Local image watermarks struggle with geometric and editing changes
What Breaks Local Watermarks? A Robustness Benchmark for Local Invisible Image Watermarking
Computer Vision and Pattern RecognitionArtificial IntelligenceCryptography and Security
Summary
Invisible watermarks hidden in specific parts of images are meant to help recover information without changing what the picture looks like. The authors studied how well these local watermarks survive many different image changes, like edits or distortions. They tested five different watermarking methods and found that all can be broken by some kinds of changes, especially ones that move parts of the image or use AI-based editing. One method, MaskWM, was generally better at recovering watermarks but made the original image look worse. This work shows why it’s important to test watermarks against many types of changes to understand their weaknesses.
What this means in practice
- •For digital image security teams: Evaluate and choose local watermarking methods that maintain payload recovery after typical image edits and distortions to better protect image authenticity.
- •For photo editing software developers: Incorporate awareness of watermark vulnerabilities after local edits like inpainting to improve software features that maintain watermark integrity.
Authors
Kai Yao, Bence Szilágyi, Sebestyén Kamp, Máté Poór, Máté Szilveszter, Matyas K. Zsoldos, Marc Juarez
Abstract
Local image watermarking embeds an invisible signal into selected image regions rather than spreading it across the entire image, enabling payload recovery from specific objects or regions without perceptibly altering the image. Existing studies evaluate the robustness of payload recovery and localization under image transformations, but they often focus on their own proposed method, resulting in narrow evaluations with inconsistent choices of transformations, datasets, and metrics. These inconsistencies across studies limit direct comparisons across methods and muddle the overall picture of local watermark robustness. To address this gap, we present the first systematic robustness benchmark for local watermarks across 55 image transformations, including (i) signal distortions, (ii) changes in image coordinate alignment, (iii) indirect local edits, and (iv) direct watermark edits. The benchmark evaluates MaskWM, WAM, OmniGuard, TrustMark, and PixelSeal, all methods that either provide native localization or require minimal adaptation to support it. Our results show that all evaluated methods are vulnerable to some transformation, with MaskWM standing out as offering the strongest payload recovery and localization, although it has the lowest image quality in the clean setting. Synchronization further improves MaskWM's payload recovery under several geometric transformations, albeit at an additional cost to image quality. A key finding is that local watermark robustness depends strongly on the nature of the transformation: signal distortions are often tolerated by the strongest methods, while geometric misalignment and generative local edits, such as inpainting and outpainting, can completely impair payload recovery. We observe that payload recovery and localization are related but not interchangeable, and both strongly depend on the transformation's impact on the watermark region.