EditGuard: Versatile Image Watermarking for Tamper Localization and Copyright Protection (CVPR 2024)

Xuanyu Zhang, Runyi Li, Jiwen Yu, Youmin Xu, Weiqi Li, Jian Zhang*
School of Electronic and Computer Engineering, Peking University
* Corresponding author
Paper Code
Figure 1

Abstract

In the era where AI-generated content (AIGC) models can produce stunning and lifelike images, the lingering shadow of unauthorized reproductions and malicious tampering poses imminent threats to copyright integrity and information security. Current image watermarking methods, while widely accepted for safeguarding visual content, can only protect copyright and ensure traceability. They fall short in localizing increasingly realistic image tampering, potentially leading to trust crises, privacy violations, and legal disputes. To solve this challenge, we propose an innovative proactive forensics framework EditGuard, to unify copyright protection and tamper-agnostic localization, especially for AIGC-based editing methods. It can offer a meticulous embedding of imperceptible watermarks and precise decoding of tampered areas and copyright information. Leveraging our observed fragility and locality of image-into-image steganography, the realization of EditGuard can be converted into a united image-bit steganography issue, thus completely decoupling the training process from the tampering types. Extensive experiments demonstrate that our EditGuard balances the tamper localization accuracy, copyright recovery precision, and generalizability to various AIGC-based tampering methods, especially for image forgery that is difficult for the naked eye to detect.

Overall Framework of EditGuard

Figure 1

Illustration of the proposed proactive forensics framework EditGuard. The dual-watermark encoder sequentially embeds the pre-defined localization watermark and copyright watermark \( \mathbf{w}_{\text{cop}} \) into the original image \( \mathbf{I}_{\text{ori}} \), generating the container image \( \mathbf{I}_{\text{con}} \). After encountering potential malicious tampering and degradation during network transmission, tampered mask \( \hat{\mathbf{M}} \) and copyright information \( \hat{\mathbf{w}}_{\text{cop}} \) are respectively extracted via the tamper locator and copyright extractor from the received image \( \mathbf{I}_{\text{rec}} \).

United Image-bit Steganography Network

Figure 2

Illustration of the united Image-bit Steganography Network (IBSN). In the training process, we randomly sample original image \( \mathbf{I}_{\text{ori}} \), localization watermark \( \mathbf{W}_{\text{loc}} \) (a natural RGB image) and copyright watermark \( \mathbf{w}_{\text{cop}} \) and expect the IBSN to recover \( \hat{\mathbf{I}}_{\text{ori}} \), \( \hat{\mathbf{W}}_{\text{loc}} \) and \( \hat{\mathbf{w}}_{\text{cop}} \) with high fidelity. In the inference process, we use core components of the pre-trained IBSN with a mask extractor (ME) to construct our EditGuard, and pre-define a simple solid color image as a localization watermark.

Results

Our EditGaurd can consistently achieve precise localization performance and copyright recovery accuracy on some careful editing with encapsulated editing software. However, almost none of the other methods can achieve comparable localization accuracy and generalization ability. More results can be found in our paper.

Figure 1

Video

BibTeX

@inproceedings{zhang2023editguard,
  author    = {Xuanyu Zhang and Runyi Li and Jiwen Yu and Youmin Xu and Weiqi Li and Jian Zhang},
  title     = {EditGuard: Versatile Image Watermarking for Tamper Localization and Copyright Protection},
  journal   = {arXiv preprint arxiv:2312.08883},
  year      = {2023},
}