TrustMark: Universal Watermarking for Arbitrary Resolution Images

TL;DR

The paper tackles robust, imperceptible watermarking of images at arbitrary resolutions to enable provenance tracking in GenAI workflows. It introduces TrustMark, a GAN-based embedder– extractor framework with a noise-robust training regime and a focal frequency loss, plus TrustMark-RM for watermark removal and re-watermarking. It includes a resolution scaling method to extend to arbitrary image sizes and validates state-of-the-art performance on three benchmarks, across clean and noisy conditions, with PSNR above 40 dB and high watermark recovery. It demonstrates the practicality of re-watermarking and resilience to adversarial and various perturbations, underscoring potential integration with C2PA and other provenance standards.

Abstract

Imperceptible digital watermarking is important in copyright protection, misinformation prevention, and responsible generative AI. We propose TrustMark - a GAN-based watermarking method with novel design in architecture and spatio-spectra losses to balance the trade-off between watermarked image quality with the watermark recovery accuracy. Our model is trained with robustness in mind, withstanding various in- and out-place perturbations on the encoded image. Additionally, we introduce TrustMark-RM - a watermark remover method useful for re-watermarking. Our methods achieve state-of-art performance on 3 benchmarks comprising arbitrary resolution images.

Figures (17)

• Figure 1: Proposed architecture of TrustMark (a). The embedder E encodes a watermark into a cover image robustly using a noise module N to simulate common perturbations on the encoded image. The extractor X recovers the watermark from the encoded image. The TrustMark-RM network (b) removes the watermark to enable re-watermarking of the image.
• Figure 2: Representative examples of TrustMark and 5 baseline methods (SSL fernandez2022watermarking, RivaGAN zhang2019robust, dwtDctSvd navas2008dwt, RoSteALS bui2023rosteals, StegaStamp tancik2020stegastamp) over 3 benchmarks (CLIC clic2020, DIV2k div2k) and MetFace metface). The residual is amplified $20 \times$ for visualization.
• Figure 3: Re-watermarking performance with and without watermark removal, evaluated on the DIV2K dataset.
• Figure 4: Impact of bit length, noise severity and adversarial attack on TrustMark performance on DIV2K. Larger watermark reduces both PSNR and bit accuracy (a). Training with higher noise severity affects PSNR more than bit accuracy (b); and improves robustness against adversarial attack (c).
• Figure 4: Ablation studies on different mutations of TrustMark ($\alpha_{\mathrm{max}}=20$) architecture, evaluated on DIV2K.