Robust Watermarking Using Generative Priors Against Image Editing: From Benchmarking to Advances

Current image watermarking methods are vulnerable to advanced image editing techniques enabled by large-scale text-to-image models. In this work, we introduce W-Bench, the first comprehensive benchmark designed to evaluate the robustness of watermarking methods against a wide range of image editing techniques, including image regeneration, global editing, local editing, and image-to-video generation. Through extensive evaluations of eleven representative watermarking methods against prevalent editing techniques, we demonstrate that most methods fail to detect watermarks after such edits. To address this limitation, we propose VINE, a watermarking method that significantly enhances robustness against various image editing techniques while maintaining high image quality. Our approach involves two key innovations: (1) we analyze the frequency characteristics of image editing and identify that blurring distortions exhibit similar frequency properties, which allows us to use them as surrogate attacks during training to bolster watermark robustness; (2) we leverage a large-scale pretrained diffusion model SDXL-Turbo, adapting it for the watermarking task to achieve more imperceptible and robust watermark embedding. Experimental results show that our method achieves outstanding watermarking performance under various image editing techniques, outperforming existing methods in both image quality and robustness. Code is available at https://github.com/Shilin-LU/VINE A key aspect of watermark design is ensuring its robustness against various image manipulations. Prior deep learning-based watermarking methods (Bui et al., 2023; Tancik et al., 2020; Zhu, 2018) have proven effective at withstanding classical transformations (e.g., compression, noising, scaling, and cropping). However, recent advances in large scale text-to-image (T2I) models (Chang et al., 2023; Ramesh et al., 2022; Rombach et al., 2022; Saharia et al., 2022) have significantly enhanced image editing capabilities, offering a wide array of user-friendly manipulation tools (Brooks et al., 2023; Zhang et al., 2024b). These T2I-based editing methods produce highly realistic modifications, rendering the watermark nearly undetectable in the edited versions. In this work, we present W-Bench, the first holistic benchmark that incorporates four types of image editing techniques to assess the robustness of watermarking methods, as shown in Figure 1(a). Eleven representative watermarking methods are evaluated on W-Bench. The benchmark encompasses image regeneration, global editing, local editing, and image-to-video generation (I2V). Each method is illustrated with a diamond and four bars.