Spread them Apart: Towards Robust Watermarking of Generated Content

Thank you for your valuable feedback. In our response below, we address the weaknesses you indicate and answer your questions. 

W1.

Thank you for the careful reading. We have fixed several typos in the updated manuscript and clarified our notations, where needed.

W2.

The paper you mention is very relevant to our work. However, the method described is more about computing the fingerprint of the particular image (namely, when the image is ready, one can compute the fingerprint, making it infeasible, for example, for the attribution problem); in contrast, in our method, an optimization is performed to obtain an image with the predefined watermark.

W3 and Q2.

In the manuscript, we consider two types of ambiguity attacks: (i) unintentional ones, occurring because of the large number of users in the database, and (ii) adversarial ones, where an attacker aims to erase an embedded watermark.

We report the robustness to attack of the first type by depicting TPR in the attribution problem (please see Table below).

Table: TPR given different values of m of number of users in the database.

The robustness to the second type of attacks is demonstrated by the evaluation of TPR against PGD attack, aimed at erasing the watermark. Please see one in the Tables (3-4) in the manuscript.

Please note that to perform a watermark overwriting attack, an attacker has to have a white-box access to the generation and watermarking pipeline; in our work, we do not consider such access.

W4.

Following your suggestion, we have added more relevant work for the comparison (please see tables 2-3-4 in the main text and table 9 in the appendix).

Q1.

It is noteworthy that slight modifications to our approach can be made to provide robustness to rotations and translations. Namely, one can embed watermarks in the invariants in the Fourier space (see Theorem 6 for rotations and Theorem 3 for translations from [1]). 

When the watermarks are embedded, due to invariance from above, they are guaranteed to retain when the corresponding transformation is applied. We present the results in the updated version of the appendix. And report them here, in Table 1. Note that the invariance to rotations in general can not be guaranteed in practice due to interpolation errors.

Table 1. TPRs under geometric transformations, JPEG, cropping and erasing, detection problem. We fix FPR = 10^-6

We evaluate our method against cropping and image erasing when the watermark is embedded in the invariant to translations (Theorem 3 from [1]).

References:

[1] Lin, Feng, and Robert D. Brandt. "Towards absolute invariants of images under translation, rotation, and dilation." Pattern Recognition Letters 14.5 (1993): 369-379.

Thank you for your valuable feedback. In our response below, we address the weaknesses you indicate and answer your questions. 

W1.

We have added the ablation study on the hyperparameters you proposed, namely, watermark length, epsilon, and loss weights. In terms of the trade-off between attack resilience and perceptual quality of the generated images (Table 1-2 here), we see that the default parameters are close to the optimal ones. We report the results of the ablation study in the appendix, Section A.1.3.

Table 1. Ablation study: the effect of the parameter values on the robustness of the watermark. We report an average bit-wise error and study the robustness to JPEG, Hue, Saturation, Sharpness and Gaussian noise, since our approach provide robustness to brightness, contrast and gamma shifts by design. In the "Parameter" column, we report the varying parameter; the other parameters are set to default values (n=50, eps=0.2, \lambda_wm=0.9, \lambda_qual=150)

Table 2. Ablation study: the effect of the parameter values on the image quality. We report the values of SSIM, PSNR, LPIPS image quality metrics.

W2.

Indeed, our approach is not limited to the diffusion models and, in principle, can be applied to any decoder-based model. We have chosen to stick to DM, since the quality of images generated by the diffusion models significantly surpasses that of VAE and GANs. Therefore, there is a much greater interest in their protection and safe deployment.

W3.

Following your suggestion, we have included more baselines to compare our approach against (Please see Tables 2-3-4 in the main text and Table 9 in the Appendix).

W4.

Please find the comparison with the other approaches in terms of time required to embed a watermark in the Table 3 below.

Table 3: Average time in seconds required to embed a watermark.

Q1.

Thank you for the idea on the possible enhancement of our method. The paper that you have shared with us inserts a watermark during the sampling process, therefore we cannot benefit from this idea straightforwardly. Regarding the block-wise watermark insertion in our setting per se, likely the perceptual image quality will degrade, because more pixels will be involved in the watermark insertion, leaving artifacts in an image. In such a case, more restrictions on pixel values should be added, and it needs further research and pondering.

References:

[1] Lin, Feng, and Robert D. Brandt. "Towards absolute invariants of images under translation, rotation, and dilation." Pattern Recognition Letters 14.5 (1993): 369-379.

I appreciate authors for their efforts in this work. After reconsideration, I can’t raise my score. Table 1 in the paper indicates that the image consistency of the proposed method is worse than others in most metrics. Table 5 indicates that the time required in the watermark embedding is high. Also, the authors’ reply to W2 indicates that their understanding of diffusion model is limited. Owing to these factors, I will keep my score.

Here are some suggestions for authors. Your method can embed high-capacity watermarks. It would be better to demonstrate them in the experiment. Also, your method is training-free, which should also be emphasized. I guess there is a trade-off between the image quality and the watermark capacity, so make sure you achieve the balance. And finally please use different color texts for the revision, which makes it more clear for reviewers to know the difference you made with respect to the previous version.

Also, I can’t understand why in many tables you use a horizontal line where there’s supposed to be a number, for example the SSIM and PSNR for WOUAF, and the Hue, Saturation for AquaLora. Can the authors explain?

Thank you for your valuable feedback. In our response below, we address the weaknesses you indicate, answer your questions and provide results of additional experiments, where requested.  

W1.

We agree that our method does not provide robustness to post-generation attacks as is. However, slight modifications to our approach can be made to provide robustness to rotations and translations. Namely, one can embed watermarks in the invariants in the Fourier space (see Theorem 6 for rotations and Theorem 3 for translations from [1]). 

When the watermarks are embedded, due to invariance from above, they are guaranteed to retain when the corresponding transformation is applied. We present the results in the updated version of the appendix. And report them here, in Table 1. Note that the invariance to rotations in general can not be guaranteed in practice due to interpolation errors.

Table 1. TPRs under geometric transformations, JPEG, cropping and erasing, detection problem. We fix FPR = 10<sup>-6

We evaluate our method against cropping and image erasing when the watermark is embedded in the invariant to translations (Theorem 3 from [1]).

W2.

Please see the results in Table 2 below.

Table 2: Average time in seconds required to embed a watermark.

It is noteworthy that our method allows to extract the watermark in less than 1 second when the number of users is 100000.

W3.

Please note that the quality metrics like PSNR were reported in the original manuscript. (Table 1). In the updated version, we add the comparison with other baselines in terms of the computation cost.

References:

[1] Lin, Feng, and Robert D. Brandt. "Towards absolute invariants of images under translation, rotation, and dilation." Pattern Recognition Letters 14.5 (1993): 369-379.

Thank you for your valuable feedback. In our response below, we address the weaknesses you indicate, answer your questions and provide results of additional experiments, where requested.  

W1 and W2. 

We agree that our method does not provide robustness to rotations, translations, and cropping as is. However, slight modifications to our approach can be made to provide robustness to rotations and translations. Namely, one can embed watermarks in the invariants in the Fourier space (see Theorem 6 for rotations and Theorem 3 for translations from [1]). 

When the watermarks are embedded, due to invariance from above, they are guaranteed to retain when the corresponding transformation is applied. We present the results in the updated version of the appendix. And report them here, in Table 1. Note that the invariance to rotations in general can not be guaranteed in practice due to interpolation errors.

Table 1. TPRs under geometric transformations, JPEG, cropping and erasing, detection problem. We fix FPR = 10^-6

We evaluate our method against cropping and image erasing when the watermark is embedded in the invariant to translations (Theorem 3 from [1]).

W3.

Regarding the scalability of the approach: we have evaluated the time cost required to extract the watermark and compare it to the public keys of the users in the database. Please see the results in Table 2 below.

Table 2: Average time in seconds required to extract a watermark, depending on the number m of users.

It is noteworthy that our method allows to extract the watermark in less than 1 second when the number of users is 100000.

Q1.

Following your suggestion, we have added examples of corrupted images in the manuscript (please see the appendix, Fig 6)

Q2.

Following you suggestion, we have added explanation for the transform "Contrast -" in the manuscript (specifically, we indicated how it differs from "Contrast +").

References:

[1] Lin, Feng, and Robert D. Brandt. "Towards absolute invariants of images under translation, rotation, and dilation." Pattern Recognition Letters 14.5 (1993): 369-379.

Thank you for your valuable feedback. In our response below, we address the weaknesses you indicate and answer your questions. 

W1 and Q2. 

Indeed, our method does not provide robustness to rotations, translations, and cropping. However, slight modifications to our approach can be made to provide robustness to rotations and translations. Namely, one can embed watermarks in the invariants in the Fourier space (see Theorem 6 for rotations and Theorem 3 for translations from [1]). 

When the watermarks are embedded, due to invariance from above, they are guaranteed to retain when the corresponding transformation is applied. We present the results in the updated version of the appendix. Note that the invariance to rotations in general can not be guaranteed in practice due to interpolation errors.

Table 1. TPRs under geometric transformations, JPEG, cropping and erasing, detection problem. We fix FPR = 10^-6

We evaluate our method against cropping and image erasing when the watermark is embedded in the invariant to translations (Theorem 3 from [1]).

W2  and Q1.

Please find the comparison with the other approaches in terms of time required to embed a watermark in the Table 2 below. 

Table 2: Average time in seconds required to embed a watermark.

Q3.

Among image editing attacks, we consider image erasing (please see the results in Table 1 here and in Table 9 in the appendix).

References:

[1] Lin, Feng, and Robert D. Brandt. "Towards absolute invariants of images under translation, rotation, and dilation." Pattern Recognition Letters 14.5 (1993): 369-379.

Thanks for addressing my concerns and I appreciate your effort in conducting additional experiments. I want to keep my rating. Here are two more suggestions: 1) You have mentioned that the proposed method embeds 100 bits long watermarks, while the competitors (Stable Sign., AquaLoRA, WOUAF) embed much shorter (at most 48 bits) watermarks in your experiments. I think this information about the embedding capacity (which is an advantage of your method) should also appear in the table. 2) Your method does not need additional training of generative model, while the competitors (Stable Sign., AquaLoRA, WOUAF) do, which I think is another important piece of information that should appear in your table.