We Can Hide More Bits: The Unused Watermarking Capacity in Theory and in Practice

Aleksandar Petrov, Pierre Fernandez, Tomas Soucek, Hady Elsahar

Keywords: watermarking, theory, provenance, misinformation, safety, transparency

TL;DR: Our theoretical bounds show watermarks can encode orders of magnitude more bits than they currently do. Thus, we train a model that embeds 1024 bits with the same quality and robustness as a 256 bit model.

Abstract:

Despite rapid progress in deep learning–based image watermarking, the capacity of current robust methods remains limited to the scale of only a few hundred bits. Such plateauing progress raises the question: how far are we from the fundamental limits of image watermarking? To this end, we present analysis that establishes upper bounds on the message-carrying capacity of images under PSNR and linear robustness constraints. Our results indicate theoretical capacities are orders of magnitude larger than what current models achieve. Our experiments show this gap between theoretical and empirical performance persist, even in minimal and amenable to analysis setups.
This suggests a fundamental problem. As a proof that larger capacities are indeed possible, we train ChunkySeal, a scaled-up version of VideoSeal, which has 4x larger capacity, i.e., 1024 bits, all while preserving image quality and robustness. These findings demonstrate modern methods have not yet saturated watermarking capacity, and that significant opportunities for architectural innovation and training strategies remain.

Primary Area: alignment, fairness, safety, privacy, and societal considerations

Submission Number: 1493