Pith. sign in

REVIEW 3 major objections 4 minor 39 references

Signpost Watermarking: Joint Optimization for Visual Watermark Coexistence

T0 review · 3 major / 4 minor · reviewed 2026-08-14 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗ Review JSON

Pith's one-line read The paper claims that watermark coexistence is a trainable objective: a lightweight signpost watermark can be optimized so that independently built watermarking systems layered on the same image or video keep decoding, rather than relying…

desk verdict The coexistence loss and the headline result face opposite directions, so the paper's flagship gain over ZOETROPE is not yet attributed to the method. read the letter →

arxiv 2608.10091 v1 pith:2PF4IWHF submitted 2026-08-10 cs.CV

Shruti Agarwal , Vishal Asnani , John Collomosse This is my paper · ORCID
classification cs.CV
keywords signpostwatermarkingwatermarkcoexistencedecoder-awaretrainingimagevideocontentprovenancelayeredsignalingimperceptible
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

This paper tries to turn the coexistence of visual watermarks from an accidental property into an explicit design goal. It argues that a lightweight 'signpost' watermark can be trained so that when other independently built watermarks are layered on top of the same image or video, both the signpost and the other watermarks keep decoding accurately. The paper first shows that the emergent coexistence previously observed for image watermarks also holds for video watermarks, then introduces a decoder-aware training objective that places frozen copies of the other watermark encoders inside the signpost's loss. The central result is that TrustMark-P, the most interference-sensitive system tested, keeps $0.929$ noise-averaged bit accuracy when the signpost is layered underneath it, versus $0.687$ with the previous signpost baseline ZOETROPE, while the signpost itself reaches $52.4$ dB solo PSNR. If right, this makes layered provenance signaling practical: one standardized signpost can route a decoder to the right provenance system without scanning all of them.

What carries the argument

The load-bearing mechanism is the coexistence loss term $\lambda_c \sum_k L_{\mathrm{BCE}}(f_\theta(\hat{x}_k), s)$, evaluated after each frozen secondary watermark encoder $k$ is applied on top of the signpost's stego image $\hat{x}$. This term forces the signpost decoder $f_\theta$ to read the 32-bit secret $s$ from the doubly-watermarked image, which in turn forces the signpost encoder to place its residual in signal space complementary to each secondary system. It is used with a frozen set of image encoders (PixelSeal, InvisMark, TrustMark-P, MaskWM) and, for video, VideoSeal, InvisMark, TrustMark-Q, and FlowMark, plus a Just Noticeable Difference (JND)-modulated perceptual loss that lets the encoder concentrate energy where distortion is least visible.

What would settle it

Run the same signpost training with the coexistence loss disabled ($\lambda_c = 0$) on identical data, and compare TrustMark-P's noise-averaged bit accuracy when the signpost is applied first and TrustMark-P second; the paper reports roughly $0.84$ for the ablated model and $0.96$ for the full model, so a rerun that fails to reproduce a gap near that size would falsify the claim that the coexistence term is the cause. A complementary decisive test is a watermarking system held out of training: if its overlay accuracy shows no improvement over the no-coexistence signpost, the benefit is memorization of the training set rather than general coexistence.

Watch

Extended reading notes

Core claim

The central claim is that coexistence is trainable. The paper trains a signpost encoder-decoder with a UNet encoder (32-bit secret lifted and upsampled into the cover image) and a ResNet-50 decoder, using a loss that evaluates signpost decoding after each of several frozen secondary watermark encoders has been overlaid on the signpost's output. The coexistence term $\lambda_c \sum_k L_{\mathrm{BCE}}(f_\theta(\hat{x}_k), s)$ pushes the signpost's residual into spatial and frequency regions left free by the secondary systems. As a result TrustMark-P's noise-averaged bit accuracy under overlay rises from $0.687$ with ZOETROPE to $0.929$ with the proposed signpost, and the signpost's own solo PSNR is $52.4$ dB; video experiments show the same pattern, with TrustMark-Q improving from at most $0.880$ under other overlays to $0.945$ under the signpost. Ablations with the coexistence loss disabled, with single frozen decoders, and with leave-one-out subsets indicate all frozen decoders contribute and that removing any one lowers overlay accuracy.

Load-bearing premise

The method assumes the signpost trainer has access to frozen copies of every watermarking system it must coexist with at training time; for systems kept secret to resist attacks, that access does not exist, so the central interoperability path fails for those systems.

Editorial extensions

If this is right

  • A standardized signpost watermark can act as a routing layer: its payload indexes a public list of provenance watermarking systems, so a decoder checks one signpost instead of testing all $N$ watermark decoders.
  • Video watermarking systems, previously unexamined for coexistence, display the same emergent compatibility as image systems, and decoder-aware training improves it, so video provenance can also use signpost-based routing.
  • The objective gives the largest gains for the watermark family that suffers most under naive overlay: TrustMark-P image accuracy rises from $0.687$ to $0.929$ and TrustMark-Q video from at most $0.880$ to $0.945$, with solo quality at $52.4$ dB PSNR.
  • Removing any one frozen decoder from training lowers overlay accuracy, meaning full-coverage training data, not a single critical pairing, is what produces the best coexistence.
  • The signpost is not a new watermarking standard but an interoperability layer, so independent systems can join a shared provenance ecosystem without agreeing on one algorithm.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • Because the method needs frozen encoder access at training time, its real-world reach is limited to watermarking systems whose encoders are available; systems kept secret to resist attacks cannot be optimized for, so the registry-based interoperability path works only for open or licensable systems.
  • The signpost's residual is sparse and spatially localized at $52.4$ dB PSNR; this likely makes it more fragile under adversarial editing or strong compression than dense global-pattern watermarks, a risk not covered by the paper's augmentation suite and worth testing directly.
  • A held-out generalization test—training on a few open watermarkers then measuring coexistence with an entirely different, never-seen watermarker—would show whether the objective learns general complementarity or memorizes the training systems; the paper's FM-32 result hints at transfer while its ZOETROPE result shows a held-out signpost can still disrupt a sensitive system.
  • The registration model also has a bootstrap problem: early deployment needs a critical mass of open watermarking systems to train against, so the signpost's value grows with the size of the registry rather than being available from day one.
Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

3 major / 4 minor

Summary. The paper introduces 'signpost watermarking': a lightweight watermark trained to coexist with a set of independently developed image and video watermarking systems, acting as a routing signal to a registry of such systems. The method uses a UNet encoder and ResNet-50 decoder, and its training objective (Eq. 1) adds a coexistence term that applies frozen secondary encoders on top of the signpost stego image and requires the signpost decoder to still recover the payload. The paper reports that (i) emergent coexistence extends to video watermarking, and (ii) decoder-aware training substantially improves coexistence, with the largest gains for TrustMark-based systems. Experiments cover four image watermarking systems and three video systems, with PSNR/VMAF quality metrics and bit-accuracy under clean and augmented conditions, plus single-decoder and leave-one-out ablations.

Significance. If the causal claim holds, this is a genuinely useful contribution: it provides the first systematic study of video watermark coexistence and offers a concrete architecture and training objective for an interoperability layer on top of proprietary watermarking systems. The ablation design is thoughtful: the noCoexist-versus-Ours comparison in Table 4 cleanly isolates the effect of the coexistence loss in the signpost-first direction, and the paper correctly identifies the TrustMark family as the most interference-sensitive watermarkers. The residual visualizations and PSNR analysis are also informative. However, the paper's headline improvement in secondary-watermark decoding accuracy is not yet attributable to the proposed objective, because the key comparison (Table 3, TrustMark-P row: 0.687 under ZOETROPE vs 0.929 under Ours) is measured with the signpost as the second watermark, whereas the training objective and the ablation table only evaluate the signpost-first direction.

major comments (3)
  1. [§4.3, Table 3; §3, Eq. (1)] The central claim that decoder-aware training improves coexistence is not yet supported by the evidence as presented. The strongest specific result, TrustMark-P noise-average bit accuracy rising from 0.687 under ZOETROPE to 0.929 under the proposed signpost (Table 3, TM-P row, Ours column), is measured with TrustMark-P as WM1 and the signpost as WM2. However, the coexistence loss in Eq. (1) is evaluated only in the opposite direction: the signpost is applied first, a frozen secondary encoder is overlaid, and the signpost decoder is trained to recover s from the doubly-watermarked image. No loss term involves any secondary decoder, and the ablation in Table 4 reports signpost bit accuracy only in the signpost-first direction. Because the noCoexist baseline is never evaluated in the WM2 direction, the improvement over ZOETROPE confounds the proposed objective with architectural and quality differences (sparse residual, JND guidance, solo PSNR 52.4 dB vs 45.8 dB). To support the attribution, please add an experiment that trains a noCoexist signpost with the same architecture, data, JND guidance, and comparable PSNR, and measures secondary-watermark bit accuracy when that signpost is overlaid as WM2. Without such a control, the headline claim in the abstract that watermarks 'can be trained with a decoder-aware objective to improve coexistence' should be narrowed to the signpost-first direction demonstrated in Table 4.
  2. [§4.1, Tables 2-4] No error bars, confidence intervals, or significance tests are reported anywhere in the experimental section. The image evaluation uses N=1000 held-out images and the video evaluation uses only 155 test videos, and many of the ablation differences in Table 4 are small (e.g., video rows differing by 0.002-0.004). Without measures of variance it is difficult to assess whether the ranking of ablated variants, or the claimed improvements such as the Table 4 image 'Ours' solo accuracy of 0.977 vs 0.957 for noCoexist, are reliable. Please report standard errors or bootstrap confidence intervals for the key comparisons, especially the headline 0.929 vs 0.687 in Table 3 and the Ours-vs-noCoexist deltas in Table 4.
  3. [§3, 'Frozen secondary encoders'; §1] The method requires access to the frozen encoder weights of every watermarking system the signpost must coexist with, as stated in Section 3. The introduction, however, emphasizes that watermarking systems are 'often kept secret to reduce attacks.' The paper does not address this tension: for proprietary or secret encoders, the proposed optimization cannot be applied, and the 'practical path' of a registry of systems implicitly requires every registered system to expose its encoder. Please state this limitation explicitly and discuss under what trust assumptions the signpost remains practical, or temper the interoperability claim accordingly.
minor comments (4)
  1. [§1, §2, general] There are several typographical artifacts: 'T able 1', 'T able 2', 'T able 3', and 'T able 4' have an errant space; 'asignpostwatermarkcanbeextendedthrough' is missing spaces in the introduction; 'The question follows:can' is missing a space after the colon; and 'for example a integer' should read 'for example an integer.'
  2. [§4.2] The sentence 'These failures are not a concern, as two competing signposts sharing a single image is not a design requirement and two signposts are never deployed together' dismisses a case that may occur if multiple independent signpost providers operate; please either justify this design assumption or acknowledge it as a limitation.
  3. [§4.1] The evaluation protocol states that 'the first watermark (hereafter, WM1) which is applied to a clean cover image' should be 'the first watermark (hereafter, WM1), which is applied'; please fix the missing comma and consider explaining why the signpost-first direction is the primary training scenario while the WM2 direction is the one highlighted in the abstract.
  4. [§3] The JND-guided loss in Eq. (2) is motivated by perceptual masking, but no comparison is provided to a version without JND guidance in the ablation table; since JND is a confounder in the headline WM2-direction comparison, adding such an ablation would strengthen the isolation of the coexistence objective.

Circularity Check

0 steps flagged · score 0.0 of 10

No significant circularity: the headline coexistence gain is measured opposite to the trained direction, so it is not a fitted input; the core claims rest on ablations and external baselines.

full rationale

The paper's central claim is that a decoder-aware objective improves watermark coexistence. The training loss in Eq. (1) directly supervises the signpost decoder f_theta on images x_hat_k obtained by applying frozen secondary encoders on top of the signpost stego, i.e., the signpost-first (SP-first) direction. Table 4 is an ablation in exactly that SP-first setting, comparing noCoexist with the full model. Measuring improvement in a directly optimized objective is an in-sample evaluation, not a circular prediction; the paper does not claim to generalize to unseen watermarking systems, and it includes a held-out FM-32 baseline in the video experiments. Crucially, the strongest headline result — TrustMark-P bit accuracy rising from 0.687 (ZOETROPE) to 0.929 (Ours) in Table 3 — is measured with TrustMark-P as WM1 and the signpost as WM2, the reverse of the trained direction. Since Eq. (1) never supervises any secondary decoder and never trains the signpost encoder on images already containing a secondary watermark, the TM-P-as-WM1 gain is not encoded by construction; it is a transfer result. The paper's other claims (video coexistence among independent systems, perceptual quality) are direct empirical observations against external systems (VideoSeal, InvisMark, FlowMark, TrustMark-Q, PixelSeal, MaskWM) on held-out data. Self-citations such as [23] and [10] are used for motivation, curriculum design, and baselines, but the load-bearing evidence is the paper's own controlled ablations and external benchmarks, so no circularity is present.

Assumptions & free parameters 3 free parameters · 4 assumptions · 0 invented entities

The central claim depends on a small set of hand-tuned loss weights and on the availability of the exact frozen watermark encoders used as training distortions. No physical or mathematical constants are introduced; the assumptions concern the training environment, the ordering of watermark applications, and the perceptual model.

free parameters (3)
  • coexistence loss weight lambda_c = 2
    Hand-tuned weight on the coexistence term in Equation 1. Setting it to zero reproduces the noCoexist baseline, so the reported coexistence gains depend on this choice.
  • signpost survival loss weight lambda_s = 20
    Hand-tuned weight on the signpost bit accuracy term in Equation 1, balancing robustness against the coexistence and quality losses.
  • image quality weights lambda_r, lambda_p, lambda_J, lambda_YUV = 1.5, 10, 1 (JND term)
    Hand-chosen reconstruction and perceptual loss weights that directly affect the reported solo PSNR of 52.4 dB and the sparsity of the residual.
assumptions (4)
  • domain assumption Coexistence ordering assumption from Petrov et al.: the decode accuracy of a first-applied watermark is impacted by a second watermark while the second watermark's decode accuracy remains unaltered.
    Invoked in Section 3 ('Frozen secondary encoders') to justify applying the signpost first during training. If this asymmetry does not hold in deployment, the training order may be unrepresentative.
  • domain assumption Frozen encoder weights of every target watermarking system are available to the signpost trainer.
    The method requires loading each secondary watermark encoder with frozen weights during training (Section 3, Figure 1). This conflicts with the paper's own observation that watermarking systems are often kept secret to resist attacks.
  • domain assumption The JND spatial-masking model from Wu et al. predicts perceptual sensitivity for the cover images and videos.
    Used to modulate the reconstruction loss in Equation 2. If the model is unrepresentative for video or for synthetic AI-generated content, the reported PSNR may not reflect perceptual quality.
  • domain assumption Standard stochastic training assumptions: the frozen encoders are stable and differentiable, and AdamW optimization reaches a useful minimum.
    The claimed improvements rely on successful optimization of the joint loss; no proof of convergence is given.

how reviews work

0 comments
Cite this review

Pith. "Pith review of Signpost Watermarking: Joint Optimization for Visual Watermark Coexistence." pith.science (2026). https://pith.science/paper/2PF4IWHF

@misc{pith2026260810091,
  author       = {Pith},
  title        = {Pith review of: Signpost Watermarking: Joint Optimization for Visual Watermark Coexistence},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/2PF4IWHF}},
  note         = {Machine review of arXiv:2608.10091}
}
read the original abstract

We present a method for training imperceptible visual watermarks to coexist with other such watermarks. Recent work has shown that independently trained image watermarking models can coexist with surprisingly limited interference, enabling watermark ensembling. However, this coexistence is a serendipitous property rather than an explicit optimization objective, leaving interference uncontrolled and potentially reducing decoding robustness or visual quality. We first show empirically that the same coexistence property extends to video watermarking. We then show that both image and video watermarks can be trained with a decoder-aware objective to improve coexistence. Our results suggest a practical path to signpost watermarks that indicate the presence of independently deployed provenance watermarking systems, supporting layered provenance signaling for content authenticity and rights.

Figures

Figures reproduced from arXiv: 2608.10091 by the authors.

Figure 1
Figure 1. Our signpost watermark architecture. Blue = UNet encoder; outputs residual r added to cover x at ⊕. Green = ResNet-50 decoder (recovers 32-bit secret sˆ from xˆ). Orange = frozen secondary watermarks applied on top of xˆ during training only. niques in common use. In concurrent work, ZOETROPE [10] proposed using a coexisting signpost watermark for images but does not explicitly train it to op￾timize for coexistence,… view at source ↗
Figure 2
Figure 2. Qualitative comparison of watermark residuals (amplified ×10, gray = zero perturbation). Shown here are residuals for (a) 10 image example and (b) 5 frames for two videos. In both cases, our signpost introduces sparse, minimal perturbations confined to a small fraction of pixels, while other watermarking techniques distributes a smooth global texture. This sparsity explains our significantly higher solo PSNR of 52.4… view at source ↗

Discussion (0). Continue with ORCID to comment.

Reference graph

Works this paper leans on

39 extracted references · 17 canonical work pages

  1. [1]

    IEEE Transactions on Circuits and Systems for Video Technology13(8), 787–800 (Aug 2003)

    Alattar, A.M., Lin, E.T., Celik, M.U.: Digital watermarking of low bit-rate ad- vanced simple profile mpeg-4 compressed video. IEEE Transactions on Circuits and Systems for Video Technology13(8), 787–800 (Aug 2003)

    2003

  2. [2]

    Asnani, V., Agarwal, S., Collomosse, J.: Flowmark: Mask-guided video watermark- ing (2026),https://arxiv.org/abs/2607.05261

    work page Pith review arXiv 2026

  3. [3]

    In: Conference on Visual Media Production (CVMP) (2023)

    Balan, K., Black, A., Jenni, S., Gilbert, A., Parsons, A., Collomosse, J.: DEC- ORAIT - DECentralized Opt-in/out Registry for AI Training. In: Conference on Visual Media Production (CVMP) (2023)

    work page 2023

  4. [4]

    In: International Conference on AI and the Digital Economy (CADE) (2025)

    Balan, K., Gilbert, A., Collomosse, J.: Content ARCs: Decentralized Content Rights in the Age of Generative AI. In: International Conference on AI and the Digital Economy (CADE) (2025)

    work page 2025

  5. [5]

    IEEE Transactions on Circuits and Systems for Video Technology29(8), 2256–2270 (2019)

    Bampis, C.G., Li, Z., Bovik, A.C.: Spatiotemporal feature integration and model fusion for full reference video quality assessment. IEEE Transactions on Circuits and Systems for Video Technology29(8), 2256–2270 (2019)

    work page 2019

  6. [6]

    In: CVPR Work- shops (Computer Vision, AI and Blockchain) (2019)

    Bui, T., Cooper, D., Collomosse, J., Bell, M., Green, A., Sheridan, J., Higgins, J., Das, A., Keller, J., Thereaux, O., Brown, A.: ARCHANGEL: Tamper-proofing video archives using temporal content hashes on the blockchain. In: CVPR Work- shops (Computer Vision, AI and Blockchain) (2019)

    2019

  7. [7]

    In: Proceedings of the IEEE/CVF International Conference on Computer Vision

    Bui, T., Agarwal, S., Collomosse, J.: Trustmark: Robust watermarking and water- mark removal for arbitrary resolution images. In: Proceedings of the IEEE/CVF International Conference on Computer Vision. pp. 18629–18639 (2025)

    2025

  8. [8]

    In: CVPR (2023)

    Bui, T., Agarwal, S., Yu, N., Collomosse, J.: RoSteALS: Robust steganography using autoencoder latent space. In: CVPR (2023)

    2023

Show all 39 references
  1. [9]

    Coalition for Content Provenance and Authenticity: Technical specification 2.4 (2026),https://c2pa.org/specifications/specifications/2.4/index.html

    2026

  2. [10]

    IEEE Computer Graphics and Applications (IEEE CG&A), in press

    Collomosse, J., Balan, K., Awan, M., Agarwal, S., Hurwitz, N., Parsons, A.: ZOETROPE: A Decentralized Framework for Licensing Visual Content for Gen- erative AI. IEEE Computer Graphics and Applications (IEEE CG&A), in press. (2026)

    2026

  3. [11]

    In: ACM DocEng (2018)

    Collomosse, J., Bui, T., Brown, A., Sheridan, J., Green, A., Bell, M., Fawcett, J., Higgins, J., Thereaux, O.: ARCHANGEL: Trusted archives of digital public documents. In: ACM DocEng (2018)

    2018

  4. [12]

    IEEE Computer Graphics and Applications (IEEE CG&A) (2024)

    Collomosse, J., Parsons, A.: To Authenticity, and Beyond! Building Safe and Fair Generative AI upon the Three Pillars of Provenance. IEEE Computer Graphics and Applications (IEEE CG&A) (2024)

    2024

  5. [13]

    In: Proceedings of the IEEE International Conference on Computing, Communication and Automation

    Dutta, A., Gupta, S.: A blind and robust video watermarking technique for h.265/hevc encoded video. In: Proceedings of the IEEE International Conference on Computing, Communication and Automation. pp. 1189–1194 (2018)

    2018

  6. [14]

    In: Proceedings of the 12th ACM Multimedia Systems Con- ference (MMSys) (2021)

    England, P., Malvar, H.S., Horvitz, E., Stokes, J.W.: AMP: Authentication of media via provenance. In: Proceedings of the 12th ACM Multimedia Systems Con- ference (MMSys) (2021)

    2021

  7. [15]

    European Parliament and Council: Regulation (EU) 2024/1689 of the european parliament and of the council — artificial intelligence act (L1689), 1–144 (Jul 2024),https://eur-lex.europa.eu/eli/reg/2024/1689/oj

    2024

  8. [16]

    In: ICCV (2023)

    Fernandez, P., Couairon, G., Jégou, H., Douze, M., Furon, T.: The stable signature: Rooting watermarks in latent diffusion models. In: ICCV (2023)

    2023

  9. [17]

    Fernandez, P., Elsahar, H., Yalniz, I.Z., Mourachko, A.: Video seal: Open and efficient video watermarking (2024),https://arxiv.org/abs/2412.09492

    2024 arXiv

  10. [18]

    Agarwal, V

    Google DeepMind: Identifying AI-generated images with SynthID (2023) 14 S. Agarwal, V. Asnani and J. Collomosse

    2023

  11. [19]

    IEEE Transactions on Circuits and Systems for Video Tech- nology20(8), 1164–1170 (2010)

    Guo, J., Pan, Y.: Motion vector-based watermarking for h.264 video stream with drift compensation. IEEE Transactions on Circuits and Systems for Video Tech- nology20(8), 1164–1170 (2010)

    2010

  12. [20]

    Advances in Neural Information Processing Systems 38, 146313–146346 (2026)

    Hu, R., Zhang, J., Zhao, S., Lukas, N., Li, J., Guo, Q., Qiu, H., Zhang, T.: Mask image watermarking. Advances in Neural Information Processing Systems 38, 146313–146346 (2026)

    2026

  13. [21]

    In: Proceedings of the ACM International Conference on Multimedia Information Retrieval (MIR)

    Huiskes, M.J., Lew, M.S.: The MIR Flickr retrieval evaluation. In: Proceedings of the ACM International Conference on Multimedia Information Retrieval (MIR). pp. 39–43. ACM (2008)

    2008

  14. [22]

    In: BMVC

    Mishra, A., Kumar, S., Nigam, A., Islam, S.: Vstegnet: Video steganography net- work using spatio-temporal features and micro-bottleneck. In: BMVC. vol. 274 (2019)

    2019

  15. [23]

    In: Intl

    Petrov, A., Agarwal, S., Torr, P., Bibi, A., Collomosse, J.: On the Coexistence and Ensembling of Watermarks. In: Intl. Conf. Neural Information Processing Systems (NeurIPS), 2025 (2025)

    2025

  16. [24]

    Ravi, N., Gabeur, V., Hu, Y.T., Hu, R., Ryali, C., Ma, T., Khedr, H., Rädle, R., Rolland, C., Gustafson, L., et al.: SAM 2: Segment anything in images and videos (2024),https://arxiv.org/abs/2408.00714

    2024 arXiv

  17. [25]

    Journal of Information Security and Applications75(2023)

    Shen, X., Yao, H., Tan, S., Qin, C.: VHNet: A video hiding network with robustness to video coding. Journal of Information Security and Applications75(2023)

    2023

  18. [26]

    arXiv preprint arXiv:2512.16874 (2025)

    Souček, T., Fernandez, P., Elsahar, H., Rebuffi, S.A., Lacatusu, V., Tran, T., Sander, T., Mourachko, A.: Pixel seal: Adversarial-only training for invisible image and video watermarking. arXiv preprint arXiv:2512.16874 (2025)

    2025

  19. [27]

    In: Proc

    Tancik, M., Mildenhall, B., Ng, R.: Stegastamp: Invisible hyperlinks in physical photographs. In: Proc. CVPR. pp. 2117–2126 (2020)

    2020

  20. [28]

    IEEE Transactions on Circuits and Systems for Video Technology 26(1), 65–76 (2016)

    Tew, Y., Wong, K.: An efficient video watermarking technique for HEVC video authentication. IEEE Transactions on Circuits and Systems for Video Technology 26(1), 65–76 (2016)

    2016

  21. [29]

    Thomee, B., Lew, M.S.: The MIRFLICKR retrieval evaluation (2010)

    2010

  22. [30]

    Wen, Y., Kirchenbauer, J., Geiping, J., Goldstein, T.: Tree-rings watermarks: Invis- iblefingerprintsfordiffusionimages.In:AdvancesinNeuralInformationProcessing Systems (NeurIPS). vol. 36 (2023)

    2023

  23. [31]

    IEEE Transactions on Image Processing26(6), 2682–2693 (2017)

    Wu, J., Li, L., Dong, W., Shi, G., Lin, W., Kuo, C.C.J.: Enhanced just noticeable difference model for images with pattern complexity. IEEE Transactions on Image Processing26(6), 2682–2693 (2017)

    2017

  24. [32]

    In: 2025 IEEE/CVF Winter Conference on Applications of Computer Vision (WACV)

    Xu, R., Hu, M., Lei, D., Li, Y., Lowe, D., Gorevski, A., Wang, M., Ching, E., Deng, A.: Invismark: Invisible and robust watermarking for ai-generated image provenance. In: 2025 IEEE/CVF Winter Conference on Applications of Computer Vision (WACV). pp. 909–918. IEEE (2025)

    2025

  25. [33]

    In: Proceedings of the International Conference on Control, Automation, Robotics and Vision

    Yong, M., Yu-Min, T., Yun-Hui, Q.: Adaptive video watermarking algorithm based on mpeg-4 streams. In: Proceedings of the International Conference on Control, Automation, Robotics and Vision. pp. 1084–1088 (2008)

    2008

  26. [34]

    arXiv preprint arXiv:1909.01230 (2019)

    Zhang, H., Dong, J., Forgione, P., Collomosse, J.: Rivagan: Robust video water- marking with attention. arXiv preprint arXiv:1909.01230 (2019)

    2019 arXiv

  27. [35]

    IEEE Transactions on Circuits and Systems II: Express Briefs54(2), 205–209 (2007)

    Zhang, J., Ho, A.T.S., Qiu, G., Marziliano, P.: Robust video watermarking of H.264/AVC. IEEE Transactions on Circuits and Systems II: Express Briefs54(2), 205–209 (2007)

    2007

  28. [36]

    In: Proceedings of the IEEE conference on computer vision and pattern recognition

    Zhang, R., Isola, P., Efros, A.A., Shechtman, E., Wang, O.: The unreasonable effectiveness of deep features as a perceptual metric. In: Proceedings of the IEEE conference on computer vision and pattern recognition. pp. 586–595 (2018) Signpost Watermarking 15

    2018

  29. [37]

    In: Proceedings of the 32nd ACM International Conference on Multimedia

    Zhang, X., Xu, Y., Li, R., Yu, J., Li, W., Xu, Z., Zhang, J.: V2a-mark: Versatile deep visual-audio watermarking for manipulation localization and copyright pro- tection. In: Proceedings of the 32nd ACM International Conference on Multimedia. pp. 9818–9827 (2024)

    2024

  30. [38]

    264/avc compression

    Zhang, Y., Ni, J., Su, W., Liao, X.: A novel deep video watermarking framework with enhanced robustness to h. 264/avc compression. In: Proceedings of the 31st ACM International Conference on Multimedia. pp. 8095–8104 (2023)

    2023

  31. [39]

    In: Proc

    Zhu, J., Kaplan, R., Johnson, J., Fei-Fei, L.: Hidden: Hiding data with deep net- works. In: Proc. ECCV. pp. 657–672 (2018)

    2018

Pith tools

Reviewed August 14, 2026 · model on record in the stance chip above.