Why is embedding watermarks in the least significant bits of pixels not effective?

While easy and quick, altering the least significant bits makes watermarks very easy to remove by simply flipping those bits back. This makes the watermark detectable but also highly vulnerable to manipulation.

How do modern watermarking systems like Google's SynthID and Adobe's Trustmark work?

These systems use neural networks, specifically encoder-decoder models, trained to embed watermarks that are robust against common image manipulations like compression, resizing, and color changes. They also employ adversarial training to improve detection accuracy and prevent easy removal.

How does Trustmark handle watermarking images of any size?

Trustmark processes images at a fixed size (e.g., 256 pixels) to watermark them, calculates the difference to isolate watermark pixels, and then scales this difference back to apply it to the original high-resolution image. Detection involves shrinking any image to the fixed size before analysis.

Is Trustmark robust against image editing like JPEG compression and resizing?

Yes, the demonstration showed that Trustmark is relatively robust. It could detect the watermark even after JPEG compression and resizing to a smaller dimension, though extreme cropping eventually removed it.

Can a watermark be illicitly transferred to another image?

This is a potential attack. To counter it, watermarking systems are trained to ensure the watermark can only be reliably recovered from the original image it was applied to, linking the watermark specifically to the source image and code.

What is the main purpose of watermarking in today's digital landscape?

While historically used for copyright and licensing, the current focus is heavily on watermarking AI-generated images to indicate their origin. However, it's not a foolproof system for proving AI absence or guaranteeing image trustworthiness.

What offers better trust and verification than watermarking?

For robust verification of image origin and integrity, digital signatures and certificates embedded in metadata are more effective. These provide stronger evidence of where an image came from and that it hasn't been tampered with.

Key Moments

How Image Watermarking Works - Computerphile

Computerphile

Education5 min read26 min video

Oct 22, 2026|45,972 views|817|61

computers computerphile computer science

Save to Pod

Key Moments

TL;DR

AI can embed invisible watermarks in images, but they can be removed by edits like cropping or JPEG compression, though robust methods are emerging.

Key Insights

Least significant bit (LSB) watermarking is easily detectable and removable by minor image alterations or standard compression like JPEG.

Modern watermarking uses neural networks, specifically encoder-decoder models, to embed and detect watermarks that are imperceptible.

Adobe's Trustmark and Google's SynthID are examples of robust AI-based watermarking systems that are trained using augmentations to withstand image manipulations.

The Trustmark system processes images at a fixed size of 256 pixels for watermarking and detection, then scales the watermark to the original image resolution.

Robust watermarking systems aim to prevent attackers from removing watermarks or fictitiously adding valid watermarks to other images by training to detect watermarks only on their original source images.

Watermarking primarily indicates an image went through a specific process (like AI generation) and does not guarantee trustworthiness or definitively prove an image is not AI-generated.

Limitations of traditional watermarking and steganography

Traditional methods of embedding information in images, such as steganography or embedding data in metadata, have significant drawbacks. Steganography aims to hide the very existence of a message and be robust against image manipulation, but often fails to protect against quality loss or accidental deletion of data. Metadata, like camera settings, is easily editable and stripped away, especially when images are re-encoded, such as into JPEG format. Even simple techniques like altering the least significant bits (LSB) of pixel data are too fragile. While LSB modification causes minimal visual change and can store substantial data, it's incredibly easy to detect and remove by flipping a few bits, rendering it ineffective for robust watermarking.

The emergence of AI-powered watermarking

Modern approaches to image watermarking leverage artificial intelligence, specifically neural networks, to embed more substantive and robust watermarks. These systems aim to create watermarks that are imperceptible to the human eye but resilient to common image manipulations like compression, resizing, color changes, and cropping. Examples include Adobe's Trustmark, which is open-source, and Google's SynthID, used for watermarking generative AI images and images from Pixel cameras. Unlike older methods, these AI-based techniques embed the watermark more deeply within the image data, making it harder to remove without significant visual degradation or complete loss of the watermark.

Encoder-decoder networks for watermark embedding and detection

At the core of AI watermarking are encoder-decoder neural networks. The encoder takes an original image and a watermark (often a short string or code) as input and outputs a watermarked version of the image. The key challenge is to ensure this watermarked image is perceptually similar to the original, meaning visual changes are minimal. Simultaneously, a separate detector network is trained to identify whether a watermark exists and, crucially, to recover the specific embedded code. This process is often a joint training endeavor: the encoder learns to embed watermarks effectively, while the detector learns to extract them. Additional 'loss' functions are employed during training to ensure the watermark is recoverable and that the watermarked image is not easily flagged as altered by a third-party detector.

Achieving robustness through adversarial training and augmentations

A significant challenge for AI watermarks is robustness against image manipulations. To address this, systems like Adobe's Trustmark employ rigorous training processes that simulate real-world attacks. The watermarked image is subjected to a battery of random 'augmentations'—such as cropping, flipping, color adjustments, and resizing—before being fed to the detector. This process is repeated thousands of times with various images and watermarks. The encoder-decoder networks are trained to not only embed the watermark but also to ensure its detectability even after these aggressive, random modifications. This adversarial training is crucial for making the watermark resilient to common user edits and file format conversions.

Handling image size variations in watermarking

A practical issue with watermarking is accommodating images of different resolutions. The Trustmark system, for instance, performs its core watermarking and detection processes at a fixed size, typically 256 pixels. For a high-resolution image, it's first shrunk to this fixed size, the watermark is applied, and then the subtle watermark changes are scaled back up to match the original image's dimensions. This allows the system to watermark and detect watermarks on images of arbitrary sizes while maintaining consistency in the underlying network operations. The process involves calculating the difference between the shrunk original and the shrunk watermarked image to isolate the watermark data before re-applying it.

Testing the resilience of AI watermarks

Experiments with the Trustmark system demonstrate its effectiveness and limitations. When a watermarked image was saved as a JPEG with reduced quality (around 75) and then further resized, the watermark was still detected successfully, indicating robustness against common compression and scaling. However, more aggressive manipulations, such as significant cropping that removed half the image area or substantial color saturation changes, eventually led to the watermark becoming undetectable. This highlights that while AI watermarks are far more robust than older methods, they are not impervious to extreme editing.

Preventing watermark misuse and understanding its limitations

Advanced watermarking systems also incorporate defenses against malicious attacks, such as preventing an attacker from extracting a watermark from one image and applying it to another to falsely claim origin or AI generation. This is achieved by training the system to recognize and verify watermarks only when they are applied to their original source images, effectively linking the watermark to specific content. It's important to note that watermarking primarily indicates that an image underwent a specific process (e.g., AI generation) rather than proving its authenticity or trustworthiness. It cannot definitively confirm an image is not AI-generated, nor can it serve as proof of IP ownership in legal contexts without additional verification like digital signatures.

Mentioned in This Episode

●Products

●Software & Apps

●Companies

●Concepts

●People Referenced

How Image Watermarking Works: Key Principles

Practical takeaways from this episode

Do This

Use AI models (neural networks) for substantive and robust watermarking.

Incorporate random augmentations (crops, flips, resizing) during training to improve robustness.

Train models jointly to embed and detect watermarks simultaneously, with adversarial losses.

Process images at a fixed size (e.g., 256 pixels) for consistent watermarking and detection, then scale.

Ensure watermarks are specific to the original image and code to prevent illicit transfer.

Consider digital signatures for stronger verification of image origin and integrity.

Avoid This

Do not rely solely on metadata, as it's easily edited or removed.

Avoid using simple least significant bit manipulation, as it's easily detected and removed.

Do not expect watermarks to be perfectly robust; significant manipulation can still break them.

Do not assume a watermark guarantees trustworthiness or definitively proves an image is not AI-generated.

Do not solely rely on watermarking for proving AI absence in sensitive contexts like competitions.

Common Questions

Steganography aims to hide the very existence of a message, maximizing secret payload and robustness. Watermarking, however, embeds a signature to prove ownership or origin, not necessarily to be secret, but to be detectable and robust.

Topics

AI & Machine Learning Technology & Innovation Science & Mathematics Generative AI Image-processing Neural Networks Computer Vision Digital Signatures Digital Watermarking

Mentioned in this video

Concepts

Steganography

A technique for hiding messages or data within other, non-secret data, aiming to prevent the existence of the hidden message from being known. It differs from watermarking in its primary goal of secrecy and maximizing payload.

Companies

Google

Mentioned in the context of their SynthID system for watermarking generative images and Pixel camera photos.

Adobe

Mentioned as developing Trustmark, a system similar to Google's SynthID for image watermarking.

Costa Coffee

Mentioned humorously by the speaker as a potential reason for a mistake made during the demonstration.

Products

Pixel camera

Cameras made by Google, mentioned as also producing watermarked images.

Software & Apps

Trustmark

Adobe's image watermarking system, which is open-source and serves as a base for discussion due to its similarity to Google's implementation.

Transformers

A type of neural network architecture mentioned as being used in more modern watermarking systems, replacing older convolutional networks.

SynthID

A system developed by Google for watermarking generative images and images taken with Pixel cameras. The video discusses its image version and mentions its similarity to text watermarking techniques.

CUDA

A parallel computing platform and API model created by Nvidia, mentioned as a component that was not properly set up, causing the demonstration to take longer.

Paint.net

An image editing program used during the demonstration to test the robustness of the watermark by applying modifications.

PyTorch

An open-source machine learning framework, mentioned as a component that was not properly set up, causing the demonstration to take longer.

People

Mike Pound

The speaker in the video, who uses himself as an example when discussing watermarking and his own photography.

Locations

Jubilee

A campus location from which an image was downloaded for the demonstration of watermarking.

Ask anything from this episode.

Save it, chat with it, and connect it to Claude or ChatGPT. Get cited answers from the actual content — and build your own knowledge base of every podcast and video you care about.

Get Started Free