Abstract:Image watermarking methods are not tailored to handle small watermarked areas. This restricts applications in real-world scenarios where parts of the image may come from different sources or have been edited. We introduce a deep-learning model for localized image watermarking, dubbed the Watermark Anything Model (WAM). The WAM embedder imperceptibly modifies the input image, while the extractor segments the received image into watermarked and non-watermarked areas and recovers one or several hidden messages from the areas found to be watermarked. The models are jointly trained at low resolution and without perceptual constraints, then post-trained for imperceptibility and multiple watermarks. Experiments show that WAM is competitive with state-of-the art methods in terms of imperceptibility and robustness, especially against inpainting and splicing, even on high-resolution images. Moreover, it offers new capabilities: WAM can locate watermarked areas in spliced images and extract distinct 32-bit messages with less than 1 bit error from multiple small regions - no larger than 10% of the image surface - even for small $256\times 256$ images.

What problem does this paper attempt to address?

The main problem that this paper attempts to solve is the limitations of existing image watermarking techniques when dealing with local watermark areas. Traditional methods usually assume that the entire image comes from the same source or has not been edited, which restricts their application in real - world scenarios, especially when parts of the image may come from different sources or have been edited. Moreover, traditional watermarking methods perform poorly when dealing with image splicing because these methods usually make a global decision for the entire image, and when the area of the watermark area decreases, the watermark signal will gradually disappear and can no longer be detected. This leads to a paradox: if only a small part of the image carries a watermark, should the entire image be considered watermarked? On the one hand, a positive decision based on a small area may be unfair to artists who use AI models for image inpainting or expansion; on the other hand, not being robust enough to resist splicing operations makes it easy to be removed. For this reason, this paper redefines watermarking techniques and regards them as a segmentation task, thus introducing a new deep - learning model - the Watermark Anything Model (WAM). The main innovations of WAM are as follows: 1. **Segmentation task**: WAM designs the watermark embedding process to be able to locally modify the input image. Meanwhile, the extractor can segment the received image into watermarked and non - watermarked areas and recover one or more hidden messages from the areas determined to be watermarked. 2. **Multi - stage training**: WAM adopts a two - stage training strategy. In the first stage, the embedder and extractor models are pre - trained at a low resolution, with the main goal of improving robustness; in the second stage, the invisibility of the watermark and the multi - watermark processing ability are further optimized through post - training. 3. **Multi - watermark processing**: WAM can locate watermark areas in a single image and extract multiple hidden messages, a function that is difficult to achieve with traditional robust watermarking techniques. Specifically, WAM uses the DBSCAN clustering algorithm to process binary strings at the pixel level without prior knowledge of the number (or center point) of watermarks. 4. **High - resolution adaptation**: WAM adjusts the image to a fixed resolution through anisotropic scaling, then calculates the watermark signal at this resolution, and finally enlarges the watermark signal back to the original image size through bilinear interpolation, thus achieving support for high - resolution images. Through these innovations, WAM not only achieves performance comparable to existing state - of - the - art methods in terms of invisibility and robustness but also demonstrates unique capabilities in new applications such as watermark location and multi - watermark extraction.

Watermark Anything with Localized Messages

ReMark: Receptive Field based Spatial WaterMark Embedding Optimization using Deep Network

Latent Watermark: Inject and Detect Watermarks in Latent Diffusion Space

WaterPool: A Watermark Mitigating Trade-offs among Imperceptibility, Efficacy and Robustness

LaWa: Using Latent Space for In-Generation Image Watermarking

Flexible and Secure Watermarking for Latent Diffusion Model

Watermarking Neural Networks with Watermarked Images

Advancing Beyond Identification: Multi-bit Watermark for Large Language Models

A Brief Yet In-Depth Survey of Deep Learning-Based Image Watermarking

WMFormer++: Nested Transformer for Visible Watermark Removal via Implict Joint Learning

Go Wide or Go Deep: Levering Watermarking Performance with Computational Cost for Specific Images

Cross-Attention Watermarking of Large Language Models

Deep Template-Based Watermarking

Suppressing High-Frequency Artifacts for Generative Model Watermarking by Anti-Aliasing

UnMarker: A Universal Attack on Defensive Image Watermarking

WAPITI: A Watermark for Finetuned Open-Source LLMs

Robust Texture-Aware Local Adaptive Image Watermarking with Perceptual Guarantee

High-Frequency Artifacts-Resistant Image Watermarking Applicable to Image Processing Models

WaterSeeker: Pioneering Efficient Detection of Watermarked Segments in Large Documents

Aparecium: Revealing Secrets from Physical Photographs

Learning to Watermark LLM-generated Text via Reinforcement Learning