SuperMark: Robust and Training-free Image Watermarking via Diffusion-based Super-Resolution

Runyi Hu, Jie Zhang, Yiming Li, Jiwei Li, Qing Guo, Han Qiu, Tianwei Zhang

Keywords: image watermarking, diffusion models

Abstract:

In today's digital landscape, the intermingling of AI-generated and authentic content has heightened the importance of copyright protection and content authentication. Watermarking has emerged as a crucial technology to address these challenges, offering a general approach to safeguard both generated and real content. To be effective, watermarking methods must withstand various distortions and attacks. While current deep watermarking techniques typically employ an encoder–noise layer–decoder architecture and incorporate various distortions to enhance robustness, they often struggle to balance robustness and fidelity, and remain vulnerable to adaptive attacks, despite extensive training. To overcome these limitations, we propose SuperMark, a novel robust and training-free watermarking framework. Our approach draws inspiration from the parallels between watermark embedding/extraction in watermarking models and the denoising/noising processes in diffusion models. Specifically, SuperMark embeds the watermark into initial Gaussian noise using existing techniques and then applies pretrained Super-Resolution (SR) models to denoise the watermarked noise, producing the final watermarked image. For extraction, the process is reversed: the watermarked image is converted back to the initial watermarked noise via DDIM Inversion, from which the embedded watermark is then extracted. This flexible framework supports various noise injection methods and diffusion-based SR models, allowing for enhanced performance customization. The inherent robustness of the DDIM Inversion process against various perturbations enables SuperMark to demonstrate strong resilience to many distortions while maintaining high fidelity. Extensive experiments demonstrate SuperMark's effectiveness, achieving fidelity comparable to existing methods while significantly surpassing most in terms of robustness. Under normal distortions, SuperMark achieves an average watermark extraction bit accuracy of 99.46%, and 89.29% under adaptive attacks. Furthermore, SuperMark exhibits strong transferability across different datasets, SR models, watermark embedding methods, and resolutions.

Primary Area: alignment, fairness, safety, privacy, and societal considerations

Code Of Ethics: I acknowledge that I and all co-authors of this work have read and commit to adhering to the ICLR Code of Ethics.

Submission Guidelines: I certify that this submission complies with the submission instructions as described on https://iclr.cc/Conferences/2025/AuthorGuide.

Anonymous Url: I certify that there is no URL (e.g., github page) that could be used to find authors’ identity.

No Acknowledgement Section: I certify that there is no acknowledgement section in this submission for double blind review.

Submission Number: 988