Logo
ScienceStack
Table of Contents
Fetching ...
Sign In

Generative Model Watermarking Suppressing High-Frequency Artifacts

Li Zhang, Yong Liu, Xinpeng Zhang, Hanzhou Wu

TL;DR

This work addresses the frequency-domain invisibility challenge in generative model watermarking by introducing an anti-aliasing–driven watermark embedding network. The proposed framework integrates a three-network pipeline (host, embedding, extractor) with a discriminator and an attack layer, plus adversarial and surrogate-training to boost robustness while maintaining image quality. Empirical results show preserved task performance, high watermark extraction success, and substantially reduced high-frequency artifacts, improving both imperceptibility and security. The study underscores the importance of considering frequency-domain effects in watermarking and provides a viable path toward more secure IP protection for generative models.

Abstract

Protecting deep neural networks (DNNs) against intellectual property (IP) infringement has attracted an increasing attention in recent years. Recent advances focus on IP protection of generative models, which embed the watermark information into the image generated by the model to be protected. Although the generated marked image has good visual quality, it introduces noticeable artifacts to the marked image in high-frequency area, which severely impairs the imperceptibility of the watermark and thereby reduces the security of the watermarking system. To deal with this problem, in this paper, we propose a novel framework for generative model watermarking that can suppress those high-frequency artifacts. The main idea of the proposed framework is to design a new watermark embedding network that can suppress high-frequency artifacts by applying anti-aliasing. To realize anti-aliasing, we use low-pass filtering for the internal sampling layers of the new watermark embedding network. Meanwhile, joint loss optimization and adversarial training are applied to enhance the effectiveness and robustness. Experimental results indicate that the marked model not only maintains the performance very well on the original task, but also demonstrates better imperceptibility and robustness on the watermarking task. This work reveals the importance of suppressing high-frequency artifacts for enhancing imperceptibility and security of generative model watermarking.

Generative Model Watermarking Suppressing High-Frequency Artifacts

TL;DR

This work addresses the frequency-domain invisibility challenge in generative model watermarking by introducing an anti-aliasing–driven watermark embedding network. The proposed framework integrates a three-network pipeline (host, embedding, extractor) with a discriminator and an attack layer, plus adversarial and surrogate-training to boost robustness while maintaining image quality. Empirical results show preserved task performance, high watermark extraction success, and substantially reduced high-frequency artifacts, improving both imperceptibility and security. The study underscores the importance of considering frequency-domain effects in watermarking and provides a viable path toward more secure IP protection for generative models.

Abstract

Protecting deep neural networks (DNNs) against intellectual property (IP) infringement has attracted an increasing attention in recent years. Recent advances focus on IP protection of generative models, which embed the watermark information into the image generated by the model to be protected. Although the generated marked image has good visual quality, it introduces noticeable artifacts to the marked image in high-frequency area, which severely impairs the imperceptibility of the watermark and thereby reduces the security of the watermarking system. To deal with this problem, in this paper, we propose a novel framework for generative model watermarking that can suppress those high-frequency artifacts. The main idea of the proposed framework is to design a new watermark embedding network that can suppress high-frequency artifacts by applying anti-aliasing. To realize anti-aliasing, we use low-pass filtering for the internal sampling layers of the new watermark embedding network. Meanwhile, joint loss optimization and adversarial training are applied to enhance the effectiveness and robustness. Experimental results indicate that the marked model not only maintains the performance very well on the original task, but also demonstrates better imperceptibility and robustness on the watermarking task. This work reveals the importance of suppressing high-frequency artifacts for enhancing imperceptibility and security of generative model watermarking.
Paper Structure (17 sections, 12 equations, 9 figures, 7 tables)

This paper contains 17 sections, 12 equations, 9 figures, 7 tables.

Table of Contents

  1. Introduction
  2. Preliminaries
  3. Discrete Cosine Transform
  4. Detection of High-Frequency Artifacts
  5. Analysis of High-Frequency Artifacts
  6. Proposed Method
  7. General Framework
  8. Structural Design
  9. Loss Function and Training Strategy
  10. Phase I
  11. Phase II
  12. Experimental Results and Analysis
  13. Setup
  14. Qualitative and Quantitative Results
  15. Robustness
  16. ...and 2 more sections

Figures (9)

  • Figure 1: An individual example of spatial image: (a) ground-truth image, (b) non-marked image generated by isola2017image, (c) marked image generated by zhang2021deep, (d) marked image generated by zhang2022generative, (e) marked image generated by wu2020watermarking, and (f) partial zoom-in of (e).
  • Figure 2: DCT heat maps over the corresponding test images (average results): (a) ground-truth images, (b) non-marked images generated by isola2017image, (c) marked images generated by zhang2021deep, (d) marked images generated by zhang2022generative, (e) marked images generated by wu2020watermarking.
  • Figure 3: Sketch for the proposed generative model watermarking framework which consists of the host network $H$, the embedding network $E$, the discriminator $D$, the extraction network $R$ and the attack layer $A_L$.
  • Figure 4: The network structure for the watermark embedding network $E$.
  • Figure 5: Structural details for different functional modules. All the up-sampling and down-sampling layers except for the first down-sampling layer use BN. The first two up-sampling layers use dropout (= 0.5).
  • ...and 4 more figures