Returning to image watermarking

D R McCoy

September 2026

Moire, my earlier image-watermarking project, broke down on large images and had little resilience to cropping or other image manipulation. Recent work on watermarking prompted me to revisit those limitations. Its successor recovers an embedded identifier after compression, cropping, and resizing, with visible grain and recovery speed remaining areas for improvement.

Three models are relevant to those problems:

TrustMark, from Adobe Research and the University of Surrey, addresses watermarking across image resolutions. Its ICCV 2025 publication follows the original 2023 release. The model combines learned embedding and extraction with error correction and resolution scaling. TrustMark paper and implementation
Pixel Seal, released by Meta in December 2025, examines visible artifacts and the loss of quality and robustness when watermarking at higher resolutions. Its design includes perceptual attenuation at the target resolution and training that accounts for the resizing used during embedding. Pixel Seal paper
Watermark Anything, from Meta and published at ICLR 2025, locates marked regions and extracts messages from them. This is relevant when a crop or composite retains only part of the marked image. Watermark Anything model and paper

The system embeds a 16-byte identifier in an image’s pixels. The identifier can be recovered without the original image, allowing a marked copy to carry a reference to a separate record even when its file metadata is removed.

Open full-size diagram

Figure 1. Embedding and recovery. The learned component operates during recovery; the encoder uses fixed patterns and a bounded change to the source pixels.

The watermark consists of repeated patterns distributed across the image. These patterns occupy selected frequency components in 8 × 8 pixel blocks and repeat every 128 pixels. Larger images contain more repetitions, while the individual pattern remains the same size. The 128 message bits are framed with a header and checksum, then protected by a convolutional error-correcting code, producing 364 encoded bits. Each bit controls the sign of a fixed pattern. Their sum forms the tile added across the image. Embedding changes each 8-bit colour channel by at most two levels before any subsequent compression.

Cropping removes some repetitions and shifts the pattern’s origin. Resizing changes its spacing. Recovery therefore begins by searching for plausible positions and scales. At each candidate alignment, the decoder combines evidence from corresponding positions in the surviving repetitions. A crop can preserve enough evidence to recover the message even though part of the image is missing. Further downsampling can remove that evidence as well as change its alignment.

The network works on the image’s frequency components. A discrete cosine transform (DCT) describes the brightness variations within each 8 × 8 block using 64 coefficients. Eighteen of these coefficients occupy the band used for the watermark. Limiting their magnitude prevents a few strong image features from dominating the initial evidence.

Open full-size diagram

Figure 2. The residual decoder. The direct connection on the right preserves the baseline evidence; the network adds a bounded correction. All channel counts refer to features on the grid of 8 × 8 image blocks.

The network receives both the full set of DCT coefficients and the 18 selected evidence channels. Two 3 × 3 convolution layers examine neighbouring blocks, and a final 1 × 1 layer produces corrections for the 18 evidence channels. The network has 57,138 learned parameters. Its output adjusts the measured evidence without changing the received image or the fixed carrier patterns.

The corrected evidence is summed across repetitions and correlated with the 364 known patterns to produce bit scores. Error correction uses these scores to recover a candidate message; its header and CRC checksum must then validate. The decoder receives neither the original image nor the expected identifier. Evaluation compares the recovered bytes with the embedded identifier and counts only complete matches as successful recoveries.

In an evaluation using 100 photographs at a 1024-pixel long edge, the system recovered the exact identifier in 699 of 700 trials. Each photograph was tested in seven conditions. Crops retained 75% of the image area, resizing ranged from 65% to 125% of the marked dimensions, and framing added a uniform border.

Image condition	Exact recoveries
Unedited	100/100
JPEG quality 85	100/100
Cropped	100/100
Resized	100/100
Framed	100/100
Cropped, resized, and framed, saved as PNG	100/100
Cropped, resized, and framed, saved as JPEG quality 85	99/100

The remaining limitations concern image quality and processing time. Small pixel changes can still produce visible grain in smooth or dark areas. Recovery is less consistent after substantial downsampling. Recovering an identifier after resizing requires a search over possible alignments, and rejecting an unmarked image can be slow. Further work can focus on reducing visible changes in sensitive regions and shortening that search while preserving exact recovery.