Residual Transferability in Neural Image Watermarking
Ziping Dong, Qi Li, Xinchao Wang
cs.CR, cs.CV
2026-09-26
Architecture, not training, drives watermark residual transfer. CoverLock XOR-wraps payloads with DINOv2 hashes and keeps average forgery ASR below 0.25% on CIN, VINE and MBRS.
Invisible image watermarks now sit in Google SynthID, Meta, OpenAI, and Amazon pipelines, sold as provenance. Residual-based forgery undercuts that claim. An attacker estimates the watermark residual (the perturbation of a watermarked image relative to a clean one) from one or a few released images and adds it to unrelated content; the decoder then reports the same message. Yang et al. average many references. WmForger uses a single watermarked image plus an auxiliary model. The cost is already low.
Earlier papers mostly built stronger attacks. They left open why the residual still decodes after the paste. The NUS group treats that survival as residual transferability (RT): after the residual is copied onto a disjoint cover, how much of the payload remains readable. High RT means the evidence barely depends on the host.
RT is scored with ground-truth residuals, so a particular estimator cannot inflate the number. For each message, average residuals from s sources, add them to T held-out targets, and set RT@s = max(2ā − 1, 0), where ā is mean bit accuracy. Zero is chance. One is near-lossless transfer. Defaults are s = T = 100 and five messages.
RT@100 on five systems: CIN 1.00, VINE 0.99, MBRS 0.98, HiDDeN 0.28, RivaGAN 0.08. Changing dataset, payload length, loss weights, or noise layers leaves HiDDeN low and MBRS high. The gap lives in the architecture.
Averaged residuals of high-RT encoders look almost identical across cover groups. At the decoder's last feature layer, cover-induced variance is 4.6% for CIN, 5.5% for VINE, and 1.0% for MBRS. HiDDeN and RivaGAN sit at 57.2% and 74.1%.
Two designs bind evidence to the cover. Broadcast-GAP spatially tiles the message into local image features and keeps spatial maps until a late global average pool. Strip both pieces from HiDDeN and RT@100 jumps from 0.214 to 0.985. Graft them onto MBRS and CIN and RT@100 falls to 0.098 and 0.091. Removing broadcast alone yields 0.228, GAP alone 0.313; the pair has to go together. RivaGAN modulates the embedding with content-adaptive attention. A fixed pattern raises RT@100 from 0.077 to 0.944.
VINE plus Broadcast-GAP failed to train (BitAcc 0.600, PSNR 6.97 dB). On MBRS the same graft drops PSNR from 42.32 to 27.07. Low RT is paid in fidelity.
When the encoder cannot be redesigned, CoverLock wraps the payload. Frozen DINOv2 patch tokens are pooled by channel mean and std, passed through a small head and a fixed orthogonal projection, and thresholded into a binary code b. Embed p = m ⊕ b; XOR b back at decode. The stock encoder and decoder stay frozen. Training is contrastive on MSCOCO views only: no watermark model, no forged pairs.
CIN, VINE, and MBRS are run on COCO, ImageNet, and DIV2K against GT@1 residuals, Yang et al.'s 100-image average, and one-shot WmForger. Thresholds follow a Bernoulli null at FPR < 10^{-6}.
CoverLock's highest average attack success rate (ASR, false-positive rate on forgeries) on this grid stays below 0.25%.
| Setting | ConvNeXt | MHDW | CoverLock |
| CIN, COCO, Yang ASR | 86.09% | 0.00% | 0.00% |
| MBRS, COCO, WmForger ASR | 96.28% | 4.76% | 0.06% |
| MBRS, COCO, GT@1 ASR | 2.41% | 11.37% | 0.11% |
On the same MBRS+COCO split, CoverLock-G true-positive rate (TPR) is 92.50% against MHDW's 86.38%. ConvNeXt is trained on genuine watermarks and GT forgeries, so a new residual estimator changes the artifact and the detector misses it. MHDW, a classical media hash, weakens when the residual gets cleaner: on MBRS, Yang ASR rises to 46.14%.
Payload BER is 7.4% for both MHDW and CoverLock-G. Hash BER falls from 14.6% to 4.2%. Extra robustness comes from a more stable image code.
Mean BitAcc on COCO under six distortions (Gaussian noise σ=0.05, brightness ×1.2, blur σ=1.0, JPEG Q=70, contrast ×1.2, 80% center crop):
| System | Vanilla | MHDW | CoverLock |
| CIN | 99.36 | 84.09 | 94.60 |
| MBRS | 92.55 | 81.39 | 89.40 |
| VINE | 91.61 | 83.12 | 87.75 |
Replacing DINOv2-Small with Giant on MBRS+COCO moves GT@1 ASR from 0.489% to 0.111%, with TPR still near 92%. On 50k clean ImageNet images, CoverLock-G tracks Binomial(256, 0.5) and records zero false accepts, so the original threshold can stay.
For post-processing watermarks already sitting in front of a generator, RT is a health check that does not assume one attack. New encoders should force cover dependence: mix the message with local features in space, or modulate the embedding by content. A cover-agnostic additive pattern is the failure mode.
CoverLock is the retrofit: watermark nets stay frozen, a small head trains on DINO statistics, and forgery data is unused. Classifier defenses have to retrain when the attack residue changes; this wrapper does not. The cost is one DINO forward pass and a few BitAcc points versus Vanilla. It is an engineering wrapper, not a new watermark family. Against handcrafted hashes and learned detectors, the operating point is better.
The appendix is blunt. Harsher or unseen transforms may move the security-robustness balance. Adaptive attacks on the image-binding hash, and larger distribution shifts, are untested. The extra module has train and serve cost. Other nets may bind to the cover by different means; only two mechanisms are isolated here.
Intervention models were retrained without robustness noise, so they are not the deployed HiDDeN or MBRS. Broadcast-GAP's PSNR hit is large, and VINE never converged, so copying HiDDeN's blocks is not a general recipe. Only post-processing neural watermarks are in the study; in-generation schemes are out of scope. CoverLock is trained on COCO and evaluated partly on COCO. The threat model assumes the attacker does not know the method or the lock. Numbers against a DINO-aware adaptive attacker do not exist.