Watermarking Images in Self-Supervised Latent Spaces

TL;DR

This work embeds marks and binary messages into the latent spaces of pre-trained self-supervised networks, notably using DINO, achieving robust watermarking under a wide range of transformations. By combining gradient-based marking with data augmentation and PCA whitening, the method delivers strong zero-bit detection and competitive multi-bit decoding without end-to-end watermarking training. It demonstrates superior robustness to common distortions on multiple datasets and scales to high-resolution images, with promising results for practical deployment. The approach highlights the intrinsic suitability of SSL-derived representations for watermarking and sets a path toward further specialized watermarking optimizations.

Abstract

We revisit watermarking techniques based on pre-trained deep networks, in the light of self-supervised approaches. We present a way to embed both marks and binary messages into their latent spaces, leveraging data augmentation at marking time. Our method can operate at any resolution and creates watermarks robust to a broad range of transformations (rotations, crops, JPEG, contrast, etc). It significantly outperforms the previous zero-bit methods, and its performance on multi-bit watermarking is on par with state-of-the-art encoder-decoder architectures trained end-to-end for watermarking. The code is available at github.com/facebookresearch/ssl_watermarking

Figures (6)

• Figure 1: Overview of our method for watermarking in self-supervised-latent spaces. A self-supervised network trained with DINO caron2021dino builds a latent space on which the mark is added by the embedding process. Its effect is to shift the image's feature into a well-specified region of the latent space, such that transformations applied during transmission do not move much the feature. The mark's detection (zero-bit watermarking setup) or message's decoding (multi-bit watermarking setup) is performed in the same latent space.
• Figure 2: Robustness of the detection in the zero-bit setup against image transformations. Top: PSNR set at 40 dB and FPR decreasing from $10^{-2}$ (red) to $10^{-12}$ (blue). Bottom: FPR set at $10^{-6}$ and PSNR ranging from 52 dB to 32 dB.
• Figure 3: Robustness against rotation. Each row (column) represents different $\pm$amplitude of the rotation at training (resp. marking \ref{['fig:0bit_rotations']}).
• Figure 4: Example of an image ($800\times 600$) watermarked at PSNR 40 dB and FPR=$10^{-6}$, and some detected alterations. The black and white picture shows the scaled amplitude of the watermark signal.
• Figure 5: Watermarked images from the INRIA Holidays dataset resized to $128 \times 128$. The watermark is added with our multi-bit watermarking method with a payload of $30$ bits and with different values for the target PSNR: $52$dB (top row), $40$dB (middle row), $32$dB (bottom row). We use a 5-bits character encoding to encode and decode one message per image, and show the decoded messages for each image (without any transformation applied to the image). The higher the PSNR, the higher the decoding errors, and the less robust the decoding is to transformations.