Logo
ScienceStack
Table of Contents
Fetching ...
Sign In

NiMark: A Non-intrusive Watermarking Framework against Screen-shooting Attacks

Yufeng Wu, Xin Liao, Baowei Wang, Han Fang, Xiaoshuai Wu, Guiling Wang

TL;DR

NiMark tackles the risk of data leakage via screen-shooting by introducing a non-intrusive, end-to-end deep learning framework that preserves visual fidelity while achieving strong robustness. Its key innovations are the Sigmoid-Gated XOR (SG-XOR) estimator, which enforces image-watermark binding and prevents trivial identity mappings, and a two-stage training strategy that decouples logic construction from restoration to bridge the screen-shooting noise domain. Empirical results show NiMark outperforms state-of-the-art non-intrusive and screen-shooting resilient methods across digital and physical attacks, with zero visual distortion and robust cross-device generalization. The work advances practical data protection by enabling rigid binding and noise-robust watermark verification in real-world capture scenarios.

Abstract

Unauthorized screen-shooting poses a critical data leakage risk. Resisting screen-shooting attacks typically requires high-strength watermark embedding, inevitably degrading the cover image. To resolve the robustness-fidelity conflict, non-intrusive watermarking has emerged as a solution by constructing logical verification keys without altering the original content. However, existing non-intrusive schemes lack the capacity to withstand screen-shooting noise. While deep learning offers a potential remedy, we observe that directly applying it leads to a previously underexplored failure mode, the Structural Shortcut: networks tend to learn trivial identity mappings and neglect the image-watermark binding. Furthermore, even when logical binding is enforced, standard training strategies cannot fully bridge the noise gap, yielding suboptimal robustness against physical distortions. In this paper, we propose NiMark, an end-to-end framework addressing these challenges. First, to eliminate the structural shortcut, we introduce the Sigmoid-Gated XOR (SG-XOR) estimator to enable gradient propagation for the logical operation, effectively enforcing rigid image-watermark binding. Second, to overcome the robustness bottleneck, we devise a two-stage training strategy integrating a restorer to bridge the domain gap caused by screen-shooting noise. Experiments demonstrate that NiMark consistently outperforms representative state-of-the-art methods against both digital attacks and screen-shooting noise, while maintaining zero visual distortion.

NiMark: A Non-intrusive Watermarking Framework against Screen-shooting Attacks

TL;DR

NiMark tackles the risk of data leakage via screen-shooting by introducing a non-intrusive, end-to-end deep learning framework that preserves visual fidelity while achieving strong robustness. Its key innovations are the Sigmoid-Gated XOR (SG-XOR) estimator, which enforces image-watermark binding and prevents trivial identity mappings, and a two-stage training strategy that decouples logic construction from restoration to bridge the screen-shooting noise domain. Empirical results show NiMark outperforms state-of-the-art non-intrusive and screen-shooting resilient methods across digital and physical attacks, with zero visual distortion and robust cross-device generalization. The work advances practical data protection by enabling rigid binding and noise-robust watermark verification in real-world capture scenarios.

Abstract

Unauthorized screen-shooting poses a critical data leakage risk. Resisting screen-shooting attacks typically requires high-strength watermark embedding, inevitably degrading the cover image. To resolve the robustness-fidelity conflict, non-intrusive watermarking has emerged as a solution by constructing logical verification keys without altering the original content. However, existing non-intrusive schemes lack the capacity to withstand screen-shooting noise. While deep learning offers a potential remedy, we observe that directly applying it leads to a previously underexplored failure mode, the Structural Shortcut: networks tend to learn trivial identity mappings and neglect the image-watermark binding. Furthermore, even when logical binding is enforced, standard training strategies cannot fully bridge the noise gap, yielding suboptimal robustness against physical distortions. In this paper, we propose NiMark, an end-to-end framework addressing these challenges. First, to eliminate the structural shortcut, we introduce the Sigmoid-Gated XOR (SG-XOR) estimator to enable gradient propagation for the logical operation, effectively enforcing rigid image-watermark binding. Second, to overcome the robustness bottleneck, we devise a two-stage training strategy integrating a restorer to bridge the domain gap caused by screen-shooting noise. Experiments demonstrate that NiMark consistently outperforms representative state-of-the-art methods against both digital attacks and screen-shooting noise, while maintaining zero visual distortion.
Paper Structure (29 sections, 13 equations, 4 figures, 5 tables)

This paper contains 29 sections, 13 equations, 4 figures, 5 tables.

Table of Contents

  1. Introduction
  2. Related Work
  3. Embedding-based Robust Watermarking
  4. Non-Intrusive Watermarking and Shortcut Learning
  5. Methodology
  6. Network Architecture
  7. Encoder
  8. Noise Layer
  9. Restorer
  10. Decoder
  11. Sigmoid-Gated XOR Estimator
  12. Binarization Approximation
  13. Continuous XOR Approximation
  14. Gradient Computation
  15. Two-Stage Training Strategy
  16. ...and 14 more sections

Figures (4)

  • Figure 1: Comparison of different watermarking frameworks against screen-shooting attacks. (a) Embedding-based Watermarking: Although robust against screen-shooting, it inevitably degrades the cover image quality by explicitly modifying pixel values. (b) Traditional Non-intrusive Watermarking: While preserving the original image, it fails to resist the severe distortions caused by screen-shooting due to the limited robustness of hand-crafted features. (c) Proposed NiMark: By harnessing the powerful capability of deep learning, our framework achieves strong robustness against screen-shooting attacks within a non-intrusive architecture, guaranteeing zero visual distortion.
  • Figure 2: Overview of the proposed NiMark framework. The top panel illustrates the detailed network architecture which includes the Encoder integrated with SG-XOR, the Noise Layer, the Restorer, and the Decoder. The bottom panels demonstrate the proposed two-stage training strategy. Stage 1 constructs the logical dependency in a noise-free environment. Stage 2 independently optimizes the restoration network to handle screen-shooting distortions.
  • Figure 3: Visualization of the discrete XOR operation and its various differentiable proxies for gradient estimation. (a) The true, non-differentiable surface of the compound operation $W = \text{round}(X_1) \oplus \text{round}(X_2)$, which defines the discrete target behavior and causes gradient cliffs that prevent standard backpropagation. (b) The standard linear STE proxy, demonstrating a crude and misaligned gradient approximation. (c) The proposed SG-XOR proxy, providing a smooth, differentiable manifold that aligns well with the discrete XOR logic while maintaining differentiability. (d) Direct comparison among the SG-XOR proxy (green), STE proxy (yellow), and target discrete function (blue), showing the superior consistency of our approach.
  • Figure 4: Mechanism of the proposed SG-XOR Estimator. The Forward Pass (top) performs the strict discrete operation $W = \text{round}(X_1) \oplus \text{round}(X_2)$, where gradients are naturally blocked by the hard binarization. The Backward Pass (bottom) utilizes our proposed differentiable proxy to estimate gradients. The upstream gradient is modulated by two distinct components: the Logic Gradient which enforces the XOR truth table and the Sigmoid Gating Gradient which stabilizes training near the decision boundaries.