AI Image Watermarking: Neural Networks for Robust Attribution

Watermarking images, particularly those generated by AI, is a growing area of interest, especially in computer vision. Unlike steganography, which aims to secretly embed messages, watermarking focuses on verifying the origin or creator of an image through an embedded signature.

Watermarking vs. Steganography

Steganography involves hiding messages in a way that prevents detection, often maximizing the payload of hidden data. The goal is secrecy and robustness against manipulation, while minimally affecting image quality.

Watermarking, however, is about attribution: determining if a specific person or process created an image based on an embedded signature. While metadata (like camera settings) can contain signatures, it's easily edited or removed, especially when images are uploaded online and converted (e.g., to JPEG).

Limitations of Simple Watermarking Techniques

Early attempts at digital image watermarking often involved manipulating the least significant bits (LSBs) of pixel data.

How LSB Watermarking Works

Digital images typically store pixel data in red, green, and blue channels, each usually 8 bits long (values from 0 to 255). LSB watermarking involves changing the last one or two bits of these channels to embed data. For example, a message like "10" could be embedded by changing the last two bits of a pixel's color value.

Why LSB Watermarking Fails

While easy and quick to implement, and capable of storing a large amount of data with minimal visible change (a change of up to 3 out of 255 levels is imperceptible), LSB watermarking is not robust:

• Easy to remove: Randomly flipping the last few bits can easily destroy the watermark.
• Easy to detect: The watermark can be read directly from the LSBs.
• Not robust to manipulation: Cropping, compression (like JPEG, which removes high frequencies), color changes, or resizing can easily disrupt or remove the watermark.

Modern AI-Powered Watermarking

Modern approaches leverage neural networks to embed more robust watermarks. Google's SynthID and Adobe's Trustmark are examples of such systems. Adobe's Trustmark is open-source, allowing for examination and understanding of its mechanisms.

The Encoder-Decoder Network Approach

The core idea involves an encoder-decoder network:

1. Encoder: Takes an input image and a watermark (e.g., a short string like "Mike") and outputs a watermarked version of the image.
   • The output image must be perceptually very similar to the original.
   • The watermark's influence on the image is subtle, similar to how a text prompt influences AI image generation.
   • The amount of data embedded is small (e.g., 32 to 100 bits), unlike steganography.
2. Detector: A separate network is trained to detect the presence of a watermark and recover the embedded code (e.g., "Mike").

Training Process

This system is trained using an adversarial process:

• Thousands of images and random watermark strings are fed into the encoder.
• The detector attempts to recover the string.
• Both networks are jointly trained: the encoder learns to embed the watermark more effectively, and the detector learns to recover it.
• Additional Loss Functions:
  • A loss function ensures the detector successfully recovers the watermark.
  • Another network (a "discriminator") is often used to determine if an image is real or watermarked. The goal is to train the encoder to produce watermarked images that the discriminator cannot distinguish from real images, ensuring perceptual similarity.

Addressing Robustness Challenges

The initial encoder-decoder model still struggles with common image manipulations like resizing, cropping, or color changes. To enhance robustness, the training process is made more complex:

1. Augmentation Layer: After the encoder produces a watermarked image, it's subjected to a variety of random "messing about" augmentations during training. These include:
   • Cropping
   • Flipping
   • Color changes
   • Resizing
   • Deleting parts
   • Rotations
2. Robust Detector Training: The detector is then trained on these augmented, noisy versions of the watermarked images. This forces the network to learn to extract the watermark even after significant manipulation.

Handling Arbitrary Image Sizes

To apply watermarking to images of any size, a specific technique is used:

1. Fixed-Size Processing: The core watermarking (encoder) and detection (detector) networks are trained and operate at a fixed, small resolution (e.g., 256x256 pixels).
2. Watermark Application:
   • A large input image is first shrunk to the fixed size (e.g., 256x256).
   • The encoder applies the watermark to this small version.
   • The difference between the shrunk original and the shrunk watermarked image (the "watermark pixels") is calculated. This difference image is mostly gray with subtle bright/dark spots.
   • This difference image is then expanded back to the original image's resolution.
   • Finally, this expanded watermark difference is applied to the original high-resolution image.
3. Watermark Detection: To detect a watermark in any image, it is first shrunk to the fixed 256x256 resolution, and then the detector network is applied. This ensures robustness across different image sizes.

Practical Demonstration with Trustmark

A demonstration using Adobe's open-source Trustmark system showed its capabilities:

• Embedding: A keyword like "computer" was embedded into an image of a campus. The maximum pixel intensity change was about 25 points, more significant than LSB changes but subtly applied.
• Visual Impact: The watermarked image looked normal, but flipping between the original and watermarked versions revealed subtle changes like added highlights or artifacts in the sky. The difference image showed these changes spread across the image, with fewer in uniform areas like the sky.
• Detection: The system successfully detected the "computer" watermark from the watermarked image.
• Robustness Testing:
  • JPEG Compression: The watermark was successfully detected even after saving the image with 75% JPEG quality, which removes high frequencies.
  • Resizing: The watermark was detected after shrinking the image to 600 pixels wide.
  • Cropping and Color Changes:
    • Initial attempts with significant cropping and saturation changes still allowed detection.
    • However, cropping the image by half its area (e.g., focusing only on a small section of the building) eventually led to the watermark not being detected.

Advanced Robustness and Attacks

Modern systems like Google's SynthID use even stronger augmentations during training and more powerful backbone networks (e.g., transformers instead of convolutional networks) to enhance robustness. Some systems are even trained to detect watermarks from printed photos.

Countering Watermark Extraction and Re-application

A potential attack involves extracting a watermark (by subtracting an original image from its watermarked version) and then stamping it onto another image to falsely attribute it (e.g., claiming a human-made image was AI-generated).

To prevent this, training processes are designed to:

• Ensure reliable watermark recovery only when it was added to the actual image.
• Train against scenarios where incorrect watermarks are applied to different images, making it harder to detect them while still detecting valid watermarks.
• This ties the watermark not just to the code and the input image, but also to their specific combination, preventing easy swapping.

Purpose and Limitations of Watermarking

Watermarking serves various purposes:

• AI Attribution: Google primarily uses SynthID for AI-generated images.
• Copyright and Licensing: For photographers or artists, watermarks can protect intellectual property, prevent unauthorized use, or ensure licensing compliance.
• Leak Prevention: Subtle watermarks can track leaked content.

However, watermarking is not a perfect solution:

• Removability: Skilled attackers or even casual editors can often find ways to remove watermarks through cropping, color manipulation, or other editing techniques, especially with powerful modern image editing tools.
• Limited Proof: A watermark only indicates that an image passed through a specific process (e.g., "generated by Google AI"). It does not definitively prove an image's trustworthiness or that it wasn't AI-generated if no watermark is found (as a watermark could have been removed).
• False Attribution: The ability to add a watermark (e.g., "no AI used") doesn't prove authenticity, as anyone could apply such a watermark.

For stronger proof of origin and trustworthiness, digital certificates and signatures are used, which will be discussed in future content. These provide verifiable metadata about an image's provenance.