发表机构
University of Edinburgh; Garandor（爱丁堡大学; Garandor）
机构由 AI 辅助整理，请以论文原文为准。AI 中文总结
针对局部图像水印鲁棒性研究分散的问题，提出首个涵盖55种变换的系统基准，评估五种方法，发现MaskWM性能最优但图像质量最低，且鲁棒性强烈依赖变换类型。
AI 中文摘要
局部图像水印将不可见信号嵌入到选定的图像区域，而非将其分布到整个图像，从而能够在不显著改变图像的情况下，从特定对象或区域恢复载荷。现有研究评估了图像变换下载荷恢复和定位的鲁棒性，但往往聚焦于各自提出的方法，导致评估范围狭窄，且在变换、数据集和指标的选择上不一致。这些研究间的不一致性限制了对不同方法的直接比较，并使局部水印鲁棒性的整体图景变得模糊。为填补这一空白，我们提出了首个针对局部水印的系统性鲁棒性基准，涵盖55种图像变换，包括(i)信号失真、(ii)图像坐标对齐变化、(iii)间接局部编辑和(iv)直接水印编辑。该基准评估了MaskWM、WAM、OmniGuard、TrustMark和PixelSeal，这些方法要么原生支持定位，要么仅需极少的适配即可支持定位。我们的结果表明，所有被评估的方法都容易受到某些变换的影响，其中MaskWM在载荷恢复和定位方面表现最为突出，尽管其在干净设置下的图像质量最低。同步处理进一步提升了MaskWM在多种几何变换下的载荷恢复能力，但代价是图像质量的额外损失。一个关键发现是，局部水印的鲁棒性强烈依赖于变换的性质：信号失真通常能被最强的方法容忍，而几何错位和生成式局部编辑（如内绘和外绘）可能完全损害载荷恢复。我们观察到，载荷恢复和定位是相关但不可互换的，且两者都强烈依赖于变换对水印区域的影响。
英文摘要
Local image watermarking embeds an invisible signal into selected image regions rather than spreading it across the entire image, enabling payload recovery from specific objects or regions without perceptibly altering the image. Existing studies evaluate the robustness of payload recovery and localization under image transformations, but they often focus on their own proposed method, resulting in narrow evaluations with inconsistent choices of transformations, datasets, and metrics. These inconsistencies across studies limit direct comparisons across methods and muddle the overall picture of local watermark robustness. To address this gap, we present the first systematic robustness benchmark for local watermarks across 55 image transformations, including (i) signal distortions, (ii) changes in image coordinate alignment, (iii) indirect local edits, and (iv) direct watermark edits. The benchmark evaluates MaskWM, WAM, OmniGuard, TrustMark, and PixelSeal, all methods that either provide native localization or require minimal adaptation to support it. Our results show that all evaluated methods are vulnerable to some transformation, with MaskWM standing out as offering the strongest payload recovery and localization, although it has the lowest image quality in the clean setting. Synchronization further improves MaskWM's payload recovery under several geometric transformations, albeit at an additional cost to image quality. A key finding is that local watermark robustness depends strongly on the nature of the transformation: signal distortions are often tolerated by the strongest methods, while geometric misalignment and generative local edits, such as inpainting and outpainting, can completely impair payload recovery. We observe that payload recovery and localization are related but not interchangeable, and both strongly depend on the transformation's impact on the watermark region.
CommentsThis work has been accepted for publication in the proceedings of the 19th ACM Workshop on Artificial Intelligence and Security (AISec 2026), co-located with ACM CCS 2026. The final version will be published in the ACM Digital Library
