FreqMark: Invisible Image Watermarking via Frequency Based Optimization in Latent Space

TL;DR

A novel method called FreqMark is proposed that involves unconstrained optimization of the image latent frequency space obtained after VAE encoding and embeds the watermark by optimizing the latent frequency space of the images and then extracts the watermark through a pre-trained image encoder.

Abstract

Invisible watermarking is essential for safeguarding digital content, enabling copyright protection and content authentication. However, existing watermarking methods fall short in robustness against regeneration attacks. In this paper, we propose a novel method called FreqMark that involves unconstrained optimization of the image latent frequency space obtained after VAE encoding. Specifically, FreqMark embeds the watermark by optimizing the latent frequency space of the images and then extracts the watermark through a pre-trained image encoder. This optimization allows a flexible trade-off between image quality with watermark robustness and effectively resists regeneration attacks. Experimental results demonstrate that FreqMark offers significant advantages in image quality and robustness, permits flexible selection of the encoding bit number, and achieves a bit accuracy exceeding 90% when encoding a 48-bit hidden message under various attack scenarios.

Figures (12)

• Figure 1: The robustness of different watermark encoding positions. Left: Encoding in image frequency space resists Gaussian noise but is vulnerable to regeneration attacks. Middle: Encoding in image latent space enhances resistance to regeneration attacks but introduces vulnerabilities to Gaussian noise. Right: FreqMark encodes latent frequency space in the image, achieving a strong defense against regeneration and traditional attacks.
• Figure 2: Overview of FreqMark. Encoding: FreqMark employs a pre-trained VAE model to encode watermarks within the latent frequency space of the image. $\epsilon1$ and $\epsilon2$ are Gaussian noise perturbations added during training. All networks are fixed and only perturbation $\delta_m$ is trained. Decoding: FreqMark utilizes a pre-trained image encoder to extract features from the image and extracts the watermark by comparing this feature against predefined directions.
• Figure 3: Examples of watermarked images. The first three columns are from ImageNet deng2009imagenet, and the others are generated by the prompts from DiffusionDB wang2022diffusiondb. These watermarked images have 48-bit messages and are robust to various attacks. Top: origin image. Middle: watermarked image. Bottom: pixel difference (amplified by a factor of 10 to enhance the visual effect).
• Figure 4: Comparison of image quality between VAE and FreqMark.
• Figure 5: The correlation matrix of each bit of the decoded message from the vanilla images and the random message.