What Breaks Local Watermarks? A Robustness Benchmark for Local Invisible Image Watermarking

• URL: http://arxiv.org/abs/2609.16832v1
• Date: Tue, 15 Sep 2026 08:30:39 GMT
• Title: What Breaks Local Watermarks? A Robustness Benchmark for Local Invisible Image Watermarking
• Abstract summary: Local image watermarking embeds an invisible signal into selected image regions rather than spreading it across the entire image.<n>Existing studies evaluate the robustness of payload recovery and localization under image transformations.<n>We present the first systematic robustness benchmark for local watermarks across 55 image transformations.
• Score: 3.71859171264774
• License: http://creativecommons.org/licenses/by/4.0/
• Abstract: Local image watermarking embeds an invisible signal into selected image regions rather than spreading it across the entire image, enabling payload recovery from specific objects or regions without perceptibly altering the image. Existing studies evaluate the robustness of payload recovery and localization under image transformations, but they often focus on their own proposed method, resulting in narrow evaluations with inconsistent choices of transformations, datasets, and metrics. These inconsistencies across studies limit direct comparisons across methods and muddle the overall picture of local watermark robustness. To address this gap, we present the first systematic robustness benchmark for local watermarks across 55 image transformations, including (i) signal distortions, (ii) changes in image coordinate alignment, (iii) indirect local edits, and (iv) direct watermark edits. The benchmark evaluates MaskWM, WAM, OmniGuard, TrustMark, and PixelSeal, all methods that either provide native localization or require minimal adaptation to support it. Our results show that all evaluated methods are vulnerable to some transformation, with MaskWM standing out as offering the strongest payload recovery and localization, although it has the lowest image quality in the clean setting. Synchronization further improves MaskWM's payload recovery under several geometric transformations, albeit at an additional cost to image quality. A key finding is that local watermark robustness depends strongly on the nature of the transformation: signal distortions are often tolerated by the strongest methods, while geometric misalignment and generative local edits, such as inpainting and outpainting, can completely impair payload recovery. We observe that payload recovery and localization are related but not interchangeable, and both strongly depend on the transformation's impact on the watermark region.

Related papers

• CASIAL: Geometric Distortion Robust Image Watermarking [27.125516766334524]
  We propose CASIAL, a geometric distortion-robust watermarking framework with cover image-aware message spreading strategy.<n>We show that CASIAL achieves substantially stronger robustness than eleven prior baselines while preserving high visual quality.<n>It also maintains competitive performance under six signal distortions and four photometric transformations.
  arXiv  Detail & Related papers  (2026-07-29T10:16:44Z)
• High-Fidelity Face Content Recovery via Tamper-Resilient Versatile Watermarking [27.912549423920243]
  We present VeriFi, a versatile watermarking framework that unifies copyright protection, pixel-level manipulation localization, and high-fidelity face content recovery.<n>It makes three key contributions: (1) it embeds a compact semantic latent watermark that serves as an content-preserving prior, enabling faithful restoration even after severe manipulations; (2) it achieves fine-grained localization without embedding localization-specific artifacts by correlating image features with decoded provenance signals; and (3) it introduces an AIGC attack simulator that combines latent-space mixing with seamless blending to improve robustness to realistic deepfake pipelines.
  arXiv  Detail & Related papers  (2026-03-25T05:02:48Z)
• OptMark: Robust Multi-bit Diffusion Watermarking via Inference Time Optimization [66.69924980864053]
  We propose OptMark, an optimization-based approach that embeds a robust multi-bit watermark into the intermediate latents of the diffusion denoising process.<n> OptMark strategically inserts a structural watermark early to resist generative attacks and a detail watermark late to withstand image transformations.<n> Experimental results demonstrate that OptMark achieves invisible multi-bit watermarking while ensuring robust resilience against valuemetric transformations, geometric transformations, editing, and regeneration attacks.
  arXiv  Detail & Related papers  (2025-08-29T15:50:59Z)
• TAG-WM: Tamper-Aware Generative Image Watermarking via Diffusion Inversion Sensitivity [76.98973481600002]
  This paper proposes a Tamper-Aware Generative image WaterMarking method named TAG-WM.<n>The proposed method comprises four key modules: a dual-mark joint sampling (DMJS) algorithm for embedding copyright and localization watermarks into the latent space while preserving generative quality.<n>The experimental results demonstrate that TAG-WM achieves state-of-the-art performance in both tampering robustness and localization capability even under distortion.
  arXiv  Detail & Related papers  (2025-06-30T03:14:07Z)
• GenPTW: In-Generation Image Watermarking for Provenance Tracing and Tamper Localization [32.843425702098116]
  GenPTW is an In-Generation image watermarking framework for latent diffusion models (LDMs)<n>It embeds structured watermark signals during the image generation phase, enabling unified provenance tracing and tamper localization.<n>Experiments demonstrate that GenPTW outperforms existing methods in image fidelity, watermark extraction accuracy, and tamper localization performance.
  arXiv  Detail & Related papers  (2025-04-28T08:21:39Z)
• Pixel-Inconsistency Modeling for Image Manipulation Localization [59.968362815126326]
  Digital image forensics plays a crucial role in image authentication and manipulation localization. This paper presents a generalized and robust manipulation localization model through the analysis of pixel inconsistency artifacts. Experiments show that our method successfully extracts inherent pixel-inconsistency forgery fingerprints.
  arXiv  Detail & Related papers  (2023-09-30T02:54:51Z)
• WMFormer++: Nested Transformer for Visible Watermark Removal via Implict Joint Learning [68.00975867932331]
  Existing watermark removal methods mainly rely on UNet with task-specific decoder branches. We introduce an implicit joint learning paradigm to holistically integrate information from both branches. The results demonstrate our approach's remarkable superiority, surpassing existing state-of-the-art methods by a large margin.
  arXiv  Detail & Related papers  (2023-08-20T07:56:34Z)
• SImProv: Scalable Image Provenance Framework for Robust Content Attribution [80.25476792081403]
  We present SImProv, a framework to match a query image back to a trusted database of originals. SimProv consists of three stages: a scalable search stage for retrieving top-k most similar images; a re-ranking and near-duplicated detection stage for identifying the original among the candidates. We demonstrate effective retrieval and manipulation detection over a dataset of 100 million images.
  arXiv  Detail & Related papers  (2022-06-28T18:42:36Z)
• Spatially-Adaptive Image Restoration using Distortion-Guided Networks [51.89245800461537]
  We present a learning-based solution for restoring images suffering from spatially-varying degradations. We propose SPAIR, a network design that harnesses distortion-localization information and dynamically adjusts to difficult regions in the image.
  arXiv  Detail & Related papers  (2021-08-19T11:02:25Z)

This list is automatically generated from the titles and abstracts of the papers in this site.

This site does not guarantee the quality of this site (including all information) and is not responsible for any consequences.