Benchmark reveals watermark detection strengths after generative editing
Latent Watermarks under Generative Editing: A Benchmark and Analysis of Detection Survival
Computer Vision and Pattern Recognition
Summary
Detecting hidden watermarks in edited images is tricky because some editing types can make detection fail. The authors studied how well eight watermarking methods stand up to various editing techniques on different image generators. They found that certain methods are more resilient when images are edited, and some measures predict detection success better than others. Their work helps understand which watermark methods survive editing and which do not, guiding future watermarking efforts.
What this means in practice
- •For digital content security teams: Evaluate watermarking methods that reliably survive common generative image edits to protect media ownership claims.
- •For image editing software developers: Incorporate knowledge of which watermark detections are robust to editing to better preserve or detect image watermarks after modifications.
Authors
Sung Ju Lee, Nam Ik Cho
Abstract
Ordinary prompt-based editing can cause latent watermark detection to fail without explicitly targeting the watermark. We benchmark eight watermark methods against five editors across four generative backbones, four editing strengths, and five semantic categories, with edit-validity and threshold checks. Separating editing from seven subsequent distortions reveals that editing alone primarily distinguishes Tree-Ring, while added distortions expose a broader spectrum of detection survival. Sequential edits reveal a second hidden difference: score separation can decline while detection rates remain near their ceiling. Across methods, standardized clean score separation ($d'$) organizes composite-survival tiers, whereas spatial overlap adds little to predicting edit-only survival beyond clean detectability. Embedding-strength interventions in two methods link higher clean separation to higher post-edit separation. In HSTR, the margin contrast is positive, while the angular layout contrast at matched clean separation remains unresolved. Together, outcome decomposition and continuous separation expose differences hidden by aggregate TPR. Method tiers are stable under threshold recalibration at the main operating points and alternative composite weights. Clean $d'$ is thus a useful empirical diagnostic within this benchmark, with mixed transfer to unseen methods. Code and supporting artifacts are planned for a separate release.