SSyncOA: Self-synchronizing Object-aligned Watermarking to Resist Cropping-paste Attacks

TL;DR

SSyncOA tackles the crop-paste desynchronization problem in object-level watermarking by tying the watermark to the protected object's geometry. It introduces a self-synchronization stage that aligns and normalizes invariant object features (centroid, principal orientation, minimum bounding square) and an object-aligned watermarking model that embeds/extracts watermarks within the synchronized region; the cropping-paste attack is simulated in training via the noise layer for end-to-end optimization. The approach delivers high visual quality and robust watermarking (e.g., PSNR > 43 dB, BAR ~98%, up to 120-bit capacity) and outperforms existing methods such as RoSteALS, ARWGAN, and OBW. This enables practical, automatic object-level copyright protection under cropping scenarios with significant improvements in both robustness and image quality.

Abstract

Modern image processing tools have made it easy for attackers to crop the region or object of interest in images and paste it into other images. The challenge this cropping-paste attack poses to the watermarking technology is that it breaks the synchronization of the image watermark, introducing multiple superimposed desynchronization distortions, such as rotation, scaling, and translation. However, current watermarking methods can only resist a single type of desynchronization and cannot be applied to protect the object's copyright under the cropping-paste attack. With the finding that the key to resisting the cropping-paste attack lies in robust features of the object to protect, this paper proposes a self-synchronizing object-aligned watermarking method, called SSyncOA. Specifically, we first constrain the watermarked region to be aligned with the protected object, and then synchronize the watermark's translation, rotation, and scaling distortions by normalizing the object invariant features, i.e., its centroid, principal orientation, and minimum bounding square, respectively. To make the watermark embedded in the protected object, we introduce the object-aligned watermarking model, which incorporates the real cropping-paste attack into the encoder-noise layer-decoder pipeline and is optimized end-to-end. Besides, we illustrate the effect of different desynchronization distortions on the watermark training, which confirms the necessity of the self-synchronization process. Extensive experiments demonstrate the superiority of our method over other SOTAs.

Figures (5)

• Figure 1: Example of the cropping-paste attack, where the butterfly captured by Alice is stolen by Bob. The red outlines indicate the embedded region of the watermark. Due to various desynchronization distortions, the image watermark embedded in the photo is destroyed, resulting in failed certification. Here, we propose the watermarking scheme SSyncOA, which embeds the watermark in the object region and synchronizes the distortion through the object invariant features.
• Figure 2: Training pipeline of SSyncOA, which consists of the self-synchronization process (SSync) and the object-aligned watermarking model. Given the object image $X_{en}$ to be protected, it is first synchronized by SSync, then the synchronization result $O_{en}$ is fed to the encoder to generate the watermarked object $O_w$. To simulate the cropping-paste attack, $O_w$ is pasted into another background image and further distorted by the noise layer. Given the synthetic image $X_{de}$ to be authenticated, it is also first synchronized by SSync. The decoder takes the synchronized object $O_{de}$ as input and extracts the embedded message.
• Figure 3: Examples of the models trained with different noise layers. The container is the original image with the watermarked object. $O_{en}$ and $O_{de}$ should have a black background in training, we set them to white here for better visualization.
• Figure 4: Embedding capacity evaluation of SSyncOA. There are four watermarking models configured with capacity settings for embedding 30, 60, 90, and 120-bit messages within the objects in images of size 256.
• Figure 5: Comparison of different methods in visual quality.