NOWA: Null-space Optical Watermark for Invisible Capture Fingerprinting and Tamper Localization

TL;DR

This work addresses digital image authenticity and tamper localization by coupling a physical optical watermark with a learning‑based reconstruction. A custom phase mask embeds a zero‑information NOWA in the null space of the imaging operator, preserved by a measurement‑consistent NSN during reconstruction and detected by a null‑space‑based tamper detector. The approach yields pixel‑level localization, remains robust to common degradations and AI‑driven edits, and is validated through simulations and a real hardware prototype. By tying authentication to the capture hardware, NOWA offers a fundamental security asymmetry that digital methods alone cannot achieve, with practical implications for protecting image integrity in media and surveillance contexts.

Abstract

Ensuring the authenticity and ownership of digital images is increasingly challenging as modern editing tools enable highly realistic forgeries. Existing image protection systems mainly rely on digital watermarking, which is susceptible to sophisticated digital attacks. To address this limitation, we propose a hybrid optical-digital framework that incorporates physical authentication cues during image formation and preserves them through a learned reconstruction process. At the optical level, a phase mask in the camera aperture produces a Null-space Optical Watermark (NOWA) that lies in the Null Space of the imaging operator and therefore remains invisible in the captured image. Then, a Null-Space Network (NSN) performs measurement-consistent reconstruction that delivers high-quality protected images while preserving the NOWA signature. The proposed design enables tamper localization by projecting the image onto the camera's null space and detecting pixel-level inconsistencies. Our design preserves perceptual quality, resists common degradations such as compression, and establishes a structural security asymmetry: without access to the optical or NSN parameters, adversaries cannot forge the NOWA signature. Experiments with simulations and a prototype camera demonstrate competitive performance in terms of image quality preservation, and tamper localization accuracy compared to state-of-the-art digital watermarking and learning-based authentication methods.

Figures (9)

• Figure 1: A hybrid physical-digital pipeline for fragile authentication. (a) Optical-digital fingerprint: A phase mask (PM) in the camera aperture optically encodes the scene, embedding a unique physical signature before digitization. A neural network $f_\theta$ reconstructs high-quality protected images by recovering the information hidden in the camera’s null space $\mathcal{N}$. (b) Image verification: The tested image is projected onto $\mathcal{N}$ to obtain a signature map revealing the embedded optical fingerprint. A detector $d_\psi$ analyzes this map to detect and localize tampering, by distinguishing predictable system noise from adversarial errors, confirming integrity at the pixel level.
• Figure 2: Qualitative comparison between the proposed method and state-of-the-art approaches. Our method produces more precise localization of manipulated regions and better preserves structural details compared to existing techniques.
• Figure 3: Qualitative ablation of detector input. Comparison of detected tamper when input to $d_\psi$ is the image or the null space. Using the image domain shows scattered false positives, while detector output on the null-space projection $\Pi_{\mathcal{N}}(\mathbf{x}_p)$ domain, producing precise tamper localization.
• Figure 4: Robustness of the proposed system against generative and analytical adversaries. For each attack, we show the protected image produced by our system ($f_{\theta}$ output) alongside its corresponding Null-Space projection. Although counterfeit images closely replicate the visual appearance, they fail to reproduce the underlying null-space signature, enabling reliable detection and rejection by our method.
• Figure 5: Tamper localization from real captures. Each column shows (top) the protected image with the target edit region outlined in green, and (bottom) the tampered image with the estimated manipulation mask overlaid in translucent red. Edits were manually made using Photoshop tools. The IoU scores below each example indicate strong localization accuracy and robust detection of real digital edits, as supported by the visual results.