Achieving Resolution-Agnostic DNN-based Image Watermarking: A Novel Perspective of Implicit Neural Representation

TL;DR

This work proposes the first, to the best of the knowledge, Resolution-Agnostic Image WaterMarking (RAIMark) framework by watermarking the implicit neural representation (INR) of image by directly watermarking the continuous signal instead of image pixels, thus achieving resolution-agnostic watermarking.

Abstract

DNN-based watermarking methods are rapidly developing and delivering impressive performances. Recent advances achieve resolution-agnostic image watermarking by reducing the variant resolution watermarking problem to a fixed resolution watermarking problem. However, such a reduction process can potentially introduce artifacts and low robustness. To address this issue, we propose the first, to the best of our knowledge, Resolution-Agnostic Image WaterMarking (RAIMark) framework by watermarking the implicit neural representation (INR) of image. Unlike previous methods, our method does not rely on the previous reduction process by directly watermarking the continuous signal instead of image pixels, thus achieving resolution-agnostic watermarking. Precisely, given an arbitrary-resolution image, we fit an INR for the target image. As a continuous signal, such an INR can be sampled to obtain images with variant resolutions. Then, we quickly fine-tune the fitted INR to get a watermarked INR conditioned on a binary secret message. A pre-trained watermark decoder extracts the hidden message from any sampled images with arbitrary resolutions. By directly watermarking INR, we achieve resolution-agnostic watermarking with increased robustness. Extensive experiments show that our method outperforms previous methods with significant improvements: averagely improved bit accuracy by 7%$\sim$29%. Notably, we observe that previous methods are vulnerable to at least one watermarking attack (e.g. JPEG, crop, resize), while ours are robust against all watermarking attacks.

Figures (6)

• Figure 1: Differences between our framework RAIMark and the previous framework. Figure \ref{['fig:endtoend']}: The end-to-end watermarking frameworks need to re-watermark images even with a change in resolution, and fixed-resolution watermarking frameworks need to re-train models to watermark different-resolution images. Figure \ref{['fig:our']}: Our framework watermarks INR and samples it to obtain watermarked images of different resolutions.
• Figure 2: Watermarked images of robust models. There are apparent artifacts of watermarks in the MBRS and DWSF, making it easy to recognize whether or not an image has been watermarked.
• Figure 3: Framework overview. In Stage 1, we create the implicit neural representation (INR); in Stage 2, we pre-train an end-to-end watermarking structure, then we discard the encoder and keep only the decoder; in Stage 3, we fine-tune the INR to obtain watermarked INR. In the test stage, we sample images of different resolutions using sampler $\mathcal{S}$.
• Figure 4: Model overview. Stage 1 creates an MLP-based INR $F_{im}$ ($F$ stands for $F_{im}$ in Stage 1 and $F_{wm}$ in Stage 3) to fit the original image. Stage 2 pre-trains a decoder $\mathcal{D}$ in a DNN-based framework. Stage 3 fine-tunes $F_{im}$ with the pre-trained decoder $\mathcal{D}$ to get watermarked INR $F_{wm}$. When fine-tuning, $F_{wm}$ randomly generates images of different resolutions by changing the input parameters of the sampler, and the noise layer $\mathcal{N}$ randomly chooses an attack and applies it to the watermarked image.
• Figure 5: Comparison of visual quality. First row: original image $I_o$. Second row: watermarked image $I_w$. Third row: residual image $I_r$. Fourth row: normalized residual image $I_m$. We randomly choose two images in the test dataset to compare the invisibility of the watermarked images between the five methods.