Pith. sign in

REVIEW 3 major objections 4 minor 45 references

Enhancing Robustness in Post-Processing Watermarking: An Ensemble Attack Network Using CNNs and Transformers

T0 review · 3 major / 4 minor · reviewed 2026-08-05 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗

Pith's one-line read Training a watermark decoder against a paired CNN-and-Transformer attack network lifts regeneration accuracy by 18.7 percentage points.

desk verdict A practical ensemble attack recipe with solid distortion/embedding gains, but the headline regeneration improvement depends on a single unexplained Regen-VAE column. read the letter →

arxiv 2509.03006 v1 pith:C2GR4VVU submitted 2025-09-03 cs.CV

Tzuhsuan Huang , Cheng Yu Yeo , Tsai-Ling Huang , Hong-Han Shuai , Wen-Huang Cheng , Jun-Cheng Chen This is my paper
classification cs.CV
keywords deepwatermarkingpost-processingattacknetworkadversarialtrainingDCT-TransformerensemblemodelWAVESbenchmarkbitaccuracy
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

This paper tries to establish that the attack network used during adversarial training, not just the watermarking architecture, decides how well a post-processing watermark survives real-world distortions. It claims that pairing a CNN attack network in the spatial domain with a Transformer attack network in the frequency domain gives the best coverage, and that a specific ensemble configuration—Model Parallel—produces the highest average bit accuracy. On the WAVES stress tests, this training change improves StegaStamp's average bit accuracy by 18.743% under regeneration attacks and lifts HiDDeN and Stable Signature across distortion, embedding, and manipulation attacks. Since post-processing watermarks can be applied to outputs of any generative model without touching internal model structure, stronger robustness here matters directly for copyright protection of AI-generated images.

What carries the argument

An ensemble attack network, specifically the Model Parallel configuration, in which a CNN-based attack network in the spatial domain and a Transformer-based attack network in the frequency domain (DCT-Transformer) are trained adversarially with the watermark encoder and decoder. The DCT-Transformer computes 2D block-DCT on 8x8 blocks in YUV color space, masks high-frequency components, rearranges coefficients by frequency band for self-attention, runs the Transformer, then returns to pixels via inverse DCT. Model Parallel randomly routes the watermarked image through one of the two attacks each iteration, exposing the decoder to both pixel-space and frequency-band perturbations without letti

What would settle it

Run the same MP training recipe but evaluate against the official released weights for DA and Stable Signature (or use the authors' released code) and compare WAVES regeneration and distortion bit accuracy; if StegaStamp_MP's regeneration edge over StegaStamp shrinks well below 18.7 percentage points, or Stable Signature MP no longer beats Stable Signature, then the claimed gains are largely an artifact of the weaker reimplementations.

Watch

Extended reading notes

Core claim

On the paper's own terms, the central discovery is that the architecture and domain of the learned attack network determine the robustness profile of a watermarking model. A CNN attack network generates spatial distortions but struggles with spectral degradations such as JPEG compression; a Transformer operating on 8x8 block-DCT coefficients in the YUV color space generates frequency-band perturbations that complement it. Combining the two as a Model Parallel ensemble—each iteration sending the watermarked image through one of the two attack networks chosen by a random threshold—produces a decoder that performs near or above the better single attack on every distortion type and substantially

Load-bearing premise

The headline comparisons assume that the paper's own re-implementations of DA and Stable Signature match the official released models; if those re-implementations are weaker on the WAVES suite, part of the reported improvement belongs to the baseline, not to the ensemble.

Editorial extensions

If this is right

  • StegaStamp and HiDDeN decoders trained with Model Parallel survive WAVES regeneration attacks (noising and denoising through diffusion models or VAEs) far better than the same models trained with the original noise layers or CNN attack networks.
  • The same MP-trained decoder can be swapped into an in-processing pipeline: fine-tuning Stable Signature's VAE with the MP-trained HiDDeN decoder raises its distortion-attack average by 8.386 percentage points while keeping embedding-attack accuracy near 90%.
  • Under editing by InstructPix2Pix and StyleRes, MP-trained HiDDeN and StegaStamp keep watermarks readable where original models drop to near chance-level accuracy.
  • Perceptual cost is a direct corollary: watermarked images from MP-trained models have lower PSNR and SSIM than the baselines, so the robustness gains come with a visibility trade-off.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • If the frequency-domain advantage is genuine, the same ensemble idea should transfer to other watermarking architectures and to higher resolutions, since block-DCT is resolution-agnostic; a testable extension is training an MP variant on 256x256 or 512x512 images and measuring whether the regeneration gain persists.
  • The DCT-Transformer's band-masking step suggests an invariant worth probing: the watermark decoder learns to hide information in frequency bands that survive regeneration, so inspecting where the embedded signal sits in DCT space could predict which new attacks will break it.
  • The paper compares against its own re-implementations of DA and Stable Signature; re-running with official released weights could change the magnitude of the reported gains—a check the reader can perform once those weights are made public.
  • Because the MP attack network is trained jointly with a specific decoder, the robustness may not transfer to an arbitrarily different decoder; a decoder-agnostic attack network would be the next logical step.
Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

3 major / 4 minor

Summary. The paper proposes an ensemble attack network for improving the robustness of post-processing deep image watermarking. The method combines a spatial-domain CNN attack network with a frequency-domain DCT-Transformer attack network, integrated via a Model Parallel routing strategy during adversarial training. The authors evaluate on the WAVES benchmark across distortion, embedding, regeneration, and manipulation attacks, reporting consistent improvements over HiDDeN, DA, StegaStamp, and Stable Signature when their models are trained with the proposed ensemble. The paper also includes ablations on Transformer depth, positional embeddings, and color space, and extends the approach to the in-processing method Stable Signature by fine-tuning with a decoder trained using the proposed attack network. The code is released.

Significance. If the results hold, this is a valuable empirical contribution: it demonstrates that combining complementary attack architectures and operating domains during adversarial training can meaningfully improve watermark robustness. The idea of a frequency-domain DCT-Transformer attack network, and the systematic comparison of ensemble strategies, is novel. The release of code and the inclusion of multiple ablations are strengths. However, the headline regeneration result rests on a single unexplained anomalous column (Regen-VAE), and several baseline comparisons rely on author re-implementations without calibration to official numbers. The paper also omits key experimental details (DCT mask cutoff, no error bars). These issues substantially temper confidence in the quantitative claims and must be addressed before the paper can be recommended for publication.

major comments (3)
  1. [Table 7 / Section 4.2 (Regeneration Attacks)] The headline claim that StegaStamp_MP improves regeneration robustness by 18.743% over StegaStamp is driven almost entirely by the Regen-VAE column: StegaStamp_MP scores 97.063% vs. 50.500% for StegaStamp, while the other three regeneration columns show much smaller gains (11.5, 9.6, and 7.3 points). HiDDeN_MP does not show a similar VAE anomaly (50.320%). The paper provides no explanation for why the MP attack network, a spatial CNN plus DCT-Transformer, would yield near-perfect robustness specifically under VAE regeneration, and it does not specify the VAE checkpoint, noising/denoising schedule, or WAVES evaluation version. If the Regen-VAE result were an artifact, the average regeneration accuracy would drop to ~57.28%, reducing the headline gain to ~7.1 points. This load-bearing result must be explained or the claim qualified.
  2. [Tables 1, 4, 7, 9; Section 4] Several baseline comparisons rely on author re-implementations. Table 1 states that the CNN (DA) is a re-implementation because Luo et al. did not release code; Table 9 states that Stable Signature is reproduced with an author-trained HiDDeN decoder. No evidence is provided that these re-implementations match the official models' performance on the WAVES benchmark. For example, Table 7 shows DA at ~50.4% (chance) on all regeneration attacks, and the paper claims a 3.537% improvement over DA; if the original DA performs differently, the comparison is not meaningful. Please report calibration results against published/official numbers where available, or clearly state the limitations of the re-implementations.
  3. [Algorithm 1; Section 4.1; Tables 4-11] The method's key frequency-domain component is not fully specified: Algorithm 1 says "apply high frequency mask on each block" but never defines the cutoff. The paper also omits the exact WAVES version, VAE checkpoint for regeneration, and any error bars or seed-level variance. These omissions prevent independent reproduction and make it impossible to assess whether the observed differences are statistically meaningful. The paper should report the mask cutoff, run multiple seeds, and provide variance/significance information.
minor comments (4)
  1. [Table 1 caption] The caption refers to 'red-marked' and 'blue-marked' distortions, but the table in the preprint appears monochrome; ensure color coding is visible in the final version or describe the marking otherwise.
  2. [Section 3.4] The acronym MP is used before it is formally defined; please define it at first use in Section 3.4.
  3. [Table 5] The column headers 'RGB Y U V B' are unclear; specify the exact channels or color spaces on which PSNR/SSIM are computed.
  4. [Limitations section] The limitations paragraph appropriately notes higher computational cost and lower PSNR/SSIM, but Table 5 shows a substantial PSNR drop (e.g., StegaStamp_MP 37.6 vs StegaStamp 45.9); this trade-off deserves more prominent discussion.

Circularity Check

0 steps flagged · score 0.0 of 10

No significant circularity: the ensemble attack network is adversarially learned and evaluated against an external benchmark; no fitted parameter is renamed as a prediction.

full rationale

The paper's central derivation trains an attack network with an explicit adversarial objective (Eq. 4) and a watermark decoder/encoder objective (Eqs. 2-3); the attack network is not constructed from the WAVES test distortions. The claim that CNN + DCT-Transformer in Model Parallel is best is an empirical comparison (Tables 1, 3), not a quantity predicted from the same inputs. The architecture choices (D=6, H=12, YUV, no positional embedding, r=0.7) are indeed ablated on the same WAVES-like average bit-accuracy metric used in the final tables, which is a selection-bias / reproducibility concern rather than a circular derivation; the paper reports the measured outcome rather than a prediction. The re-implementations of DA and Stable Signature are disclosed in Table 1 and Table 9, and the Stable Signature result is explicitly said to use an author-trained HiDDeN decoder (Section 4.3); this is a fairness/weakness issue, not circularity. The only self-citation, reference [43], appears in a related-work list and is not load-bearing. The anomalous Regen-VAE column in Table 7 and the acknowledged lower PSNR/SSIM in the Limitations section are experimental validity concerns, not circular steps. No equation or fitted parameter in the paper reduces to its own input by construction.

Assumptions & free parameters 4 free parameters · 4 assumptions · 0 invented entities

The central claim is entirely empirical and rests on a small set of training choices, including loss weights, the ensemble routing threshold, the DCT mask cutoff, and the Transformer configuration. No new physical or mathematical entity is introduced.

free parameters (4)
  • Model Parallel routing threshold r_w = r_co = 0.7
    Probability threshold used to route each watermarked or cover image through the DCT-Transformer versus the CNN in Section 3.4; set in Section 4.1 with no validation sweep reported.
  • Watermark loss coefficients alpha1_enc=1.5, alpha2_enc=0.01, alpha1_dec=0.3, alpha2_dec=0.2, alpha1_adv=15.0, alpha2_adv = see name
    Hand-set training balances inherited from DA. Table 2 shows the Identity value is sensitive to alpha2_adv, so these choices materially affect the reported robustness and image quality trade-off.
  • Transformer attack network depth=6, heads=12, patch=8, embedding=256 = 6/12/8/256
    Selected by ablations in Section 5 and Tables 12 and 13; deeper transformers score worse on the average WAVES metric, so this selection affects the claimed gains.
  • DCT high-frequency mask cutoff = not reported
    Algorithm 1 masks high-frequency 8x8 DCT coefficients but never gives the cutoff value. This is a free parameter for the frequency-domain attack and is missing from the reproducibility artifacts.
assumptions (4)
  • domain assumption Adversarial training against a learned attack network transfers to held-out WAVES distortions, embedding attacks, and regeneration attacks.
    Core premise inherited from DA and used throughout Sections 3 and 4; the paper measures transfer on WAVES but does not prove it.
  • standard math 2D block-DCT and IDCT in YUV color space are differentiable and invertible enough to train through.
    Algorithm 1 treats forward and inverse DCT as differentiable layers; DCT is a linear orthogonal transform, making this a standard gradient-based training assumption.
  • domain assumption WAVES benchmark attacks and bit accuracy are the right proxy for real-world watermark robustness.
    All headline claims are stated relative to WAVES in Section 4.1; if that benchmark is not representative, the practical significance of the gains changes.
  • domain assumption The high-frequency masking in DCT preserves acceptable visual quality.
    The authors acknowledge in the Limitations that PSNR and SSIM remain relatively low, so this assumption is only partially checked.

how reviews work

0 comments
Cite this review

Pith. "Pith review of Enhancing Robustness in Post-Processing Watermarking: An Ensemble Attack Network Using CNNs and Transformers." pith.science (2026). https://pith.science/paper/C2GR4VVU

@misc{pith2026250903006,
  author       = {Pith},
  title        = {Pith review of: Enhancing Robustness in Post-Processing Watermarking: An Ensemble Attack Network Using CNNs and Transformers},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/C2GR4VVU}},
  note         = {Machine review of arXiv:2509.03006}
}
read the original abstract

Recent studies on deep watermarking have predominantly focused on in-processing watermarking, which integrates the watermarking process into image generation. However, post-processing watermarking, which embeds watermarks after image generation, offers more flexibility. It can be applied to outputs from any generative model (e.g. GANs, diffusion models) without needing access to the model's internal structure. It also allows users to embed unique watermarks into individual images. Therefore, this study focuses on post-processing watermarking and enhances its robustness by incorporating an ensemble attack network during training. We construct various versions of attack networks using CNN and Transformer in both spatial and frequency domains to investigate how each combination influences the robustness of the watermarking model. Our results demonstrate that combining a CNN-based attack network in the spatial domain with a Transformer-based attack network in the frequency domain yields the highest robustness in watermarking models. Extensive evaluation on the WAVES benchmark, using average bit accuracy as the metric, demonstrates that our ensemble attack network significantly enhances the robustness of baseline watermarking methods under various stress tests. In particular, for the Regeneration Attack defined in WAVES, our method improves StegaStamp by 18.743%. The code is released at:https://github.com/aiiu-lab/DeepRobustWatermark.

Figures

Figures reproduced from arXiv: 2509.03006 by the authors.

Figure 1
Figure 1. The CNN-based attack network proposed in “Distor￾tion Agnostic Deep Watermarking (DA)” [2] tends to generate limited types of distortions due to its architectural capacity, which results in suboptimal performance of the watermark￾ing model when facing unseen attacks. To overcome this limitation, we propose an ensemble attack network (ensem￾ble model) that integrates CNN and Transformer architec￾tures across both spa… view at source ↗
Figure 2
Figure 2. Our framework begins with the channel encoder [PITH_FULL_IMAGE:figures/full_fig_p003_2.png] view at source ↗
Figure 3
Figure 3. The illustration of four distinct configurations of ensemble methods, including Model Cascade, Model Parallel, [PITH_FULL_IMAGE:figures/full_fig_p006_3.png] view at source ↗
Figures from the paper (4 more)
Figure 4
Figure 4. Figure 4: We compare the bit accuracy (y-axis) of different watermarking models trained with distinct attack networks. The [PITH_FULL_IMAGE:figures/full_fig_p007_4.png]
Figure 5
Figure 5. Figure 5: We show the watermarked images after being sub [PITH_FULL_IMAGE:figures/full_fig_p007_5.png]
Figure 6
Figure 6. Figure 6: We show the difference between cover images and [PITH_FULL_IMAGE:figures/full_fig_p008_6.png]
Figure 7
Figure 7. Figure 7: We utilize StyleRes [11] for editing the watermarked images embedded in CelebA with various prompts, as demon￾strated in the top row. The second row showcases the out￾comes of watermarked images (COCO dataset) after being edited by InstructPix2Pix [14], where we employ…

Discussion (0). Sign in to comment.

Reference graph

Works this paper leans on

45 extracted references · 45 canonical work pages

  1. [1]

    Necst: Neural joint source-channel coding

    Kristy Choi, Kedar Tatwawadi, Tsachy Weissman, and Stefano Ermon., “Necst: Neural joint source-channel coding. ”International Conference on Machine Learning, 2018 Enhancing Robustness in Post-Processing Watermarking: An Ensemble Attack Network Using CNNs and Transformers AISEC’ 25, October 17, 2025, Taipei, Taiwan

    work page 2018

  2. [2]

    Distortion agnostic deep watermarking,

    Xiyang Luo, Ruohan Zhan, Huiwen Chang, Feng Yang, and Peyman Milanfar., “Distortion agnostic deep watermarking, ”Computer Vision and Pattern Recognition, 2020

    work page 2020

  3. [3]

    Analyzing and Improving the Image Quality of StyleGAN,

    Tero Karras, Samuli Laine, Miika Aittala, Janne Hellsten, Jaakko Lehtinen, and Timo Aila., “Analyzing and Improving the Image Quality of StyleGAN, ”Computer Vision and Pattern Recognition, 2020

    work page 2020

  4. [4]

    Alias-Free Generative Adversarial Networks,

    Tero Karras, Miika Aittala, Samuli Laine, Erik Härkönen, Janwatermarkingne Hellsten, Jaakko Lehtinen, and Timo Aila., “Alias-Free Generative Adversarial Networks, ”Neural Information Processing Systems, 2021

    work page 2021

  5. [5]

    Dual Contrastive Loss and Attention for GANs,

    Ning Yu, Guilin Liu, Aysegul Dundar, Andrew Tao, Bryan Catanzaro, Larry Davis, and Mario Fritz., “Dual Contrastive Loss and Attention for GANs, ”International Conference on Computer Vision, 2021

    work page 2021

  6. [6]

    Inclusive GAN: Improving Data and Minority Coverage in Generative Models,

    Ning Yu, Ke Li, Peng Zhou, Jitendra Malik, Larry Davis, and Mario Fritz., “Inclusive GAN: Improving Data and Minority Coverage in Generative Models, ”European Conference on Computer Vision, 2020

    work page 2020

  7. [7]

    DF-GAN: A Simple and Effective Baseline for Text-to-Image Synthesis,

    Ming Tao, Hao Tang, Fei Wu, Xiao-Yuan Jing, Bing-Kun Bao, and Changsheng Xu., “DF-GAN: A Simple and Effective Baseline for Text-to-Image Synthesis, ”Computer Vision and Pattern Recognition, 2022

    work page 2022

  8. [8]

    LAFITE: Towards Language-Free Training for Text-to-Image Generation,

    Yufan Zhou, Ruiyi Zhang, Changyou Chen, Chunyuan Li, Chris Tensmeyer, Tong Yu, Jiuxiang Gu, Jinhui Xu, and Tong Sun., “LAFITE: Towards Language-Free Training for Text-to-Image Generation, ”Computer Vision and Pattern Recognition, 2022

    work page 2022

Show all 45 references
  1. [9]

    Scaling up GANs for Text-to-Image Synthesis,

    Minguk Kang, Jun-Yan Zhu, Richard Zhang, Jaesik Park, Eli Shechtman, Sylvain Paris, and Taesung Park., “Scaling up GANs for Text-to-Image Synthesis, ”Computer Vision and Pattern Recognition, 2023

    2023

  2. [10]

    Interpreting the Latent Space of GANs for Semantic Face Editing,

    Yujun Shen, Jinjin Gu, Xiaoou Tang, and Bolei Zhou., “Interpreting the Latent Space of GANs for Semantic Face Editing, ”Computer Vision and Pattern Recognition, 2020

    2020

  3. [11]

    StyleRes: Transforming the Residuals for Real Image Editing with StyleGAN,

    Hamza Pehlivan, Yusuf Dalva, and Aysegul Dundar., “StyleRes: Transforming the Residuals for Real Image Editing with StyleGAN, ”Computer Vision and Pattern Recognition, 2023

    2023

  4. [12]

    E4S: Fine-grained Face Swapping via Editing With Regional GAN Inversion,

    Maomao Li, Ge Yuan, Cairong Wang, Zhian Liu, Yong Zhang, Yongwei Nie, Jue Wang, and Dong Xu., “E4S: Fine-grained Face Swapping via Editing With Regional GAN Inversion, ”Computer Vision and Pattern Recognition, 2023

    2023

  5. [13]

    Elucidating the De- sign Space of Diffusion-Based Generative Models,

    Tero Karras, Miika Aittala, Timo Aila, and Samuli Laine., “Elucidating the De- sign Space of Diffusion-Based Generative Models, ”Neural Information Processing Systems, 2022

    2022

  6. [14]

    InstructPix2Pix: Learn- ing to Follow Image Editing Instructions,

    Tim Brooks, Aleksander Holynski, and Alexei A. Efros., “InstructPix2Pix: Learn- ing to Follow Image Editing Instructions, ”Computer Vision and Pattern Recognition, 2023

    2023

  7. [15]

    GLIDE: Towards Photorealistic Image Generation and Editing with Text-Guided Diffusion Models,

    Alex Nichol, Prafulla Dhariwal, Aditya Ramesh, Pranav Shyam, Pamela Mishkin, Bob McGrew, Ilya Sutskever, and Mark Chen., “GLIDE: Towards Photorealistic Image Generation and Editing with Text-Guided Diffusion Models, ”International Conference on Machine Learning, 2022

    2022

  8. [16]

    Adding Conditional Control to Text-to-Image Diffusion Models,

    Lvmin Zhang, Anyi Rao, and Maneesh Agrawala., “Adding Conditional Control to Text-to-Image Diffusion Models, ”International Conference on Machine Learning, 2023

    2023

  9. [17]

    Hidden: Hiding data with deep networks,

    Jiren Zhu, Russell Kaplan, Justin Johnson, and Li Fei-Fei., “Hidden: Hiding data with deep networks, ”European Conference on Computer Vision, 2018

    2018

  10. [18]

    WAVES: Benchmarking the Robustness of Image Watermarks,

    Bang An, Mucong Ding, Tahseen Rabbani, Aakriti Agrawal, Yuancheng Xu, Chenghao Deng, Sicheng Zhu, Abdirisak Mohamed, Yuxin Wen, Tom Goldstein, and Furong Huang., “WAVES: Benchmarking the Robustness of Image Watermarks, ” International Conference on Machine Learning, 2024

    2024

  11. [19]

    StegaStamp: Invisible Hyperlinks in Physical Photographs,

    Matthew Tancik, Ben Mildenhall, and Ren Ng., “StegaStamp: Invisible Hyperlinks in Physical Photographs, ”Computer Vision and Pattern Recognition, 2020

    2020

  12. [20]

    The Stable Signature: Rooting Watermarks in Latent Diffusion Models,

    Pierre Fernandez, Guillaume Couairon, Hervé Jégou, Matthijs Douze, and Teddy Furon., “The Stable Signature: Rooting Watermarks in Latent Diffusion Models, ” International Conference on Computer Vision, 2023

    2023

  13. [21]

    Wavelet-Based CNN for Robust and High-Capacity Image Watermarking,

    Junxiong Lu, Jiangqun Ni, Wenkang Su, and Hao Xie., “Wavelet-Based CNN for Robust and High-Capacity Image Watermarking, ”IEEE International Conference on Multimedia and Expo, 2022

    2022

  14. [22]

    Artificial Fin- gerprinting for Generative Models: Rooting Deepfake Attribution in Training Data,

    Ning Yu, Vladislav Skripniuk, Sahar Abdelnabi, and Mario Fritz., “Artificial Fin- gerprinting for Generative Models: Rooting Deepfake Attribution in Training Data, ”Computer Vision and Pattern Recognition, 2021

    2021

  15. [23]

    A Recipe for Watermarking Diffusion Models,

    Yunqing Zhao, Tianyu Pang, Chao Du, Xiao Yang, Ngai-Man Cheung, and Min Lin., “A Recipe for Watermarking Diffusion Models, ”arXiv preprint, 2023

    2023

  16. [24]

    High-Resolution Image Synthesis with Latent Diffusion Models,

    Robin Rombach, Andreas Blattmann, Dominik Lorenz, Patrick Esser, and Björn Ommer., “High-Resolution Image Synthesis with Latent Diffusion Models, ”Com- puter Vision and Pattern Recognition, 2022

    2022

  17. [25]

    Tree-Ring Watermarks: Fingerprints for Diffusion Images that are Invisible and Robust,

    Yuxin Wen, John Kirchenbauer, Jonas Geiping, and Tom Goldstein., “Tree-Ring Watermarks: Fingerprints for Diffusion Images that are Invisible and Robust, ” Neural Information Processing Systems, 2023

    2023

  18. [26]

    WOUAF: Weight Modulation for User Attribution and Fingerprinting in Text-to- Image Diffusion Models,

    Changhoon Kim, Kyle Min, Maitreya Patel, Sheng Cheng, and Yezhou Yang., “WOUAF: Weight Modulation for User Attribution and Fingerprinting in Text-to- Image Diffusion Models, ”Computer Vision and Pattern Recognition, 2024

    2024

  19. [27]

    PTW: Pivotal Tuning Watermarking for Pre- Trained Image Generators,

    Nils Lukas and Florian Kerschbaum., “PTW: Pivotal Tuning Watermarking for Pre- Trained Image Generators, ”USENIX: The Advanced Computing Systems Association, 2023

    2023

  20. [28]

    An Image is Worth 16x16 Words: Transformers for Image Recognition at Scale,

    Alexey Dosovitskiy, Lucas Beyer, Alexander Kolesnikov, Dirk Weissenborn, Xi- aohua Zhai, Thomas Unterthiner, Mostafa Dehghani, Matthias Minderer, Georg Heigold, Sylvain Gelly, Jakob Uszkoreit, and Neil Houlsby., “An Image is Worth 16x16 Words: Transformers for Image Recognitio...

    2021

  21. [29]

    Do Vision Transformers See Like Convolutional Neural Networks?,

    Maithra Raghu, Thomas Unterthiner, Simon Kornblith, Chiyuan Zhang, and Alexey Dosovitskiy., “Do Vision Transformers See Like Convolutional Neural Networks?, ”Neural Information Processing Systems, 2021

    2021

  22. [30]

    Deep Learning Face Attributes in the Wild,

    Ziwei Liu, Ping Luo, Xiaogang Wang, and Xiaoou Tang., “Deep Learning Face Attributes in the Wild, ”International Conference on Computer Vision, 2015

    2015

  23. [31]

    Microsoft COCO: Common Objects in Context,

    Tsung-Yi Lin, Michael Maire, Serge Belongie, Lubomir Bourdev, Ross Girshick, James Hays, Pietro Perona, Deva Ramanan, C. Lawrence Zitnick, and Piotr Dollár., “Microsoft COCO: Common Objects in Context, ”European Conference on Computer Vision, 2014

    2014

  24. [32]

    Encoded Feature Enhancement in Watermarking Network for Distortion in Real Scenes,

    Han Fang, Zhaoyang Jia, Hang Zhou, Zehua Ma, and Weiming Zhang., “Encoded Feature Enhancement in Watermarking Network for Distortion in Real Scenes, ” IEEE TRANSACTIONS on MULTIMEDIA, 2023

    2023

  25. [33]

    Print-Camera Resistant Image Watermarking With Deep Noise Simulation and Constrained Learning,

    Chuan Qin, XIaomeng Li, Zhenyi Zhang, Fengyong Li, Xinpeng Zhang, and Guorui Feng., “Print-Camera Resistant Image Watermarking With Deep Noise Simulation and Constrained Learning, ”IEEE TRANSACTIONS on MULTIMEDIA, 2024

    2024

  26. [34]

    Towards Deep Learning Models Resistant to Adversarial Attacks,

    Aleksander Madry, Aleksandar Makelov, Ludwig Schmidt, Dimitris Tsipras, and Adrian Vladu., “Towards Deep Learning Models Resistant to Adversarial Attacks, ” International Conference on Learning Representations, 2018

    2018

  27. [35]

    Deep Residual Learn- ing for Image Recognition,

    Kaiming He, Xiangyu Zhang, Shaoqing Ren, and Jian Sun., “Deep Residual Learn- ing for Image Recognition, ”Computer Vision and Pattern Recognition, 2016

    2016

  28. [36]

    Learning Transferable Visual Models From Natural Language Supervision,

    Alec Radford, Jong Wook Kim, Chris Hallacy, Aditya Ramesh, Gabriel Goh, Sandhini Agarwal, Girish Sastry, Amanda Askell, Pamela Mishkin, Jack Clark, Gretchen Krueger, and Ilya Sutskever., “Learning Transferable Visual Models From Natural Language Supervision, ”International Con...

    2021

  29. [37]

    SDXL: Improving Latent Diffusion Models for High-Resolution Image Synthesis,

    Dustin Podell, Zion English, Kyle Lacey, Andreas Blattmann, Tim Dockhorn, Jonas Müller, Joe Penna, and Robin Rombach., “SDXL: Improving Latent Diffusion Models for High-Resolution Image Synthesis, ”arXiv preprint arXiv, 2023

    2023

  30. [38]

    Robustness of AI-Image Detectors: Fundamental Limits and Practical Attacks,

    Mehrdad Saberi, Vinu Sankar Sadasivan, Keivan Rezaei, Aounon Kumar, Atoosa Chegini, Wenxiao Wang, and Soheil Feizi., “Robustness of AI-Image Detectors: Fundamental Limits and Practical Attacks, ”International Conference on Learning Representations, 2023

    2023

  31. [39]

    Two-Stage Watermark Removal Framework for Spread Spectrum Watermarking,

    Jinkun You, and Yicong Zhou., “Two-Stage Watermark Removal Framework for Spread Spectrum Watermarking, ”IEEE TRANSACTIONS on MULTIMEDIA, 2024

    2024

  32. [40]

    Exploring Accurate Invariants on Polar Harmonic Fourier Moments in Polar Coordinates for Robust Image Watermarking,

    Mingze He, Hongxia Wang, Fei Zhang, and Yuyuan Xiang., “Exploring Accurate Invariants on Polar Harmonic Fourier Moments in Polar Coordinates for Robust Image Watermarking, ”IEEE TRANSACTIONS on MULTIMEDIA, 2023

    2023

  33. [41]

    De-END: Decoder-Driven Watermarking Network,

    Han Fang, Zhaoyang Jia, Yupeng Qiu, Jiyi Zhang, Weiming Zhang, and Ee-Chien Chang., “De-END: Decoder-Driven Watermarking Network, ” IEEE TRANSAC- TIONS on MULTIMEDIA, 2023

    2023

  34. [42]

    Estimating the Secret Key of Spread Spectrum Watermarking Based on Equivalent Keys,

    Jinkun You, Yuan-Gen Wang, Guopu Zhu, Ligang Wu, Hongli Zhang, and Sam Kwong., “Estimating the Secret Key of Spread Spectrum Watermarking Based on Equivalent Keys, ”IEEE TRANSACTIONS on MULTIMEDIA, 2023

    2023

  35. [43]

    Invisible Backdoor Triggers in Image Editing Model via Deep Watermarking,

    Yu-Feng Chen, Tzuhsuan Huang, Pin-Yen Chiu, and Jun-Cheng Chen., “Invisible Backdoor Triggers in Image Editing Model via Deep Watermarking, ”arXiv preprint arXiv:2506.04879, 2025

    2025 arXiv

  36. [44]

    Exploring Frequency Adversarial Attacks for Face Forgery Detection,

    Jia, Shuai and Ma, Chao and Yao, Taiping and Yin, Bangjie and Ding, Shouhong and Yang, Xiaokang., “Exploring Frequency Adversarial Attacks for Face Forgery Detection, ”Computer Vision and Pattern Recognition, 2022

    2022

  37. [45]

    Frequency-driven Imperceptible Adversarial Attack on Semantic Similarity,

    Luo, Cheng and Lin, Qinliang and Xie, Weicheng and Wu, Bizhu and Xie, Jin- heng and Shen, Linlin., “Frequency-driven Imperceptible Adversarial Attack on Semantic Similarity, ”Computer Vision and Pattern Recognition, 2022

    2022

Pith tools

Reviewed August 5, 2026 · model on record in the stance chip above.