StyleMark: A Robust Watermarking Method for Art Style Images Against Black-Box Arbitrary Style Transfer

Dengpan Ye; Jun Wang; Sipeng Shen; Yunming Zhang

REVIEW 3 major objections 4 minor 28 references

StyleMark: A Robust Watermarking Method for Art Style Images Against Black-Box Arbitrary Style Transfer

T0 review · 3 major / 4 minor · reviewed 2026-08-11 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗ Review JSON

Pith's one-line read A watermark embedded in style-feature statistics survives black-box arbitrary style transfer, letting platforms trace stylized images back to the source artwork.

desk verdict A genuinely new watermarking approach for style transfer, but the 'across different AST' claim outruns the evidence and the evaluation needs error bars and a false-positive analysis. read the letter →

arxiv 2412.07129 v1 pith:5JEZFLSQ submitted 2024-12-10 cs.CV

Yunming Zhang , Dengpan Ye , Sipeng Shen , Jun Wang This is my paper · ORCID

classification cs.CV

keywords watermarkingarbitrarystyletransfercopyrightprotectionfeaturestatisticsAdaINblack-boxrobustnessimageattributiondeepneuralnetworks

verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

StyleMark claims that copyright watermarks can survive arbitrary style transfer if they are embedded into the shared style-feature statistics that AST models transfer, rather than into the image's visible structure. The paper proposes an encoder that hides a 30-bit artist identifier in the mean activations of style features at multiple scales, so that when a black-box AST model renders the style onto a content image, the watermark is re-rendered along with the brushstrokes. A decoder then recovers the identifier from the stylized image with 82.1%–98.6% bit accuracy across seven AST models, while prior watermarking methods stay near random guessing. If correct, art-sharing platforms could attribute stylized images to the source artwork without knowing which AST model produced them.

What carries the argument

The carrier of the argument is the shared style-feature statistics used by adaptive instance normalization (AdaIN): channel-wise mean and standard deviation of the style image's feature map. StyleMark's encoder, a style-feature encoder plus a reconstructor with residual connections, learns to shift these statistics under control of the watermark bits, and its distribution squeeze loss forces the watermark into style features rather than content structure. The decoder, a ResNet50 classifier, is first trained end-to-end with the AdaIN AST model as the only distortion, then fine-tuned under random pixel noise, so that it learns to read the watermark from stylized and post-processed images alike.

What would settle it

Train or adapt a pre-trained AST model that matches style without aligning channel-wise means and variances, for example by explicit higher-order distribution matching or attention-only feature fusion, then run StyleMark; if the recovered 30-bit watermark accuracy falls from above 80% toward 50%, the shared-statistics hypothesis is falsified.

Watch

Extended reading notes

Core claim

StyleMark's central claim is that a copyright watermark can be co-rendered into arbitrary style transfer outputs if the watermark is embedded in the style-feature statistics that AST models actually transfer. The paper's 'mild hypothesis' is that these statistics—specifically channel-wise mean and variance—form a shared style feature space across different AST architectures. The encoder modifies these statistics at multiple scales, and the decoder is trained end-to-end with AdaIN as a white-box stand-in, then fine-tuned against noise. On seven AST models the recovered 30-bit watermark has 82.1%–98.6% accuracy, versus near 50% for prior watermarking techniques. The authors interpret this as evidence that watermark traces ride along with brushstroke features into the stylized image.

Load-bearing premise

The load-bearing premise is that every black-box AST model conveys style through the same channel-wise mean and variance statistics that AdaIN uses, so a watermark embedded in those statistics by an encoder trained only with AdaIN survives all other AST models.

Editorial extensions

If this is right

If StyleMark works as claimed, art-sharing platforms can attribute a stylized image to a registered artist's source image without knowing which AST model produced it.
Prior deep watermarking methods fail at this task, so the result would open a new defense line against unauthorized style transfer.
Watermark rewriting attacks and common post-processing (JPEG, blur, brightness) would not erase attribution, according to the reported experiments.
The method does not block legitimate AST use, since it only adds invisible markers and does not degrade the normal style-transfer experience.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

The core mechanism may transfer to other generative pipelines that rely on feature-statistics alignment, such as diffusion-based style transfer, but this is not tested in the paper.
The claimed robustness depends on the entire family of AST models sharing AdaIN-like statistics; a future AST built on attention or reversible transformations that discard channel-wise moments could evade the watermark.
The paper's two-stage training recipe—pretrain on the easiest white-box distortion, then fine-tune the decoder on a noise pool—could strengthen other watermarking methods if adopted generally.
A direct test would be to probe intermediate feature maps of stylized images for watermark signal in channel means, which would confirm or refute the claimed mechanism.

Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Desk Editor's Note

read the letter

First thing: this paper shows a real new capability. StyleMark embeds a watermark into the mean/variance statistics of the style image, in the same feature space AdaIN-style AST models use, and trains with an AST noise pool. The result is 82-98% bit accuracy after seven black-box AST models while HiDDeN, MBRS, FakeTagger, PIMoG, and FIN all sit at chance. That's a big gap, and the ablation makes the case that the style-feature encoder is the reason: swap in MBRS's encoder and recovery collapses to ~50%. The distribution squeeze loss and two-stage decoder fine-tuning both show measurable gains, and the authors test on the official pre-trained AST models. Credit where due.

Now the soft spots. The main one is the generalization claim. Every AST model in the test set is in the VGG-feature-statistics family. AdaIN is the white-box training model, and SANet, CCPL, CAP, EFDM, MANet, MccSTN all align style via feature statistics on VGG features. So 'across different AST' actually means 'across variants of the AdaIN-style family.' There's no WCT2, no ArtFlow, no transformer-based alignment, no Gram-matrix optimization. The paper calls this a 'mild hypothesis,' which is honest, but it means the headline is broader than the evidence. If a future AST model doesn't compute those statistics, the watermark likely doesn't survive.

Second, the evaluation lacks the statistical grounding a watermarking paper needs. No error bars, so I can't tell if the 82% vs 85% differences are noise. More importantly, no false-positive analysis: with a 30-bit watermark, is 0.82 bit accuracy enough to claim attribution with a known false-alarm rate? The paper never gives the decision threshold. For a copyright tool, that's the number that matters. The adaptive attacks are also weak—overwriting with FakeTagger/MBRS and retraining those two under the StyleMark framework is not a serious removal attempt (no fine-tuning against an adversarial AST, no adversarial stylization, no removal network).

Who should read this? Anyone working on watermarking or style transfer robustness. It's a genuine step in a new direction, and the experiments are mostly well done. The revision needs to narrow the generalization claim, add error bars and false-positive analysis, and test at least one structurally different AST model. I'd send it to review, and I'd also bring it to our reading group.

Referee Report

3 major / 4 minor

Summary. The paper introduces StyleMark, a watermarking method that embeds an artist identifier into a style image so that the watermark can be recovered from images produced by black-box arbitrary style transfer (AST). The encoder uses multi-scale style features and an AdaIN-style feature alignment (Eq. 2) to plant the watermark in channel statistics; a distribution squeeze loss pushes watermark energy into style features rather than content structure; a two-stage training procedure first trains with AdaIN as the distortion model and then fine-tunes the decoder on pixel-level noise. Experiments on seven AST models and common image distortions report bit accuracies of 82%–99% after AST, far above the near-chance performance of baseline deep watermarking methods. Ablations show that the proposed network, residual reconstruction, and distribution squeeze loss all contribute.

Significance. StyleMark addresses a genuinely new and practically relevant watermarking scenario—art style attribution after arbitrary style transfer—and its central mechanism is plausible: embedding in style-feature statistics that are precisely what AdaIN-style AST aligns. The reported accuracy gaps over HiDDeN, MBRS, FakeTagger, PIMoG, and FIN are large, and the ablations support the contribution of the style-specific encoder, the squeeze loss, and decoder fine-tuning. The paper includes clear algorithmic pseudocode and tests on several representative open-source AST models. However, the significance is bounded by three evaluation gaps: the tested black-box AST models all share the VGG/channel-statistics family for which the method was designed; the attribution claim lacks false-positive analysis and error bars; and the adaptive-attack evaluation is narrow relative to the security claim.

major comments (3)

[Introduction / Eq. (2) / Table 1] The paper's central claim, 'across different AST', is supported only within the family of VGG-front-end, channel-statistic-based style alignments. The six black-box models in Table 1 (SANet, CCPL, CAP, EFDM, MANet, MccSTN) all use VGG-style feature extractors and align features by matching channel statistics; the encoder is trained exclusively with the AdaIN alignment of Eq. (2) and Eq. (9). The manuscript gives no experiment or structural argument for a model that aligns style via whitening/coloring (e.g., WCT2), normalizing flows, or a non-VGG transformer. Because the watermark is placed in the mean/variance statistics of VGG features, a structurally different AST model could discard those statistics entirely. Please either test such a model or explicitly bound the claim to the AdaIN/VGG feature-statistics family.
[Threat Model / Robustness Evaluation (Table 1)] No false-positive analysis is provided for the attribution guarantee. The paper reports average bit accuracies (0.821–0.986 for 30-bit watermarks) but does not define a decision rule, such as a Hamming-distance threshold, or report the probability that an arbitrary stylized image is attributed to the wrong artist. Since the threat model envisions over a billion possible identifiers, a per-user false-positive rate is needed to substantiate the claim of precise attribution; otherwise a 0.82 bit-accuracy can correspond to very different per-image false-positive risks depending on the threshold. Also, the results are reported without standard deviations or multiple seeds, so it is unclear whether the smallest accuracy gaps are significant. Add repeated runs and a threshold/false-positive-rate analysis.
[Security Evaluation / Table 3] The adaptive-attack evaluation tests only watermark overwriting with FakeTagger and MBRS, including versions retrained with the StyleMark framework. This does not support the statement that StyleMark 'securely defends against malicious adaptive attacks.' A knowledgeable adversary could instead fine-tune a removal network, add combined geometric and pixel distortions, or train an attack that minimizes decoder confidence while preserving style. Please add at least one attack that directly targets the StyleMark decoder, or replace the security claim with a more limited statement.

minor comments (4)

[Eq. (5) / Algorithm 1] Fcon is introduced as a single-image encoder (fcon = Fcon(Isty)), but it is called as Fcon(gray(Iwm), gray(Isty)) in Eq. (5) and Algorithm 1; clarify what the two arguments are, and make the output order in Eq. (5) consistent with Algorithm 1.
[Adaptive Attacks] The text refers to 'Table 4' for the watermark overwriting results, but those results appear in Table 3; Table 4 is the ablation table.
[Table 1] The 'Average' column appears to include the 'Ori' column; state the averaging scope explicitly so that readers can reproduce the reported mean.
[Abstract / Introduction] The phrase 'securely defending against malicious adaptive attacks' and the term 'plug-and-play' are stronger than what the current experiments demonstrate; please calibrate these claims to the tested attack and AST families.

Circularity Check

0 steps flagged · score 0.0 of 10

No significant circularity: the watermark-recovery accuracy is an empirical test on held-out black-box AST models, not a fitted input or self-citation.

full rationale

StyleMark's central claim is empirical rather than derived from its own fitted constants. Equation (2) defines an AdaIN-style feature alignment used by the watermark encoder, and Eqs. (9)-(12) train the decoder against a single white-box AST model (AdaIN). The reported bit accuracies are measured on held-out test images and on six other AST models that were not used in training (Table 1), so the generalization claim is not forced by construction. No parameter is fitted to the reported accuracy values, and no load-bearing uniqueness theorem or prior self-citation is invoked. The "mild hypothesis" that watermark traces co-render with shared style features is a motivating assumption; its potential failure on non-statistics-based AST models is a generalization limitation or correctness risk, not circularity. The AdaIN model being both the architectural inspiration and the white-box training model is a mild self-referential design choice, but it does not reduce the black-box evaluation to a tautology. Therefore no equation-level circularity was found.

Assumptions & free parameters 6 free parameters · 4 assumptions · 0 invented entities

No new physical entities are postulated. The paper introduces a watermark encoder-decoder architecture and a loss, which are method components rather than new particles, forces, or dimensions. The central claim rests mainly on the shared-style-feature assumption and on hand-chosen loss weights.

free parameters (6)

lambda_mse = 1
Weights the MSE term for overall pixel fidelity; chosen empirically.
lambda_dsl = 0.2
Weights the distribution squeeze loss on grayscale content features; set by hand.
lambda_inv = 1
Weights the total invisibility loss in stage 1.
lambda_wm = 0.002
Weights the watermark BCE loss relative to invisibility.
watermark_length = 30 bits
Copyright ID length; trade-off between capacity and invisibility, tested from 10 to 40 bits.
training_schedule = 4000 stage 1 iterations, 200 stage 2 iterations
Selected without a stated criterion; affects encoder and decoder convergence.

assumptions (4)

domain assumption AdaIN channel statistics (mean and standard deviation) are a complete carrier of artistic style across all AST models.
Used to design Eq. (2) and to justify training only with AdaIN; not proven for attention-based or reversible-network AST models.
ad hoc to paper A watermark embedded in style feature statistics survives arbitrary black-box AST feature-alignment pipelines.
Called the paper's 'mild hypothesis'; empirical validation only on seven models, no theoretical guarantee.
domain assumption Grayscale content-feature MSE after normalization captures unwanted content distortion and is a valid proxy for invisibility.
Justifies the distribution squeeze loss in Eq. (6); no user study or perceptual metric beyond PSNR and SSIM.
standard math BCE on recovered bits is a sufficient training objective for reliable attribution.
Standard in watermarking, but assumes independent bits and ignores false-positive verification thresholds.

how reviews work

0 comments

Cite this review

Pith. "Pith review of StyleMark: A Robust Watermarking Method for Art Style Images Against Black-Box Arbitrary Style Transfer." pith.science (2026). https://pith.science/paper/5JEZFLSQ

@misc{pith2026241207129,
  author       = {Pith},
  title        = {Pith review of: StyleMark: A Robust Watermarking Method for Art Style Images Against Black-Box Arbitrary Style Transfer},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/5JEZFLSQ}},
  note         = {Machine review of arXiv:2412.07129}
}

read the original abstract

Arbitrary Style Transfer (AST) achieves the rendering of real natural images into the painting styles of arbitrary art style images, promoting art communication. However, misuse of unauthorized art style images for AST may infringe on artists' copyrights. One countermeasure is robust watermarking, which tracks image propagation by embedding copyright watermarks into carriers. Unfortunately, AST-generated images lose the structural and semantic information of the original style image, hindering end-to-end robust tracking by watermarks. To fill this gap, we propose StyleMark, the first robust watermarking method for black-box AST, which can be seamlessly applied to art style images achieving precise attribution of artistic styles after AST. Specifically, we propose a new style watermark network that adjusts the mean activations of style features through multi-scale watermark embedding, thereby planting watermark traces into the shared style feature space of style images. Furthermore, we design a distribution squeeze loss, which constrain content statistical feature distortion, forcing the reconstruction network to focus on integrating style features with watermarks, thus optimizing the intrinsic watermark distribution. Finally, based on solid end-to-end training, StyleMark mitigates the optimization conflict between robustness and watermark invisibility through decoder fine-tuning under random noise. Experimental results demonstrate that StyleMark exhibits significant robustness against black-box AST and common pixel-level distortions, while also securely defending against malicious adaptive attacks.

Figures

Figures reproduced from arXiv: 2412.07129 by the authors.

**Figure 2.** The whole pipeline of our StyleMark. To address the limitations of current defense methods, we propose a new concept inspired by deep watermarking technology, called “StyleMark”. This is the first watermarkbased method for protecting the copyright of art style images against black-box AST. As shown in [PITH_FULL_IMAGE:figures/full_fig_p002_2.png] view at source ↗

**Figure 3.** Subjective visual quality under various AST distortions. [PITH_FULL_IMAGE:figures/full_fig_p006_3.png] view at source ↗

Figures from the paper (1 more)

**Figure 4.** Figure 4: Visualization of images from different models. [PITH_FULL_IMAGE:figures/full_fig_p007_4.png]

Discussion (0). Continue with ORCID to comment.

Reference graph

Works this paper leans on

28 extracted references · 19 canonical work pages

[1]

, " * write output.state after.block = add.period write newline

ENTRY address archivePrefix author booktitle chapter edition editor eid eprint howpublished institution isbn journal key month note number organization pages publisher school series title type volume year label extra.label sort.label short.list INTEGERS output.state before.all mid.sentence after.sentence after.block FUNCTION init.state.consts #0 'before.a...
[2]

write newline

" write newline "" before.all 'output.state := FUNCTION n.dashify 't := "" t empty not t #1 #1 substring "-" = t #1 #2 substring "--" = not "--" * t #2 global.max substring 't := t #1 #1 substring "-" = "-" * t #2 global.max substring 't := while if t #1 #1 substring * t #2 global.max substring 't := if while FUNCTION word.in bbl.in capitalize " " * FUNCT...
[3]

Deng, Y.; Tang, F.; Dong, W.; Sun, W.; Huang, F.; and Xu, C. 2020. Arbitrary style transfer via multi-adaptation network. In Proceedings of the 28th ACM international conference on multimedia, 2719--2727

work page 2020
[4]

Fang, H.; Jia, Z.; Ma, Z.; Chang, E.-C.; and Zhang, W. 2022. Pimog: An effective screen-shooting noise-layer simulation for deep-learning-based watermarking network. In Proceedings of the 30th ACM international conference on multimedia, 2267--2275

work page 2022
[5]

Fang, H.; Qiu, Y.; Chen, K.; Zhang, J.; Zhang, W.; and Chang, E.-C. 2023. Flow-based robust watermarking with invertible noise layer for black-box distortions. In Proceedings of the AAAI conference on artificial intelligence, volume 37, 5054--5061

work page 2023
[6]

Guo, Z.; Wang, K.; Li, W.; Qian, Y.; Arandjelovi \'c , O.; and Fang, L. 2024. Artwork protection against neural style transfer using locally adaptive adversarial color attack. arXiv preprint arXiv:2401.09673

arXiv 2024
[7]

He, K.; Zhang, X.; Ren, S.; and Sun, J. 2016. Deep residual learning for image recognition. In Proceedings of the IEEE conference on computer vision and pattern recognition, 770--778

2016
[8]

Hong, K.; Jeon, S.; Lee, J.; Ahn, N.; Kim, K.; Lee, P.; Kim, D.; Uh, Y.; and Byun, H. 2023. AesPA-Net: Aesthetic pattern-aware style transfer networks. In Proceedings of the IEEE/CVF international conference on computer vision, 22758--22767

work page 2023

Show all 28 references

[9]

Hu, R.; Zhang, J.; Zhang, T.; and Li, J. 2024. Robust-Wide: Robust Watermarking against Instruction-driven Image Editing. arXiv preprint arXiv:2402.12688

2024 arXiv
[10]

Huang, X.; and Belongie, S. 2017. Arbitrary style transfer in real-time with adaptive instance normalization. In Proceedings of the IEEE international conference on computer vision, 1501--1510

2017
[11]

Jia, Z.; Fang, H.; and Zhang, W. 2021. Mbrs: Enhancing robustness of dnn-based watermarking by mini-batch of real and simulated jpeg compression. In Proceedings of the 29th ACM international conference on multimedia, 41--49

2021
[12]

Lan, Y.; Shang, F.; Yang, J.; Kang, X.; and Li, E. 2023. Robust image steganography: hiding messages in frequency coefficients. In Proceedings of the AAAI conference on artificial intelligence, volume 37, 14955--14963

2023
[13]

Li, W. 2023. AI painting on the stand. The Paper

2023
[14]

Li, Y.; Ren, J.; Xu, H.; and Liu, H. 2024. Neural style protection: Counteracting unauthorized neural style transfer. In Proceedings of the IEEE/CVF winter conference on applications of computer vision, 3966--3975

2024
[15]

Lin, T.-Y.; Maire, M.; Belongie, S.; Hays, J.; Perona, P.; Ramanan, D.; Doll \'a r, P.; and Zitnick, C. L. 2014. Microsoft coco: Common objects in context. In Computer Vision--ECCV 2014: 13th European Conference, Zurich, Switzerland, September 6-12, 2014, Proceedings, Part V 1...

2014
[16]

Liu, C.; Zhang, J.; Zhang, T.; Yang, X.; Zhang, W.; and Yu, N. 2024. Detecting Voice Cloning Attacks via Timbre Watermarking. In Network and Distributed System Security Symposium

2024
[17]

Ma, R.; Guo, M.; Yuming, L.; Zhang, H.; Ma, C.; Li, Y.; Xie, X.; and Zhang, S. 2024. PiGW: A Plug-in Generative Watermarking Framework. arXiv preprint arXiv:2403.12053

2024 arXiv
[18]

Pan, M.; Zeng, Y.; Lin, X.; Yu, N.; Hsieh, C.-J.; and Jia, R. 2023. AnchMark: Anchor-contrastive watermarking vs genAI-based image modifications. In NeurIPS 2023 Workshop on Regulatable ML

2023
[19]

Y.; and Lee, K

Park, D. Y.; and Lee, K. H. 2019. Arbitrary style transfer with style-attentional networks. In proceedings of the IEEE/CVF conference on computer vision and pattern recognition, 5880--5888

2019
[20]

Phillips, F.; and Mackintosh, B. 2011. Wiki art gallery, inc.: A case for critical thinking. Issues in Accounting Education, 26(3): 593--608

2011
[21]

Wang, R.; Juefei-Xu, F.; Luo, M.; Liu, Y.; and Wang, L. 2021. Faketagger: Robust safeguards against deepfake dissemination via provenance tracking. In Proceedings of the 29th ACM international conference on multimedia, 3546--3555

2021
[22]

Wang, Z.; Bovik, A.; Sheikh, H.; and Simoncelli, E. 2004. Image quality assessment: from error visibility to structural similarity. IEEE Transactions on Image Processing, 13(4): 600--612

2004
[23]

Wen, L.; Gao, C.; and Zou, C. 2023. CAP-VSTNet: content affinity preserved versatile style transfer. In Proceedings of the IEEE/CVF conference on computer vision and pattern recognition, 18300--18309

2023
[24]

Wu, Z.; Zhu, Z.; Du, J.; and Bai, X. 2022. Ccpl: Contrastive coherence preserving loss for versatile style transfer. In European conference on computer vision (ECCV), 189--206. Springer

2022
[25]

Zhang, Y.; Li, M.; Li, R.; Jia, K.; and Zhang, L. 2022 a . Exact feature distribution matching for arbitrary style transfer and domain generalization. In Proceedings of the IEEE/CVF conference on computer vision and pattern recognition, 8035--8045

2022
[26]

Zhang, Y.; Tang, F.; Dong, W.; Huang, H.; Ma, C.; Lee, T.-Y.; and Xu, C. 2022 b . Domain enhanced arbitrary image style transfer via contrastive learning. In ACM SIGGRAPH 2022 conference proceedings, 1--8

2022
[27]

Zhao, H.; Xiao, C.; Yang, J.; Jin, G.; and Li, M. 2024. MccSTN: Multi-Scale Contrast and Fine-Grained Feature Fusion Networks for Subject-driven Style Transfer. In Proceedings of the 2024 joint international conference on computational linguistics, language resources and evalu...

2024
[28]

Zhu, J.; Kaplan, R.; Johnson, J.; and Fei-Fei, L. 2018. Hidden: Hiding data with deep networks. In Proceedings of the European conference on computer vision (ECCV), 657--672. Springer

2018

Pith tools

Reviewed August 11, 2026 · model on record in the stance chip above.

[1] [1]

, " * write output.state after.block = add.period write newline

ENTRY address archivePrefix author booktitle chapter edition editor eid eprint howpublished institution isbn journal key month note number organization pages publisher school series title type volume year label extra.label sort.label short.list INTEGERS output.state before.all mid.sentence after.sentence after.block FUNCTION init.state.consts #0 'before.a...

[2] [2]

write newline

" write newline "" before.all 'output.state := FUNCTION n.dashify 't := "" t empty not t #1 #1 substring "-" = t #1 #2 substring "--" = not "--" * t #2 global.max substring 't := t #1 #1 substring "-" = "-" * t #2 global.max substring 't := while if t #1 #1 substring * t #2 global.max substring 't := if while FUNCTION word.in bbl.in capitalize " " * FUNCT...

[3] [3]

Deng, Y.; Tang, F.; Dong, W.; Sun, W.; Huang, F.; and Xu, C. 2020. Arbitrary style transfer via multi-adaptation network. In Proceedings of the 28th ACM international conference on multimedia, 2719--2727

work page 2020

[4] [4]

Fang, H.; Jia, Z.; Ma, Z.; Chang, E.-C.; and Zhang, W. 2022. Pimog: An effective screen-shooting noise-layer simulation for deep-learning-based watermarking network. In Proceedings of the 30th ACM international conference on multimedia, 2267--2275

work page 2022

[5] [5]

Fang, H.; Qiu, Y.; Chen, K.; Zhang, J.; Zhang, W.; and Chang, E.-C. 2023. Flow-based robust watermarking with invertible noise layer for black-box distortions. In Proceedings of the AAAI conference on artificial intelligence, volume 37, 5054--5061

work page 2023

[6] [6]

Guo, Z.; Wang, K.; Li, W.; Qian, Y.; Arandjelovi \'c , O.; and Fang, L. 2024. Artwork protection against neural style transfer using locally adaptive adversarial color attack. arXiv preprint arXiv:2401.09673

arXiv 2024

[7] [7]

He, K.; Zhang, X.; Ren, S.; and Sun, J. 2016. Deep residual learning for image recognition. In Proceedings of the IEEE conference on computer vision and pattern recognition, 770--778

2016

[8] [8]

Hong, K.; Jeon, S.; Lee, J.; Ahn, N.; Kim, K.; Lee, P.; Kim, D.; Uh, Y.; and Byun, H. 2023. AesPA-Net: Aesthetic pattern-aware style transfer networks. In Proceedings of the IEEE/CVF international conference on computer vision, 22758--22767

work page 2023