"Training robust watermarking models may compromise certification!" Exploring and mitigating identity information leakage in robust watermarking

The researchers propose an image watermarking framework, W-IR, that balances identity protection and robustness; the authors state that extensive experiments show it effectively reduces identity information leakage while maintaining high authentication accuracy. Post-processing image watermarking verifies by embedding a watermark message in an image and decoding a similar message from the watermarked image, but it faces both adversarial attacks that manipulate the watermarked image so that it decodes an unverified message and identity leakage attacks such as forging watermarked images; the paper points out that the identity leakage threat is particularly severe in both empirically robust and certifiably robust watermarking methods. To this end, W-IR introduces a new randomized smoothing technique that provides certified robustness against perturbations in two transformation spaces, pixel-level and coordinate-level, and proposes a strategy based on residual information loss that minimizes the mutual information between the residual image and the watermarked image. Code is open-sourced at https://github.com/holdrain/W-I-R。