Just How Good are Invisible Watermarks Now?

Over the past two years, invisible watermarking technology has improved by leaps and bounds. With big players like Google and Meta creating their own invisible watermarks (SynthID and Stable Signature, respectively) in response to impending legislation (such as CA-AB3211, among others), the technology is quickly growing into a viable solution for secure labeling in an age where provenance, amidst the AI-generated content, is becoming increasingly important.

So, what is an invisible watermark? The goal is to embed information into the digital content itself, so that the information is computer-readable but imperceptible to the human eye. It is an invisible QR code. It is metadata that is embedded into the content rather than appended onto the content. It is a robust method of labeling content that remains intact as long as the content itself remains intact.

The question is: just how durable and invisible are these watermarks? And are they finally good enough to be used?

#Benchmark

Using our benchmark tool, we can evaluate some different watermarks to see how they stack up in durability and invisibility. A watermark is durable if it survives content alterations: compression, cropping, user edits, color filters, rotation, and so on. A watermark is invisible if it does not alter the image significantly: PSNR and SSIM are some popular metrics. The focus here will be on images.

Let us go through this chart step by step. (Note that this is written in a blog setting, not as an academic publication; there may be minor inaccuracies.)

#2000 SotA

Leading up to the dot-com bubble, digital steganography saw significant improvements. Many advanced techniques were introduced during this period: wavelets, log-polar DFT, spread-spectrum, and many more.

#Pre-2023

Through the next two decades, industry stalwarts such as Digimarc and Verance developed some great products, with audio watermarking and invisible barcodes being some of the highlights.

One of the recent popular watermarking libraries is invisible-watermark, which in 2023 was adopted by Stable Diffusion. This watermark sits around the (27, 36) coordinate — quite low. The visual artifacts are immediately noticeable, and it rarely survives common image edits.

#Pre-2023 (ML)

In the past few years, machine learning techniques have been applied to invisible watermarks, starting with HiDDeN in 2018. Note that the only ML watermark shown here is from the aforementioned library; the best ones (HiDDeN, StegaStamp) likely score high within the blue range.

#2023 SotA

In 2023, President Biden issued an executive order on AI, with a push to watermark AI-generated content. Large tech companies, notably Google and Meta, released models to do just that. Because the watermarks are applied during the generation process, visual artifacts are minimal.

Some of these watermarks can also be applied to existing “non-AI” content. Adobe’s Trustmark is one such example that works quite well, and is shown in blue in the chart.

#Trufo (v0.x)

Earlier this year, we introduced our version 0.1 watermark, which proved to be a significant improvement over the previous SotA. One important decision we made was to abandon the end-to-end paradigm that most models are trained on in favor of a separate encoding and decoding paradigm. This allows Trufo to improve the watermark without breaking compatibility. This also allows the watermark to work on both AI-generated and existing content despite the encoding workflows being different.

The v0.2 release added dynamic embedding and extraction: a state-of-the-art AI model that (1) knows where to put watermark data and (2) knows where to look for watermark data.

With this model incorporated, the upgraded watermarks became far less noticeable to the human eye: not only did the absolute noise drop by 25–50% (well under that of JPEG Q=95), but because the noise is added in a smarter fashion, the practical improvements were even greater — all while keeping server-side encoding and decoding speeds in the range of 20–500ms.

#Trufo (v1.0)

Over the past few months, we have tested our watermark in a closed alpha setting and made numerous improvements. For our public beta launch, we are releasing two image watermarks. Across multiple datasets, they score:

• pawprint: 84.7–87.2% decoded at 45.3–46.7 PSNR.
• pawprint.lite: 74.9–75.4% decoded at 48.7–49.8 PSNR.

Compare this to other watermarks, for example:

• trustmark: 79.4–80.2% decoded at 42.3–43.5 PSNR.
• dwtdctsvd: 26.6–28.2% decoded at 40.1–40.2 PSNR.

In other words, pawprint is about 50% less visible and 35% more durable than the best watermarks outside of Trufo.

#Examples

Here are some examples of Trufo’s watermark in action. First, watermarked images:

Next, here are some examples of edits that are decoded successfully (based on the squirrel + pawprint image):

#Viability

Based on the results, watermarks are finally at the point where they can be easily integrated into workflows to immediately add value. Specifically, we now believe that Trufo’s two watermarks have reached that threshold of viability.

#Invisibility

Historically, most research papers have cited 40 PSNR as a target threshold. This is similar to a JPEG compression with a quality of 60 (out of 100), and market research suggests that this degree of invisibility is not enough: the quality of the content is still significantly compromised.

The base viable threshold is around 45.5 PSNR, which is similar to a JPEG compression at 90 (out of 100) quality and the standard compression option for a “high-quality” image. Trufo’s watermarks, which come in at around 46 and 49 PSNR, achieve this.

#Durability

For watermarks to be useful, they must stick to the content through various alterations in distribution. That is their main advantage over metadata (which carries far more information and requires far less computation). As shown in the decoding examples, Trufo’s watermark is able to remain intact even when the content modifications are substantial.

#Security

There are of course some basic security concerns. Chiefly, any watermark can be removed and, with some more effort, forged. For example, in an ongoing NeurIPS competition (disclosure: we are a sponsor), entrants have been able to remove state-of-the-art watermarks with remarkable efficacy. This means that in order for watermarks to be fully effective, they must be built on top of a secure system.

For example, through Trufo, the provenance information attached to the watermark is vetted according to C2PA conformance standards: different types of users may opt for different levels of security. Furthermore, Trufo’s suite of perceptual and differential hashes means that false positives are easily prevented and content modifications (benign or malign) are quickly identified. For more details on how this can be done, see our whitepaper.