StyleMark: A Robust Watermarking Method for Art Style Images Against Black-Box Arbitrary Style Transfer

TL;DR

The paper tackles copyright protection for artworks subjected to black-box Arbitrary Style Transfer (AST). It introduces StyleMark, a robust watermarking framework that embeds watermarks into the shared multi-scale style feature space to enable attribution after AST, even under distortions and adversarial attempts. Key contributions include a novel style watermark encoder, a distribution squeeze loss to preserve watermark distribution without compromising content structure, and a two-stage training regimen with random-noise fine-tuning to boost robustness. Empirical results across seven AST models show strong watermark recovery and security against post-processing and adaptive attacks, with minimal impact on visual quality and practical watermark lengths suitable for large-scale deployment.

Abstract

Arbitrary Style Transfer (AST) achieves the rendering of real natural images into the painting styles of arbitrary art style images, promoting art communication. However, misuse of unauthorized art style images for AST may infringe on artists' copyrights. One countermeasure is robust watermarking, which tracks image propagation by embedding copyright watermarks into carriers. Unfortunately, AST-generated images lose the structural and semantic information of the original style image, hindering end-to-end robust tracking by watermarks. To fill this gap, we propose StyleMark, the first robust watermarking method for black-box AST, which can be seamlessly applied to art style images achieving precise attribution of artistic styles after AST. Specifically, we propose a new style watermark network that adjusts the mean activations of style features through multi-scale watermark embedding, thereby planting watermark traces into the shared style feature space of style images. Furthermore, we design a distribution squeeze loss, which constrain content statistical feature distortion, forcing the reconstruction network to focus on integrating style features with watermarks, thus optimizing the intrinsic watermark distribution. Finally, based on solid end-to-end training, StyleMark mitigates the optimization conflict between robustness and watermark invisibility through decoder fine-tuning under random noise. Experimental results demonstrate that StyleMark exhibits significant robustness against black-box AST and common pixel-level distortions, while also securely defending against malicious adaptive attacks.

Figures (4)

• Figure 1: Protection scenarios for StyleMark. Artists register on the art-sharing platform and upload their art style images. The platform embeds copyright watermarks before public release. Unauthorized adversaries may download the art style image and use AST for style transfer. When misuse is detected, the platform can extract the watermark from stylized images to verify the source of the art style.
• Figure 2: The whole pipeline of our StyleMark.
• Figure 3: Subjective visual quality under various AST distortions. $R_{wm}$ represents the amplified residual image of $I_{wm}$ and $I_{sty}$: $(I_{wm}-I_{sty})\times 10$. $R_{wm}^{cs}$ represents the amplified residual image of $I_{wm}^{cs}$ and $I_{cs}$: $(I_{wm}^{cs}-I_{cs})\times 5$.
• Figure 4: Visualization of images from different models.