Thank you for your high praise of our work! We apologize for any confusion that may have been caused by unclear wording in the main text. We will make the necessary corrections in the camera-ready version.

Q1: Lack of detailed computational complexity analysis (shown in Weaknesses)

We have already provided the inference time in Table 4. We mainly claim that we can train images of any size with fixed and limited computing resources. To this end, we provide the GPU usage (GB) per sample during training (Adam optim) for different methods:

It can be seen that the memory usage of our method does not increase with the image size.

Q2: The selection of rank influence the balance between computational efficiency and watermark performance

In Section 4.6, we have already shown the impact of different ranks on visual quality and decoding accuracy in the ablation experiment.

Here, we focus on the GPU memory consumption of different ranks with the corresponding number of INR parameters in training single samples, and we also provide the GPU memory consumption without using low-rank watermarking for watermark injection:

If we directly use formula (5) from the paper, single sample training would exceed 24GB memory. Since we use RTX 3090 with 24GB, this makes training impossible to complete.

Q3: Interval selection process and consistency guarantee

For simplicity in the main text, we refer to this as a "randomly selected interval $\Delta_t$". However, in our actual implementation, $\Delta_t$ is automatically determined based on the selected region.

We first randomly sample the top-left coordinates $(x,y)$ from the "normalised coordinate matrix" (shown in section 3.1) and randomly sample the submatrix side length $s\in[0,2]$. The code is as follows:

    def gen_start_coords():
        side_length = np.random.uniform(0, 2)
        start_x = np.random.uniform(-1, 1 - side_length)
        start_y = np.random.uniform(-1, 1 - side_length)
        return (start_x, start_y), side_length

Then, we generate the subcoordinate matrix using the fixed grid parameter $r$. The code is as follows:

    x = torch.linspace(start_x, start_x + side_length, r)
    y = torch.linspace(start_y, start_y + side_length, r)
    xv, yv = torch.meshgrid(x, y, indexing='ij')
    coordinates = torch.stack([xv, yv], dim=-1)

As can be seen, as long as we sample a matrix of any size from the "normalised coordinate matrix", we can determine a corresponding $\Delta_t$.

Consistency is ensured by the intrinsic properties of INRs, which learn a continuous coordinate-to-RGB mapping. Since each coordinate maps to a unique RGB value and coordinates are processed independently during training, the same coordinate will always yield the same RGB value regardless of the sampling submatrix's size or location, thereby maintaining consistency across scales.

Q4: Specific image dimensions used for the high-resolution and low-resolution categories in Table 1

For High Resolution, we measured at 2K size (except for DWSF), and for Low Resolution, we measured at 128x128 size. For DWSF, it essentially embeds the watermark into many 128x128 blocks, so we measured the visual quality of the block.

We understand your concern that visual quality may vary across different resolutions, so we have also measured the visual quality of our method at different resolutions:

Our method maintains consistent visual quality at different resolutions.

Q5: Whether a single pretrained model is applicable across all resolutions without retraining

As mentioned in Section 4.3, in order to make a fair comparison with the low-resolution model, Table 2 shows the results of training at a fixed resolution of 128×128 only.

Table 3 and Figure 4 shows the performance of our method at varying image resolutions. It is trained only at 2K resolution and tested at different resolutions.

We will clarify this point in the camera-ready version.

Thank you for your appreciation of our work! We will answer your questions one by one.

Q1: Capacity of framework

Fixing the message length at 30 bits is a common practice. It is widely adopted in both low-resolution studies such as HiDDeN[1] (2018), MBRS[2] (2021), and recent high-resolution approaches like DWSF[3] (2023) and $\mathrm{RAIM_{ARK}}$[4] (2024).

We present the relationship between visual quality and decoding accuracy for models trained with message payloads of 30, 50, and 100 bits:

In addition, We find that convergence is quite difficult when exceeding 100 bits (the convergence rate is slow), and the visual quality deteriorate significantly.

This is reasonable. In order to accurately extract watermarks at any size, it is inevitable that a large amount of redundant information will be embedded. Therefore, how to further improve capacity based on existing methods remains a topic worthy of further exploration.

Q2: Missing of local packages and instructions

We apologize, but since FastTools is an internal package that contains a large amount of private information (such as Hugging Face user tokens and passwords), we have not yet organised it. We will organise clean code and clear instructions after the camera-ready version is complete and open source it.

Q3: Compare of training time

Here is a comparison of training times using one RTX 3090 24G (32 batch):

As can be seen, CNN-based methods have a clear advantage in terms of training time, but we are still significantly faster than DWSF in training. Furthermore, $\mathrm{RAIM_{ARK}}$ requires fine-tuning for each image, which is unacceptable in large-scale production.

Q4: Hardware specification

We provide detailed specifications for hardware and software.

Q5: Printing images distortion adaptation

StegaStamp is able to cope with printing image distortion mainly because it implements noise layers that simulate this process. Therefore, we only need to replace our noise layer with theirs, which enables adaptation to printing image distortion.

Additionally, our designed distortion layers already encompass their design to a certain extent. Therefore, we directly present our experimental results.

we randomly select 50 2K images (PSNR at 35 dB), print them on A4 paper using the HP Color Laser MFP 178nw printer, and capture them using a Redmi K20 Pro at a distance of 20 cm from the image. The average accuracy rate we achieved is 91.2%.

Q6: Format problem

Thank you for your patience and attention to detail. We will correct these formatting errors in the camera-ready version.

Reference

[1] Zhu J, Kaplan R, Johnson J, et al. Hidden: Hiding data with deep networks[C]//Proceedings of the European conference on computer vision (ECCV). 2018: 657-672.

[2] Jia Z, Fang H, Zhang W. Mbrs: Enhancing robustness of dnn-based watermarking by mini-batch of real and simulated jpeg compression[C]//Proceedings of the 29th ACM international conference on multimedia. 2021: 41-49.

[3] H. Guo, Q. Zhang, J. Luo, F. Guo, W. Zhang, X. Su, and M. Li, “Practical deep dispersed watermarking with synchronization and fusion,” in Proceedings of the 31st ACM International Conference on Multimedia, 2023, pp. 7922–7932.

[4] Y. Wang, X. Zhu, G. Ye, S. Zhang, and X. Wei, “Achieving resolution-agnostic dnn-based image watermarking: A novel perspective of implicit neural representation,” in Proceedings of the 32nd ACM International Conference on Multimedia, 2024, pp. 10 354–10 362.

Thank you for your appreciation of our approach! Our main contribution lies in proposing a completely new paradigm to break through the inherent resolution problem. We apologise for any confusion caused by our oversight of certain details, and we will address each of your questions below.

Q1: Discussion about application scenarios due to template-based watermarking approach

Template-based watermark selection involves a trade-off. The content-agnostic nature of the method is a double-edged sword. While it doesn't adapt to the image content, this very independence is what enables its offline generation and mass reusability, making it uniquely suited for scalable platforms like large image libraries, news agencies, content distribution platforms and so on.

Moreover, we have provided many examples of embeddings at different sizes in Figure 3 and Figure 7. As shown in Figure 3 (first row) shows that smaller image sizes with simpler textures exhibit more obvious visual distortion.

At the same time, we also explored how to utilise cover image content under the INR architecture, but encountered challenges. Our experimental methods are as follows:

(1) The RGB values of the original image and the feature $z_e$ in Section 3.1 are concatenated and fed into INR.

(2) Pre-computing the texture richness of each pixel using the Laplacian operator and normalising it to [0,1] as $\gamma$ (shown in Section 3.2). This approach effectively controls embedding only in high-frequency regions.

This is result at DIV2K:

For method (1), the INR model selectively ignores raw RGB values, which makes sense since isolated pixels do not convey meaningful semantic information on their own.

While using the Laplacian operator to constrain embedding to high-frequency regions improves visual quality, it significantly reduces decoding accuracy. This occurs because the Laplacian constraint ($\gamma$) and the predicted watermark residual are independent variables, making decoding accuracy unreliable.

Q2: Robustness of mixed distortions

For clarity, we have not included the performance of combination distortion in the main text.

Here is the “noise+scaling+cropping" results. The results represent the average accuracy rate of embedding on a 2K image(DIV2K datasets), first performing different distortion attacks, then scaling to different resolutions, and finally randomly cropping a 128x128 patch for decoding. For fair comparison, PSNR is unified to 35.

Other methods cannot withstand resolutions higher than 512x512, while our method performs well under most combinations of noise.

Q3: Discussion about stripe-like watermark pattern

We acknowledge this limitation may reduce concealment and make them vulnerable to targeted attacks and believe it represents a significant area for future improvement. During our early explorations, we found that using SIREN [1] as the base INR block or employing different parameter initialization methods for the Hierarchical Multi-Scale Coordinates Embedding resulted in different watermark textures (e.g., fractal-like effects). However, most of these approaches led to training failures where visual quality improved but decoding accuracy remained at 0.5.

Consequently, we chose the ReLU activation function for INR and default parameter initialization as the most stable option. This finding suggests that model structure and initialization methods significantly influence watermark texture, making this a promising direction for future research.

Q4: Discussion about variable-length messages

We designed the message following mainstream methods such as HiDDeN[2] (2018), MBRS[3] (2021), DWSF[4] (2023), and $\mathrm{RAIM_{ARK}}$[5] (2024), all of which are fixed at 30 bits. As our primary focus is on proposing a new paradigm to effectively embed watermarks in high-resolution images, we adopt consistent designs with mainstream methods in other aspects.

To the best of our knowledge, only training-free diffusion-based methods [6,7] can dynamically change embedding bit counts during inference. Other trained image watermarking methods cannot modify number of bits at inference time.

Nevertheless, we can approximate dynamic bit changes through redundant embedding. For example, if trained with 6 bits but only 3 bits are needed (e.g., "010"), we embed "010|010" instead. This method can improve robustness through voting.

Q5: Format problem

Thank you for your careful review and attention to detail. We will fix these formatting issues in the camera-ready version.

Reference

[1] Sitzmann V, Martel J, Bergman A, et al. Implicit neural representations with periodic activation functions[J]. Advances in neural information processing systems, 2020, 33: 7462-7473.

[2] Zhu J, Kaplan R, Johnson J, et al. Hidden: Hiding data with deep networks[C]//Proceedings of the European conference on computer vision (ECCV). 2018: 657-672.

[3] Jia Z, Fang H, Zhang W. Mbrs: Enhancing robustness of dnn-based watermarking by mini-batch of real and simulated jpeg compression[C]//Proceedings of the 29th ACM international conference on multimedia. 2021: 41-49.

[4] H. Guo, Q. Zhang, J. Luo, F. Guo, W. Zhang, X. Su, and M. Li, “Practical deep dispersed watermarking with synchronization and fusion,” in Proceedings of the 31st ACM International Conference on Multimedia, 2023, pp. 7922–7932.

[5] Y. Wang, X. Zhu, G. Ye, S. Zhang, and X. Wei, “Achieving resolution-agnostic dnn-based image watermarking: A novel perspective of implicit neural representation,” in Proceedings of the 32nd ACM International Conference on Multimedia, 2024, pp. 10 354–10 362.

[6] Wen Y, Kirchenbauer J, Geiping J, et al. Tree-ring watermarks: Fingerprints for diffusion images that are invisible and robust[J]. arXiv preprint arXiv:2305.20030, 2023.

[7] Yang Z, Zeng K, Chen K, et al. Gaussian shading: Provable performance-lossless image watermarking for diffusion models[C]//Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition. 2024: 12162-12171.

Thank you for your patience in reviewing our work!

We have noticed that you seem to have some questions about the computational efficiency of our method, and we sincerely apologise for any confusion caused by unclear wording.

In the main text, we primarily aimed to highlight that INR has weaker representational capabilities compared to CNN. As a result, under the same scale, INR-based methods require longer training times and converge more slowly. However, since INR is essentially an MLP, its computational overhead during inference is significantly lower than that of CNN under the same scale. We will provide a detailed explanation in the following sections.

Q1: Robustness analysis across different spatial locations

Due to our coordinate sampling strategy, our method can guarantee decoding at any position. To prove this, we embedded the watermark in 2K images (DIV2K dataset) and cropped blocks ranging from 128×128 to 1024×1024 pixels from five different positions (top left, bottom left, top right, bottom right, and center), then calculated the average accuracy rate of blocks(PSNR at 35 dB).

As can be seen, our method can robustly decode regardless of the position.

Q2: Clarification on INR fitting process and computational cost

We sincerely apologise for any confusion caused by our unclear statement.

When we say that "the fitting process of INR can be computationally expensive," we mean that the model converges slowly during training. This is because INR has weaker representation capabilities than CNN, and our method requires more time to train than CNN-based methods. However, once training is complete, our method can not only pre-generate watermark templates, but also process arbitrary pixels independently and in parallel, resulting in high computational efficiency.

Here is a comparison of training times using one RTX 3090 24G (32 batch):

Although our method is slower than methods such as MBRS, it is still faster than DWSF. Furthermore, $\mathrm{RAIM_{ARK}}$ requires fine-tuning for each image, which is unacceptable in large-scale production.

Q3: Report the actual time required to generate a single watermark during embedding

Unlike CNNs, which require computations across the entire image, our method enables independent parallel processing for each pixel. Consequently, in theory, given sufficient GPU resources for parallel execution, our computational overhead is equivalent to the inference time of a single pixel.

We demonstrate this by measuring the inference time for watermarking a single 2K image using one GPU, two GPUs(RTX3090 24GB):

Our INR method requires only 24.16ms on a single GPU, which is 3x faster than DWSF and 12.7x faster than TrustMark. Essentially, INR is just MLP, and its computational load is much lower than that of CNN of the same scale.

Thank you for your patience and thorough review! We note your concerns regarding visual quality.

It is important to emphasise that our contribution primarily lies in proposing a novel paradigm centred on INRs to address the challenge of robust embedding on ultra-large images.

We adopt this architecture specifically to overcome the computational bottlenecks and memory constraints that CNN-based methods face with high-resolution inputs.

The slight reduction in visual fidelity stems from the inherent nature of INRs, which process pixel coordinates independently and thus do not leverage local spatial features as effectively as CNNs.

In fact, we made considerable efforts in perceptual quality but encountered some challenges. We will detail these in the following sections.

Q1: Using a hybrid INR-CNN model to improve perceptual quality

We appreciate the reviewer's insightful suggestion. Indeed, we explored similar hybrid architectures during our initial investigations but found them unsuitable due to several fundamental challenges.

we have explored hybrid architectures, using methods similar to LIIF [1], which involve first extracting features from the entire image using a lightweight CNN(3-layer Conv-BN-ReLU structure with 3×3 kernels), and then sampling these feature maps by coordinate for prediction with an INR.

It can be expressed as:

$$L_c = \mathrm{CNN}(I)$$ $$z_e=\Gamma(L_c(x,y)\odot z_p)$$

$L_c$ is similar to the embedded features mentioned in the section "Hierarchical Multi-Scale Coordinates Embedding" in the paper, while $z_e$ is equivalent to formula (4) in the paper.

However, this introduces three issues:

(1) It is still necessary to perform CNN on the entire image, which results in computational overhead increasing with image size.

(2) Computational efficiency is extremely low. In the CNN part, we need to perform calculations on the entire image, but in the INR part, we only sample local regions for watermark embedding during training, resulting in most of the computational overhead being meaningless.

(3) More importantly, since the final watermark generation still relies on the INR, during actual training, the network selectively ignores features from the CNN, degenerating into pure INR training.

If we only perform CNN on the specific regions where watermarks are to be embedded, This reintroduces the block-based generation problem shown in Figure 1 at our paper, requiring precise watermark block localization.

we give our results on DIV2K dataset (2K resolution):

Avg ACC represents the average decoding accuracy after various noise attacks, and GPU Memory represents the computing memory occupied by one sample during training. It can be seen that the visual quality has not improved significantly, while the GPU usage during training is much higher than that of our method.

Q2: About adaptive $\gamma$

We have tried two strategies:

(1) Assigning a dynamic trainable parameter to each pixel, i.e., INR predicts not only RGB but also $\gamma$. However, this approach has issues where the predicted gamma values become completely ineffective, and due to the lack of hard constraints, this method produces very low visual quality.

(2) Pre-computing the texture richness of each pixel using the Laplacian operator and normalising it to [0,1] as $\gamma$. This approach effectively controls embedding only in high-frequency regions, but the decoding accuracy is very low. This is because INR cannot perceive the Laplacian operator, inevitably leading to information loss in low-frequency regions.

This is results:

Q3: Adversarial examples or model inversion attacks

Currently, existing image watermarking methods do not extensively discuss this type of attack, so we primarily adopt mainstream attacks from previous SOTA methods like DWSF[2] (ACM MM 23) and $\mathrm{RAIM_{ARK}}$[3] (ACM MM 24) in our design.

To our knowledge, "model inversion attacks" are mainly used to infer the original data used to train the model. This does not seem to be particularly relevant to the domain we are discussing.

In addition, we test the performance of different adversarial attack methods using the DIV2K dataset, where watermarks are embedded at 2K resolution with a fixed PSNR of 35 dB.

We use torchattacks (a third-party adversarial example library) to test three different attack methods: PGD[4], FGSM[5], and BIM[6]. Attacked PSNR represents the PSNR of the distorted image and the clean image after the attack, ACC is the accuracy rate after the attack.

The specific settings are as follows:

    pgd1 = torchattacks.PGD(wrapped_model, eps=8/255, alpha=2/255, steps=20)
    pgd2 = torchattacks.PGD(wrapped_model, eps=16/255, alpha=4/255, steps=20)
    fgsm1 = torchattacks.FGSM(wrapped_model, eps=16/255)
    fgsm2 = torchattacks.FGSM(wrapped_model, eps=128/255)
    bim1 = torchattacks.BIM(wrapped_model, eps=64/255, alpha=8/255, steps=20)
    bim2 = torchattacks.BIM(wrapped_model, eps=128/255, alpha=16/255, steps=20)

wrapped_model is the watermark decoder from different methods.

We find that our method demonstrates greater resistance to such attacks compared to other methods, as evidenced by two key factors:

(1) Under identical attack parameters, our method maintains a higher PSNR after the attack, indicating its insensitivity to adversarial perturbations;

(2) At the same PSNR level, our method achieves a higher accuracy rate, demonstrating its superior robustness against such attacks.

Q4: Robustness of online platforms

We select 50 images and test our method on different media at PSNR 35 （2K resolution on DIV2K）:

Our method is the most effective.

Q5: Performance under extreme conditions

"We test the extreme cases with combined distortions involving "noise + scaling + cropping".

We first embed the messages into 2K images. These images are then subjected to various distortions. After that, we enlarge the distorted images to 4K resolution. Finally, we randomly crop 128×128 blocks from the enlarged images for decoding.

In this case, our performance will decline significantly, but it will still be far better than other solutions.

Reference

[1] Chen Y, Liu S, Wang X. Learning continuous image representation with local implicit image function[C]//Proceedings of the IEEE/CVF conference on computer vision and pattern recognition. 2021: 8628-8638.

[2] H. Guo, Q. Zhang, J. Luo, F. Guo, W. Zhang, X. Su, and M. Li, “Practical deep dispersed watermarking with synchronization and fusion,” in Proceedings of the 31st ACM International Conference on Multimedia, 2023, pp. 7922–7932.

[3] Y. Wang, X. Zhu, G. Ye, S. Zhang, and X. Wei, “Achieving resolution-agnostic dnn-based image watermarking: A novel perspective of implicit neural representation,” in Proceedings of the 32nd ACM International Conference on Multimedia, 2024, pp. 10 354–10 362.

[4] Madry A, Makelov A, Schmidt L, et al. Towards deep learning models resistant to adversarial attacks[J]. arXiv preprint arXiv:1706.06083, 2017.

[5] Goodfellow I J, Shlens J, Szegedy C. Explaining and harnessing adversarial examples[J]. arXiv preprint arXiv:1412.6572, 2014.

[6] Kurakin A, Goodfellow I, Bengio S. Adversarial machine learning at scale[J]. arXiv preprint arXiv:1611.01236, 2016.

Dear Reviewer 2eV2,

Thank you for your thoughtful and constructive reviews of this submission. Your time and expertise are greatly appreciated.

The author response is now available. Please carefully read the rebuttal and update your reviews with post-rebuttal comments, indicating whether the response adequately addresses your concerns and whether it changes your assessment of the paper.

Please also feel free to engage in discussion with your fellow reviewers, especially in cases where there are divergent opinions, so we can reach a more accurate and well-informed consensus. If you have any points of disagreement or clarification, this is a good time to raise and explore them collaboratively.

Best regards,

AC

Dear Reviewer 2eV2,

We sincerely appreciate your initial review of our submission and the time you have dedicated so far. As the discussion phase is entering its final hours, we kindly follow up to request your post-rebuttal feedback.

Given the strong results and clarifications provided, we hope our rebuttal has sufficiently addressed your reservations. If so, we would be truly grateful if you could consider raising your assessment to reflect this, as your post-rebuttal input is essential to ensuring an informed consensus.

All other reviewers have engaged in the discussion and explicitly confirmed that their concerns have been addressed. We would greatly value your updated perspective as well, so that the final decision can be made based on the most complete set of reviews.

If you have any remaining concerns or questions about our rebuttal, we are more than willing to clarify them promptly before the discussion closes. Your timely input at this stage would be extremely helpful in ensuring that the consensus truly reflects all reviewers’ views.

Thank you very much for your attention and consideration!

Sincerely,

The Authors of Submission 15851