Invisible Image Watermarking and Its Robustness

Google reports that SynthID-Image has watermarked more than ten billion images and video frames across its services (Gowal et al., 2025, SynthID-Image: Image watermarking at internet scale, arXiv:2510.09263). At that volume a detector wrong one time in a million still makes around ten thousand mistakes, and the more awkward problem runs the other way: anyone who wants the mark gone can usually remove it with an off-the-shelf diffusion model. Invisible image watermarking is a real engineering discipline with real deployments, and its robustness claims only hold against the attacks someone thought to test.

Unlike text watermarks, which bias a sampler over a discrete vocabulary (text-watermarking-and-the-detectability-tradeoff), image marks live in a continuous space: more room to hide a signal, more room to destroy it. Unlike content credentials, they sit in the pixels, so a screenshot does not strip them.

Three places to put the signal

Post-hoc pixel watermarks. HiDDeN trains an encoder \(E\) and a decoder \(D\) end to end (Zhu et al., 2018, HiDDeN: Hiding Data With Deep Networks, arXiv:1807.09937). Given a cover image \(x\) and a \(k\)-bit message \(m \in \{0,1\}^k\), the encoder produces \(x_w = E(x, m)\). A differentiable noise layer \(N\) applies JPEG approximations, crops or blur, and the decoder reads \(\hat m = D(N(x_w))\). Training minimises

where the first term keeps the change small, \(\mathcal{L}_{\text{adv}}\) is a discriminator loss that pushes \(x_w\) towards the distribution of natural images, and the binary cross-entropy term makes the message recoverable. The weights \(\lambda\) trade imperceptibility against robustness, and robustness only extends to the distortions placed in \(N\).

In-model watermarks. Stable Signature fine-tunes the latent decoder of a latent diffusion model so every image it renders already carries a fixed signature (Fernandez et al., 2023, The Stable Signature, ICCV 2023, arXiv:2303.15435). The authors report detection above 90% on images cropped to 10% of their content, at a false-positive rate below \(10^{-6}\).

Generation-time semantic watermarks. Tree-Ring writes a key pattern into the Fourier transform of the initial noise \(z_T\) before sampling (Wen et al., 2023, Tree-Ring Watermarks, NeurIPS 2023). Detection runs DDIM inversion to estimate \(\hat z_T\) from the image and compares the masked Fourier region against the key. Rings in frequency space are unchanged by rotation, flips and crops. The cost is that the detector needs the generator to invert, and the scheme is zero-bit: it answers "watermarked or not" and carries no message.

The threshold sets the false-positive rate

For a multi-bit scheme, detection counts matching bits \(s = \sum_{i=1}^{k} \mathbf{1}[\hat m_i = m_i]\) and flags the image when \(s \ge \tau\). On an unwatermarked image the decoded bits behave roughly like fair coin flips, so under the null hypothesis \(s \sim \mathrm{Binomial}(k, \tfrac12)\) and

With \(k = 48\): \(\tau = 36\) gives \(3.6 \times 10^{-4}\), \(\tau = 41\) gives \(3.1 \times 10^{-7}\) and \(\tau = 42\) gives \(5.0 \times 10^{-8}\). Scanning a billion unwatermarked images at \(\tau = 41\) still produces about 310 false flags. Raising \(\tau\) buys precision, and every step up means a mildly degraded watermarked image is more likely to fall below the line. The fair-coin null is an idealisation, since decoders can be biased on some image types, so check published rates on the population you will scan.

Regeneration: the attack that generalises

Zhao et al. show that watermarks made of small pixel perturbations are removable in principle: add Gaussian noise \(\tilde x = x_w + \sigma\epsilon\) until the watermark is destroyed, then reconstruct with a denoiser or diffusion model (Zhao et al., 2024, Invisible Image Watermarks Are Provably Removable Using Generative AI, NeurIPS 2024, arXiv:2306.01953). Against four schemes it beat existing attacks on both detection rate and image quality. Reconstruction yields a new natural image with the same content, and an imperceptible residual is exactly what it throws away.

Saberi et al. formalise the dilemma (Saberi et al., 2024, Robustness of AI-Image Detectors: Fundamental Limits and Practical Attacks, arXiv:2310.00076). For low-perturbation watermarks, diffusion purification creates a trade-off between evasion error and spoofing error. High-perturbation watermarks resist purification but fall to adversarial attacks built on a substitute model. They also show spoofing: using only black-box access to the detector, an attacker can make a real photograph register as watermarked.

Where the field disagrees, and when it breaks

The live disagreement is whether semantic watermarks escape the regeneration argument. Zhao et al. suggest watermarks that keep an image semantically similar are the natural defence, and Tree-Ring is built on that intuition: its signal is carried by the sampling trajectory, not a residual. The WAVES benchmark, which stress-tests schemes against distortions, regeneration and adversarial attacks, found previously unknown weaknesses in several modern algorithms, which is the argument against trusting any scheme's own robustness table (An et al., 2024, WAVES, ICML 2024, arXiv:2401.08573).

Open weights defeat in-model marks. A signature fine-tuned into a latent decoder is gone the moment a user swaps in the original decoder. Stable Signature protects a hosted API or a closed release, not a public checkpoint.

Absence proves nothing. A negative result means "not watermarked by this scheme, or no longer watermarked". Treating it as evidence of authenticity is the base-rate error that detecting-synthetic-media-without-watermarks warns about.

Spoofing turns the detector into a weapon. If a public detector can be driven to flag real photos, a positive result is no longer strong evidence of origin. SynthID verification, for one, is gated to trusted testers.

Robustness is a list, not a property. A robustness table covers the transformations in the noise layer and evaluation suite. Generative upscalers, style transfer and image-to-image editing are often missing, and they are what circulating images go through.