On the Coexistence and Ensembling of Watermarks

We thank the reviewer for their detailed and constructive feedback. We appreciate their recognition of the novelty of our work in exploring watermark coexistence, the real-world relevance of our proposed scenarios, and the clarity of our paper's organisation. With regards to their concerns and questions, here are our answers:

W1 / Q1: There lacks the evidence to prove the watermark coexistence can still be seen in other categories of carriers different from images. Authors can modify the expression of this manuscript to just focus on image watermarking, or consider to add some experiments using audio or text watermarking methods to prove their opinion.

As we disclose at the end of the Introduction (lines 65–66), we restrict the focus of the present work to watermarking in the image domain. However, we agree with the reviewer that some parts of the paper might sound more general than we aimed them to be therefore. Therefore, we have edited the Abstract and the Introduction to be more explicitly clear that we are focusing on image watermarking. Thank you for your feedback!

W2 / Q2. Authors are encouraged to give more theoretical analysis to try to find out the root reason causing the watermark coexistence, which is also beneficial for the improvement of academic value of this manuscript.

We thank the reviewer for their suggestion. We have added a new Appendix A providing a geometric intuition behind watermark coexistence. While a rigorous theoretical analysis is beyond the scope of this work, our geometric interpretation offers insights into the underlying mechanisms that enable different watermarking methods to coexist. We believe this analysis enhances the academic value of our manuscript.

W3 / Q3. Based on their acquired findings shown in this manuscript, it would be better for authors to go further and show more special contributions less relying on previous achievements, so as to strengthen the novelty of their work.

The novelty of our work is not in proposing a single novel watermarking model but rather in showing that there can exist watermarking systems consisting of multiple watermarking methods. The core contributions of our work lie in demonstrating the feasibility of watermark coexistence for modern deep learning-based watermarking techniques. We are the first to formally introduce this concept, evaluate its effectiveness, and propose ensembling as a novel method to enhance watermark capacity. Our work provides a deeper understanding of the underlying mechanisms of watermark coexistence and offers practical strategies for leveraging this phenomenon to achieve improved performance trade-offs.

W4 / Q4. Authors should manage to find a method to better instruct ordinary users to correctly find watermarking methods that can really achieve desired performance with the utilization of watermark coexistence, compared to just use one strong base method with ECC.

We acknowledge the reviewer's concern regarding the potential complexity of choosing optimal watermarking methods for ordinary users. However, it's important to note that in practical scenarios, end-users often don't directly select watermarking methods. Instead, they rely on systems or platforms that incorporate watermarking as a backend process. Our work is primarily targeted at the developers of these systems. By understanding the trade-offs between different methods and their potential for coexistence, these developers can make informed decisions to optimize watermarking performance for their specific use cases.

W5 / Q5. Typo

Thank you for spotting this typo. We have fixed it.

We thank the reviewer for acknowledging the practical importance of the watermark coexistence problem and the value to the field of our comprehensive experimental analysis. Here are our responses to the reviewer’s concerns:

W1. The conditions for robustness testing are not fully explained. Section 2 contains ambiguous phrases, such as "augmentations used for training RivaGAN." Clear details on the types of attacks used, each attack's strength, and the methodology for calculating the robustness values would improve clarity.

The reviewer is right, the nature of the augmentations for the various robustness metrics is an important detail and we apologise for the omission. We have added these details to a new Appendix D in the revised manuscript. Thank you for pointing this out!

W2. The effectiveness of ensembling under varying attack strengths needs further verification. Given that robustness is achieved through ECC, it would be beneficial to assess whether the proposed method can withstand strong attacks.

We would like to clarify that robustness is not achieved solely through error-correcting codes (ECCs) but also via the inherent robustness of the base watermarking models. ECCs are only used to further boost the robustness. We are not sure what the reviewer considers “strong attacks” but we evaluate against 5 different sets of augmentations and observe that for every model there is at least one set of augmentations that the model would have less than 50% accuracy for. Hence, the augmentations we consider appear to be sufficiently strong and challenging for the 8 models we consider.

W3. Despite the inclusion of ECC, the observed robustness values appear insufficient for practical applications.

We are not sure what level of robustness the reviewer considers sufficient for practical applications, but in our experience that depends greatly on the application and what trade-off it can tolerate. That is a key thesis of our paper, and a key property of watermarking: it is all about the trade-offs. Using the techniques in the paper, we can easily construct very robust watermarks, by reducing the image quality or the capacity (e.g. we can apply the trivial repetition code to a 100bit block size to get 1bit message, while being able to correct up to 49 bit flips). We chose the case studies in the paper with a somewhat balanced trade-off setting in mind, but of course, any other setting is also possible.

W4. Figure 5 does not demonstrate an improvement in the overall capacity-robustness-quality trade-off with ensembling. For example, in sub figure B, ensembling reduces robustness compared to TrustMark. Although a slight improvement in quality is noted, it does not suggest that ensembling offers a better trade-off.

We want to clarify that we do not claim that we have experimental results showing that ensembling simultaneously improves capacity, accuracy, robustness and quality. In fact, we state the opposite (see lines 508-511). What we claim is that ensembling can enable different trade-offs than what the original watermarking model can do alone. In this way, ensembling is a powerful tool for specialising existing methods for the concrete requirements of downstream applications.

We thank the reviewer for their kind words regarding the practical value, logical organisation, clear articulation, and comprehensive experimental design of our work. As for their outstanding concern, we have the following response:

W1. The coexistence of multiple watermarks was proposed and discussed in the past as an early issue. As the author mentioned, the frequency-based method (one category of watermark coexistence research) and similar studies like [1] . Therefore, when stating the contribution, it would be better to specifically refer to deep learning-based watermark coexistence research.

While we tried to highlight previous work on non-deep learning-based coexistence and ensembling, that was only in the coexistence section (Section 3, lines 143–145). We agree that we should highlight that our paper focuses on deep-learning based techniques and hence have edited the abstract and introduction to highlight that. Thank you for this feedback!

W2. Although the author claims that past frequency-based watermark coexistence research is not applicable to current deep learning-based watermark methods, there is a lack of corresponding discussion and formula derivation. It might be beneficial to include a comparison of relevant methods in the experiments to further enhance persuasiveness.

Unfortunately, the frequency-based watermark coexistence work that we have seen, including the work referenced by the reviewer, appears to be tailored for a specific base watermarking technique, e.g., DWT. Therefore, it is difficult to compare against these prior works, considering we cannot apply their techniques to most modern deep watermarking methods of interest. We are also afraid that deep-learning methods are not quite amenable to closed-form analysis and we are not sure how one could go about deriving formulas for their performance. Nevertheless, if the reviewer has concrete suggestions how we could go about this, we would appreciate their insight!

Following the reviewers’ questions, we also added a new Appendix A providing a geometric perspective that helps explain why watermarking methods can coexist. While this is not a formal analysis, we hope it adds more intuition and depth to our results.

W3. The key figures and table in the paper are very complex. Consider adding more detailed explanations to help readers understand them better.

Thank you for the feedback! As we aim for clear and self-contained figures, we edited the descriptions of Table 1 and Figures 2 and 3 to add further details. We hope that improves the readability of the paper.

We would like to thank the reviewer for appreciating how our work leverages extensive experimentation to challenge common beliefs about the coexistence of watermarks, as well as the presentation of our paper. With that in mind, we would like to address their concerns.

W1. The authors in this work did not present complete scientific innovation; instead, it focuses more on engineering improvements and exploration, as strength clipping and error correction are relatively mature techniques. I am somewhat concerned about whether the authors have demonstrated sufficient scientific innovation in this work.

We agree with the reviewer that strength clipping and error-correction are not novel techniques in the context of watermarking, as described in the introduction of Section 4 (line 351) and in Figure 4. The scientific contribution of our work lies elsewhere, namely:

1. We are first to formulate the need for watermark coexistence, first to evaluate it for modern deep-learning based watermarking techniques, and first to demonstrate that watermark coexistence does indeed happen out of the box.

2. We study the “fine print” of these findings, including when coexistence happens, and what trade-offs are involved, and offer potential explanations as to why it might be happening.

3. We offer ensembling watermarks, a technique which, to the best of our knowledge, has never before been applied to watermarking. We show that naïvely applying ensembling is not enough and demonstrate the importance of combining it with strength clipping and error-correction. These two are tools we use but coexistence and ensembling are the core scientific innovations of our work.

Overall, the core scientific innovation of our work is showing that, contrary to popular belief, watermarks can coexist, as well as showing how this coexistence can be leveraged for obtaining new trade-offs between capacity, accuracy, robustness and image quality.

W2. The authors are encouraged to provide some theoretical justification as to why most watermarking methods can coexist. Additionally, they could offer paradigms, such as which types of watermarking integrations tend to yield better results. For example, it would be helpful to investigate whether watermarks using different hiding techniques, such as frequency and spatial domains, are more easily integrated. This would aid in the design of future watermarking methods.

We thank the reviewer for their suggestion. We have added a new appendix (App. A in the revised manuscript) discussing our geometric intuition behind watermark coexistence. To quote from there:

One explanation is that watermarks are designed to be robust to various augmentations, which induces sparsity into what perturbations can be considered valid watermarks. However, there are many possible sparse patterns that can satisfy the robustness requirements and different watermarking methods might be —either by random selection, or due to particular design decisions— picking different such patterns. As a result, the perturbations used by different methods could be non-overlapping and might be sufficiently different so that they are still identifiable even after composing.

While a rigorous theoretical analysis remains an open challenge, our geometric interpretation provides a conceptual understanding of why different watermarking methods can coexist. We believe this analysis supports our empirical findings and provides a foundation for future research in this area.

W3. For the initially embedded watermark, the second watermark added actually serves as a form of degradation. Have the authors considered jointly training the encoding and decoding processes of the first and second watermarks? This might lead to better coexistence results.

This is an excellent observation! We did consider fine-tuning the individual watermarking models to work better when applied together. We also mention that in the Discussion section of the paper (line 533). However, we ultimately decided that this would be out-of-scope for the current paper. First, if we modify the models, analysing whether the models coexist would be much more complicated as there would be a dependency on a training dataset and hyperparameters. It would also not help us with making conclusions about the original models. Furthermore, some of the methods we considered cannot be fine-tuned without drastically modifying the method itself. For example, DwtDct and DwtDctSvd have no learnable parameters, while SSL is not trained as it utilises a frozen embedding model. Hence, fine-tuning these models might change them too much. Thus, we concluded that this would be of little scientific value. That being said, for practical applications, we do believe there could be added utility of jointly fine-tuning the constituent methods, if that is possible.

Thank you for your responses. I have carefully reviewed all the comments and your replies. My main concerns have been addressed, so I will maintain my original score. Good luck!