Ilmu Komputer & AI editorial
What Breaks Local Watermarks? A Robustness Benchmark for Local Invisible Image Watermarking
The core problem
Local image watermarking embeds an invisible signal into selected image regions rather than spreading it across the entire image. This enables payload recovery from specific objects or regions without perceptibly altering the image. Existing studies evaluate robustness of payload recovery and localization under image transformations, but they typically focus on their own proposed method, resulting in narrow evaluations with inconsistent choices of transformations, datasets, and metrics. These inconsistencies limit direct comparisons across methods and obscure the overall picture of local watermark robustness.
To address this gap, the authors present the first systematic robustness benchmark for local watermarks across 55 image transformations. The benchmark covers four categories: (i) signal distortions, (ii) changes in image coordinate alignment, (iii) indirect local edits, and (iv) direct watermark edits. The evaluated methods are MaskWM, WAM, OmniGuard, TrustMark, and PixelSeal—all methods that either provide native localization or require minimal adaptation to support it. The central research question is: which transformations break local watermarks, and how do payload recover
Innovation
All evaluated methods are vulnerable to some transformation. MaskWM stands out as offering the strongest payload recovery and localization, although it has the lowest image quality in the clean setting. Synchronization further improves MaskWM's payload recovery under several geometric transformations, albeit at an additional cost to image quality.
A key finding is that local watermark robustness depends strongly on the nature of the transformation. Signal distortions are often tolerated by the strongest methods, while geometric misalignment and generative local edits—such as inpainting and outpainting—can completely impair payload recovery. The benchmark reports that payload recovery and localization are related but not interchangeable; both strongly depend on the transformation's impact on the watermark region.
Quantitatively, the paper reports that across the 55 transformations, the strongest methods maintain high payload recovery under signal distortions but suffer severe drops under geometric misalignment and generative edits. For example, inpainting and outpainting can reduce payload recovery to near zero for all methods, while rotation and scaling cause significant localiza
Why it matters
The benchmark reveals a clear hierarchy of threats to local watermarks. Signal distortions, which preserve spatial alignment and local content structure, are the least damaging. Geometric misalignment breaks the spatial correspondence between the watermark and the image, causing localization to fail even if some payload signal remains. Generative local edits are the most destructive because they replace or extend the watermarked region with new content, effectively erasing the watermark.
The finding that payload recovery and localization are not interchangeable has important implications for system design. A method may recover the payload but fail to localize the region, or vice versa. This suggests that robustness should be reported separately for both tasks, and that benchmarks should not conflate them.
MaskWM's strong performance under payload recovery and localization, despite lower clean image quality, highlights a trade-off between imperceptibility and robustness. Synchronization improves geometric robustness but further reduces image quality, indicating that no single configuration dominates across all criteria. The authors conclude that local watermark robustness is highly transformation-dependent, and that future methods should be evaluated against a diverse set of transformations, especially geometric misalignment and generative edits, to avoid overestimating robustness.
The benchmark's taxonomy of transformations provides a foundation for standardized evaluation. By covering 55 transformations across four categories, it enables direct comparison across methods and exposes failure modes that narrower evaluations miss. The results call for more robust synchronization mechanisms and for watermarking methods that can survive generative local edits, which are increasingly common in real-world image editing workflows.
Who should read this
Opening member content…