Author Response (Reviewer fV1g)

Dear Reviewer, thank you very much for your careful review of our paper and thoughtful comments. We hope the following responses can help address your concerns.

---

Q1 Elaborate the genuine technical novelties. Explicitly characterize the scenarios where the masking strategy provides unique advantages beyond what could be achieved through existing robustness techniques.

A1: Thank you for raising this important point. Below, we elaborate on the genuine technical novelties introduced by MaskMark and characterize the unique scenarios where our masking strategy provides clear advantages over prior watermarking techniques and robustness mechanisms.

Functional Innovation: Native Local Watermark Embedding.

• MaskMark is, to our knowledge, the first method to introduce a spatial mask during the encoding phase to enable native local watermark embedding.
• While WAM and other global watermarking methods can embed a global watermark and then applies post-hoc cropping to simulate local watermark embedding (which introduces signal loss and robustness issues), MaskMark embeds the watermark directly into designated regions by conditioning encoder on a spatial mask. This results in improved robustness and precise regional protection.

Methodological Innovation: A Unified Mask Mechanism Enabling Multiple Functions.

• Beyond native local embedding, the introduced mask mechanism provides a unified design that enables multiple watermarking functionalities: local watermark extraction, watermark localization and multi-watermark embedding and extraction.
• While existing methods may achieve some of these functions individually, they typically rely on task-specific architectures or ad-hoc procedures, and cannot achieve all three simultaneously within a single coherent framework. Moreover, their performance or efficiency also tends to fall short compared to ours. Below, we explain the advantages of our approach.
  • Compared to Global Watermarking Methods that Use Crop as a Distortion. Some global watermarking methods (e.g., HiDDeN, MBRS) introduce Crop as a distortion during training to improve robustness. However, our mask mechanism differs fundamentally in both its role and effectiveness:
    • Persistent Throughout Encoding and Decoding: The mask is not just a training-time augmentation but a central component in both the encoder and decoder during training and inference. This persistent guidance enables the model to learn true spatial awareness and region-specific signal embedding/extraction.
    • Supports Learnable “Locate-then-Extract” Decoding: Our decoder includes a dedicated mask prediction module, allowing the model to first locate the watermark region and then extract the message from that region only. This significantly reduces interference from unmarked areas and improves decoding robustness. We empirically validate this in Sec. 4.5 (“Importance of Localization before Extracting Local Watermarks”).
    • Improves Embedding Signal Concentration: Because the encoder/decoder is always guided by a mask, the watermark signal is learned to be concentrated within the specified region, rather than being diluted across the entire image. In contrast, global methods that see cropped distortions during training still tend to spread the watermark signal across the full image due to the global decoding objective. This limits their true robustness to local extraction, especially when the marked region is small.
  • Compared to WAM (Localized Watermarking Method).
    • While WAM simultaneously supports local watermark extraction, watermark localization, and multi-watermark embedding and extraction, its design introduces several challenges.
      • The core idea of WAM is to treat watermark extraction as a pixel-wise semantic segmentation problem. Each pixel independently carries bits of the watermark, which are later averaged during inference.
      • Extracting meaningful information from individual pixels is inherently difficult, leading to slow convergence, high training complexity, and limited capacity for longer watermark messages (as noted in the WAM paper).
      • The final extraction relies on a non-trainable and naive voting/averaging mechanism across pixels, which cannot be optimized end-to-end and performs poorly when the watermarked region is small or per-pixel accuracy is low.
    • In contrast, MaskMark is fundamentally built around spatially-aware encoding and decoding. The encoder and decoder are both guided by a spatial mask, enabling the system to:
      • Embed and extract information across multiple pixels within a localized region, which lowers training difficulty and allows extension to longer messages.
      • Train all components end-to-end, including both mask prediction and region-wise watermark embedding/extraction, avoiding WAM’s reliance on non-trainable inference heuristics. This leads to improved robustness in local watermark extraction
  • Compared to EditGuard (Watermark Localization Method).
    • EditGuard embeds two separate types of signals: a 1D copyright watermark and a 2D fragile localization watermark to achieve watermark localization. This dual embedding comes with trade-offs:
      • The addition of a second watermark signal increases visual distortion and complexity.
      • Ensuring robustness of both the copyright and localization watermarks simultaneously is difficult and may involve conflicting optimization objectives, limiting the achievable performance.
    • The watermark localized by MaskMark serves as a copyright watermark, which allows robustness and traceability to be ensured simultaneously. This leads to a higher potential performance upper bound and minimal impact on visual quality.

---

Q2: Does MaskMark maintain its superiority under such composite attacks, and does the proposed architecture have inherent limitations against certain attack combinations?

A2: We appreciate your question regarding robustness under composite attacks, which indeed reflect more realistic adversarial scenarios.

• To evaluate this, we conducted extensive experiments where combinations of multiple distortions were applied to the watermarked images.
  • We considered a total of 13 distortions: 10 valuemetric distortions (JPEG Compression, Gaussian Filter, Gaussian Noise, Median Filter, Salt & Pepper Noise, Resize, Brightness, Contrast, Hue and Saturation) and 3 geometric distortions (Rotation, Perspective and Horizontal Flip).
  • During evaluation, we randomly selected and applied between 1 to 5 of these distortions to simulate composite attacks.
• As shown in Table 1, MaskMark maintains strong performance even as the number of combined distortions increases.
  • While there is a natural drop in extraction accuracy with more severe corruption, the results remain at a high level across all combinations tested.
  • Importantly, we did not observe any inherent architectural limitations or specific attack combinations under which MaskMark fails disproportionately, further demonstrating its robustness and practical utility in real-world settings.

Table 1. Watermark extraction accuracy of MaskMark-D under varying numbers of random combined distortions across different watermarked area ratios.

Table 2. Watermark extraction accuracy of MaskMark-ED under varying numbers of random combined distortions across different watermarked area ratios.

Author Response (Reviewer E8Tv)

Dear Reviewer, thank you very much for your careful review of our paper and thoughtful comments. We hope the following responses can help address your concerns.

---

W1: Lack of detail about decoding multiple watermarks in one image.

A1: We appreciate your feedback. As described in Appendix C.2.4, MaskMark handles multiple watermarks by first predicting a segmentation mask that may contain multiple disjoint regions. To separate these, we apply OpenCV’s cv2.connectedComponents, which identifies and isolates each connected region. Each region is then decoded independently using the watermark decoder. This region-wise decoding approach parallels WAM's use of DBSCAN in purpose, although our segmentation-based method avoids the need for additional clustering.

---

W2&Q1: A section detailing the main difference with WAM (architecture, training procedure...). What explains the better performances (w.r.t. to all metrics - complexity, robustness, message lengths) compared to WAM?

A: Thank you for the suggestion. Below we summarize the main differences between MaskMark and WAM in terms of core design principles, model architecture, and training procedures, and explain why these differences lead to better performance across complexity, robustness, and message length.

• Core Design Principles.
  • The core idea of WAM is to treat watermark extraction as a pixel-wise semantic segmentation problem. Each pixel independently carries bits of the watermark, which are later averaged during inference. This creates several challenges:
    • Extracting meaningful information from individual pixels is inherently difficult, leading to slow convergence, high training complexity, and limited capacity for longer watermark messages (as noted in the WAM paper).
    • The final extraction relies on a non-trainable and naive voting/averaging mechanism across pixels, which cannot be optimized end-to-end and performs poorly when the watermarked region is small or per-pixel accuracy is low.
  • In contrast, MaskMark is fundamentally built around spatially-aware encoding and decoding. The encoder and decoder are both guided by a spatial mask, enabling the system to:
    • Embed and extract information across multiple pixels within a localized region, which lowers training difficulty and allows extension to longer messages.
    • Train all components end-to-end, including both mask prediction and region-wise watermark embedding/extraction, avoiding WAM’s reliance on non-trainable inference heuristics. This leads to improved robustness in local watermark extraction
• Model Architecture.
  • The WAM architecture is heavily weighted toward the decoder, as its main challenge lies in extracting bits from individual pixels. It uses a VQGAN-based encoder and a ViT-Base decoder, resulting in a highly asymmetric and heavy design.
  • MaskMark adopts the classical symmetric design commonly used in prior watermarking literature. Both the encoder and decoder use U-Net backbones, resulting in a lightweight and balanced architecture. Importantly:
    • Unlike WAM, MaskMark decouples bit extraction and mask prediction. A lightweight $\text{U}^2$-Net is added in parallel to the decoder as a dedicated mask predictor, which improves optimization stability and convergence.
    • This design is backbone-agnostic and highly flexible — MaskMark can easily adapt to different base architectures or be scaled up/down depending on the use case.
• Training Procedure.
  • WAM employs a two-stage training scheme: the first stage optimizes watermark extraction, while the second stage aims to improve the visual quality of the watermarked image. This is necessary because pixel-level bit decoding is extremely hard, and optimizing both objectives simultaneously in the first stage can cause conflicts. However, this adds substantial training overhead.
  • MaskMark uses a single-stage training pipeline, similar to traditional watermarking methods. Both watermark extraction accuracy and visual quality are optimized jointly from the start. This leads to: simplified training, faster convergence, and lower computational cost.

---

Q2: It would be a good idea to consider another setting with stronger attacks.

A2: We appreciate your suggestion to consider a setting with stronger attacks.

• In response, we increased the distortion strength beyond what the model was exposed to during training and conducted evaluation under these more challenging conditions.
• As shown in Table 1 and Table 2, MaskMark consistently maintains strong extraction accuracy under these stronger attacks. This demonstrates the generalizability and robustness of our method, even when facing distortions that exceed the training distribution.

Table 1. Watermark extraction accuracy of MaskMark-D under stronger-than-training distortions across different watermarked area ratios.

Table 2. Watermark extraction accuracy of MaskMark-ED under stronger-than-training distortions across different watermarked area ratios.

---

L1: One limitation is that the watermark is visible.

A1: Thank you for pointing this out. As also acknowledged in Appendix A, we recognize that our current method may produce visible artifacts under close inspection by trained professionals. Addressing this limitation, especially for high-fidelity applications such as artworks or cinematic content, is part of our ongoing and future work.

---

L2: Another limitation concerns reproducibility.

A2: Thank you for raising this concern. We understand the importance of reproducibility and fully agree that providing code is essential for verifying our claims. If the paper is accepted, we will release all code, pretrained models, and implementation details, ensuring full reproducibility of our results.

Author Response (Reviewer oDY7)

Dear Reviewer, thank you very much for your careful review of our paper and thoughtful comments. We hope the following responses can help address your concerns.

---

W1&Q1: Can the author provide ablation studies for investigating the functionality of different model components?

A: Thank you for your great suggestion. We agree that ablation studies are important for understanding which components contribute to performance. In our case, MaskMark intentionally builds upon standard architectural components widely used in image watermarking. Specifically:

• Encoder: CNN + U-Net + JND.
  • The CNN + U-Net combination is a classical structure for watermark embedding [1][2][3][4] and we did not introduce any novel architectural modifications or attempt alternative variants here.
  • The JND module, adopted from WAM, is used solely to enhance the visual quality of the watermarked image. We provide an ablation study on the effect of the JND module in Appendix D.1.
• Decoder: CNN + U-Net + $\text{U}^2$-Net.
  • Similarly, the CNN + U-Net stack is also a standard structure used for watermark extraction [1][4].
  • The only additional component is a lightweight $\text{U}^2$-Net used for mask prediction. We explored different configurations, including varying the size of $\text{U}^2$-Net and replacing it with a larger U-Net, but observed minimal impact on performance. As such, we selected the small variant of $\text{U}^2$-Net for efficiency, which proved to be sufficiently effective.

Overall, MaskMark’s strength lies not in the specific architectural choices, but in the mask mechanism itself. Because it is independent of the underlying backbone architecture, MaskMark remains flexible and easily transferable to other model designs.

References

1. Sepmark: Deep separable watermarking for unified source tracing and deepfake detection. ACM MM, 2023.
2. Robust-wide: Robust watermarking against instruction-driven image editing. ECCV, 2024.
3. Trustmark: Universal watermarking for arbitrary resolution images. Arxiv, 2023.
4. Editguard: Versatile image watermarking for tamper localization and copyright protection. CVPR, 2024.

---

Q2: Similar to HiDDeN and other classical image watermarking methods, WAM learns a residual map and embeds it into the cover image at the pixel level, while MaskMark concatenates the watermark feature map with the cover image in the channel dimension. Is this concatenation a key design to ensure better performance for MaskMark?

A2: Thank you for this insightful observation. We would like to clarify that both the residual map embedding and the channel-wise concatenation you mentioned are standard practices in neural network-based image watermarking methods (including ours), and occur at different stages of the watermark embedding process. Therefore, the channel-wise concatenation is not a key design choice unique to MaskMark, nor is it the main reason for its performance gains.

• Residual map embedding typically occurs after fusing the watermark information with the cover image to generate the encoded image, and serves as the final step in producing the watermarked image.
  • Specifically, once the encoder outputs an encoded image, the residual map is computed as: $I_\text{res} = I_\text{enc} − I_\text{cover},$ where $I_\text{res}$ is the residual map, $I_\text{enc}$ is the encoded image and $I_\text{cover}$ is the cover image. Then, the final watermarked image is produced by: $I_\text{wm} = I_\text{cover} + \alpha \times I_\text{res}.$ where $I_\text{wm}$ is the watermarked image and $\alpha$ is a tunable strength factor balancing robustness and visual quality.
  • This operation actually takes place inside the JND module in Figure 1 of the paper, rather than during the initial concatenation of $𝑓$. The residual map is further modulated by JND and then multiplied by the JND coefficient before being embedded into the cover image to produce the final watermarked image.
• Channel-wise concatenation, on the other hand, occurs at the early stage of the watermark encoder, before fusion begins.
  • Specifically, watermark information (either in the form of a repeated message map or an extracted feature map) is concatenated with the cover image or its intermediate features along the channel dimension.
  • This fused tensor is then passed through the encoder (e.g., a U-Net) to produce the encoded image. This strategy is widely used in prior works such as HiDDeN, MBRS, and even WAM itself, and is not a key design innovation of MaskMark.

---

W2&Q3: Can the authors provide theoretical analysis or insights on why the proposed method can achieve better performance than the selected baselines?

A: Thank you for the insightful question. While our paper focuses on empirical results, we provide here a conceptual and architectural analysis of why MaskMark achieves superior performance compared to prior baselines across three categories: global watermarking, localized watermarking, and watermark localization methods.

• Compared to Global Watermarking Methods (e.g., StegaStamp, TrustMark).
  • Global watermarking methods are not designed to support localized watermark extraction, which is discussed in Lines 134–140 of the paper.
• Compared to WAM (Localized Watermarking Method).
  • The core idea of WAM is to treat watermark extraction as a pixel-wise semantic segmentation problem. Each pixel independently carries bits of the watermark, which are later averaged during inference. This creates several challenges:
    • Extracting meaningful information from individual pixels is inherently difficult, leading to slow convergence, high training complexity, and limited capacity for longer watermark messages (as noted in the WAM paper).
    • The final extraction relies on a non-trainable and naive voting/averaging mechanism across pixels, which cannot be optimized end-to-end and performs poorly when the watermarked region is small or per-pixel accuracy is low.
  • In contrast, MaskMark is fundamentally built around spatially-aware encoding and decoding. The encoder and decoder are both guided by a spatial mask, enabling the system to:
    • Embed and extract information across multiple pixels within a localized region, which lowers training difficulty and allows extension to longer messages.
    • Train all components end-to-end, including both mask prediction and region-wise watermark embedding/extraction, avoiding WAM’s reliance on non-trainable inference heuristics. This leads to improved robustness in local watermark extraction
• Compared to EditGuard (Watermark Localization Method).
  • EditGuard embeds two separate types of signals: a 1D copyright watermark and a 2D fragile localization watermark to achieve watermark localization. This dual embedding comes with trade-offs:
    • The addition of a second watermark signal increases visual distortion and complexity.
    • Ensuring robustness of both the copyright and localization watermarks simultaneously is difficult and may involve conflicting optimization objectives, limiting the achievable performance.
  • The watermark localized by MaskMark serves as a copyright watermark, which allows robustness and traceability to be ensured simultaneously. This leads to a higher potential performance upper bound and minimal impact on visual quality.

---

Q4: WAM achieves multiple watermarks since the ViT decoder is a per-pixel-based message decoder, which can decode multiple watermarks simultaneously. Regarding MaskMark message decoder is one-dimensional bit-stream decoding. How can MaskMark achieve multiple watermarks under such settings?

A4: Thank you for your question. While WAM uses a per-pixel ViT decoder to directly extract multiple watermarks, our approach handles multi-watermark decoding differently but effectively.

• As detailed in Appendix C.2.4, MaskMark predicts a mask containing multiple spatially disjoint regions in a single forward pass. We then use OpenCV’s cv2.connectedComponents to segment this predicted mask into separate connected components, each corresponding to a distinct embedded watermark. Each segmented region is then processed independently by our one-dimensional bitstream decoder to extract its associated watermark message. This design enables MaskMark to support multiple watermarks simultaneously despite using a 1D decoder.

Author Response (Reviewer Umwi)

Dear Reviewer, thank you very much for your careful review of our paper and thoughtful comments. We hope the following responses can help clarify potential misunderstandings and alleviate your concerns.

---

W1&Q1: The idea is very similar to that of Watermark Anything in terms of goal, but also in terms of approach. Clarify what part of the method was taken from WAM, what is novel.

A: We appreciate your concerns and the opportunity to clarify the novelty and positioning of our method relative to WAM.

It is true that the only components we share with WAM are the JND module and the use of LaMa masks.

• These choices were indeed inspired by WAM; however, they are neither core components nor novel contributions of either method.
• Both are long-standing tools commonly used in image editing [1][2][3] and watermarking research [4][5][6], and we incorporated them purely as standard building blocks.

Our key contributions go well beyond these shared elements, in both functionality and architectural design:

• Native Local Watermark Embedding: A Functional Innovation.
  • Unlike WAM, which lacks native support for local watermark embedding, MaskMark is specifically designed for this functionality. While WAM embeds a global watermark and then applies post-hoc cropping to simulate local watermark embedding (which introduces signal loss and robustness issues), MaskMark embeds the watermark directly into designated regions by conditioning encoder on a spatial mask. This results in improved robustness and precise regional protection.
• Fundamental Differences in Core Design Philosophy.
  • The core idea of WAM is to treat watermark extraction as a pixel-wise semantic segmentation problem. Each pixel independently carries bits of the watermark, which are later averaged during inference. This creates several challenges:
    • Extracting meaningful information from individual pixels is inherently difficult, leading to slow convergence, high training complexity, and limited capacity for longer watermark messages (as noted in the WAM paper).
    • The final extraction relies on a non-trainable and naive voting/averaging mechanism across pixels, which cannot be optimized end-to-end and performs poorly when the watermarked region is small or per-pixel accuracy is low.
  • In contrast, MaskMark is fundamentally built around spatially-aware encoding and decoding. The encoder and decoder are both guided by a spatial mask, enabling the system to:
    • Embed and extract information across multiple pixels within a localized region, which lowers training difficulty and allows extension to longer messages.
    • Train all components end-to-end, including both mask prediction and region-wise watermark embedding/extraction, avoiding WAM’s reliance on non-trainable inference heuristics. This leads to improved robustness in local watermark extraction.

In summary, while we acknowledge WAM as an important prior work, MaskMark introduces a functionally novel capability (native local embedding) and is built upon a substantially different architectural philosophy. These distinctions are crucial for achieving improved efficiency and robustness.

References

1. Instructdiffusion: A generalist modeling interface for vision tasks. CVPR, 2024.
2. Paint by example: Exemplar-based image editing with diffusion models. CVPR, 2023.
3. Inpaint anything: Segment anything meets image inpainting. Arxiv, 2023.
4. Color image watermarking based on orientation diversity and color complexity. Expert Systems with Applications, 2020.
5. Pattern complexity-based JND estimation for quantization watermarking. Pattern Recognition Letters, 2020.
6. Towards perceptual image watermarking with robust texture measurement. Expert Systems with Applications, 2023.

---

Q2: What does "4. Lack of native local embedding: WAM embeds watermarks globally and then crops for local focus, introducing embedding losses that reduce extraction robustness." mean?

A2: Thank you for the question. This comment refers to a limitation of WAM in supporting localized watermark embedding.

• WAM performs watermark embedding over the entire image globally. To simulate a local watermark, WAM must embed a global watermark first and then crop the image to retain only the protected region. The remaining (unprotected) regions are replaced post hoc with the corresponding clean (non-watermarked) content from the original image.
• This process inherently causes the loss of watermark signal in cropped-out regions and creates inconsistencies at the region boundaries, which ultimately reduces the robustness and reliability of watermark extraction.

---

Q3: Is the method robust to moving a watermarked object inside the image or changing its proportions?

A3: Thank you for raising this interesting and challenging attack scenario that combines both valuemetric and geometric distortions, namely, the MoveAndResize attack.

• We have evaluated this setting as follows: a watermarked region (as defined by the segment mask) is cropped and resized using a random scale factor sampled from the range (0.5, 1.2). This resized patch is then pasted onto a different, non-watermarked image, and watermark extraction is performed on the composite.
• Evaluation results for MaskMark-D, MaskMark-ED, and WAM under this setting are shown in Table 1 below.
  • We observe that when the watermarked region is small, the default version of MaskMark may underperform. However, as the region size increases, MaskMark consistently outperforms WAM.
  • By incorporating the MoveAndResize distortion into the training pipeline and fine-tuning the model for just 50k steps, we achieved significant improvements in robustness (see the FT version in Table 1). In this adapted setting, MaskMark surpasses WAM across all region sizes.
  • WAM appears to suffer from a performance bottleneck when dealing with large watermarked regions. This is due to limited performance of its mask prediction, which hinders complete and precise recovery of the watermarked region for extraction. In contrast, MaskMark does not exhibit this issue.

Table 1. Watermark extraction accuracy under the MoveAndResize attack across different watermarked area ratios.

Author Response (Reviewer 4ngb)

Dear reviewer, thank you very much for your careful review of our paper and thoughtful comments. We hope the following responses can help address your concerns.

---

W1: I'm not sure that VAE attacks can be considered "adaptive".

A1: Thank you for pointing this out! We agree that our use of the term "adaptive" was inappropriate in this context, and we appreciate the opportunity to clarify.

• What we intended to convey is that users can adapt the model to specific attack scenarios by fine-tuning it with particular distortions included in the distortion layer. In this sense, the model becomes robust to specific attacks through targeted fine-tuning.
• Therefore, the term "adaptive" here refers to the model being fine-tuned to adaptively enhance its robustness against specific attacks, rather than describing the attacks themselves as adaptive. This is a writing issue on our part, we should not have placed "adaptive" in front of "attacks."
• To avoid confusion, we will revise our terminology and replace "adaptive" with "specific" when referring to this type of robustness enhancement via fine-tuning.

---

W2: The proposed method presumably shares the inherent robustness limitations of existing post-hoc image watermarks, which are vulnerable against generative "purification" attacks.

A2: Thank you for highlighting this important class of attacks. We agree that generative “purification” attacks, such as partial noising/denoising using diffusion models, pose a serious challenge for post-hoc watermarking methods.

• To address this, we conducted evaluations of both the default and VAE fine-tuned versions of MaskMark-D and MaskMark-ED under such purification attacks. Specifically, we used Stable Diffusion v1.5 with an empty prompt, applied 20 steps of forward noising to the watermarked image, and then performed denoising to generate the purified output.
• As shown in Table 1, the default model (without fine-tuning) is indeed vulnerable to such generative purification. However, the VAE fine-tuned variant demonstrates strong robustness even against this unseen purification attack, indicating great generalization.
• We hypothesize that this is due to the underlying similarity between VAE-based regeneration attacks and diffusion-based purification: they both aim to reconstruct the input while removing imperceptible signals. As such, incorporating differentiable VAE corruption during training provides a practical and effective proxy that enhances robustness against a broader class of generative purification attacks.

Table 1. Watermark extraction accuracy under generative "purification" attacks across different watermarked area ratios.

---

W3: I would strongly recommend a name change.

A3: Thank you for your great suggestion! We were not aware of the name overlap with the audio watermarking method. We appreciate your suggestion and will revise the name in the next revision or the camera-ready version to avoid confusion.

---

Q1: Can the authors more clearly indicate which evaluated image distortions were not seen by the model at training time?

A1: Thank you for highlighting this important aspect of robustness evaluation. We agree that assessing generalizability to unseen distortions is critical for a thorough understanding of a watermarking method’s reliability.

• We list in Table 2 and Table 3 the distortion types that were not seen during training, along with their corresponding results, as originally reported in the main paper.
• To further address your concern, we conducted additional evaluations (Table 4 and Table 5), where we increased the intensity of certain test-time distortions beyond the levels seen during training. Although these distortions are of the same types, their extreme variants were never encountered by the model, and thus can be considered unseen in a broader sense.
• Across both types of evaluation, MaskMark demonstrates strong robustness, indicating its generalizability to distortions beyond those encountered during training.

Table 2. Watermark extraction accuracy of MaskMark-D under distortions not seen during the training stage across different watermarked area ratios.

Table 3. Watermark extraction accuracy of MaskMark-ED under distortions not seen during the training stage across different watermarked area ratios.

Table 4. Watermark extraction accuracy of MaskMark-D under stronger-than-training distortions across different watermarked area ratios.

Table 5. Watermark extraction accuracy of MaskMark-ED under stronger-than-training distortions across different watermarked area ratios.