OmniGuard: Hybrid Manipulation Localization via Augmented Versatile Deep Image Watermarking

TL;DR

OmniGuard presents a hybrid forensic framework that unifies proactive dual watermarking with a passive degradation-aware tamper extractor to achieve precise tamper localization and robust copyright recovery under both global AIGC edits and local manipulations. It introduces an adaptive localized watermark transform and a lightweight AIGC-editing simulator to boost container image fidelity while preserving localization accuracy. Joint training of localization and copyright watermarks, along with a degradation-aware extractor, yields superior performance over state-of-the-art methods across PSNR, F1, AUC, and bit recovery, even under challenging degradations. The approach demonstrates strong generalization to new AIGC-edit methods and high-resolution content, offering practical impact for digital content authenticity and copyright protection in AI-assisted workflows.

Abstract

With the rapid growth of generative AI and its widespread application in image editing, new risks have emerged regarding the authenticity and integrity of digital content. Existing versatile watermarking approaches suffer from trade-offs between tamper localization precision and visual quality. Constrained by the limited flexibility of previous framework, their localized watermark must remain fixed across all images. Under AIGC-editing, their copyright extraction accuracy is also unsatisfactory. To address these challenges, we propose OmniGuard, a novel augmented versatile watermarking approach that integrates proactive embedding with passive, blind extraction for robust copyright protection and tamper localization. OmniGuard employs a hybrid forensic framework that enables flexible localization watermark selection and introduces a degradation-aware tamper extraction network for precise localization under challenging conditions. Additionally, a lightweight AIGC-editing simulation layer is designed to enhance robustness across global and local editing. Extensive experiments show that OmniGuard achieves superior fidelity, robustness, and flexibility. Compared to the recent state-of-the-art approach EditGuard, our method outperforms it by 4.25dB in PSNR of the container image, 20.7% in F1-Score under noisy conditions, and 14.8% in average bit accuracy.

Figures (12)

• Figure 1: Comparison between OmniGuard and typical state-of-the-art versatile deep watermarking method zhang2024editguard. Here, we paste a moon onto the container image (tampering) and reduce the overall brightness (degradation). Under AIGC-Editing or simple tampering, our method significantly outperforms EditGuard zhang2024editguard across multiple metrics, including container image fidelity (PSNR, SSIM), localization accuracy in degraded conditions (F1-Score, AUC, IoU), and copyright recovery precision (Bit Acc).
• Figure 2: Review of prior deep versatile watermarking zhang2024editguardzhao2024proactive. They used a fixed localized watermark and produced masks via residual subtraction between the recovered and added ones.
• Figure 3: High-Level Framework of the proposed OmniGuard. Based on the existing versatile watermarking framework, we can more flexibly select and embed localized watermarks to improve container image fidelity. Additionally, a deep tamper extractor is introduced to robustly extract tamper masks. The copyright watermark extraction can also resist interference from AIGC-Editing.
• Figure 4: Detail of our proposed OmniGuard. Our proactive dual watermarking network utilizes forward and backward transform to filter high-frequency information from the localized watermark. The passive degradation-aware tamper extractor employs a window-based transformer and degradation querying techniques to predict the mask $\hat{\mathbf{M}}_{\text{loc}}$ from $\hat{\mathbf{W}}_{\text{loc}}$ predicted by the trained watermarking network and $\mathbf{I}_{\text{rec}}$. The AIGC-Editing simulator uses partial removal and VAE compression as surrogate attacks for global edits and local tampering.
• Figure 5: Visualized Comparison between our OmniGuard and other methods on the in-the-wild tampered samples. The tampered image has undergone JPEG compression (1$^{st}$ row), brightness adjustment (2$^{nd}$ row) and contrast adjustment (3$^{rd}$ row).