Robust Image Self-Recovery against Tampering using Watermark Generation with Pixel Shuffling

TL;DR

The paper tackles the challenge of authenticating and recovering tampered images in the era of AI-generated content. It introduces ReImage, a neural watermarking framework that embeds a shuffled version of the original image as a watermark using an invertible neural network, complemented by a Watermark Generator, Image Enhancement, and Tamper Localization modules. The approach yields high-fidelity recovered content and accurate tamper localization across diverse attacks, outperforming prior self-recovery methods and showing robustness to common degradations. By enabling end-to-end self-recovery with attack-agnostic resilience, ReImage offers a practical pathway to trustworthy digital media and attacker-intent understanding, with code and models to be released.

Abstract

The rapid growth of Artificial Intelligence-Generated Content (AIGC) raises concerns about the authenticity of digital media. In this context, image self-recovery, reconstructing original content from its manipulated version, offers a practical solution for understanding the attacker's intent and restoring trustworthy data. However, existing methods often fail to accurately recover tampered regions, falling short of the primary goal of self-recovery. To address this challenge, we propose ReImage, a neural watermarking-based self-recovery framework that embeds a shuffled version of the target image into itself as a watermark. We design a generator that produces watermarks optimized for neural watermarking and introduce an image enhancement module to refine the recovered image. We further analyze and resolve key limitations of shuffled watermarking, enabling its effective use in self-recovery. We demonstrate that ReImage achieves state-of-the-art performance across diverse tampering scenarios, consistently producing high-quality recovered images. The code and pretrained models will be released upon publication.

Figures (12)

• Figure 1: Overall architecture of the proposed methods. In our framework, given a target image $I_\mathrm{org}$, module (a) generates a secret image $I_\mathrm{sec}$ optimized for watermarking. The image is shuffled to obtain $\mathcal{S}(I_\mathrm{sec})$, which is then embedded into the cover image $I_\mathrm{cov}$—identical to $I_\mathrm{org}$—via module (b), yielding the container image $I_\mathrm{con}$. An attacker may generate a tampered image using an AI tool, resulting in the attacked image $I_\mathrm{att}$. During image self-recovery, Noise Estimator predicts the discarded noise component $\hat{I}_\mathrm{noise}$, which is used in module (c) to recover the shuffled secret image $\mathcal{S}(\hat{I}_\mathrm{sec})$ from $I_\mathrm{att}$. This image is then unshuffled to obtain $\hat{I}_\mathrm{sec}$ and passed through module (d) to reconstruct the target image $\hat{I}_\mathrm{org}$. Module (e) refines $\hat{I}_\mathrm{org}$ using contextual information, producing an enhanced recovered image $\hat{I}_\mathrm{enh}$. Finally, module (f) locates tampered regions and restores them using corresponding untampered areas from $I_\mathrm{att}$, yielding $\hat{I}_\mathrm{rec}$.
• Figure 2: Effects of Pixel Shuffling.(a) Visualization of pixel-shuffled images with different grid configurations, defining how the image is divided into equally sized patches: finer grids introduce higher variance between neighboring pixels, indicating increased high-frequency content. (b) Magnitude spectra of the images in (a), obtained via FFT: a brighter center indicates dominant low-frequency content, suggesting a smoother image. As the patch size decreases, spectral energy spreads outward, indicating an increase in high-frequency components. (c) PSNR of container and recovered images under varying the grid configurations: both degrade significantly as the grid becomes finer, due to the increased high-frequency component.
• Figure 3: Qualitative Comparison across Component Configurations. We qualitatively analyze the visual impact of each core component. The settings (a) to (d) correspond to those in \ref{['tab:effect_of_Generator']}. Tampering is simulated using SD Inpaint, and the red box indicates the region that is magnified for closer inspection. As components are progressively added, the recovery of tampered regions improves. While settings (a), (b), and (c), which exclude the WG, exhibit visible artifacts in the container image, setting (d) produces a cleaner result that closely resembles the ground truth.
• Figure 4: Qualitative Results of Different Self-Recovery Methods. Visual tampering is simulated as outlined in \ref{['tab:baseline']}. We compare our method with Imuge, Imuge+, and W-RAE†, showing that our approach yields clearer and more complete restorations.
• Figure 5: Masking Strategy (a) Irregular masking is implemented using random brush strokes and (b) box-shaped masking produces rectangular masked regions.