Watermark Anything With Localized Messages

We thank the reviewer for their valuable feedback and time spent on our paper. We try to answer everything and remain available for further discussion.

1. I am unclear on how the model achieves multiple watermark encodings. If I understand correctly, according to Figure 2, the model does not accept a mask input during the inference stage. In that case, how does it inject different messages into different regions? This makes Figure 1 somewhat misleading, as the first two steps suggest that the message can be precisely controlled to be encoded into specific objects. Could the authors provide further clarification on this point?

• This process is detailed in Section 5.5: "This is done by feeding the image several times to WAM’s embedder, then pasting the different watermarked areas onto the original image." So yes indeed the model does not accept a mask input during the inference stage. We will clarify this point in the paper.
• In practice, we can thus embed multiple watermarks in the same image, and watermark only one object. However, the user might not deliberately place several watermarks, but only a single one on its whole image . Due to modifications, splicing, or inpainting, the image can end up with multiple watermarked regions, or one watermarked region and the rest not watermarked: this is more the motivation of the paper.

2. Could you clarify how the mask for the watermark's position is inputted into WAM in Figure 7 of the Appendix? Additionally, could you explain why this specific position was chosen for the localization experiment?

• Please refer to Section 5 where this is explained. The answer is similar to that of question 1: We watermark the entire image and then consider the splice between the original and watermarked images, retaining only the wm pixels whose positions are determined by the mask. This approach is similar to what is used in training and is depicted in Figure 2, with the corresponding equation in the augmentation paragraph of Section 4.2. We will clarify this in the paper.
• Regarding the specifics of the mask, this is described in Section 5.4. We use centered watermarked rectangles of various sizes within the images to ensure a well-controlled experiment. This ensures that after the upper left crop, the same proportion of the resulting image remains watermarked. However, WAM can detect watermark areas of any shape (Figure 6 in the appendix shows the masks used in training, and WAM achieves an average mIoU of 95%).

3. In lines 226-232, if I am not mistaken, this method appears to be identical to the method proposed by Bui et al., rather than merely 'a similar approach'. Please provide proper credit.

• We do not cite the scaling as a contribution and will ensure this is more clearly highlighted in the paper.
• However on a side note, the method by Bui et al. is not exactly the same, as they predict the watermarked image and then rescale, whereas we predict a distortion that is rescaled.

4. Regarding the claim in lines 304-305, it is unclear why applying JND would make training easier compared to using perceptual loss. Could the authors provide evidence or reasoning to support this claim? 'Applying JND only in the second training phase makes training easier than previous methods relying on “perceptual” or “contradictory” losses.'

• We do not claim that using JND is universally superior, but in our experiments, it proved easier to fine-tune with JND than with perceptual losses. Specifically, LPIPS did not perform visually as well (i.e. more visible) at a fixed PSNR compared to JND.
• The rationale is that our 1M parameter embedder benefits from having the visual system provided via JND, eliminating the need for the relatively small network to learn it by itself and focus and message transmission. This simplifies training by reducing constraints.

5. I believe the reason WAM outperforms the baselines in terms of bit accuracy for splicing is simply because WAM incorporates splicing during training, whereas the other models do not. If the other models were to apply splicing as an augmentation or attack during training, would WAM still outperform them in terms of bit accuracy?

• Our embedder does not have a unique feature specifically for splicing; we agree that robustness to splicing comes from incorporating masks during training. We consider training with randomly generated masks a novel contribution of WAM.
• The reviewer suggests that using the same training pipeline with masks, but without pixel-level detection, could still achieve robustness to splicing. We agree. However this is not done by others and it would be less informative, as it wouldn't identify which parts of the image are watermarked.
• Note that WAM's pixel-level detection also enhances robustness against inpainting (as demonstrated in Table 2). Figure 10 in the appendix further illustrates the benefit of identifying inpainted pixels.

We thank the reviewer for their response.

Does the embedder encode the entire image in every forward? If so, then the user needs to manually copy the desired watermarked region from this single forward according to a mask. This process will repeat n times, where n is equal to the number of objects or regions that the user wants to add watermarks. Is there anything wrong with my understanding?

• Your understanding is correct. The embedder encodes the entire image in each forward pass, and the user then uses a mask to replace the original part of the image by its watermarked version (see equation in line 247). This process is repeated for each object or region the user wishes to watermark. Note that a segmentation model can be employed to create the mask for the specific object or region.
• We would like to emphasize that our primary motivation for WAM is watermark an entire image, which may then undergo various transformations such as inpainting or background changes. This can result in only a portion of the image retaining the watermark (or several watermarks in the same image). While it is indeed possible to deliberately watermark different objects within the same image, this is a secondary consideration. We will make sure to clarify this aspect.

About multiple watermarks:

1. It is indeed beneficial against splicing, but the methods trained with crop/cropout/dropout noise layers are also robust to splice already. I am still not sure why it is necessary for multiple separate messages?

• If a GenAI provider applies a unique watermark message for each user, and the images are later spliced, there will be different messages embedded in different parts of the resulting image. WAM can successfully extract each distinct message. In contrast, methods that extract only a single message would inevitably fail in this scenario, even if they are trained with crop/cropout/dropout noise layers as suggested by the reviewer as they decode a single message per image, they will not be able to extract several messages.

2. For active object detection, could authors provide a practical scenario/example that this function is useful/important?

• A practical scenario where active object detection is useful is in tracking the usage of specific objects across different posts (see [1]), such as in memes or other derivative works . By embedding a watermark in an object within an image, you can monitor how that object is reused elsewhere. This is particularly valuable for copy detection, as it allows you to identify and trace the spread of the object across various contexts. Additionally, a watermarked object can deliberately serve as a visual hashtag, making it easily detectable by the extractor and facilitating the organization and retrieval of content related to that object.

3. Could the authors clarify more in detail how separate messages can help identify and track multiple watermarked AI tools within a single image?

• For instance, if you own a tool that can modify images in various ways, you can add a unique watermark message to each modification. This means that if one user changes someone's hair color using your tool, the modified hair color can be watermarked with a specific message (e.g., user ID or type of transformation ID). Later, if another user changes the background of the same image using a different feature of your tool, the new background can be watermarked with a distinct message. So by embedding these separate messages, it becomes possible to track the history of modifications made to the image.

Overall, we think that it is just a more versatile way of seeing image watermarking: it also keeps all the natural properties of other models. We remain open to further clarifications.

[1] Vishal Asnani, Abhinav Kumar, Suya You, and Xiaoming Liu. Probed: proactive object detection wrapper. Advances in Neural Information Processing Systems, 36, 2024.

Weakness 1: Insufficient innovation, little change in the existing image watermarking framework, no analysis for specific modules, still using the traditional training architecture, just increase the template after random clipping, to achieve the application of the scene changes.

• WAM is the first work to approach watermarking as a segmentation task, which significantly differs from traditional architectures. It offers three additional functionalities: localization, the ability to hide multiple 32-bit messages, and detection separate from decoding.
• We are unclear about the reviewer's comment, "just increase the template after random clipping, to achieve the application of the scene changes." Could the reviewer please clarify?
• If the suggestion is to simply add masks as augmentation without performing segmentation/detection, we acknowledge that this might result in a model robust to splicing. However, it would not allow us to identify which parts of the image are watermarked after modifications, which is WAM's primary motivation. Additionally, it would not support embedding multiple watermarks, which is another key innovation of our approach. Moreover, an innovation in WAM is specifically this training with random masks.

Weakness 2: Many existing work has been involved in local image watermarking, known as multi-source image watermarking [1]. The arbitrary image watermarking framework proposed in this paper does not require prior knowledge and can be protected against any image. But only the major part of the image in a real scene has a role to play and there is no need to add watermarking information for any pixel.

• The statement that "the major part of the image in a real scene has a role to play and there is no need to add watermarking information for any pixel" is subjective and open to discussion. It's important to note that a user might not intentionally choose to watermark only the background. In scenarios where the entire image is watermarked but only the background remains after inpainting the foreground by someone else, WAM can segment and identify the watermarked areas (see Table 2 and Figure 10 in the appendix). Simply providing a yes or no answer for the entire image would be insufficient.

1 The paper compares EditGuard's work, but does not compare the work that is very similar to this paper [1], please explain the difference between the two;

• Thank you for highlighting the reference to MuST [1], we will cite it. Unlike MuST, which decodes different parts of the image independently, WAM uses a single extractor that automatically performs segmentation. This allows for a watermarked background, which is specifically why we opted to predict masks rather than boxes, because it offers greater versatility
• Unfortunately, MuST's weights are not available, and their GitHub repository does not provide instructions for reproducing the model (as noted in issues raised by others), so we cannot offer a direct comparison.
• But considering the results presented in the paper, MuST is tailored for specific applications and struggles with scenarios like a 10% crop, where it results in random bit accuracy. MuST loses robustness even at an 80% crop.

2. How to guarantee the imperceptibility of the framework, and did not see the loss module in the mature watermarking framework, such as the MSE loss between the embedded image x_m and x, the loss of discriminative networks, etc. This is detailed in Section 4.3 and illustrated in Figure 3.

• We do not use perceptual losses (e.g., LPIPS or MSE) or a discriminator, as these can introduce instability due to conflicting signals. Instead, WAM's training is divided into two phases:

First Phase: Training is conducted without any perceptual loss/constraint, using only the tanh function to upper bound the watermark distortion:

We continue training until achieving good detection and decoding accuracy, which serves as an initialization for the second phase.

Second Phase: Training proceeds similarly (using the same augmentations/masks for robustness/detection), but now the distortion is modulated by the Just Noticeable Difference (JND):

We do not state that it is optimal, but experimentally it eases things as the small embedder does not have to learn the visual system.

We thank the reviewer for their valuable feedback and time spent on our paper.

1. Although the authors discuss different model architectures, the overall parameter size remains significantly larger compared to prior models such as HiDDeN (454.4K), FIN (737.8K) [2], and CIN (36.01M) [3]. While the authors highlight that their encoder (1.1M parameters) is relatively compact, it is still substantially larger compared to earlier models like HiDDeN (188.93K) and FIN (747.80K). This large parameter size may limit the method's applicability in resource-constrained environments.

• We agree that smaller models enhance applicability for memory-constrained envs, but a larger parameter size does not necessarily equate to slower performance. Our method consistently embeds or detects the watermark at a low resolution (256x256). This downscaling and subsequent upscaling approach, not used in HiDDeN, MBRS, or SSL, ensures that WAM operates with a constant computational requirement regardless of image size.
• Our watermark embedder indeed consists of 1M parameters, which is larger than HiDDeN. However, this increase in size does not inherently lead to slower performance. Below is a comparison of the WAM embedder's speed to HiDDeN's in seconds on a 32GB V100 GPU (with 16 CPUs, Intel(R) Xeon(R) Gold 6230 CPU @ 2.10GHz):

We appreciate the reviewer highlighting this point and will include a discussion in the paper. Additionally, as mentioned in the general comment, we will add an ablation study on using smaller embedders or extractors.

2. The comparative experiments are not comprehensive. The authors do not consider more advanced watermarking models, such as MBRS, FIN, and CIN, which significantly outperform HiDDeN.

• We chose to compare the methods present in the paper because they constitute a solid baseline. Our goal was not to demonstrate that WAM is more robust than all methods in every setting, but rather to show that it performs well for classical watermarking while introducing new capabilities.

• We argue that MBRS, FIN, and CIN are not robust to crops, indicating a different operating point. Our focus is on decoding the image even from small watermarked areas.

We have added comparisons to CIN and MBRS*. Specifically:

• MBRS has a 256-bit payload. Like other methods, we encode 16 bits for detection and 32 bits for decoding. We encode this 16+32 = 48-bit message 5 times, occupying 240 bits. At decoding time, we average the outputs of the decoder every 48 bits (soft majority vote) and output the decoded 48-bit message.

• CIN, on the other hand, only handles 30 bits. We show the bit accuracy for the first 30 bits of the message for CIN and do not perform detection (a favorable setup for CIN).

• For both methods, we scale the distortion to achieve a similar PSNR as all models (see Table 1). We present the bit accuracy on the validation set of COCO, using the exact same setup as in Table 2:

• We observe that both methods do not handle any geometric transformations (they actually only manage crop and then padding, not crop and resize, which is not a realistic setup). This is due to their different operating points, which place more emphasis on robustness against value metric transformations.

3. It would be helpful for the authors to provide a relationship graph between the extractor’s parameter size and performance, to justify the necessity of the large parameter size for detection and decoding tasks.

• Our preliminary ablations indicated that a larger extractor is necessary to enhance pixel-level detection and decoding. We agree that including an ablation study on this topic could be valuable, as smaller models might benefit the community even if they perform slightly worse. As mentioned in the general comment, we have launched the training and will include the results in the paper.

Overall, I am optimistic about the paper's method and the problem it addresses. […]. My final score will depend on the authors' rebuttal.

• We thank the reviewer for the positive feedback and are glad to hear of your interest. We remain open for discussion during the rebuttal session.

*we had to revise the table in the comment because of a typo

We thank the reviewer for their prompt answer

Regarding 1)

• 22 Giga flops for HiDDeN VS 42 Giga Flops for our VAE embedder when evaluating both on 256x256 images. We reported speed because it was asked by reviewer n1mi. We agree that both are important metrics; flops will be added in the table.
• We agree about the parameter counts, which would be in favor of HiDDeN. But we would argue that a 1.1M parameter is still doable in most scenarios. For instance, with int8 quantization, it would fit in 1MB. (Note that this is less the case for the extractor, but this is less of an issue since most of the time detection is done on the server side.)

Regarding 2)

• We use the public models available, that don't have different capacities. We did not have time to retrain models from scratch for the rebuttal. For MBRS, we chose the model that was at the same resolution (256x256), and for CIN, we chose the only one that was available.
• For the noise layers, these models don't use any augmentations that change the geometry of the image (the crop they use is not a crop, but a black mask pasted on top of part of the image - see https://github.com/rmpku/CIN/blob/main/codes/models/modules/Noise_option/crop.py), which may explain the performance they show. For our evaluations, we use geometric augmentations as defined by the torchvision library (for instance, the crop we evaluate on is a "true" crop). We agree that its not apple to apple comparaison, but we believe that our transformations are more realistic to evaluate robustness against real-world application. Moreover, in our experience, as soon as you add crops/perspective or any geometric changes, training is much harder. We could ask the authors of the paper if they have tried training with it.

We thank the reviewer for their valuable feedback and time spent on our paper.

1. Although the paper compares WAM with several baseline watermarking models, including advanced steganographic methods could provide a more comprehensive assessment of WAM's relative strengths and limitations. Additionally, embedding and extracting multiple watermarks in different regions of an image is not a unique concept, as it has been previously introduced in methods such as [a] and [b].

• The official terminology established by Ross Anderson and Birgit Pfitzmann at the Information Hiding conference in the 90s distinguishes between steganography (hiding messages undetectably) and digital watermarking (hiding messages robustly). This distinction is widely accepted in the literature, as noted in the seminal book by Ingemar Cox et al. The reviewer seems to be conflating steganography with digital watermarking. Based on their titles, references [a] and [b] are steganography papers.
• Reference [a] involves hiding an image within another, albeit locally, which is a fundamentally different approach.
• We appreciate the reviewer mentioning reference [b], but it does not offer watermark detection and is not shown to have the capability to hide multiple watermarks.
• We have added comparisons* to CIN [1] and MBRS [2], as suggested by reviewer oRgo (see our response to the reviewer for implementation details). However, these methods do not handle localization or multiple watermarks. Below is the decoding accuracy when a 32-bit message is hidden, obtained for the same columns as Tables 1 and 2:

• We can see that both methods do not handle any geometric transformation, because they have different operating points (larger capacity, more emphasis on robustness against value metric transformations).

2. The need for pixel-level detection across high-resolution images could make WAM computationally intensive, especially in scenarios requiring real-time analysis. Further evaluation of computational costs would help contextualize its practical limitations.

• This is discussed in section 6 (Limitations). WAM consistently embeds or detects the watermark at a low resolution (256x256). This downscaling and subsequent upscaling approach, not used in HiDDeN, MBRS, or SSL, ensures that WAM operates at a constant computational requirement regardless of the image size.

• Our watermark embedder consists of 1M parameters, larger than the others. However, this increase in size does not necessarily translate to slower performance; it primarily requires more memory.

• The pixel-level detection capability is indeed why we found that increasing the size of WAM's extractor enhances decoding and detection performance. However, similarly to the encoder, the number of parameters does not directly correlate with speed

We provide a comparison of the WAM embedder's speed (in seconds) to others on a one 32GB-V100 GPU (with 16 cpus Intel(R) Xeon(R) Gold 6230 CPU @ 2.10GHz):

However, a larger number of parameters does correlates with larger memory needs. As stated in the general comment, we will add an ablation on using smaller models.

*we had revise the table in the response because of a typo in the original one.

We thank the reviewer for their valuable feedback and time spent on our paper.

1. W 1 [...] the comparison with the baseline method were not entirely fair when they are designed for larger capacity, i.e. SSL’s default capacity is 2048 bits.

• We believe there is a misunderstanding. SSL cannot hide 2048 bits; it only encodes 30 bits as stated in the SSL paper. While it could potentially encode more, doing so would compromise both perceptibility and robustness.

The paper lacked discussion of the computational complexity, which would be valuable for understanding its efficiency and scalability in real-world applications.

• This is discussed in Section 6, limitation paragraph. We agree that smaller models enhance applicability for memory-constrained envs, but a larger parameter size does not necessarily equate to slower performance. Our method consistently embeds or detects the watermark at a low resolution (256x256). This downscaling and subsequent upscaling approach, not used in HiDDeN, MBRS, or SSL, ensures that WAM operates with a constant computational requirement regardless of image size.
• WAM's watermark embedder indeed consists of 1M parameters, which is larger than e.g. HiDDeN, and our extractor is significantly larger (price to pay to get pixel level detection). However, this increase in size does not inherently lead to slower performance. Below is a comparison of the WAM embedder's speed to others in seconds on a 32GB V100 GPU (with 16 CPUs, Intel(R) Xeon(R) Gold 6230 CPU @ 2.10GHz):

• We agree that this is an important point that we will clarify. Also as pointed out in the general comment, we will add an ablation for different extractor sizes.

1. In the two-stage training process, robustness and imperceptibility were trained separately. Could the authors clarify how they ensure that this separation does not lead to conflict? For instance, robustness training led to visible artifacts, while imperceptibility training weakened robustness. How is this balance maintained effectively? This is described in Section 4.3 and illustrated in Figure 3.

This is described in Section 4.3 and illustrated in Figure 3.

During the first training phase, the training is conducted without any perceptual loss/constraint, using only the tanh function to upper bound the watermark distortion:

We train until achieving good detection and decoding accuracy (95% mIoU and 100% bit accuracy). This serves as an initialization for the second phase. In the second phase, training is similar (using the same augmentations/masks for robustness/detection), but now the distortion is modulated by the JND:

Without perceptual constraints, the PSNR would be lower, and the watermark is expected to be more robust. The balance is maintained by controlling the scalar value \\alpha_{\text{JND}}\, which can be adjusted during the second phase of training. Even if trained for a specific value (2 in our case), a different value can be used at inference to enhance robustness (albeit with increased visibility).

• We illustrate this by showing the bit-accuracy of a 32-bit message for different values of \\alpha_{\text{JND}}\ (1, 1.5, 2.0, 2.5, and 3.0), against a combination of JPEG-80, center 50% crop + resize, and brightness 1.5

(Same set-up as table 2 on COCO). Thus, in practice, the WAM’s robustness/imperceptibility tradeoff can be controlled at inference time.

We respectfully disagree with the reviewer's statement regarding the capacity and complexity of our proposed method. We do not not only provide intuitive explanations but also detailed demonstrations throughout the paper and the rebuttal.

Capacity Concerns:

• We would like to reiterate that SSL does not hide 2048 bits, as previously mentioned by the reviewer, but rather 30 bits in the original paper, which is less than WAM. We also kindly invite the reviewer to refer to our response to reviewer n1mi, where we compare WAM to CIN, another watermarking technique that hides 30 bits, and WAM demonstrates greater robustness. The trade-off between capacity and robustness is a well-known challenge, and our method priorities robustness. This is our operating point: the importance is to be very robust, in which case we believe that 32 bits is enough

1. What application does the reviewer have in mind where 32 bits are insufficient? In the case of WAM, it is decoupled from detection, allowing the messages to be fully utilized to hide, for example, each user's ID or AI tool ID, for which 32 bits are enough (approximately 4 billion different IDs!) if robust*.
2. Could the reviewer point to any watermarking method with a higher capacity that is more robust than WAM, particularly in evaluations similar to Table 2, where we highlight WAM's robustness against geometric transformations?

Complexity Concerns

• We have addressed the complexity of our method both in the paper (limitations paragraph of section 6) and in our rebuttal by adding experiments comparing the time required for embedding and extracting watermarks with other methods. Could the reviewer specify what additional experiments they were waiting for?

We appreciate the reviewer's feedback and are open to further discussion to clarify any remaining concerns.

*We crossed "user's ID" and "approx 4B different IDs" present in the original version of this answer as the first part was a typo and the second did not convey the correct message. As discussed in our next comment, our paper's motivation is about the "application scenario of AIGC", which is not about tracing users, but about detecting AI-generated images, such as attributing a message per AI generator, not per user.

The capacity of an image watermarking system is often misunderstood as the number of bits of a message. However, the true meaning of the capacity of a watermarking system is the total number of unique messages that can be supported by a watermarking system without causing significant confusion between different messages when detecting watermarks.

This means, even if you use 32 bits for a message, the number of non-confusing messages, which is the true capacity of the watermarking system, is often much smaller than 2^32, and it will be even smaller if the images are under attacks.

The reviewer's question is related to the true capacity of the proposed watermarking system. Not the theoretical upper-bound given by 2^32.

More often than not, the true capacity is difficult to derive theoretically. One way to demonstrate a high true capacity is to sample a large number of unique messages and evaluate false positive rates on a large enough dataset (typically starting from the scale of 1e6).

To conclude, the final question boils down to how many unique messages are used in the experiments? and how many unique images are used?

If any of the numbers are small, then the experimental results are not statistically significant, thus not convincing.

An image watermarking system with small capacity is not quite useful in practice, especially in the application scenario of AIGC, where hundreds of thousands of users generate huge amount of images.

Our paper's motivation is indeed about the "application scenario of AIGC", which is not about tracing users, but about detecting AI-generated images. We kindly invite the reviewer to have a look at the regulations we cited in the first paragraph. None of them requires to trace users. On the contrary, this would be an infringement of the GDPR Privacy Act in Europe.

The application we are targeting is more about attributing a message per AI generator, so that even when splicing images generated by several generators, we can still localize and attribute each part of the image to a generator.

As for the capacity, we can of course rely to Shannon theory applied to Binary Symmetric Channel. The capacity is $1-H(p)$ where $H$ is the binary entropy and $p$ the Bit Error Rate. This means that we can transmit $n(1-H(p))$ bits addressing $2^{n(1-H(p))}$ generators.

But all of this is misleading in practice. Asking for the capacity of the image watermarking scheme does not make sense in practice because the Bit Error Rate $p$ goes to $1/2$ as one distorts more and more the images. In real life, there is no such thing as a maximum distortion giving birth to a maximum $p$ and thus, a would-be guaranteed capacity. This is the humble point of view of a practitioner.

Since the authors' previous response did not address the reviewer's question on the capacity of the image watermarking system, the reviewer decides to temporarily lower the rating until this question is addressed

The question that the reviewer is referring to is "What is the maximum number of unique messages that is used in the experiments of the paper?". For table 2, as detailed in line 425, we evaluate the detection rates and bit accuracies on 10000 images of the COCO validation set. It is done with a different randomly generated 32-bit message for each image.

Is it what the reviewer is asking for? Could the reviewer please also provide one or a list of "convincing" papers according to the reviewer's standards, with large numbers of unique messages and unique images?

Another way to approach the problem is to consider it as a statistical detection test. We consider the null hypothesis $H_0$ that each bit of the output binary message $\hat{m}$ is independent and distributed as a Bernoulli variable with probability of success $0.5$, and the alternative hypothesis $H_1$ which is that $\hat{m} = m$. Given an observed bit accuracy $bit.acc.(m, \hat{m})$, the $p$-value is the probability of observing a bit accuracy at least as extreme as the one obtained under the null hypothesis. It is given by the cumulative distribution function of the binomial distribution:

where

• $n$ is the number of bits,
• $p = bit.acc.(m, \hat{m})$,
• the c.d.f. of the binomial is expressed by $I_x(a, b)$, the regularized incomplete Beta function.

To further validate this, we additionally compute the bit accuracy and the $-log_{10}$ p-value on 100 images of COCO, and report the average in the following table. What we can observe is that, indeed, MBRS and TrustMark have higher capacity, which results in better $-log_{10}$ p-value for many augmentations (identity, contrast, jpeg). However, there are less robust: for instance for a combined augmentation of JPEG60 Crop 50% (in area) and brightness 1.5 no method achieve a $-log_{10}$ p-value bigger than $1$, while ours is bigger than $5$ (note that is is without using the detection map given by WAM, only the extracted bits).

One could also extend the previous approach in the case of multiple messages. We compare the message $\hat m$ from the watermark extractor to $m_{1}, . . . , m_{N'}$ (where $N'$ would be the number of messages, representing for instance $N'$ generative models). If the $N'$ hypotheses are rejected, we can conclude that the image was not generated by any of the models. With regards to the detection task, false positives ( i.e., obtaining a collision with one of the message by chance) are more likely since there are N' tests. The new p-value would be $pvalue_{N'} (m , \hat m) = 1 - (1 - pvalue(m, \hat m))^{N'} \approx N' pvalue(m, \hat m)$. We can report these results if needed.

We thank the reviewer for their valuable feedback and time spent on our paper.

The model demonstrates a 100% true positive rate in many cases; however, most of these manipulations are included in the training augmentation, which may indicate overfitting rather than true robustness. If a manipulation is not included in the training data, can the watermark still be detected? Please also elaborate on the model performance against VAE attack and diffusion attack.

• We would like to emphasize that the primary focus of our paper is not solely on robustness. Our main contribution lies in introducing three novel capabilities: localization, multiple watermarks, and detection separate from decoding, while maintaining comparable robustness.

• For robustness, our goal is to achieve extreme resilience against typical internet/social network image sharing, which is why we incorporate extensive augmentation during training. It is not trivial overfitting: it is challenging to maintain robustness across all augmentations. Target ones can be integrated into the training pipeline to for specific robustness.

• Regarding the VAE attack, we conducted new experiments to assess WAM's performance. We measured bit accuracy for a 32-bit message (consistent with Table 2 and as detailed in our response to Reviewer oRgo for MBRS and CIN newly added). WAM remains robust until the VAE significantly compresses the image (PSNR 25). In this scenario, only MBRS and Trustmark maintain robustness, but they lack resilience against geometric transformations, which represents a different trade-off choice. We will include these findings in the paper.

The watermark model has not yet been tested against attacks from generative AI, which is widely used today. [...] . It’s important to show that the model can handle generative AI modifications, like Stable Diffusion..

• As shown in Table 2 and Figure 10 in the appendix, we demonstrate WAM's robustness against heavy inpainting. WAM is not only robust to such modifications but can also precisely localize which subparts have been edited
• Regarding full-image purification via Stable Diffusion, WAM shares the same limitations as other methods. We acknowledge that this is an important research area, but it is beyond the current scope of our work.
• We provide a new comparison focusing on decoding 32 bits using the DiffPure method and implementation from [1]. We observe that WAM shows comparable robustness and breaks when the purification is heavy. We will include these findings in the paper.

Another useful test would be to see if adding a second watermark to an image removes or covers the first one. For instance, after editing an image, if I use WAM again to add my own watermark, can the original watermark message still be found?

We demonstrate that, on average across 100 images, WAM can still detect the presence of a watermark even if two watermarks overlap entirely on the whole image with different messages. We appreciate the reviewer for raising this point, as it highlights the advantage of having decoding separated from detection.

• However, WAM will not be able to decode both messages if one watermark is directly on top of the other. In practice, if the detector and encoder are managed by the same person, they can verify that the image is not already watermarked by WAM before adding a second watermark.

[1] Saberi et al., 2024, Robustness of AI-Image Detectors: Fundamental Limits and Practical Attacks, ICLR 2024

Thank you. We updated the camera ready submission, incorporating the rebuttals discussion.