ResGuard: Enhancing Robustness Against Known Original Attacks in Deep Watermarking

Ee-Chien Chang; Han Fang; Hanyi Wang; Shilin Wang; Yupeng Qiu

ResGuard: Enhancing Robustness Against Known Original Attacks in Deep Watermarking

T0 review · 2 major / 0 minor · reviewed 2026-07-13 · grok-4.5

Challenge this review Download PDF Read on arXiv ↗

Pith's one-line read Deep watermarking residuals transfer across images, so a simple known-pair subtraction erases the mark; ResGuard forces image-specific residuals and restores near-perfect extraction.

desk verdict Clean diagnosis of residual transferability in END watermarking plus a lightweight fix that works against the simple KOA they actually test; adaptive residual estimators remain unexamined. read the letter →

arxiv 2604.03693 v1 submitted 2026-04-04 cs.CV

Hanyi Wang , Han Fang , Yupeng Qiu , Shilin Wang , Ee-Chien Chang This is my paper · ORCID

classification cs.CV

keywords ImageWatermarkingSecurityRobustnessDeepLearningKnownOriginalAttackResidualSpecificity

verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

Standard deep image watermarking hides a message with an encoder, simulates random distortions in a noise layer, and recovers the message with a decoder. The paper shows that an attacker who holds even one original and watermarked pair can estimate the embedding residual and subtract a similar residual from other watermarked images, nearly destroying the message while leaving the picture looking intact. The cause is that the residual pattern produced by these models is almost the same from image to image, so it transfers. ResGuard is a plug-and-play training addition that pushes residuals of different host images apart and trains the decoder against residual-subtraction attacks. Integrated into five existing methods it raises average extraction accuracy under this attack from roughly 60 percent to 99.8 percent without harming visual quality or ordinary distortion robustness.

What carries the argument

Residual Specificity Enhancement (RSE) loss: a contrastive objective that pulls residuals of the same host image (different messages) together and pushes residuals of different hosts (same message) apart, paired with a KOA noise layer that subtracts a foreign residual during training so the decoder learns to decode under residual mismatch.

What would settle it

Take any ResGuard-trained model, give an attacker dozens of original-watermarked pairs, let the attacker fit a residual predictor (PCA, auto-encoder, or small network) instead of averaging, subtract the predicted residual from held-out watermarked images, and measure whether bit accuracy falls well below the reported 99 percent.

Watch

Extended reading notes

Core claim

Encoder-noise-decoder deep watermarking produces embedding residuals that lack strong image dependency and are therefore transferable across host images. Even a minimal Known Original Attack that subtracts an average residual estimated from one or a few known pairs can drop watermark extraction accuracy near chance while preserving visual quality. Enforcing image-specific residuals with a contrastive residual-specificity loss and an auxiliary residual-subtraction noise layer during training eliminates that transferability and restores extraction accuracy to near 100 percent across existing frameworks.

Load-bearing premise

The paper treats simple averaging of one or a few known residuals as the practical attack an adversary would actually use; more sophisticated residual estimators built from the same pairs could still succeed.

Editorial extensions

If this is right

Drop-in addition of ResGuard to existing END watermarkers raises average KOA bit accuracy from 59.87 percent to 99.81 percent.
Cross-image residual cosine similarity falls by roughly 45 percent and residual maps become visibly content-adaptive.
PSNR, SSIM, LPIPS and accuracy under JPEG, blur and noise remain essentially unchanged.
Even the weakest practical setting (one known pair) is defeated once residuals are forced to be image-coupled.
Re-using the same ownership message across many images is especially unsafe without image-specific embedding.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

Adaptive attackers who estimate principal residual components rather than simple averages may still partially succeed unless stronger image coupling is enforced.
The same residual-transfer vulnerability is likely present in other deep steganography or image-to-image systems that learn additive perturbations.
Varying the watermark message per image only partially mitigates KOA; image dependency remains necessary.
Contrastive residual training may transfer to video or audio watermarking where known-original pairs are equally realistic.

Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Desk Editor's Note

read the letter

The real news here is empirical: five published END watermarkers collapse to ~50–63% bit accuracy under a one-pair residual subtraction attack, and a plug-in training module (RSE contrastive loss + KOA noise layer) restores them to ~99.8% without wrecking PSNR/SSIM or ordinary channel robustness. That diagnosis is new and useful; the fix is straightforward engineering that is architecture-agnostic.

What they do well is the multi-baseline re-training under matched settings, the ablation that separates RSE from the KOA noise layer, and the residual cosine-similarity numbers plus visual residual maps that actually support the claimed mechanism. Same-message vs different-message KOA curves are also informative: the attack is strongest when the watermark key is reused, which matches real ownership-verification practice. Math is elementary (MSE + InfoNCE-style contrastive), citations cover the classic KOA literature and the modern deep baselines, and the evaluation metrics are external to the training losses, so circularity is low.

Soft spots are real but proportionate. The headline 59.87% → 99.81% claim is measured only against non-adaptive average residual subtraction (N=1 default). The paper itself says KOA “enables various targeted suppression strategies,” yet never tries a content-conditioned residual predictor, nearest-neighbor residual, or any optimized suppressor that uses the same known pairs. Both ResGuard components are tailored exactly to the average-residual attack they inject at train time, so the near-perfect numbers rest on an untested assumption that the adversary cannot do better. No code release, no error bars, free λ and τ parameters. Those are addressable referee points, not load-bearing cracks in the central observation.

This is for people who build or evaluate deep image watermarking / media forensics systems. Worth a serious referee; I would bring it to reading group and would cite the attack surface result.

Referee Report

2 major / 0 minor

Summary. The paper identifies a Known Original Attack (KOA) vulnerability in END-style deep image watermarking: given one or more host–watermarked pairs, an adversary can estimate an embedding residual (typically the average residual) and subtract it from other watermarked images, collapsing extraction accuracy while preserving visual quality. The authors attribute this to insufficient image-dependency of residuals. They propose ResGuard, a plug-and-play training module with (i) a residual specificity enhancement (RSE) contrastive loss that pulls same-host residuals together and pushes different-host residuals apart, and (ii) a KOA noise layer that injects residual-style additive perturbations so the decoder remains reliable under residual mismatch. Integrated into five public baselines (HiDDeN, MBRS, CIN, RoSteALS, InvisMark) without architecture changes, ResGuard raises average KOA bit accuracy from ~59.87% to ~99.81% while preserving clean/distorted extraction accuracy and PSNR/SSIM/LPIPS. Ablations, residual cosine-similarity measurements, and residual visualizations support the claimed mechanism.

Significance. If the result holds under the stated threat model, the paper fills a genuine gap: modern deep watermarking has focused on random channel noise and largely ignored intentional residual-based removal when originals are known. The contribution is practical—plug-and-play, architecture-agnostic, and demonstrated on five independent public codebases under matched training settings—with clear external metrics (bit accuracy under residual subtraction, residual cosine similarity, standard quality metrics). The dual-pair training regime, RSE loss, and KOA noise layer are concrete and reproducible design choices. The work is therefore of clear interest to the watermarking and multimedia-security community, provided the scope of the attack model is stated carefully.

major comments (2)

Section 1 and §4.2 define KOA as enabling “various targeted suppression strategies,” yet all quantitative claims (Abstract, Table 2, Fig. 3, Table 7) evaluate only non-adaptive average residual subtraction (N=1 default). Both RSE (Eqs. 1–2 and the contrastive loss) and the KOA noise layer (Eqs. 3–7) are tailored exactly to this additive residual model. An adversary with the same known pairs could train a content-conditioned residual predictor, select a nearest-neighbor residual, or optimize a non-linear suppressor. Without at least one such adaptive baseline, the near-100% figure cannot be taken as general KOA robustness. Either add such experiments or explicitly restrict the claim to average-residual KOA.
The dual-pair training axiom (two hosts, two messages) is load-bearing for both RSE and the KOA noise layer, yet the paper does not analyze how residual image-dependency or KOA accuracy scales with the number of pairs seen during training, nor whether the learned residual structure generalizes when the test distribution of hosts differs substantially from DIV2K. A short scaling or leave-one-out residual-similarity check would strengthen the central mechanism claim.

Circularity Check

0 steps flagged · score 0.0 of 10

No circularity: ResGuard's losses are training objectives evaluated against independent external metrics (bit accuracy under residual subtraction, residual cosine similarity, PSNR/SSIM/LPIPS).

full rationale

The paper's central claim is empirical: integrating an RSE contrastive loss (Eq. after (2), pulling same-host residuals and pushing cross-host residuals) plus a KOA noise layer (Eqs. 3–7, injecting residual-style additive perturbations) into existing END frameworks raises average KOA bit accuracy from 59.87% to 99.81% (Abstract, Table 2) while preserving clean/distorted extraction and visual quality (Tables 3–5). These quantities are measured on held-out COCO images under an independently defined attack (average residual subtraction, N=1 default, Sec. 1 and 4.2) and standard image metrics; none is defined by, or algebraically forced by, the training losses. Residual cosine similarity (Fig. 5) is likewise an external diagnostic, not a fitted parameter later reported as a prediction. No uniqueness theorem, self-citation chain, or ansatz is load-bearing for the result; prior KOA citations [5,6] merely name the attack setting. The derivation is therefore self-contained against external benchmarks and exhibits no reduction of outputs to inputs by construction.

Assumptions & free parameters 4 free parameters · 3 assumptions · 2 invented entities

The central empirical claim rests on standard deep-learning training assumptions, public image datasets, and a handful of hand-chosen loss weights and temperature. No new physical entities are postulated; the RSE loss and KOA noise layer are engineering constructs whose only evidence is the reported accuracy tables.

free parameters (4)

lambda_1 (KOA loss weight) = 1.0
Set to 1.0 by hand; balances ordinary message loss against the simulated KOA term.
lambda_2 (image loss weight) = 0.7
Set to 0.7 by hand; trades off visual fidelity against message recovery.
lambda_3 (RSE loss weight) = 0.5
Set to 0.5 by hand; controls strength of residual-specificity regularisation.
tau (temperature in RSE contrastive loss) = 0.1
Set to 0.1 by hand; scales cosine-similarity logits inside the InfoNCE-style RSE term.

assumptions (3)

domain assumption Embedding residuals produced by END frameworks lack strong image dependency and are therefore transferable across images.
Stated as the root cause of KOA vulnerability (Introduction and Section 3.1); empirically supported by residual-similarity measurements but treated as a modelling premise for the design of RSE.
ad hoc to paper A dual-pair training regime (two hosts, two messages) is sufficient to learn residual relationships that generalise to unseen images.
Introduced in Section 3.2 without theoretical justification that two pairs capture the full residual manifold.
domain assumption Cosine similarity of pixel-space residuals is an adequate proxy for residual transferability under KOA.
Used both as the RSE objective and as the diagnostic metric in Figure 5.

invented entities (2)

Residual Specificity Enhancement (RSE) loss
purpose: Contrastive regulariser that pulls same-host residuals together and pushes different-host residuals apart.
Defined in Eq. (after residual definitions) of Section 3.2; no independent theoretical derivation outside the paper.
KOA noise layer
purpose: Training-time residual-subtraction attack that forces the decoder to remain accurate under residual transfer.
Defined by Eqs. (3)–(7) in Section 3.2; purely an engineering construct whose only validation is the ablation table.

how reviews work

0 comments

Cite this review

Pith. "Pith review of ResGuard: Enhancing Robustness Against Known Original Attacks in Deep Watermarking." pith.science (2026). https://pith.science/paper/2604.03693

@misc{pith2026260403693,
  author       = {Pith},
  title        = {Pith review of: ResGuard: Enhancing Robustness Against Known Original Attacks in Deep Watermarking},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/2604.03693}},
  note         = {Machine review of arXiv:2604.03693}
}

read the original abstract

Deep learning-based image watermarking commonly adopts an "Encoder-Noise Layer-Decoder" (END) architecture to improve robustness against random channel distortions, yet it often overlooks intentional manipulations introduced by adversaries with additional knowledge. In this paper, we revisit this paradigm and expose a critical yet underexplored vulnerability: the Known Original Attack (KOA), where an adversary has access to multiple original-watermarked image pairs, enabling various targeted suppression strategies. We show that even a simple residual-based removal approach, namely estimating an embedding residual from known pairs and subtracting it from unseen watermarked images, can almost completely remove the watermark while preserving visual quality. This vulnerability stems from the insufficient image dependency of residuals produced by END frameworks, which makes them transferable across images. To address this, we propose ResGuard, a plug-and-play module that enhances KOA robustness by enforcing image-dependent embedding. Its core lies in a residual specificity enhancement loss, which encourages residuals to be tightly coupled with their host images and thus improves image dependency. Furthermore, an auxiliary KOA noise layer injects residual-style perturbations during training, allowing the decoder to remain reliable under stronger embedding inconsistencies. Integrated into existing frameworks, ResGuard boosts KOA robustness, improving average watermark extraction accuracy from 59.87% to 99.81%.

Discussion (0). Continue with ORCID to comment.

Reference graph

Works this paper leans on

27 extracted references · 2 linked inside Pith

[1]

Eirikur Agustsson and Radu Timofte. 2017. Ntire 2017 challenge on single image super-resolution: Dataset and study. InProceedings of the IEEE conference on computer vision and pattern recognition workshops. 126–135

2017
[2]

Reem A Alotaibi and Lamiaa A Elrefaei. 2019. Text-image watermarking based on integer wavelet transform (IWT) and discrete cosine transform (DCT).Applied Computing and Informatics15, 2 (2019), 191–202

2019
[3]

Tu Bui, Shruti Agarwal, and John Collomosse. 2023. Trustmark: Universal water- marking for arbitrary resolution images.arXiv preprint arXiv:2311.18297(2023)

arXiv 2023
[4]

Tu Bui, Shruti Agarwal, Ning Yu, and John Collomosse. 2023. Rosteals: Robust steganography using autoencoder latent space. InProceedings of the IEEE/CVF conference on computer vision and pattern recognition. 933–942

2023
[5]

François Cayre, Caroline Fontaine, and Teddy Furon. 2004. Watermarking attack: Security of wss techniques. InInternational Workshop on Digital Watermarking. Springer, 171–183

2004
[6]

2007.Digital watermarking and steganography

Ingemar Cox, Matthew Miller, Jeffrey Bloom, Jessica Fridrich, and Ton Kalker. 2007.Digital watermarking and steganography. Morgan kaufmann

2007
[7]

Patrick Esser, Robin Rombach, and Bjorn Ommer. 2021. Taming transformers for high-resolution image synthesis. InProceedings of the IEEE/CVF conference on computer vision and pattern recognition. 12873–12883

2021
[8]

Han Fang, Zhaoyang Jia, Zehua Ma, Ee-Chien Chang, and Weiming Zhang. 2022. PIMoG: An effective screen-shooting noise-layer simulation for deep-learning- based watermarking network. InProceedings of the 30th ACM international con- ference on multimedia. 2267–2275

2022

Show all 27 references

[9]

Han Fang, Yupeng Qiu, Kejiang Chen, Jiyi Zhang, Weiming Zhang, and Ee- Chien Chang. 2023. Flow-based robust watermarking with invertible noise layer for black-box distortions. InProceedings of the AAAI conference on artificial intelligence, Vol. 37. 5054–5061

2023
[10]

Han Fang, Weiming Zhang, Hang Zhou, Hao Cui, and Nenghai Yu. 2018. Screen- shooting resilient watermarking.IEEE Transactions on Information Forensics and Security14, 6 (2018), 1403–1418

2018
[11]

Pierre Fernandez, Alexandre Sablayrolles, Teddy Furon, Hervé Jégou, and Matthijs Douze. 2022. Watermarking images in self-supervised latent spaces. InICASSP 2022-2022 IEEE International Conference on Acoustics, Speech and Signal Processing (ICASSP). IEEE, 3054–3058

2022
[12]

Mohamed Hamidi, Mohamed El Haziti, Hocine Cherifi, and Mohammed El Has- souni. 2018. Hybrid blind robust image watermarking technique based on DFT- DCT and Arnold transform.Multimedia Tools and Applications77 (2018), 27181– 27214

2018
[13]

Hai-tao Hu, Ya-dong Zhang, Chao Shao, and Quan Ju. 2014. Orthogonal moments based on exponent functions: Exponent-Fourier moments.Pattern Recognition 47, 8 (2014), 2596–2606

2014
[14]

Ming-Kuei Hu. 1962. Visual pattern recognition by moment invariants.IRE transactions on information theory8, 2 (1962), 179–187

1962
[15]

Zhaoyang Jia, Han Fang, and Weiming Zhang. 2021. Mbrs: Enhancing robustness of dnn-based watermarking by mini-batch of real and simulated jpeg compression. InProceedings of the 29th ACM international conference on multimedia. 41–49

2021
[16]

Xiangui Kang, Jiwu Huang, Yun Q Shi, and Yan Lin. 2003. A DWT-DFT composite watermarking scheme robust to both affine transform and JPEG compression. IEEE transactions on circuits and systems for video technology13, 8 (2003), 776–786

2003
[17]

Tsung-Yi Lin, Michael Maire, Serge Belongie, James Hays, Pietro Perona, Deva Ramanan, Piotr Dollár, and C Lawrence Zitnick. 2014. Microsoft coco: Common objects in context. InComputer vision–ECCV 2014: 13th European conference, zurich, Switzerland, September 6-12, 2014, procee...

2014
[18]

Rui Ma, Mengxi Guo, Yi Hou, Fan Yang, Yuan Li, Huizhu Jia, and Xiaodong Xie
[19]

InProceedings of the 30th ACM International Conference on Multi- media

Towards blind watermarking: Combining invertible and non-invertible mechanisms. InProceedings of the 30th ACM International Conference on Multi- media. 1532–1542
[20]

Rajesh Mehta, Navin Rajpal, and Virendra P Vishwakarma. 2016. LWT-QR decomposition based robust and efficient image watermarking scheme using Lagrangian SVR.Multimedia Tools and Applications75 (2016), 4129–4150

2016
[21]

Zahra Pakdaman, Saeid Saryazdi, and Hossein Nezamabadi-Pour. 2017. A pre- diction based reversible image watermarking in Hadamard domain.Multimedia Tools and Applications76 (2017), 8517–8545

2017
[22]

Abdallah Soualmi, Adel Alti, and Lamri Laouamer. 2018. Schur and DCT de- composition based medical images watermarking. In2018 Sixth International Conference on Enterprise Systems (ES). IEEE, 204–210

2018
[23]

Qingtang Su, Yugang Niu, Hailin Zou, Yongsheng Zhao, and Tao Yao. 2014. A blind double color image watermarking algorithm based on QR decomposition. Multimedia tools and applications72 (2014), 987–1009

2014
[24]

Ron G Van Schyndel, Andrew Z Tirkel, and Charles F Osborne. 1994. A digital watermark. InProceedings of 1st international conference on image processing, Vol. 2. IEEE, 86–90

1994
[25]

Rui Xu, Mengya Hu, Deren Lei, Yaxi Li, David Lowe, Alex Gorevski, Mingyu Wang, Emily Ching, and Alex Deng. 2025. InvisMark: Invisible and Robust Watermarking for AI-generated Image Provenance. In2025 IEEE/CVF Winter Conference on Applications of Computer Vision (W ACV). IEEE, 909–918

2025
[26]

Kevin Alex Zhang, Lei Xu, Alfredo Cuesta-Infante, and Kalyan Veeramacha- neni. 2019. Robust invisible video watermarking with attention.arXiv preprint arXiv:1909.01285(2019)

2019 arXiv
[27]

Jiren Zhu, Russell Kaplan, Justin Johnson, and Li Fei-Fei. 2018. Hidden: Hiding data with deep networks. InProceedings of the European conference on computer vision (ECCV). 657–672

2018

Pith tools

Reviewed July 13, 2026 · model on record in the stance chip above.

[1] [1]

Eirikur Agustsson and Radu Timofte. 2017. Ntire 2017 challenge on single image super-resolution: Dataset and study. InProceedings of the IEEE conference on computer vision and pattern recognition workshops. 126–135

2017

[2] [2]

Reem A Alotaibi and Lamiaa A Elrefaei. 2019. Text-image watermarking based on integer wavelet transform (IWT) and discrete cosine transform (DCT).Applied Computing and Informatics15, 2 (2019), 191–202

2019

[3] [3]

Tu Bui, Shruti Agarwal, and John Collomosse. 2023. Trustmark: Universal water- marking for arbitrary resolution images.arXiv preprint arXiv:2311.18297(2023)

arXiv 2023

[4] [4]

Tu Bui, Shruti Agarwal, Ning Yu, and John Collomosse. 2023. Rosteals: Robust steganography using autoencoder latent space. InProceedings of the IEEE/CVF conference on computer vision and pattern recognition. 933–942

2023

[5] [5]

François Cayre, Caroline Fontaine, and Teddy Furon. 2004. Watermarking attack: Security of wss techniques. InInternational Workshop on Digital Watermarking. Springer, 171–183

2004

[6] [6]

2007.Digital watermarking and steganography

Ingemar Cox, Matthew Miller, Jeffrey Bloom, Jessica Fridrich, and Ton Kalker. 2007.Digital watermarking and steganography. Morgan kaufmann

2007

[7] [7]

Patrick Esser, Robin Rombach, and Bjorn Ommer. 2021. Taming transformers for high-resolution image synthesis. InProceedings of the IEEE/CVF conference on computer vision and pattern recognition. 12873–12883

2021

[8] [8]

Han Fang, Zhaoyang Jia, Zehua Ma, Ee-Chien Chang, and Weiming Zhang. 2022. PIMoG: An effective screen-shooting noise-layer simulation for deep-learning- based watermarking network. InProceedings of the 30th ACM international con- ference on multimedia. 2267–2275

2022