SLIC: Secure Learned Image Codec through Compressed Domain Watermarking to Defend Image Manipulation

TL;DR

The Secure Learned Image Codec (SLIC) is introduced, a novel active approach to ensuring image authenticity through watermark embedding in the compressed domain that leverages neural network-based compression to embed watermarks as adversarial perturbations in the latent space.

Abstract

The digital image manipulation and advancements in Generative AI, such as Deepfake, has raised significant concerns regarding the authenticity of images shared on social media. Traditional image forensic techniques, while helpful, are often passive and insufficient against sophisticated tampering methods. This paper introduces the Secure Learned Image Codec (SLIC), a novel active approach to ensuring image authenticity through watermark embedding in the compressed domain. SLIC leverages neural network-based compression to embed watermarks as adversarial perturbations in the latent space, creating images that degrade in quality upon re-compression if tampered with. This degradation acts as a defense mechanism against unauthorized modifications. Our method involves fine-tuning a neural encoder/decoder to balance watermark invisibility with robustness, ensuring minimal quality loss for non-watermarked images. Experimental results demonstrate SLIC's effectiveness in generating visible artifacts in tampered images, thereby preventing their redistribution. This work represents a significant step toward developing secure image codecs that can be widely adopted to safeguard digital image integrity.

Figures (6)

• Figure 1: The proposed Secure Learned Image Codec (SLIC) validates content authenticity by severely degrading the image content if the source image contains any protected content. Embedding a watermark in the latent representation can be thought of as perturbations to generate adversarial examples for a neural compressor.
• Figure 2: The proposed SLIC framework. Our training procedure contains four subflows: (a) image encoding/decoding flow, (b) stego image generating flow, (c) noise attack simulation flow, and (d) message embedding/extraction flow.
• Figure 3: The re-compressed results of stego images with various editing operations. The SLIC is based on the Balle2018 codec.
• Figure 4: Watermark robustness against selected noise attacks evaluated on DIV2K.
• Figure 5: The re-compressed results of stego images with various editing operations. The SLIC is based on the Minnen2018 codec.