WaveMark improves image watermarking robustness against removal attacks
WaveMark: Robust Wavelet-Domain Image Watermarking for Diffusion Models
Cryptography and SecurityComputer Vision and Pattern Recognition
Summary
Images created by AI models can be marked to show who made them, but these marks are often easy to remove without changing the picture much. The authors propose WaveMark, a new way to hide these marks in the early noise used by AI image generators. This method spreads the secret message widely across different parts of the image to make it hard to erase. Tests show WaveMark can still detect the marks correctly even after tough attempts to remove them.
What this means in practice
- •For digital artists and content creators: Protect ownership by embedding robust watermarks in AI-generated images that survive attempts to remove them.
- •For media platform security teams: Trace the origin of AI-generated images by detecting watermarks even after common tampering or filtering operations.
Authors
Jie Cao, Qi Li, Chaklam Cheong, Yutong Jin, Enze Yu, Zelin Zhang, Jianbing Ni
Abstract
Image watermarking enables provenance tracing for photorealistic images generated by diffusion models. However, state-of-the-art (SOTA) removal attacks can suppress embedded signals with little perceptual degradation. This vulnerability limits the effectiveness of watermarks for intellectual property protection and misuse attribution. We propose WaveMark, a novel wavelet-domain watermarking method that embeds messages in a diffusion model's initial noise. To support robust recovery from perturbed carriers, WaveMark distributes keyed replicas of message bits across spatial positions, wavelet orientations, and scales. Each carrier groups coefficients from four latent channels and encodes a randomized bit through magnitude projection, providing an explicit decoding margin. We evaluate WaveMark with SD2.1 on SDP and MS-COCO Captions under 14 attacks. WaveMark achieves 100.0% bit accuracy (BA) without attacks, while maintaining image quality comparable to the evaluated baselines. Under SOTA MarkNull and MarkNull-A, it retains over 88% BA, outperforming all baselines.