Image Watermarking in Vision
A watermark hides a readable signature inside image pixels. The signature survives ordinary re-saves but breaks under deliberate scrubbing, and that gap is the whole design trade.
Why Does This Exist?
Generators now produce product shots, portraits, and news-style photos on demand. Viewers cannot tell, and generators need a way to label their own output that survives ordinary handling: a re-save, a thumbnail, a mild filter. Text-side provenance is covered in watermarking and provenance; this page covers the image half.
The threat model matters before any method. The watermark must survive benign transforms (JPEG, resize, slight crop) that everyday sharing applies, while a determined attacker with the detector in hand can try to scrub it. No watermark survives every scrub, so each scheme states its survival list, its false-positive rate on unwatermarked photos, and its visible cost. Without those three, vendor claims mean nothing.
Think of It Like This
A cattle brand under the hide
A ranch brands calves so ownership survives rain, mud, and winter coats. The brand must be readable at the market but must not lame the animal. A thief with time, tools, and no fear of scarring can still alter it, so the brand deters casual theft rather than defeating surgery.
Image watermarks balance the same three: readability after weather (JPEG and resize), invisibility during life (no visible artifacts), and resistance to surgery (scrubbing). The analogy stops at cryptography: signed metadata proves origin perfectly until stripped, while a watermark degrades gracefully instead of vanishing at once.
How It Actually Works
Embedding adds a low-amplitude spread-spectrum pattern in a mid-frequency band: strong enough to detect by correlation, weak enough to stay invisible, placed where JPEG preserves it. Detection correlates the suspect image with the secret pattern; scores above threshold count as watermarked. Capacity is typically tens of bits (an ID, not a paragraph), because every extra bit costs robustness.
The demo numbers that price it
On a demo set of 100 watermarked and 100 clean photos: after JPEG at quality 70, detection reads 94 of 100 watermarked at 2 false positives (0.94 recall, 0.02 false-positive rate). After a 20 percent border crop plus re-save, detection falls to 61 of 100 at the same threshold. Peak signal-to-noise ratio averages 41 dB, visibly clean. The trade is direct: lowering the threshold recovers 12 cropped detections but adds 9 false positives. State the threshold with every score.
Watch Out For
Claiming detection without a false-positive rate
A detector that flags everything reaches perfect recall and is useless. The symptom is a 99 percent detection headline with no clean-image number. Demand the paired rate on unwatermarked photos at the same threshold, measured after the same transforms.
The Quick Version
- Image watermarks embed a low-amplitude pattern that correlation detects later.
- The design prices three things: survival after benign transforms, invisibility, and scrub resistance.
- On the demo set JPEG keeps 94 of 100 detections while a 20 percent crop keeps 61.
- Every claim states the transform list, the threshold, and the false-positive rate.
- Watermarks deter casual misuse; they do not defeat a determined scrubber.