Logo
ScienceStack
Table of Contents
Fetching ...
Sign In

We Can Hide More Bits: The Unused Watermarking Capacity in Theory and in Practice

Aleksandar Petrov, Pierre Fernandez, Tomáš Souček, Hady Elsahar

TL;DR

The paper argues that the theoretical capacity to hide bits in images under PSNR and linear-robustness constraints is far larger than what current watermarking methods achieve. It develops a geometry-based framework that bounds capacity via cube-ball intersections and extends to robustness transformations like LinJPEG, showing substantial theoretical headroom remains. Empirical results reveal that state-of-the-art models underutilize this headroom, prompting architectural and training innovations, exemplified by ChunkySeal which achieves 1024 bits with minimal loss of image quality. Overall, the work highlights a large, actionable gap between theory and practice and calls for principled benchmarking and new architectures to unlock higher watermarking capacities.

Abstract

Despite rapid progress in deep learning-based image watermarking, the capacity of current robust methods remains limited to the scale of only a few hundred bits. Such plateauing progress raises the question: How far are we from the fundamental limits of image watermarking? To this end, we present an analysis that establishes upper bounds on the message-carrying capacity of images under PSNR and linear robustness constraints. Our results indicate theoretical capacities are orders of magnitude larger than what current models achieve. Our experiments show this gap between theoretical and empirical performance persists, even in minimal, easily analysable setups. This suggests a fundamental problem. As proof that larger capacities are indeed possible, we train ChunkySeal, a scaled-up version of VideoSeal, which increases capacity 4 times to 1024 bits, all while preserving image quality and robustness. These findings demonstrate modern methods have not yet saturated watermarking capacity, and that significant opportunities for architectural innovation and training strategies remain.

We Can Hide More Bits: The Unused Watermarking Capacity in Theory and in Practice

TL;DR

The paper argues that the theoretical capacity to hide bits in images under PSNR and linear-robustness constraints is far larger than what current watermarking methods achieve. It develops a geometry-based framework that bounds capacity via cube-ball intersections and extends to robustness transformations like LinJPEG, showing substantial theoretical headroom remains. Empirical results reveal that state-of-the-art models underutilize this headroom, prompting architectural and training innovations, exemplified by ChunkySeal which achieves 1024 bits with minimal loss of image quality. Overall, the work highlights a large, actionable gap between theory and practice and calls for principled benchmarking and new architectures to unlock higher watermarking capacities.

Abstract

Despite rapid progress in deep learning-based image watermarking, the capacity of current robust methods remains limited to the scale of only a few hundred bits. Such plateauing progress raises the question: How far are we from the fundamental limits of image watermarking? To this end, we present an analysis that establishes upper bounds on the message-carrying capacity of images under PSNR and linear robustness constraints. Our results indicate theoretical capacities are orders of magnitude larger than what current models achieve. Our experiments show this gap between theoretical and empirical performance persists, even in minimal, easily analysable setups. This suggests a fundamental problem. As proof that larger capacities are indeed possible, we train ChunkySeal, a scaled-up version of VideoSeal, which increases capacity 4 times to 1024 bits, all while preserving image quality and robustness. These findings demonstrate modern methods have not yet saturated watermarking capacity, and that significant opportunities for architectural innovation and training strategies remain.
Paper Structure (54 sections, 2 theorems, 61 equations, 14 figures, 5 tables, 4 algorithms)

This paper contains 54 sections, 2 theorems, 61 equations, 14 figures, 5 tables, 4 algorithms.

Table of Contents

  1. Introduction
  2. Related work
  3. Information-theoretic capacity of watermarking
  4. The need for a new framework for watermarking capacity
  5. Bounds on watermarking capacity
  6. Absolute capacity of the image space
  7. Capacity under a PSNR constraint
  8. Cube in ball (low PSNR)
  9. Ball in cube (high PSNR)
  10. Non-trivial intersection (medium PSNR)
  11. From central gray image to arbitrary cover images
  12. Adding robustness constraints
  13. From single cover images to datasets and data distributions
  14. Empirical performance is much lower than predicted
  15. The real-world complexity does not explain the performance gap
  16. ...and 39 more sections

Key Result

Theorem 1

Let $S(x) = \int_{0}^{x} \sin(t^2) \, dt$ and $C(x) = \int_{0}^{x} \cos(t^2) \, dt$ be the Fresnel integrals.Note that some software libraries provide alternative (normalized) definitions for the Fresnel integrals: $\tilde{S}(x)= \int_0^x \sin (\pi x^2 / 2)$ and $\tilde{C}(x)= \int_0^x \cos (\pi x^2 where $K=\prod_{j=1}^{n} |\beta_j - \alpha_j|$ and $\Phi$ is defined as

Figures (14)

  • Figure 1: Existing image watermarking models have capacities well under what this paper suggests to be possible. Shown are theoretical bounds on watermarking capacity under a PSNR constraint alone (thick line) and in combination with robustness requirements (thin lines). Recent methods operate far below the achievable bounds, often by orders of magnitude, as seen in the log-scale inset. Our proposed Chunky Seal (1024 bits) pushes capacity higher than prior work, but is still very far from the theoretical limits, indicating a large potential for future development.
  • Figure 2: The box-ball configurations of the PSNR-only constraint. The cube $C_\mathcal{I}$ represents the set of all images and the sphere is the PSNR ball centred at the cover. Their intersection determines the set of feasible watermarked images, with the cardinality being the watermarking capacity. (a), (b) and (c) are the cases with the cover image $\bm{x}$ at the centre of the cube $C_\mathcal{I}$ (gray image, resulting in highest capacity, \ref{['sec:gray_psnr']}). (d) is the case of the worst-case cover $\bm{x}$, i.e., at the corner of $C_\mathcal{I}$ (\ref{['sec:nongray_psnr']}).
  • Figure 3: Discrepancy between the volume of a ball and the number of integer lattice points contained in it for small $\epsilon(\tau)$. When the radius is small, the volume-based approximation \ref{['bnd:gray_psnr_ball_in_cube_vol_approx']} underesimates the actual number of integer points. In such cases we use the exact count \ref{['bnd:gray_psnr_ball_in_cube_counting']} instead. Evaluated for a $16\times16\times 3=768$-dimensional ball.
  • Figure 4: Watermarking capacity under PSNR constraints for a 16$\times$16px 3-channel cover image without robustness requirements. We show the case where the cover lies at the centre of the pixel range (left, \ref{['sec:absolute_capacity', 'sec:gray_psnr']}) and at the extreme corner where pixels are saturated (right, \ref{['sec:nongray_psnr']}). In both cases we plot the family of bounds we established ranging from the trivial total capacity (\ref{['bnd:total_image_capacity']}) to volume approximations (\ref{['bnd:gray_psnr_ball_in_cube_vol_approx', 'bnd:anyim_psnr_ball_in_cube_vol_approx']}), exact lattice counts (\ref{['bnd:gray_psnr_ball_in_cube_counting', 'bnd:anyim_psnr_ball_in_cube_counting']}), and numerical integration for partial overlap (\ref{['bnd:gray_psnr_ball_constales', 'bnd:anyim_psnr_ball_constales']}). In the right panel, the arbitrary cover image case lies below the centred gray image case by at most $cwh$ bits i.e., at most one bit per pixel (1 bpp). The discontinuity between \ref{['bnd:anyim_psnr_ball_in_cube_vol_approx', 'bnd:anyim_psnr_ball_in_cube_counting']} is due to the volume approximation undercounting the integer points on the faces of the cube.
  • Figure 5: Robustness constraints considered in this paper. The figure illustrates the linear transformations we evaluate: Horizontal Flip, Crop&Rescale, Rotation and Linearlized JPEG compression. We show them both at full resolution and at ${16}{\times}{16}\text{px}$ at which we compute the bounds in \ref{['sec:gray_psnr_augmentations']}.
  • ...and 9 more figures

Theorems & Definitions (2)

  • Theorem 1: Volume of the intersection of a cube and a ball
  • Theorem 2