WARP benchmark evaluates invisible image watermarking robustness and attacks
WARP: A Unified Benchmark for Invisible Image Watermarking -- Robustness and Protection Against Attacks
Computer Vision and Pattern RecognitionArtificial IntelligenceMultimedia
Summary
Invisible watermarks in images help prove who made or owns them, which is important as more AI-generated images appear. The authors created WARP, a thorough test setup that checks if these hidden marks survive many challenges, including clever attempts to erase them. They tested many watermarking methods against different types of attacks to see which are strongest and found some weaknesses in certain methods. This gives a clearer picture of how to protect images from being tampered with or unmarked.
What this means in practice
- •For digital content protection teams: Use WARP to test and choose invisible watermark methods that best protect images against removal or tampering in media workflows.
- •For media platform security teams: Evaluate the effectiveness of watermark robustness in detecting and tracking AI-generated or manipulated images across large content pools.
Authors
Khaled Abud, Aleksey Yakushev, Aleksandr Akimenkov, Irina Serzhenko, Kirill Aistov, Egor Kovalev, Dmitry Obydenkov, Sergey Lavrushkin, Anastasia Antsiferova, Dmitriy Vatolin, Yury Markin, Kirill Lukianov
Abstract
Digital image watermarking is increasingly critical in media contexts, as emerging regulations and industry practices require marking AI-generated content and ensuring traceable sources to prevent manipulation or misuse. Recent advances in invisible watermarking methods highlight the need to update existing benchmarking practices to reflect current techniques and evaluation criteria. We address this by introducing WARP -- a unified framework and benchmark for evaluating the robustness of invisible watermarks. WARP incorporates 32 recent classical, deep, and generative watermarking methods, as well as 34 different erasing techniques, ranging from traditional distortions to more sophisticated adversarial, purification, and re-embedding attacks. It provides standardized, reproducible, and easily scalable protocols for evaluating perceptual quality, watermark readability, and attack resilience. Using WARP, we extensively evaluate current invisible watermarking techniques, collecting the largest robustness benchmark in the field. Results identify the most robust approaches under both distortion and adversarial conditions, and reveal consistent relationships between watermarking methods and the attack strategies most effective against them. Our experiments also highlight that some of the watermarking methods considered are highly vulnerable to reembedding, even if they are robust to standard distortions. The code is made available at https://github.com/ispras/wibe.