InvisMark: Invisible and Robust Watermarking for AI-generated Image Provenance

Rui Xu,Mengya,Deren Lei,Yaxi Li,David Lowe,Alex Gorevski,Mingyu Wang,Emily Ching,Alex Deng
2024-11-11
Abstract:The proliferation of AI-generated images has intensified the need for robust content authentication methods. We present InvisMark, a novel watermarking technique designed for high-resolution AI-generated images. Our approach leverages advanced neural network architectures and training strategies to embed imperceptible yet highly robust watermarks. InvisMark achieves state-of-the-art performance in imperceptibility (PSNR$\sim$51, SSIM $\sim$ 0.998) while maintaining over 97\% bit accuracy across various image manipulations. Notably, we demonstrate the successful encoding of 256-bit watermarks, significantly expanding payload capacity while preserving image quality. This enables the embedding of UUIDs with error correction codes, achieving near-perfect decoding success rates even under challenging image distortions. We also address potential vulnerabilities against advanced attacks and propose mitigation strategies. By combining high imperceptibility, extended payload capacity, and resilience to manipulations, InvisMark provides a robust foundation for ensuring media provenance in an era of increasingly sophisticated AI-generated content. Source code of this paper is available at: <a class="link-external link-https" href="https://github.com/microsoft/InvisMark" rel="external noopener nofollow">this https URL</a>.
Cryptography and Security,Artificial Intelligence
What problem does this paper attempt to address?
The problem that this paper attempts to solve is: With the popularization of AI - generated images, there is an urgent need for a powerful content authentication method to verify the origin and authenticity of these images. Specifically, the paper proposes a novel watermarking technique named InvisMark, aiming to provide an invisible and highly robust watermark embedding method for high - resolution AI - generated images. ### Main Problems 1. **Information Integrity and Public Trust** - With the development of generative AI technology, hyper - realistic deep - fake images are becoming easier and easier to generate. These images may be used to manipulate elections, damage reputations or undermine the social foundation. Therefore, a reliable method is required to verify the origin and authenticity of digital content. 2. **Limitations of Existing Methods** - Existing content authentication methods, such as metadata signatures, are easily stripped by malicious actors or lost on social media platforms. - Traditional watermarking techniques perform poorly on high - resolution images. Especially when facing image transformations, it is difficult to simultaneously ensure the robustness and invisibility of watermarks. - Current watermarking algorithms have trade - offs among capacity, invisibility and robustness, which limit their effectiveness in practical applications. ### Solutions The paper proposes InvisMark, which solves the above problems through the following points: 1. **Novel Architecture** - Utilize advanced neural network architectures and training strategies to enhance the robustness of the decoder against common image transformations while minimizing the impact on the quality of the encoded image. 2. **Excellent Performance** - InvisMark outperforms existing methods in both invisibility and robustness and performs well on both AI - generated and non - AI - generated image datasets. 3. **Larger Payload** - It can embed a 256 - bit watermark while maintaining extremely high invisibility and robustness, expanding the application range of the method in practical scenarios. ### Technical Details - **Watermark Encoder**: Use the MUNIT - based encoder architecture and skip connections to preserve image details, and perform post - processing through multi - layer 1×1 convolution layers to maintain high fidelity. - **Watermark Decoder**: Use ConvNeXT - base as the default decoder and replace the last - layer classifier with an l - dimensional sigmoid - activated fully - connected layer to predict an l - bit secret message. - **Noise Module**: Introduce a noise module to simulate real - world image transformations and optimize the robustness of the model by selecting the worst watermark recovery situation. - **Training Strategy**: Conduct training in three stages, gradually optimizing watermark extraction, image reconstruction and robustness enhancement. ### Experimental Results - **Watermark Quality**: InvisMark significantly outperforms other methods in PSNR and SSIM metrics, reaching a PSNR value of about 51. - **Watermark Robustness**: Under various common image transformations, InvisMark performs well. Especially under complex transformations such as Gaussian blur, it can still maintain more than 97% bit accuracy. - **Watermark Attack**: InvisMark has high robustness against adversarial attacks, regenerative attacks and forgery attacks. Even when the PSNR value is low, it can still maintain high bit accuracy. ### Conclusion InvisMark provides a solid foundation for ensuring the authenticity and origin of AI - generated content by combining high invisibility, expanded payload capacity and robustness against image transformations.