Robust Watermarking Using Generative Priors Against Image Editing: From Benchmarking to Advances

TL;DR

This work introduces W-Bench, the first comprehensive benchmark for assessing watermark robustness against image edits enabled by large generative models, covering image regeneration, global/local editing, and image-to-video generation. It reveals that existing watermarking methods are fragile under such edits and proposes VINE, a robust watermarking approach that combines frequency-aware surrogate attacks with a strong generative prior (SDXL-Turbo) via a condition adaptor to embed watermarks with high perceptual quality. Through extensive experiments and ablations, VINE-B and VINE-R outperform prior methods in both image quality and robustness, highlighting the value of one-step pretrained diffusion backbones for watermarking. Limitations include partially limited performance on image-to-video generation and higher computational demands, suggesting directions for making the approach more scalable and broadly applicable.

Abstract

Current image watermarking methods are vulnerable to advanced image editing techniques enabled by large-scale text-to-image models. These models can distort embedded watermarks during editing, posing significant challenges to copyright protection. In this work, we introduce W-Bench, the first comprehensive benchmark designed to evaluate the robustness of watermarking methods against a wide range of image editing techniques, including image regeneration, global editing, local editing, and image-to-video generation. Through extensive evaluations of eleven representative watermarking methods against prevalent editing techniques, we demonstrate that most methods fail to detect watermarks after such edits. To address this limitation, we propose VINE, a watermarking method that significantly enhances robustness against various image editing techniques while maintaining high image quality. Our approach involves two key innovations: (1) we analyze the frequency characteristics of image editing and identify that blurring distortions exhibit similar frequency properties, which allows us to use them as surrogate attacks during training to bolster watermark robustness; (2) we leverage a large-scale pretrained diffusion model SDXL-Turbo, adapting it for the watermarking task to achieve more imperceptible and robust watermark embedding. Experimental results show that our method achieves outstanding watermarking performance under various image editing techniques, outperforming existing methods in both image quality and robustness. Code is available at https://github.com/Shilin-LU/VINE.

Figures (18)

• Figure 1: (a) Flowchart of the W-Bench evaluation process. (b) Watermarking performance. Each method is illustrated with a diamond and four bars. The area of the diamond represents the method’s encoding capacity. The y-coordinate of the diamond’s center indicates normalized image quality, calculated by averaging the normalized PSNR, SSIM, LPIPS, and FID between watermarked and input images. The x-coordinate represents robustness, measured by the True Positive Rate at a 0.1% False Positive Rate (TPR@0.1%FPR) averaged across four types of image editing methods, encompassing a total of seven distinct models and algorithms. The four bars are oriented to signify different editing tasks: image regeneration (left), global editing (top), local editing (right), and image-to-video generation (bottom). The length of each bar reflects the method’s normalized TPR@0.1%FPR after each type of image editing—the longer the bar, the better the performance.
• Figure 2: Process for analyzing the impact of image editing on an image's frequency spectrum. In this example, the editing model Instruct-Pix2Pix, denoted as $\epsilon(\cdot)$, is employed. The function $\mathcal{F}(\cdot)$ represents the Fourier transform, and we visualize its magnitude on a logarithmic scale.
• Figure 3: Impact of various image editing techniques and distortions on the frequency spectra of images. Results are averaged over 1,000 images. Image editing methods tend to remove frequency patterns in the mid- and high-frequency bands, while low-frequency patterns remain largely unaffected. This trend is also observed with blurring distortions such as pixelation and defocus blur. In contrast, commonly used distortions like JPEG compression and saturation do not exhibit similar behavior in the frequency domain. The analysis of SVD is not included, as it removes all patterns, rendering them invisible to the human eye. A discussion on SVD can be found in Section \ref{['sec:overall_result']}.
• Figure 4: The overall framework of our method, VINE. We utilize the pretrained one-step text-to-image model SDXL-Turbo as the watermark encoder. A condition adaptor is incorporated to fuse the watermark with the image before passing the information to the VAE encoder. Zero-convolution layers zhang2023adding and skip connections are added for better perceptual similarity. For decoding the watermark, we employ ConvNeXt-B liu2022convnet as the decoder, with an additional fully connected layer to output a 100-bit watermark. Throughout the entire training process, the SDXL-Turbo text prompt is set to null prompt. Figure \ref{['fig:cond_adaptor']} shows the condition adaptor architecture.
• Figure 5: The performance of watermarking methods under (a) Stochastic regeneration, (b) Global editing, and (c) Local editing. Additional results are available in Figure \ref{['fig:all_exp_app']}.