InvisMark: Invisible and Robust Watermarking for AI-generated Image Provenance

TL;DR

This work presents InvisMark, a novel watermarking technique designed for high-resolution AI-generated images that enables the embedding of UUIDs with error correction codes, achieving near-perfect decoding success rates even under challenging image distortions.

Abstract

The proliferation of AI-generated images has intensified the need for robust content authentication methods. We present InvisMark, a novel watermarking technique designed for high-resolution AI-generated images. Our approach leverages advanced neural network architectures and training strategies to embed imperceptible yet highly robust watermarks. InvisMark achieves state-of-the-art performance in imperceptibility (PSNR$\sim$51, SSIM $\sim$ 0.998) while maintaining over 97\% bit accuracy across various image manipulations. Notably, we demonstrate the successful encoding of 256-bit watermarks, significantly expanding payload capacity while preserving image quality. This enables the embedding of UUIDs with error correction codes, achieving near-perfect decoding success rates even under challenging image distortions. We also address potential vulnerabilities against advanced attacks and propose mitigation strategies. By combining high imperceptibility, extended payload capacity, and resilience to manipulations, InvisMark provides a robust foundation for ensuring media provenance in an era of increasingly sophisticated AI-generated content. Source code of this paper is available at: https://github.com/microsoft/InvisMark.

Figures (6)

• Figure 1: Overview of our method for watermark encoding and decoding. Watermark first passes through a preprocessing layer and then concatenates with the resized cover image. A MUNIT-based encoder generates watermark residuals, which are upscaled and added to the original image, producing the watermarked image. To ensure robustness, we select the top-k noises that yield the poorest watermark recovery from a pre-defined set of noises, these losses are incorporated into watermark training.
• Figure 2: Encoded images and amplified residuals (20$\times$) from InvisMark and 4 other watermarking methods (TrustMark bui2023trustmark, SSL fernandez2022watermarking, StegaStamp tancik2020stegastamp and dwtDctSvd navas2008dwt) on DALL$\cdot$E 3 (top) and DIV2K (bottom) datasets. The residuals from InvisMark are smaller and more imperceptible compared to previous works.
• Figure 3: PSNR / SSIM distributions for encoded images from DALL$\cdot$E 3 (top panels) and DIV2K (bottom panels) datasets.
• Figure 4: InvisMark's performance under adverserial attack and regeneration attack.
• Figure 5: An example image from DALL$\cdot$E 3 dataset with 256-bit encoded watermark.