arxiv: 2604.11491 · v1 · submitted 2026-04-13 · 📊 stat.ML · cs.AI· cs.LG· math.ST· stat.ME· stat.TH

ADD for Multi-Bit Image Watermarking

An Luo , Jie Ding This is my paper

Pith reviewed 2026-05-10 14:47 UTC · model grok-4.3

classification 📊 stat.ML cs.AIcs.LGmath.STstat.MEstat.TH

keywords multi-bit image watermarkingrobust watermarkinggenerative image authenticityinner-product decodingADD methodMS-COCO benchmarkimage distortion resiliencelinear embedding

0 comments p. Extension

The pith

ADD embeds 48-bit messages into images so they decode at 100% accuracy even after distortions, using a learned additive watermark and inner-product recovery.

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The paper develops ADD to solve the problem of marking AI-generated images with traceable multi-bit messages that survive editing and transmission. It learns a single watermark vector that combines linearly with the message bits before being added to the image, then recovers the bits by computing inner products between the received image and the learned vector. On the MS-COCO benchmark this produces complete decoding accuracy for 48-bit messages, with at most a 2% accuracy drop across many common distortions, while also running substantially faster than prior techniques. The authors supply a theoretical account showing why the linear embedding and dot-product decoder remain stable. A reader would care because reliable, efficient watermarking offers a concrete tool for verifying image origins amid widespread generative models.

Core claim

ADD learns a watermark vector such that any chosen multi-bit message can be encoded by scaling the vector components according to the message bits and adding the result to the image; the message is later recovered by taking the sign of the inner products between the watermarked image and each component of the learned watermark. This construction reaches 100% decoding accuracy on 48-bit messages from the MS-COCO dataset, loses no more than 2% accuracy under a broad suite of distortions, requires only linear operations at both embedding and decoding stages, and is accompanied by a proof that the inner-product rule is robust when the watermark satisfies certain orthogonality and norm conditions

What carries the argument

ADD (Add, Dot, Decode): a learned watermark vector that is linearly combined with message bits and added to the image, followed by recovery via inner products with the same vector

If this is right

Images carrying 48-bit identifiers can be traced to their source even after compression, cropping, noise addition, or rotation.
Embedding and verification become fast enough for real-time use on large image collections.
Higher message capacities become practical without the steep robustness penalty seen in earlier methods.
The linear structure supplies a simple, analyzable alternative to the optimization-heavy or network-based watermarkers used today.

Where Pith is reading between the lines

These are editorial extensions of the paper, not claims the author makes directly.

The same additive construction could be tested on video frames or audio spectrograms to see whether the inner-product decoder transfers across modalities.
Because decoding requires only dot products, it could be implemented directly in hardware or on low-power devices for on-device verification.
Training the watermark once on a diverse image corpus might allow the same fixed vector to watermark outputs from many different generative models without per-model retraining.

Load-bearing premise

The learned watermark can be trained to stay robust under many distortions while leaving the image visually unchanged, and the inner-product decoder will continue to work on images and distortions outside the training distribution.

What would settle it

Measure 48-bit decoding accuracy on a fresh set of images watermarked with ADD and then subjected to a distortion type withheld from training; if accuracy falls below 98% the central performance claim is falsified.

Figures

Figures reproduced from arXiv: 2604.11491 by An Luo, Jie Ding.

**Figure 1.** Figure 1: An overview of multi-bit image watermarking. An image, which may be generated by AI models or created as digital artwork such as paintings or photographs, can be embedded with a multi-bit message. Such messages may encode information such as a timestamp, IP address, signature, or private key. The resulting watermarked image is then distributed over the Internet and may undergo distortions (e.g., compressio… view at source ↗

**Figure 2.** Figure 2: Overview of ADD for multi-bit image watermarking. Given an image x ∈ X , a K-bit message m ∈ {±1} K is embedded by x˜ = x+ PK k=1 mkwk. After distribution, the watermarked image may be distorted by an distortion operator A, yielding the observed image x˜ ′ i = A(x˜). Detection is performed to decide whether x˜ ′ is watermarked by ADD and if detected, decoding is performed to recover m. Specifically, detect… view at source ↗

**Figure 3.** Figure 3: Qualitative comparison of image quality across watermarking methods. All methods are evaluated on the same image, with PSNR values reported. Our method is visually close to the original image, as the rest of the methods do. A visual comparison of the magnified pixel-wise differences is in Section G of the supplementary material. 24 [PITH_FULL_IMAGE:figures/full_fig_p024_3.png] view at source ↗

**Figure 4.** Figure 4: Empirical trade-offs from β and n. Trade-off between PSNR and average bit accuracy from (a) different β values and (b) different training sample sizes n. In (a), n = 2000 and β ∈ {1, 10, 100, 500, 1000, 5000, 10000}. In (b), β = 1000 and n ∈ {10, 15, 20, 50, 100, 500, 1000, 2000}. The dashed red lines indicate acceptable thresholds chosen to reflect practical deployment requirements: PSNR = 32 dB in (a) an… view at source ↗

read the original abstract

As generative models enable rapid creation of high-fidelity images, societal concerns about misinformation and authenticity have intensified. A promising remedy is multi-bit image watermarking, which embeds a multi-bit message into an image so that a verifier can later detect whether the image is generated by someone and further identify the source by decoding the embedded message. Existing approaches often fall short in capacity, resilience to common image distortions, and theoretical justification. To address these limitations, we propose ADD (Add, Dot, Decode), a multi-bit image watermarking method with two stages: learning a watermark to be linearly combined with the multi-bit message and added to the image, and decoding through inner products between the watermarked image and the learned watermark. On the standard MS-COCO benchmark, we demonstrate that for the challenging task of 48-bit watermarking, ADD achieves 100\% decoding accuracy, with performance dropping by at most 2\% under a wide range of image distortions, substantially smaller than the 14\% average drop of state-of-the-art methods. In addition, ADD achieves substantial computational gains, with 2-fold faster embedding and 7.4-fold faster decoding than the fastest existing method. We further provide a theoretical analysis explaining why the learned watermark and the corresponding decoding rule are effective.

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, simulated authors' rebuttal, and a circularity audit. Tearing a paper down is the easy half of reading it; the pith above is the substance, this is the friction.

Desk Editor's Note private letter to a colleague

ADD gets strong reported numbers on 48-bit watermarking with small distortion drops and speed gains, but the robustness may depend on whether test distortions entered the learning stage.

read the letter

The main takeaway is that ADD achieves 100% decoding accuracy for 48-bit watermarks on MS-COCO and limits the accuracy drop to 2% under various distortions, compared to 14% for existing methods, while also running faster. This could be useful if the numbers hold up. The approach is new in its specific combination: they learn a watermark vector that gets linearly added to the image after being combined with the message, then decode using inner products. They back this with some theoretical analysis and report clear speed gains of 2 times for embedding and 7.4 times for decoding. The paper does well in focusing on a practical problem and providing benchmark numbers that are easy to understand. The theoretical part adds some justification beyond pure empirics. The soft spots are around the robustness. The concern that the optimization might have included the test distortions is worth checking in the full text. If the learning stage sees the same distortion types, the small drop becomes less impressive and the outperformance over SOTA less convincing. The paper should clarify the exact training procedure, including whether distortions are in the objective or not, and provide more on baselines and any statistical tests. Without that, the central claim is harder to evaluate fully. This work is aimed at people building tools for verifying AI-generated images and content moderation. Readers working on signal processing or ML for security applications could find the simple decoder and speed improvements interesting. It deserves a serious referee because the claims are concrete and the method is implementable, even if revisions are needed on the experimental details. I would recommend sending it for peer review with attention to the training-distortion overlap issue.

Referee Report

3 major / 2 minor

Summary. The paper proposes ADD (Add, Dot, Decode), a two-stage multi-bit image watermarking scheme: a watermark vector is learned and linearly combined with the message bits before addition to the image; decoding uses inner products between the watermarked image and the learned watermark. On MS-COCO for 48-bit watermarking it claims 100% decoding accuracy with at most 2% degradation under a range of distortions (versus 14% average for prior methods), 2x faster embedding and 7.4x faster decoding than the fastest baseline, plus a theoretical analysis justifying the approach.

Significance. If the robustness holds without training-test overlap on distortions and the speed/accuracy numbers are reproducible with full experimental details, the work would represent a meaningful advance in high-capacity, distortion-resilient watermarking for generative images, offering both empirical gains and theoretical grounding that could influence practical deployment in authenticity verification.

major comments (3)

[Method section] Method section (description of the two-stage process): the learning objective for the watermark vector is not stated to exclude the specific distortions later used in evaluation. If those distortions appear inside the optimization (as the skeptic concern notes), the reported 100% baseline accuracy and ≤2% drop become unsurprising and the comparison to SOTA methods (whose 14% drop is presented as inferior) is no longer apples-to-apples; the central robustness claim then requires explicit confirmation that test distortions are held out.
[Experiments section] Experiments section (performance claims on MS-COCO): the abstract and results assert 100% accuracy, ≤2% drop, and large margins over baselines, yet no details are supplied on the exact baselines, statistical tests, distortion parameter ranges, training/validation splits, or whether the inner-product decoder was tuned on the same distortion family. These omissions make the load-bearing empirical claims unverifiable from the provided text.
[Theoretical analysis section] Theoretical analysis section: the manuscript references a theoretical justification for why the learned watermark plus inner-product decoder is effective, but does not show how the analysis establishes robustness when the test-time distortion distribution differs from any distribution seen during learning; without this, the theory does not yet close the gap raised by the potential training-test overlap.

minor comments (2)

[Abstract and Introduction] The abstract and introduction should include a brief statement of the exact training procedure and whether any evaluation distortions enter the learning stage, to preempt the generalization concern.
[Results tables/figures] Tables or figures reporting accuracy under distortions should list the precise distortion parameters and include error bars or statistical significance markers to support the 'at most 2%' claim.

Simulated Author's Rebuttal

3 responses · 0 unresolved

We thank the referee for the constructive and detailed comments. We address each major point below and have revised the manuscript to add the requested clarifications and details.

read point-by-point responses

Referee: [Method section] Method section (description of the two-stage process): the learning objective for the watermark vector is not stated to exclude the specific distortions later used in evaluation. If those distortions appear inside the optimization (as the skeptic concern notes), the reported 100% baseline accuracy and ≤2% drop become unsurprising and the comparison to SOTA methods (whose 14% drop is presented as inferior) is no longer apples-to-apples; the central robustness claim then requires explicit confirmation that test distortions are held out.

Authors: We agree that explicit confirmation is essential for the robustness claims. The watermark vector is learned solely on clean images using an objective that does not incorporate any of the evaluation distortions; those distortions are applied only at test time. We have revised the Method section to state this explicitly and to confirm the absence of training-test overlap on distortions, thereby preserving the validity of the 100% accuracy and ≤2% drop results relative to baselines. revision: yes
Referee: [Experiments section] Experiments section (performance claims on MS-COCO): the abstract and results assert 100% accuracy, ≤2% drop, and large margins over baselines, yet no details are supplied on the exact baselines, statistical tests, distortion parameter ranges, training/validation splits, or whether the inner-product decoder was tuned on the same distortion family. These omissions make the load-bearing empirical claims unverifiable from the provided text.

Authors: We acknowledge the need for full experimental transparency. The revised Experiments section now includes: a complete enumeration of baselines with references and implementation details; statistical reporting (means and standard deviations over 1000 independent trials); precise distortion parameter ranges and types; the exact MS-COCO train/validation/test splits; and a statement confirming that decoder parameters were fixed after training and not tuned on the evaluation distortions. These additions make the reported accuracy, robustness margins, and speedups fully verifiable and reproducible. revision: yes
Referee: [Theoretical analysis section] Theoretical analysis section: the manuscript references a theoretical justification for why the learned watermark plus inner-product decoder is effective, but does not show how the analysis establishes robustness when the test-time distortion distribution differs from any distribution seen during learning; without this, the theory does not yet close the gap raised by the potential training-test overlap.

Authors: The theoretical analysis derives a worst-case bound on bit-error rate that depends only on the L2 norm of the watermark and the maximum L2 norm of any additive distortion; the bound is distribution-independent and therefore applies to any bounded distortion, including those unseen during learning. We have added an explicit paragraph in the Theoretical analysis section clarifying this generalization property and confirming that the bound holds under distribution shift, thereby addressing the concern about unseen test distortions. revision: yes

Circularity Check

0 steps flagged

No significant circularity; derivation is self-contained

full rationale

The paper presents a two-stage empirical method (learn watermark for linear embedding, decode via inner product) plus a separate theoretical analysis. Performance metrics (100% clean accuracy, ≤2% drop under distortions) are reported as measured outcomes on MS-COCO rather than quantities forced by definition or by re-using fitted parameters as 'predictions.' No load-bearing self-citation chains, ansatz smuggling, or renaming of known results appear in the provided description. The central claims rest on data-driven training and external benchmark evaluation, which are independent of the reported numbers by construction.

Axiom & Free-Parameter Ledger

1 free parameters · 2 axioms · 0 invented entities

The approach depends on the data-driven learning of a watermark vector whose effectiveness is not independently derived but fitted to achieve the reported accuracy; standard linear algebra assumptions underpin the add and dot operations.

free parameters (1)

learned watermark vector
Optimized during the first stage to enable accurate decoding after addition to images.

axioms (2)

domain assumption Images can be modified by linear addition of a watermark without destroying perceptual quality or semantic content
Required for the embedding stage to be practical.
domain assumption Inner products with the learned watermark extract the message bits reliably
Core of the decoding stage.

pith-pipeline@v0.9.0 · 5530 in / 1289 out tokens · 53196 ms · 2026-05-10T14:47:47.539555+00:00 · methodology

discussion (0)

Reference graph

Works this paper leans on

4 extracted references · 4 canonical work pages

[1]

(2007), ‘Combined DWT-DCT digital image watermarking’,Journal of Computer Science3(9), 740–746

Al-Haj, A. (2007), ‘Combined DWT-DCT digital image watermarking’,Journal of Computer Science3(9), 740–746. Altun, H. O., Orsdemir, A., Sharma, G. & Bocko, M. F. (2009), ‘Optimal spread spectrum watermark embedding via a multistep feasibility formulation’,IEEE Transactions on Image Processing18(2), 371–387. Publisher: IEEE. An, B., Ding, M., Rabbani, T., A...

work page 2007
[2]

& Zitnick, C

Lin, T.-Y., Maire, M., Belongie, S., Hays, J., Perona, P., Ramanan, D., Dollár, P. & Zitnick, C. L. (2014), Microsoft COCO: Common objects in context,in‘Computer Vision – ECCV 2014’, Vol. 8693 ofLecture Notes in Computer Science, Springer, Cham, pp. 740–755. Lin, Y. (2004), ‘A note on margin-based loss functions in classification’,Statistics & Probability...

work page 2014
[3]

(2001), ‘The role of information theory in watermarking and its application to image watermarking’,Signal Processing81(6), 1121–1139

Moulin, P. (2001), ‘The role of information theory in watermarking and its application to image watermarking’,Signal Processing81(6), 1121–1139. Moulin, P. & O’Sullivan, J. (2000), Information-theoretic analysis of watermarking,in‘2000 32 IEEE International Conference on Acoustics, Speech, and Signal Processing.’, Vol. 6, pp. 3630–3633 vol.6. Moulin, P. &...

work page 2001
[4]

Tancik, M., Mildenhall, B. & Ng, R. (2020), Stegastamp: Invisible hyperlinks in physical photographs,in‘Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition’, pp. 2117–2126. van Schyndel, R. G., Tirkel, A. Z. & Osborne, C. F. (1994), ‘A digital watermark’,Proceedings of 1st International Conference on Image Processing2, 86–90 ...

work page 2020