Architectural design reduces forgery risk in neural image watermarks
Residual Transferability in Neural Image Watermarking
Cryptography and SecurityComputer Vision and Pattern Recognition
Summary
Protecting digital images with hidden watermarks helps prove their origin, but these watermarks can be stolen and copied to other pictures—a problem called residual transferability. The authors of this paper studied why some watermarking methods are more vulnerable than others and found that the design of the neural network itself makes a big difference. They identified ways to make watermarks more tied to the original image, making forgery harder. They also created a method called CoverLock that can improve security in existing watermark systems without changing their design.
What this means in practice
- •For digital content distributors: Protect images from forgery by choosing watermark architectures that reduce watermark copying across unrelated content.
- •For software developers in media security: Add the CoverLock strategy to existing watermarking software to strengthen watermark security without redesigning neural networks.$Commercial implications: Enables selling improved watermark protection software as an add-on for existing image security products.
Authors
Ziping Dong, Qi Li, Xinchao Wang
Abstract
Neural image watermarks can be forged by extracting watermark-bearing residuals from released images and transferring them to unrelated content. While prior work has demonstrated this vulnerability, what makes these residuals transferable remains poorly understood. We formalize this vulnerability with \textbf{residual transferability (RT)}, a metric that quantifies how well watermark evidence remains decodable after transfer across unrelated images. Through comparative analyses and controlled interventions, we find that common training-side variations do not account for the large RT differences across watermarking systems; instead, architectural design plays a central role. By contrasting high- and low-RT systems and validating their architectural differences through controlled interventions, we identify two mechanisms that strengthen the dependence of watermark evidence on the cover image, thereby suppressing the residual transferability. These findings provide concrete design guidance for developing more forgery-resistant watermarking architectures. Complementarily, for existing watermarking systems where architectural redesign is impractical, we introduce \textbf{CoverLock}, a plug-and-play strategy for existing watermarking systems that strengthens such image dependence without architectural redesign. Across representative watermarking systems exhibiting high residual transferability, CoverLock achieves a more favorable security--robustness trade-off than both traditional handcrafted defenses and learned classifier-based defenses.