Residual Transferability in Neural Image Watermarking
Ziping Dong, Qi Li, Xinchao Wang
National University of Singapore
Published September 26, 2026 · on the feed September 29, 2026 · ▲ 12 · arXiv 2609.32241
The abstract
Neural image watermarks can be forged by extracting watermark-bearing residuals from released images and transferring them to unrelated content. While prior work has demonstrated this vulnerability, what makes these residuals transferable remains poorly understood. We formalize this vulnerability with residual transferability (RT), a metric that quantifies how well watermark evidence remains decodable after transfer across unrelated images. Through comparative analyses and controlled interventions, we find that common training-side variations do not account for the large RT differences across watermarking systems; instead, architectural design plays a central role. By contrasting high- and low-RT systems and validating their architectural differences through controlled interventions, we identify two mechanisms that strengthen the dependence of watermark evidence on the cover image, thereby suppressing the residual transferability. These findings provide concrete design guidance for developing more forgery-resistant watermarking architectures. Complementarily, for existing watermarking systems where architectural redesign is impractical, we introduce CoverLock, a plug-and-play strategy for existing watermarking systems that strengthens such image dependence without architectural redesign. Across representative watermarking systems exhibiting high residual transferability, CoverLock achieves a more favorable security--robustness trade-off than both traditional handcrafted defenses and learned classifier-based defenses.
The Brief
2:17A short podcast summary of the paper. Written and voiced by AI.
Transcript
Residual Transferability in Neural Image Watermarking. By Ziping Dong and two others, from the National University of Singapore. Published on the twenty-sixth of September. No code repository is linked to it.
Neural image watermarks have a known weakness. An attacker can extract the residual that carries the watermark from a released image and transfer it onto unrelated content, forging the mark. Prior work demonstrated this, but not why some residuals transfer and others do not, which left anyone building a watermark without a clear idea of what to change. The claim here is that the answer lies mostly in architecture. Common variations on the training side do not account for the large differences between watermarking systems. Architectural design plays the central role.
To measure the problem, the authors define residual transferability, or RT. It quantifies how well the watermark evidence can still be decoded after the residual is moved onto an unrelated image. With that metric in hand, they run comparative analyses and controlled interventions. Contrasting systems with high and low RT, and validating the architectural differences through further interventions, they identify two mechanisms. Both make the watermark evidence depend more strongly on the cover image, the picture it was embedded in, and that stronger dependence is what suppresses transfer. The logic is intuitive once stated. A residual that only makes sense on top of its original image carries little decodable evidence once it is lifted off and laid over a different one. The abstract does not name the two mechanisms, only what they have in common.
The architectural finding helps most when a system is still being designed, and the authors present it as concrete guidance for building watermarks that resist forgery. Many systems already exist, though, and redesigning them may not be practical. For those, the paper introduces CoverLock, a plug-and-play strategy that strengthens the same dependence on the cover image without touching the architecture. Across representative systems that show high residual transferability, CoverLock reaches a more favourable balance between security and robustness than both traditional handcrafted defences and learned classifier-based defences. The abstract states that comparison qualitatively and gives no figures for it.
A forged watermark works because the mark can live apart from the picture. The thread running through the paper is to bind the two together, whether that is done in the architecture from the start or added afterwards with CoverLock.
Paper Quest · 7 chapters · about 41 min
Play this paper
Learn it by doing: make the calls the authors made, guess the result before you see it, and defend it in a viva graded on your own words. Chapter 1 is right here.
Chapter 1 🧩 · The problem
A watermark is only useful if it cannot be copied. This one can, and why is poorly understood.
You maintain an invisible watermark for AI-generated images. Attackers lift the watermark-carrying residual from released images and lay it onto unrelated pictures, forging your mark.
The road ahead
- 1 · The problem ~7 min Attackers can copy an invisible watermark onto unrelated pictures, and it is poorly understood why some watermarking systems are far easier to copy than others.
- 2 · What came before ~3 min
- 3 · The key idea ~9 min A watermark is hard to transfer when its evidence depends on the cover image, and that dependence comes mainly from the architecture.
- 4 · Choose your own research ~3 min
- 5 · Build the method ~8 min Measure transfer, rule out training settings, compare architectures, pin down two binding mechanisms, then add CoverLock to systems that cannot be rebuilt.
- 6 · The experiment ~6 min You’ll guess: Some neural image watermarking systems leak residuals that transfer to unrelated images far more than others. What mainly explains the difference?
- 7 · The viva ~5 min Three questions from the examiners, answered in your own words. Win it for the paper’s trophy.
Free, with Google or an email address. Your stars and progress are kept.