💻 computer science

Signpost Watermarking: Joint Optimization for Visual Watermark Coexistence

This paper introduces "Signpost Watermarking," a method that jointly optimizes imperceptible visual watermarks for images and videos to explicitly enable robust coexistence with other independently trained watermarks, thereby facilitating layered provenance signaling for content authenticity.

Original authors: Shruti Agarwal, Vishal Asnani, John Collomosse

Published 2026-08-12

📖 4 min read☕ Coffee break read

CC BY 4.0

Original authors: Shruti Agarwal, Vishal Asnani, John Collomosse

Original paper licensed under CC BY 4.0 (http://creativecommons.org/licenses/by/4.0/). ✨ This is an AI-generated explanation of the paper below. It is not written or endorsed by the authors. For technical accuracy, refer to the original paper. Read full disclaimer

Imagine the internet as a giant, bustling library where everyone is constantly writing new stories, drawing pictures, and making movies. But lately, a new kind of writer has arrived: Artificial Intelligence. These AI writers can create amazing art and videos in seconds, but it's getting hard to tell what was made by a human and what was made by a machine. To fix this, experts are trying to hide tiny, invisible "secrets" inside digital files. Think of these secrets like a microscopic fingerprint or a secret code stamped on a painting that you can't see with your eyes, but a special scanner can read later. This is called digital watermarking.

The goal is to prove who owns a picture or if an AI helped make it. But here's the tricky part: there isn't just one company making these watermarks. Adobe, Google, Meta, and many others are all building their own secret stampers. If a picture has a stamp from Adobe, and then someone else tries to add a stamp from Google, will the two stamps crash into each other? Will they ruin the picture, or will they cancel each other out so neither can be read? Until now, we didn't know if these different secret codes could live together peacefully, or if we needed to force everyone to use the exact same stamping machine.

This paper, titled "Signpost Watermarking," tackles that exact problem. The researchers asked: Can we train a special "signpost" watermark that knows how to share space with other watermarks without causing a mess? They discovered that while different watermarks can accidentally coexist (like two people trying to sit on the same park bench without bumping), it's often a lucky accident that leaves the picture looking a bit fuzzy or the codes hard to read.

To fix this, the team created a new training method. Imagine a dance instructor teaching a new dancer (the signpost) how to move around a room full of other dancers (the existing watermarks). Instead of letting the new dancer just guess where to step, the instructor freezes the other dancers in place and tells the new one, "Move your feet so you don't trip anyone, and make sure they can still hear their own music." By doing this, the new signpost learns to hide its secret code in the empty spaces between the other codes, like a squirrel hiding a nut in the gaps between tree branches.

The results are quite promising. The researchers tested this on both still images and moving videos. They found that their new "signpost" is incredibly good at being invisible, keeping the picture quality very high (measured at a score of 52.4 dB, which is a very clean, crisp image). More importantly, when they layered this signpost on top of other existing watermarks, it didn't break them. In fact, it helped them survive better than before. For example, when a tricky watermark called "TrustMark" was involved, the new method improved its ability to be read correctly by a huge margin, jumping from a shaky 0.687 accuracy to a strong 0.929.

The paper suggests that this "signpost" could act like a traffic light or a directory. Instead of trying to decode every single possible secret code in the world, a scanner could first look for the signpost. If the signpost says, "Hey, there's a Google watermark here!" or "Check for an Adobe code!", the scanner knows exactly which tool to use next. This creates a friendly ecosystem where different companies can keep their own secret methods, but they can all work together to prove that a photo or video is real and who owns it. The authors suggest this is a practical path forward, though they note that future work will need to see if these signs can survive even more aggressive attacks. For now, it looks like we might finally have a way to let all these different digital fingerprints live together in harmony.

Technical Summary: Signpost Watermarking: Joint Optimization for Visual Watermark Coexistence

Problem Statement
The proliferation of independently developed digital watermarking systems for images and videos—driven by the need for content authenticity, AI provenance, and IP rights protection—has created a fragmented landscape. While recent work (e.g., Petrov et al. [23]) demonstrated that independently trained watermarks can coexist within the same media asset with limited interference, this coexistence is currently a serendipitous emergent property rather than an explicit optimization objective. Consequently, interference between coexisting watermarks remains uncontrolled, potentially degrading decoding robustness or visual quality. Furthermore, there is a lack of interoperability mechanisms to efficiently discover which specific proprietary watermarking system is present in a given asset without attempting to decode against all possible technologies (the 1-to-N problem).

Methodology
The authors propose a "Signpost Watermarking" framework designed to explicitly optimize for coexistence. The core innovation is a decoder-aware training objective that treats watermark coexistence as a multi-objective learning problem.

Architecture: The system employs a UNet-based encoder and a ResNet-50 decoder. The encoder takes a cover image (or video frame) and a 32-bit binary secret, producing a residual map added to the cover to create the stego media.
Decoder-Aware Training: During training, the signpost encoder is optimized not only for its own robustness and perceptual quality but also to preserve the decoding performance of other "frozen" secondary watermarking systems.
- Process: A collection of pre-trained, frozen watermark decoders (representing various state-of-the-art systems) are loaded. The signpost encoder generates a stego image, which is then passed through these frozen encoders to apply secondary watermarks.
- Loss Function: The total loss ( $L$ $L$ ) combines three terms:
  1. Image Quality ( $L_{img}$ ): A combination of L1, YUV-weighted L2, LPIPS perceptual loss, and Just Noticeable Difference (JND) guidance to minimize visible distortion.
  2. Signpost Survival ( $L_{BCE}$ ): Binary cross-entropy loss ensuring the signpost itself can be decoded from the augmented stego image.
  3. Coexistence Term ( $L_{coex}$ ): A critical component where the signpost decoder attempts to recover its payload from images that have already been watermarked by the frozen secondary systems. This forces the signpost encoder to concentrate embedding energy in spatial and frequency components that remain invariant to subsequent watermark overlays.
Training Curriculum: The training follows a three-phase curriculum (inspired by TrustMark [7]), gradually introducing dataset diversity, augmentation noise (compression, cropping, noise, etc.), and image quality losses to stabilize the embedding.

Key Contributions

Video Watermark Coexistence: The paper provides the first empirical evidence that the coexistence properties observed in image watermarks extend to the temporal domain of video. It demonstrates that independently developed video watermarking systems can coexist within the same video asset.
Explicit Coexistence Optimization: The authors show that coexistence can be transformed from an empirical observation into an explicit training objective. By optimizing a signpost encoder to preserve the decoding accuracy of coexisting systems, they achieve significantly improved interoperability compared to independently trained baselines.
Signpost Routing Mechanism: The work proposes a practical path for a "signpost" watermark—a lightweight signal indicating the presence of a specific provenance or rights watermark. This avoids the need to standardize a single watermarking algorithm for all use cases or to train a classifier that requires representative data for every possible technology. Instead, a signpost can simply encode an index into a registry of available watermarking methods.

Results
The authors evaluated their approach against up to four state-of-the-art image watermarking systems (PixelSeal, InvisMark, TrustMark-P, MaskWM) and three video systems (VideoSeal, InvisMark, FlowMark, TrustMark-Q).

Visual Quality: The proposed signpost achieves the highest solo perceptual quality among all evaluated methods, reaching a PSNR of 52.4 dB for both images and video, and a VMAF of 99.2 for video. The residuals are sparse and spatially localized, contrasting with the dense global textures of other methods.
Coexistence Performance:
- Clean Conditions: The signpost maintains high bit accuracy (often >0.99) when overlaid with other watermarks. Crucially, it significantly improves the robustness of sensitive systems like TrustMark-P/Q when they are the primary watermark (WM1) and the signpost is applied second.
- Augmented Conditions: Under noise and transformation, the decoder-aware training yields substantial gains. For example, in images, the bit accuracy of TrustMark-P under a ZOETROPE overlay was 0.687, whereas under the proposed signpost, it rose to 0.929 (+0.24). Similar improvements were observed for InvisMark and TrustMark-Q in video.
- Ablation: The study confirms that training with multiple frozen decoders simultaneously is superior to training with single decoders or no coexistence loss. The "leave-one-out" analysis shows that every decoder contributes to the final performance, with the TrustMark family being the most interference-sensitive and thus benefiting most from explicit supervision.

Significance and Claims
The paper claims that this work establishes a practical foundation for interoperable watermarking without requiring a single, unified watermarking standard. By treating coexistence as an optimization objective, the authors enable a "signpost" system that can efficiently route to independently deployed provenance or rights signaling systems.

The authors emphasize that their results support the feasibility of a standardized signpost payload (e.g., an integer indexing a public list of methods, similar to C2PA's "soft binding algorithm list"). This approach allows diverse image and video watermarking technologies to participate in a shared ecosystem for content authenticity and IP rights, addressing the urgent need for interoperability in the face of generative AI and evolving regulatory requirements (e.g., EU AI Act). The paper concludes by noting that future work should address robustness against adaptive attacks specifically targeting doubly-watermarked signals.

Technical Summary: Signpost Watermarking: Joint Optimization for Visual Watermark Coexistence

More like this