Transactions on Systems, Man, and Cybernetics, Part B (Cybernetics), vol. 29, no. 3, pp. 433–439, 1999. [42] G. Doërr and J.-L. Dugelay, “Collusion issue in video watermarking,” in Security, Steganography, and Watermarking of Multimedia Contents VII, vol. 5681. SPIE, 2005, pp. 685–696. [43] I. Cohen, Y. Huang, J. Chen, J. Benesty, J. Benesty, J. Chen, Y. Huang, and I. Cohen, “Pearson correlation coefficient,” Noise reduction in speech processing, pp. 1–4, 2009. [44] R. Ma, M. Guo, Y. Hou, F. Yang, Y. Li, H. Jia, and X. Xie, “Towards Blind Watermarking: Combining Invertible and Non-invertible Mechanisms,” in Proceedings of the 30th ACM International Conference on Multimedia. Lisboa Portugal: ACM, Oct. 2022, pp. 1532– 1542. [45] J. C. Pérez, M. Alfarra, S. Giancola, B. Ghanem et al., “3deformrs: Certifying spatial deformations on point clouds,” in Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, 2022, pp. 15 169–15 179. [46] M. Alfarra, A. Bibi, N. Khan, P. H. Torr, and B. Ghanem, “Deformrs: Certifying input deformations with randomized smoothing,” in Proceedings of the AAAI Conference on Artificial Intelligence, vol. 36, no. 6, 2022, pp. 6001–6009. [47] L. Li, M. Weber, X. Xu, L. Rimanic, B. Kailkhura, T. Xie, C. Zhang, and B. Li, “Tss: Transformation-specific smoothing for robustness certification,” in Proceedings of the 2021 ACM SIGSAC Conference on Computer and Communications Security, 2021, pp. 535–557. [48] X. Nguyen, M. J. Wainwright, and M. I. Jordan, “Estimating divergence functionals and the likelihood ratio by convex risk minimization,” IEEE Transactions on Information Theory, vol. 56, no. 11, pp. 5847–5861, 2010. [49] T. Karras, T. Aila, S. Laine, and J. Lehtinen, “Progressive growing of GANs for improved quality, stability, and variation,” in International Conference on Learning Representations, 2018. [Online]. Available: https://openreview.net/forum?id=Hk99zCeAb [50] T.-Y. Lin, M. Maire, S. Belongie, J. Hays, P. Perona, D. Ramanan, P. Dollár, and C. L. Zitnick, “Microsoft coco: Common objects in context,” in Computer Vision–ECCV 2014: 13th European Conference, Zurich, Switzerland, September 6-12, 2014, Proceedings, Part V 13. Springer, 2014, pp. 740–755. [51] P. J. Rousseeuw, “Silhouettes: a graphical aid to the interpretation and validation of cluster analysis,” Journal of computational and applied mathematics, vol. 20, pp. 53–65, 1987. [52] L. Lei, K. Gai, J. Yu, and L. Zhu, “Diffusetrace: A transparent and flexible watermarking scheme for latent diffusion model,” arXiv preprint arXiv:2405.02696, 2024. [53] W. Gu, C.-C. Chang, Y. Bai, Y. Fan, L. Tao, and L. Li, “Antiscreenshot watermarking algorithm for archival image based on deep learning model,” Entropy, vol. 25, no. 2, p. 288, 2023. [54] D. Chopra, P. Gupta, G. Sanjay, and A. Gupta, “Lsb based digital image watermarking for gray scale image,” IOSR Journal of Computer Engineering, vol. 6, no. 1, pp. 36–41, 2012. [55] A. Al-Haj, “Combined dwt-dct digital image watermarking,” Journal of computer science, vol. 3, no. 9, pp. 740–746, 2007. [56] K. Hu, M. Wang, X. Ma, J. Chen, X. Wang, and X. Wang, “Learningbased image steganography and watermarking: A survey,” Expert Systems with Applications, vol. 249, p. 123715, Sep. 2024. [57] H. Fang, Y. Qiu, K. Chen, J. Zhang, W. Zhang, and E.-C. Chang, “Flow-based robust watermarking with invertible noise layer for black-box distortions,” in Proceedings of the AAAI conference on artificial intelligence, vol. 37, no. 4, 2023, pp. 5054–5061. [58] N. Yu, V. Skripniuk, S. Abdelnabi, and M. Fritz, “Artificial Fingerprinting for Generative Models: Rooting Deepfake Attribution in Training Data,” in 2021 IEEE/CVF International Conference on

Computer Vision (ICCV). Montreal, QC, Canada: IEEE, Oct. 2021, pp. 14 428–14 437. [59] N. Yu, V. Skripniuk, D. Chen, L. S. Davis, and M. Fritz, “Responsible disclosure of generative models using scalable fingerprinting,” in International Conference on Learning Representations, 2021. [60] Y. Wen, J. Kirchenbauer, J. Geiping, and T. Goldstein, “Tree-ring watermarks: Fingerprints for diffusion images that are invisible and robust,” arXiv preprint arXiv:2305.20030, 2023. [61] Y. Zhao, T. Pang, C. Du, X. Yang, N.-M. Cheung, and M. Lin, “A recipe for watermarking diffusion models,” arXiv preprint arXiv:2303.10137, 2023. [62] A. Madry, A. Makelov, L. Schmidt, D. Tsipras, and A. Vladu, “Towards deep learning models resistant to adversarial attacks,” arXiv preprint arXiv:1706.06083, 2017. [63] J. Chen, M. I. Jordan, and M. J. Wainwright, “Hopskipjumpattack: A query-efficient decision-based attack,” in 2020 ieee symposium on security and privacy (sp). IEEE, 2020, pp. 1277–1294. [64] Y. Hu, Z. Jiang, M. Guo, and N. Gong, “A Transfer Attack to Image Watermarks,” Mar. 2024. [65] X. Zhao, K. Zhang, Z. Su, S. Vasan, I. Grishchenko, C. Kruegel, G. Vigna, Y.-X. Wang, and L. Li, “Invisible Image Watermarks Are Provably Removable Using Generative AI,” Aug. 2023. [66] J. Ballé, D. Minnen, S. Singh, S. J. Hwang, and N. Johnston, “Variational image compression with a scale hyperprior,” arXiv preprint arXiv:1802.01436, 2018. [67] Z. Cheng, H. Sun, M. Takeuchi, and J. Katto, “Learned image compression with discretized gaussian mixture likelihoods and attention modules,” in Proceedings of the IEEE/CVF conference on computer vision and pattern recognition, 2020, pp. 7939–7948. [68] P. Esser, R. Rombach, and B. Ommer, “Taming transformers for high-resolution image synthesis,” in Proceedings of the IEEE/CVF conference on computer vision and pattern recognition, 2021, pp. 12 873–12 883. [69] J. Song, C. Meng, and S. Ermon, “Denoising diffusion implicit models,” arXiv preprint arXiv:2010.02502, 2020. [70] Z. Yang, K. Zeng, K. Chen, H. Fang, W. Zhang, and N. Yu, “Gaussian Shading: Provable Performance-Lossless Image Watermarking for Diffusion Models,” May 2024, comment: 17 pages, 11 figures, accepted by CVPR 2024.

A PPENDIX A P ROOF FOR R ESIDUAL I NFORMATION L OSS Theorem 3. To deal with the estimation of mutual information in Eq. 13, we introduce the following theorem as an estimate of residual information objective to mitigate identity leakage:

max I(w; t) − I(z; t) ⇐ max fKL [Pw ∥Pz ] − fKL [Pz ∥Pw ]. (17) Proof. In accordance with the definition of mutual information, given three random variables w, z, and t, the difference of mutual information can be expressed as follows: ZZ

I(w; t) − I(z; t) =

p(w, t) dwdt− p(w)p(t) ZZ p(z, t) p(z, t) log dzdt p(z)p(t) p(w, t) log

p(t|w) dwdt− p(t) ZZ p(t|z) p(z)p(t|z) log dzdt p(t) ZZ p(t|w)p(t|z) = p(w)p(t|w) log dwdt− p(t)p(t|z) ZZ p(t|z)p(t|w) p(z)p(t|z) log dzdt. p(t)p(t|w) ZZ

=

p(w)p(t|w) log

(18)

15

By factorizing the double integrals in Eq. 18 into another two components, we show the following: ZZ

p(t|w)p(t|z) dwdt p(t)p(t|z) ZZ p(t|w) = p(w)p(t|w) log dwdt+ p(t|z) ZZ p(t|z) dwdt p(w)p(t|w) log p(t) ZZ p(t|w) = p(w)p(t|w) log dwdt+ p(t|z)  Z Z p(t|z) dt p(w)p(t|w)dw log p(t) ZZ Z p(t|w) p(t|z) = p(w)p(t|w) log dwdt + p(t) log dt p(t|z) p(t) Z Z p(t|z) = p(w)fKL [p(t|w)||p(t|z)]dw + p(t) log dt, p(t) p(w)p(t|w) log

(19)

ZZ

p(z)p(t|z) log

(20)

Therefore, our objective is equivalent to:

I(w; t) − I(z; t) Z Z p(t|z) = p(w)fKL [p(t|w)||p(t|z)]dw + p(t) log dt− p(t) Z Z p(t|w) p(z)fKL [p(t|z)||p(t|w)]dz − p(t) log dt p(t) Z

= Z

p(w)fKL [p(t|w)||p(t|z)]dw− Z p(t|z)p(t) p(z)fKL [p(t|z)||p(t|w)]dz + p(t) log dt p(t)p(t|w)

Z

=

p(w)fKL [p(t|w)||p(t|z)]dw − {z } V1 Z Z p(t|z) p(z)fKL [p(t|z)||p(t|w)]dz + p(t) log dt . p(t|w) | {z } | {z } |

V2

max I(w; t) − I(z; t) ⇐ max fKL [Pw ∥Pz ] − fKL [Pz ∥Pw ]. (23) At the extreme, where z does not contain any information about t, it is further shown that w is sufficient for t.

A PPENDIX B AUTHENTICATION A LGORITHM

where fKL represents KL-divergence. Conduct similar factorization for the second term in Eq. 18, we have: p(t|z)p(t|w) dzdt p(t)p(t|w) ZZ p(t|z) = p(z)p(t|z) log dzdt+ p(t|w) ZZ p(t|w) dzdt p(z)p(t|z) log p(t) ZZ p(t|z) = p(z)p(t|z) log dzdt+ p(t|w)  Z Z p(t|w) p(z)p(t|z)dz log dt p(t) Z ZZ p(t|w) p(t|z) dzdt + p(t) log dt = p(z)p(t|z) log p(t|w) p(t) Z Z p(t|w) = p(z)fKL [p(t|z)||p(t|w)]dz + p(t) log dt p(t)

is the difference between the watermarked image w and the original image x. Our goal is that w contains all information of secret watermark t while z does not contain any information of t, i.e., t and z are orthogonal to each other. Therefore, in maximizing V1 −V2 , t and z become progressively orthogonal to each other, which allows to explicitly approximate R p(t) p(t|z) as p(t), so Q ≈ p(t) log p(t|w) dt = fKL [p(t)||p(t|w)]. Based on the non-negativity of KL-divergence, we further have:

Q

(21) We can see that:

V1 − V2 = Ew∼EE (W|T ,X ) {fKL [Pw ∥Pz ] − fKL [Pz ∥Pw ]}, (22) where Pw = p(t|w), Pz = p(t|z) denote the probability distributions. Note that, in our system, the residual image z

Algorithm 2 Authentication Algorithm (W-CR) Require: Test sample’s pixel value w, pixel coordinate v , authentication model h, perturbation type P , pixel transformation ϕP (·, ϵ), coordinate transformation θP (·, ρ), secret watermark t, verification threshold τ , N , N0 , α. 1: w , v ← watermarked image pixel and coordinate 2: counts0 ← S AMPLE U NDER N OISE(h, ϕP (w, ϵ), θP (v, ρ), t, τ, N0 ) 3: ŷA ← top index in counts0, where ŷA ∈ {0, 1} 4: counts ← S AMPLE U NDER N OISE(h, ϕP (w, ϵ), θP (v, ρ), t, τ, N ) 5: pA ← L OWER C ONF B OUND(counts[ŷA ], N, 1 − α) 6: if pA > 12 return prediction ŷA and radius R = σΦ−1 (pA ) 7: else return ABSTAIN

A PPENDIX C W-IR T RAINING A LGORITHM Algorithm 3 Training Algorithm for W-IR Require: Training dataset D, the original image x ⊂ X , secret watermark t ⊂ T , perturbation layer lp , encoder E , decoder D. 1: Initialize encoder parameters ψE and decoder parameters ψD . 2: for epoch κ = 1, 2, 3, ...K do 3: for each image x in D do 4: Phase 1: Train Encoder and Decoder with L 5: Sample random secret watermark t from T 6: w ← E(x, t) ▷ Watermarked image 7: tD ← D(lp (w)) 8: Calculate loss L(t′ , t, w, x) using Eq. 1 9: Update parameters ψE and ψD to minimize L. 10: Phase 2: Train Encoder with LRIL 11: Get residual image z ← w − x 12: tw ← D(w) 13: tz ← D(z) 14: Calculate loss LRIL (tw , tz ) using Eq. 16 15: Update only parameters ψE to minimize LRIL 16: end for 17: end for 18: Output: Trained encoder and decoder parameters ψE , ψD .

16

A PPENDIX D D ISCUSSION AND L IMITATIONS

Table 8: Results of identity forgery attacks where the user identity is known to the adversary or not. COCO (StegaStamp) CelebA (StegaStamp)

The Knowledge of Residual Image. We assume that the adversary in identity linking and forgery attacks has access to residual images of watermarked images. While the direct obtaining of residual images may be impractical in realworld scenarios, which is also beyond the scope of this work, alternative approaches exist. For instance, watermark removal methods such as VAE reconstruction [32] can provide estimates of the original images, from which residual images can be derived. To validate our attacks under such conditions, we conduct experiments under COCO (StegaStamp), employing VAE reconstruction to estimate original images and generate residual images for identity leakage assessment. Table 13 shows that despite the performance degradation, we can still successfully implement identity leakage attacks using VAE reconstruction estimates. Identity Leakage Attacks in In-processing Watermarks. We investigate identity leakage in in-processing watermarks [60], [70], where the embedded information strongly correlates with image semantics. We utilize Tree-Rings [60], a method that embeds watermark patterns in the Fourier domain of diffusion model noise. We generate watermarked images using four distinct patterns, each representing a different user. We use prompts sampled from the COCO dataset captions. Given that Tree-Rings does not embed conventional bit string watermarks, our investigation concentrates on identity linking and forgery attacks. The identity linking attack produces a modest Silhouette Score of 0.21, likely because the semantic watermark fundamentally alters the image content, causing residuals to retain substantial semantic information that hinders effective clustering. However, when conducting identity forgery attacks on the COCO dataset with access to a user’s watermarked images, we achieve 100% forgery accuracy, demonstrating significant vulnerabilities in identity protection.

×

User identity

Noise Forged (σ ) Bit Acc.

✓

×

✓

Forged Bit Acc.

Forged Bit Acc.

Forged Bit Acc.

Clean vanilla

-

65.44%

78.72%

84.80%

94.49%

W-ER

-

98.99%

98.96%

100.0%

100.0%

W-CR: 0.10 Additive 0.25 Gaussian noise 0.50

91.10% 95.22% 96.66%

91.52% 95.14% 96.61%

98.61% 98.74% 92.13%

98.59% 98.76% 92.06%

W-CR: Affine transformation

81.34% 77.97% 81.79%

87.26% 86.98% 84.34%

94.29% 95.39% 91.56%

94.63% 95.36% 91.58%

0.01 0.02 0.03

A PPENDIX F R OBUSTNESS R ESULTS ON W-CR WITH LRIL Table 9 summarizes the certified accuracy of W-CR under different settings. The results indicate that our residual information loss can maintain the certified robustness of the W-CR without the residual information loss (refer to Table 6). For instance, their average certified accuracy are respectively 99.43% vs 99.27% under additive Gaussian noise, and 98.73% vs 98.28% under affine transformations, respectively. This validates that the designed residual information loss almost does not affect the model’s robust training. We also report the certified accuracy across various radii under different datasets, models, and noise perturbations in Figure 16 and Figure 17. The results also demonstrate that the introduced residual information loss does not affect the certified radius. Table 9: Certified robustness of W-CR with residual information loss LRIL . Additive Gaussian noise

Affine transformation

Dataset (Model) Noise (σ ) Certified Acc.↑ Noise (σ ) Certified Acc.↑

A PPENDIX E I MPACT OF K NOWING U SER I DENTITY In identity forgery attacks, the adversary uses k -means clustering to cluster residual images without knowing their user identity. Here we further explore the attack when the adversary knows the user-specific residual images and the results are shown in Table 8. Note that when the identity is known, there is no need for the adversary to use the clustering algorithm. We observe that, with additive Gaussian noise, our attack achieves similar forged bit accuracy on knowing the user identity or not. For instance, on CelebA (StegaStamp) with additive Gaussian noise σ = 0.1, the forged bit accuracy differs by only 0.02%. With affine transformation, on average, the forged bit accuracy without knowing the identity is 2.97% lower than that with knowing the identity. The results validate that the proposed k-mean clustering-based attack is effective, and knowing the user identity of residual images can further make the identity forgery attack more serious.

COCO (StegaStamp)

0.10 0.25 0.50

98.80% 97.60% 98.00%

0.01 0.02 0.03

98.40% 98.20% 97.40%

CelebA (StegaStamp)

0.10 0.25 0.50

100.00% 100.00% 100.00%

0.01 0.02 0.03

100.00% 100.00% 100.00%

COCO (HiDDeN)

0.10 0.25 0.50

100.00% 100.00% 100.00%

0.01 0.02 0.03

100.00% 100.00% 100.00%

CelebA (HiDDeN)

0.10 0.25 0.50

100.00% 100.00% 100.00%

0.01 0.02 0.03

100.00% 100.00% 100.00%

Average

99.25%

99.50%

A PPENDIX G A DDITIONAL E XPERIMENTAL R ESULTS Our robust training (both W-ER and W-CR) maintains O(1) complexity vs. vanilla training, with minor overhead on noise injection. During standard inference, W-ER maintains O(1) complexity, identical to vanilla inference. For certification inference, W-CR operates at O(N/k) complexity (N :noise sampling count; k :inference batch size). Table 11

17

Table 10: Authentication effectiveness and visual quality of different watermarking methods with LRIL . Clean vanilla

W-ER

W-CR: Additive Gaussian noise

W-CR: Affine transformation

Dataset Clean Clean Clean Clean Noise Clean Clean Noise Clean Clean PSNR↑ SSIM↑ PSNR↑ SSIM↑ PSNR↑ SSIM↑ PSNR↑ SSIM↑ (Model) Bit Acc.↑ Acc.↑ Bit Acc.↑ Acc.↑ (σ ) Bit Acc.↑ Acc.↑ (σ ) Bit Acc.↑ Acc.↑ COCO (StegaStamp)

0.10 27.66 0.9041 99.88% 100.0% 25.77 0.7767 100.0% 100.0% 0.25 0.50

24.78 0.8775 99.98% 100.0% 0.01 23.69 0.8240 100.0% 100.0% 0.02 20.03 0.7363 99.99% 100.0% 0.03

27.84 0.9144 99.95% 100.0% 26.97 0.9039 99.98% 100.0% 25.03 0.8909 99.98% 100.0%

CelebA (StegaStamp)

0.10 27.48 0.8975 99.69% 100.0% 27.46 0.7609 99.97% 100.0% 0.25 0.50

23.37 0.8202 99.99% 100.0% 0.01 23.20 0.7992 100.0% 100.0% 0.02 20.38 0.6457 99.98% 100.0% 0.03

33.61 0.9554 99.98% 100.0% 31.14 0.9525 99.99% 100.0% 26.61 0.8929 99.98% 100.0%

0.10 COCO 32.27 0.9397 79.23% 100.0% 27.94 0.8752 81.08% 100.0% 0.25 (HiDDeN) 0.50

25.71 0.8034 85.34% 99.92% 0.01 21.83 0.6949 80.23% 99.83% 0.02 19.51 0.6044 79.96% 100.0% 0.03

29.77 0.9154 81.28% 100.0% 29.75 0.9125 81.52% 100.0% 29.88 0.9113 80.34% 100.0%

0.10 CelebA 35.14 0.9599 88.45% 100.0% 32.26 0.9472 77.82% 100.0% 0.25 (HiDDeN) 0.50

26.20 0.8105 83.77% 100.0% 0.01 22.68 0.7178 77.37% 100.0% 0.02 21.21 0.7199 76.67% 99.86% 0.03

32.07 0.9419 89.13% 100.0% 31.61 0.9414 87.88% 100.0% 22.66 0.9330 78.78% 99.88%

Average

22.72 0.7545 90.27% 99.97%

28.91 0.9221 91.57% 99.99%

= 0.1 = 0.25 = 0.5

0

1

radius

2

3

certified accuracy

1.0 0.8 0.6 0.4 0.2 0.0

0

1

radius

2

3 = 0.1 = 0.25 = 0.5

0

1

radius

2

3

Figure 16: Certified accuracy (w/ LRIL ) at different radii against additive Gaussian noise. Datasets: left-COCO and right-CelebA; Models: top-StegaStamp and bottomHiDDeN.

0.0

0.1

radius

0.2

0.3 = 0.01 = 0.02 = 0.03

certified accuracy

1.0 0.8 0.6 0.4 0.2 0.0

0.0

0.1

radius

0.2

0.3

= 0.01 = 0.02 = 0.03

certified accuracy

1.0 0.8 0.6 0.4 0.2 0.0 1.0 0.8 0.6 0.4 0.2 0.0

0.0

0.1

radius

0.2

0.3 = 0.01 = 0.02 = 0.03

certified accuracy

= 0.01 = 0.02 = 0.03

certified accuracy

1.0 0.8 0.6 0.4 0.2 0.0

0.0

0.1

radius

0.2

0.3

Figure 17: Certified accuracy (w/ LRIL ) at different radii against affine transformation. Datasets: left-COCO and right-CelebA; Models: top-StegaStamp and bottomHiDDeN.

1.0 0.8 0.6 0.4 0.2 0.0

0.0

0.1

radius

0.2

0.3 = 0.01 = 0.02 = 0.03

0.0

0.1

radius

0.2

Table 11: Training and inference time (seconds) of W-IR, including W-ER and W-CR. Dataset(Model) Phase

Clean W-ER W-CR W-CR vanilla without LRIL without LRIL with LRIL

COCO (StegaStamp)

Training Inference

4073 <1

4105 <1

4106 4.46

4394 4.46

Imagenet (StegaStamp)

Training Inference

4923 <1

5184 <1

4903 12.7

5832 12.79

1.0 0.8 0.6 0.4 0.2 0.0

0.3

0.0

0.1

radius

0.2

0.3 = 0.01 = 0.02 = 0.03

0.0

0.1

radius

0.2

0.3

Figure 18: Certified accuracy (w/o LRIL ) at different radii against affine transformation. Datasets: left-COCO and right-CelebA; Models: top-StegaStamp and bottomHiDDeN.

1.0 0.9 0.8 0.7 0.6 0.5

Distance-Close Distance-Med. Distance-Far

an

Cle

pir

Em

l

ica

0

0.1

an-

si aus

G

G

5

0.2

an-

si aus

G

1 0 02 03 0.5 e-0.0 -0. -0. in ine ine Aff Aff Aff

an-

si aus

Models

Figure 19: Impact of secret watermark pairs’ distances under CelebA (StegaStamp). Table 12: Accuracy of W-CR and W-ER against unseen adversarial examples. Clean vanilla W-ER

shows that both W-ER and W-CR are efficient in large-scale applications.

= 0.01 = 0.02 = 0.03

certified accuracy

3

1.0 0.8 0.6 0.4 0.2 0.0

certified accuracy

2

= 0.01 = 0.02 = 0.03

Forged Bit Accuracy

radius

1.0 0.8 0.6 0.4 0.2 0.0

certified accuracy

1

= 0.1 = 0.25 = 0.5

certified accuracy

0

certified accuracy

1.0 0.8 0.6 0.4 0.2 0.0

1.0 0.8 0.6 0.4 0.2 0.0

certified accuracy

= 0.1 = 0.25 = 0.5

certified accuracy

1.0 0.8 0.6 0.4 0.2 0.0

30.64 0.9253 91.81% 100.0% 28.36 0.8400 89.72% 100.0%

W-CR (Gaussian noise)

W-CR (Affine)

Dataset(Model)

Acc.↑

Acc.↑ Noise(σ ) Certified Acc.↑ Noise(σ ) Certified Acc.↑

CelebA (StegaStamp)

0%

10.00%

0.10 0.25 0.50

100% 100% 100%

0.01 0.02 0.03

100% 100% 100%

To evaluate W-CR’s robustness against unseen adversarial examples, we combine pixel and coordinate transformations to generate 100 novel adversarial samples and evaluate their classification accuracy under CelebA (StegaStamp). The results in Table 12 demonstrate that the W-ER model shows minimal resistance (10%) to unseen attacks. W-CR models across various noise levels exhibit high defensive

18

capabilities against these adversarial examples. Table 13: Comparison of identity leakage of original and estimated residual images under COCO (StegaStamp). The original refers to the known original image, and ‘Estimate’ uses VAE to estimate the original image. Silhouette Score

Forged Bit Accuracy

Perturbations

Noise(σ )

Original

Estimate

Original

Estimate

Additive Gaussian noise

0.10 0.25 0.50

0.5519 0.7416 0.8327

0.3637 0.2885 0.3311

91.10% 95.22% 96.66%

71.74% 66.34% 68.46%

Affine transformation

0.01 0.02 0.03

0.3661 0.3792 0.3869

0.3772 0.3604 0.3775

81.34% 77.97% 81.79%

71.13% 72.69% 65.54%