Lightweight invertible-NN image watermarking: an on-camera carrier that embeds an Ed25519 content-bound signature in pixels (896 b headline payload, ECC-wrapped to 1024 b), recoverable after JPEG / resize / platform pipelines, without a C2PA-style manifest. Companion to the public imagehide-demo; this page is the internal work-surface (open risks, decision log, in-flight design line). See Spec (overview + vs SOTA) / Model (full reference) / Design (rationale) / Plan. Paper draft: Overleaf.
Active research has moved on to the idea084/d001 → idea112/d003 design line (subband-weighted permutation adapter, multi-aux losses; see results/exp0_inn_idea*/). The "pending reds" list in HANDOFF predates this. The deployed carrier on imagehide-demo is idea097_design001 (lives in the sibling autohide project, 2026-05-17). Headline numbers below are from its eval. Treat the deployed-carrier section as ground truth for what verifies today; in-flight jobs are tracked locally via squeue -u $USER. A STATUS as of 2026-05-19 callout at the top of HANDOFF.md spells out which earlier facts (chain_wechat removal, multi-res light, v2 mobile carrier) are superseded by the deployed model.
autohide/experiments/1024bit_noamp_keepckpt/idea097_design001/ckpt_latest.pt
[ H(128) | sig(512) | pk(256) ] · 896 b
p8 ≥ 1 − 14/128 ⇒ p ≥ 0.9856. Patch-tile errors are clustered (multi-bit per failed patch) so the realised floor is somewhat lower — empirical per-image RS-success sweep still pending.
chain_wechat at 0.955 (avg) / 0.992 (1024²). At 1024² alone every in-scope attack ≥ 0.99; the 0.955 floor is dominated by 256² where the patch grid is tightest. Gaussian-noise and noise-augmented platform chains excluded per threat model.
idea097_design001 to imagehide-demo. 8/light backbone, 1024 b ECC codeword wrapping 896 b data, no-AMP train, step 30k. PSNR clean 37.4 dB, bit_acc avg 0.995 over 14 in-scope attacks (worst: chain_wechat at 0.955). Lives in sibling autohide project.
idea084/design001. Residual stamp/caption amp 10× → 20×. commits c320b9f, d0cc7dc
chain_wechat dropped from live attack suite (past resize-tolerance bound). Live attack suite now 12 + 1 archival.
56391691 NaN'd at step 40,200; decoder froze to constant output (val PSNR pinned 11.09 dB). Cancelled. Root-cause work pending. Multi-res sampler is the new variable vs. v2.
src/multi_res_dataset.py.
num_blocks 16→8, subnet rdb→light. 24× fewer params, 24× fewer FLOPs.
pdq.js port), max drift ≤ 3 / 128 over the design's threat-model attack suite, comfortably inside the BCH t=4 budget. The open question is adversarial-collision: NeuralHash broken in 11 days, pHash broken by standard attacks, and PDQ has not been red-teamed for adaptive collisions at our spec (jpeg-survivable PGD-style search). Path-2 commitment — we claim resistance to named prior methodologies, not arbitrary adaptive adversaries; the adaptive red-team is a follow-up paper, not gating Exp 5.chain_insta/x/whatsapp/wechat attack suite tests the same resize ratios but at 256² training scale; extrapolating to 4032² is an open empirical question (crop-size ablation §3 in design.html). Margin only; verify against the original-resolution camera file, not the platform-resized derivative is the deployment story.idea109/idea112 may have addressed it; pending eval will tell.device_id, timestamp, gps are signed but not attested. No hardware root. Flagged in threat model.| category | attack | avg | @ 1024² | note |
|---|---|---|---|---|
| clean | — | 1.000 | 1.000 | no attack baseline |
| single jpeg | q90 / q70 / q50 / q30 | 1.000 / 0.999 / 0.999 / 0.996 | 1.000 / 1.000 / 1.000 / 1.000 | platform re-encode |
| jpeg chain | 85→60 · 70×3 | 0.999 / 0.999 | 1.000 / 1.000 | cross-platform re-uploads |
| resize only | 0.9 / 0.7 / 0.5 | 1.000 / 1.000 / 1.000 | 1.000 / 1.000 / 1.000 | down-then-up resample |
| platform | chain_insta | 0.998 | 1.000 | Instagram feed (resize 0.5 + Q85) |
| platform | chain_x | 0.986 | 1.000 | X / Twitter (resize 0.4 + Q75) |
| platform | chain_whatsapp_std | 0.996 | 1.000 | WhatsApp Std / FB feed (resize 0.5 + Q70) |
| platform | chain_wechat | 0.955 | 0.992 | WeChat (resize 0.3 + Q50) — worst overall; 1024² holds 0.99 |
autohide/experiments/1024bit_noamp_keepckpt/idea097_design001/eval.json · 14 attacks across 7 sizes (256² → 2048×1536 + random). avg row = mean across 7 sizes (avg bit_acc 0.995, min 0.955). @ 1024² = single-size slice (avg 0.999, min 0.992 — every in-scope attack ≥ 0.99). PSNR clean 37.4 dB at 1024². Gaussian-noise and noise-augmented (_full) chains excluded — noise is out of the canonical-delivery threat model.
# activate env (don't use `source activate`) module load conda/latest eval "$(conda shell.bash hook)" conda activate hang # check 2080Ti availability sinfo -p gpu-preempt -o "%t %D %G" | grep 2080_ti # running jobs squeue -u $USER -o "%.18i %.20j %.8t %.10M %R" # interactive debug session srun --partition=gpu-preempt --gres=gpu:2080_ti:1 \ --mem=16G --time=1:00:00 --pty bash # re-eval the deployed carrier (~30 min) sbatch scripts/exp0_inn_eval_v2.sbatch # → results/exp0_inn_p896_light_v2/eval.json