blind_watermark — mechanism, benchmark, ideas-to-steal

Source: guofei9987/blind_watermark v0.4.4 (12.9 k★, pure Python, no associated paper). Method class: classical DWT-DCT-SVD with QIM modulation on the leading singular value. Our eval: 20 DIV2K val images, 512×512, 13-attack compression-only suite mirroring src/exp0_inn_eval.py. Sweep payloads 32 → 8192 b. JSON at results/blindwm_baseline/eval.json and eval_highpayload.json.

This page mines blind_watermark for design ideas to bring back into MWIP, with the explicit acknowledgement that its compression-attack robustness is competitive with most learned baselines in our related-work table and deserves to inform the design rather than be dismissed. Companion markdown at docs/blindwm_report.md.

§1Headline numbers

Payload	Clean PSNR	Clean SSIM	Clean bit_acc	Avg (13 atks)	Worst	Worst attack	Embed fails
32	37.86	0.972	1.000	0.992	0.911	`chain_wechat`	0
64	37.80	0.971	1.000	0.984	0.887	`chain_wechat`	0
128	37.86	0.970	1.000	0.970	0.780	`chain_wechat`	0
256	37.85	0.969	1.000	0.962	0.759	`chain_wechat`	0
512	37.84	0.969	1.000	0.946	0.703	`chain_wechat`	0
896	37.84	0.969	1.000	0.926	0.667	`chain_wechat`	0
1024	37.84	0.969	1.000	0.922	0.666	`chain_wechat`	0
2048	37.84	0.969	0.999	0.879	0.617	`chain_wechat`	0
4096	—	—	—	—	—	rejected (capacity) 20 / 20
8192	—	—	—	—	—	rejected (capacity) 20 / 20

PSNR / SSIM are payload-independent — distortion is determined by block count and QIM step d1, not by bit count.
Clean bit_acc stays at 1.000 up to 2048 b; only drops to 0.999 at 2048.
Hard ceiling at 4095 b for 512² images (one block per bit, no redundancy). Library asserts wm_size < block_num.
Robustness degrades smoothly with payload (less per-bit repetition), no cliff before capacity.
Two attacks dominate the loss budget: jpeg_q30 (0.73 at 896 b) and chain_wechat (0.67 at 896 b). Most other attacks stay ≥ 0.95 even at 896 b.

vs MWIP @ 896 b on the same suite: blind_watermark loses ~7 pp on average, ~30 pp worst-case. PSNR is actually ~0.4 dB higher for blind_watermark.

vs published learned methods (TM1/MS2/MSF7 mixes): blind_watermark at 100 b would deliver ~0.99 bit_acc on the compression subset alone — competitive with TrustMark-Q (0.95 ± 0.09 over mix), and strictly dominating StegaStamp (0.72), RoSteALS (0.94), MetaSeal, HiDDeN on this axis. The averaged "mix" numbers in published tables hide which method actually wins on which attack family.

§2Mechanism (verified from source)

Pipeline per image (bwm_core.py:79-138):

RGB → YUV
for each channel (Y, U, V):
    LL, (LH, HL, HH) = dwt2(channel, 'haar')        # LL is 256×256 for 512² input
    blocks = LL.reshape into 4×4 tiles               # 64×64 = 4096 blocks
    for block_i in blocks:
        permutation = PRNG(password_img, block_i)    # 16-element permutation
        block_dct  = dct(block)
        block_perm = block_dct.flatten()[permutation].reshape(4,4)
        u, s, v    = svd(block_perm)                 # singular values, length 4
        bit        = wm_bits[block_i % len(wm_bits)] # cyclic assignment
        s[0]       = (s[0] // d1 + 1/4 + 1/2 * bit) * d1   # QIM on largest sv
        block_new  = u @ diag(s) @ v
        block_back = block_new.flatten() un-permuted → reshape → idct
    reassemble blocks → idwt → write

Extraction (bwm_core.py:140-202):

RGB → YUV → dwt → tiles → for each block:
    permute → dct → svd → bit_hat = (s[0] % d1 > d1/2)
collect 3 × 4096 soft bits; for each watermark bit j:
    soft_j = mean(bit_hats[:, j::wm_size])  # average all repetitions × 3 channels
final = soft > 0.5  (or k-means thresholding via extract_with_kmeans)

Design choices worth noting

Choice	Where	Why it matters
Embed in DWT LL band (low-freq)	`dwt2(..., 'haar')` then operate on LL	LL is the part JPEG and resize preserve best. Counter-intuitive but correct: natural attack-domain alignment makes JPEG robustness almost free.
QIM on singular values	`s[0] = (s[0] // d1 + 1/4 + 1/2 * bit) * d1`	Adds a fixed bias of ±d1/4 to s[0]. Robust to any attack with magnitude < d1/4 in s[0]-space. `d1` is the JPEG-robustness/PSNR knob.
All 3 YUV channels carry the watermark	loop over `channel in range(3)`	Independent 3× repetition for free. Decoder averages — ~√3 SNR boost.
Cyclic bit assignment	`wm_bits[block_i % wm_size]`	At payload P, each bit gets `floor(block_num / P) × 3` reps. At P=32 → 384 reps/bit; at P=896 → 13.7. Implicit repetition coding scales inversely with payload.
Per-block coefficient permutation	`block_dct.flatten()[shuffler[i]]`	Different blocks have different SVD bases (post-permute), so the modulation pattern is not periodic in pixel coords. This is the "obscurity-keying" via `password_img`.
Soft averaging + threshold	`extract_avg` then `> 0.5`	We threshold at 0.5; library also offers k-means thresholding (`extract_with_kmeans`) that adapts to the soft distribution. We didn't use it — likely leaving a few pp on the table.
No training, no neural network	n/a	Embedding parameters (`d1`, `block_shape`) are hand-tuned constants. Deploys instantly anywhere with NumPy + OpenCV + PyWavelets.

Why it's slow (despite no NN)

~12 k SVD calls per image on 4×4 matrices, in a Python for loop. LAPACK call overhead dominates the actual SVD compute on tiny matrices. There's an AutoPool (multiprocessing.Pool) but IPC overhead eats the savings at 512² scale. A batched-SVD CUDA implementation would be ~100× faster — the slowness is implementation, not algorithm.

§3Why it works as well as it does

Three structural reasons compression robustness is so good:

(a) Domain alignment

JPEG compresses by quantizing DCT coefficients per 8×8 block. Resize-down-then-up is a low-pass filter. blind_watermark embeds in DWT-LL coefficients of 4×4 blocks — both sit in the low-frequency regime that JPEG and resize preserve best. The watermark lives in the part of the spectrum that the attacks don't touch. This is the opposite of HF-embedding intuition: HF gets killed by JPEG; LF survives.

(b) QIM step size as a single explicit knob

The d1 parameter directly controls the PSNR / robustness tradeoff. Larger d1 → bigger singular-value perturbation → more visible (lower PSNR) but more robust to attack noise in s[0]. Library default d1=36 gives PSNR ~38 dB and decent robustness. Single hyperparameter, no training, fully interpretable.

(c) Massive over-redundancy at low payloads

4096 blocks × 3 channels = 12 288 bit-carriers. At 32 bits payload, that's 384 reps/bit. Even random-bit-flip noise from any attack needs to corrupt > 50% of those 384 to actually flip a bit. The "graceful degradation with payload" curve is just this repetition-coding gain decreasing.

Why it's not perfect: chain_wechat (0.3 scale + Q50 JPEG) destroys enough of the LL band that even 384× redundancy isn't enough at high payloads — and the per-block QIM has no error-correction structure beyond simple averaging.

§4Where it fails

Known (from our eval)

Hard capacity ceiling at block_num − 1 (4095 b for 512², block_shape=(4,4)). No graceful overflow — library throws on embed.
chain_wechat worst-case is 0.67 at 896 b, well below practical ECC threshold (~0.85 recoverable with BCH+RS at MWIP's rates).
jpeg_q30 drops fast (0.73 at 896 b). Aggressive single-pass JPEG is harsher than chained mild JPEG because it quantizes the LL band coarser.

Suspected (untested, high confidence)

Geometric attacks collapse to ~0.5. The 4×4 block grid is rigid in pixel coordinates. Crop 10% → grid misaligned → every block reads from the wrong DCT coefficients → noise. Rotation 1° → same. No geometric synchronization mechanism.
Regeneration attacks (SD-VAE encode/decode) likely catastrophic. The VAE decoder doesn't preserve fine DWT-LL structure faithfully; it produces a "perceptually similar" image with completely different singular-value statistics.
Adaptive attacks trivial. Modulation pattern is structured: ~12 k blocks each have s[0] snapped to a d1/2-spaced grid. An attacker who knows the algorithm computes the stego's singular values, identifies the snapping pattern, and adds noise to disrupt the modular structure without changing the perceptual image. The password_img permutation doesn't help — the snapping itself is the signature.

Security

"Password" = numpy.RandomState(int) seed. 2³² keyspace per password; 2⁶⁴ for both. Brute-force is ~weeks on a cluster (vs known-plaintext recovery, even faster).
No content binding at channel level. Same bitstring + same password → same modulation pattern → copy-attackable.
"Password" is not a cryptographic key. It's an obscurity-keyed PRNG seed.

§5Ideas worth stealing for MWIP

A.Sanity-check that we embed in attack-aligned frequencies

Verify MWIP's INN distributes the watermark signal in spatial-frequency regions that survive the dominant attacks (JPEG mid-band, resize low-band). If our learned residual has significant HF content, we're leaving robustness on the table. Action: plot the spectral distribution of the stego–cover residual and compare to where JPEG actually preserves energy. Quick diagnostic, no training.

B.Explicit per-bit spatial spreading

blind_watermark gets ~13 reps/bit at 896 b via cyclic assignment. MWIP's 32×32 bit grid puts each bit in a single slot. Adding explicit per-bit spreading (each bit modulates k > 1 spatial locations with a deterministic spreading code) gives the same noise-averaging gain at decode time. Trade-off: increases per-image PSNR cost or reduces effective payload — but the worst-case bit_acc gain on chain_wechat-style attacks may be worth it. Quick experiment: train with spreading-factor 2 / 4 / 8; measure worst-case bit_acc improvement.

C.Three-channel redundancy

blind_watermark embeds in all 3 YUV channels. If MWIP currently embeds in RGB with a single residual, consider channel-conditioned heads producing 3 independent residuals (Y, Cb, Cr) decoded by 3 detectors and combined. Free ~1.7× SNR if independent. Caveat: the INN may already be implicitly using channel redundancy — needs checking.

D.Lean into LL-band embedding

The biggest robustness lesson is embed where the attack doesn't go. For MWIP: ensure the INN's residual is mostly low-spatial-frequency rather than evenly distributed. Encourage via a band-limited loss term during training — penalize HF content in the residual. Likely a 1–2 dB PSNR cost for a non-trivial bit_acc gain under chain_wechat-style heavy compression.

E.QIM-style decoder regularization at training

blind_watermark's decoder is exact QIM extraction: (s[0] mod d1) > d1/2. Robustness comes from snapping s[0] to a discrete grid. MWIP's decoder is a learned soft classifier — typically noisier than QIM under attack. Idea: add a QIM-like quantization layer at encoder output (snap watermarked features to a discrete grid before re-injection), with straight-through gradient. Could give the same noise-rejection that QIM provides for free.

F.k-means thresholding at extraction

For our reported numbers, we used hard threshold at 0.5 on the soft outputs. blind_watermark's extract_with_kmeans adaptively learns the bit-0 / bit-1 cluster centers from the soft distribution. Same idea applies to MWIP's logits — adaptive thresholding (or bias-correction from a small held-out set) could pick up a few pp without retraining.

G.Distortion that's payload-independent

blind_watermark's PSNR is constant across 32 → 2048 bits. This is unusual and useful: the same encoder can carry many payload sizes at the same perceptual cost. If MWIP retrains per payload, we're spending compute on something blind_watermark gets for free via cyclic assignment. Idea: train MWIP at max payload, then cyclic-assign fewer bits at runtime. Or: train with payload randomization (sample payload per batch, mask unused bit slots). Either lets one model serve many payload regimes.

H."Obscurity-keying" as cheap per-instance variation

blind_watermark's password_img permutes block coefficients per-block. Even though it's weak as a crypto key, it gives a runtime parameter that varies the watermark pattern without retraining. For MWIP, an analogous mechanism — e.g., a permutation of the 32×32 bit-to-location mapping, seeded by an instance-specific value — could give: per-user / per-device customization without retraining; defense against template-extraction attacks (attacker can't average across instances if each has a different permutation); combinable with the cryptographic key in the payload (the permutation seed could be a hash of the public key).

I.No-training deployment as the headline, not the apology

blind_watermark is competitive because it has no training. Embedding parameters are hand-tuned constants matched to attack physics. For MWIP we should be honest about what training actually buys us — and ensure the answer isn't "marginal improvement on compression robustness." The training premium should pay off on attacks blind_watermark can't address: geometric, regeneration, adversarial. If our training doesn't deliver on those, we should question why we're training at all.

Top three to prioritize: (D) band-limited loss term and (B) explicit per-bit spreading are the most likely to move worst-case bit_acc. (A) is the quick diagnostic that should happen first to confirm whether (D) is even needed.

§6What we haven't tested (and should)

Geometric attacks: rotation (1°, 5°, 15°), crop (10 %, 30 %, 50 %), perspective warp, shear. Expectation: blind_watermark collapses to chance.
Regeneration attacks: SD-VAE encode-decode, JPEG-AI compression, generative inpainting at low strength. Expectation: blind_watermark goes to chance; MWIP unknown.
Color attacks: brightness / contrast / saturation / hue shifts. Expectation: blind_watermark loses some robustness because LL band shifts with color; MWIP unknown.
Adaptive / white-box attacks: an attacker who knows the algorithm and tries to null the watermark. Expectation: blind_watermark trivially defeated; MWIP unknown but probably more robust.
Higher resolutions: 1024², 2048², 4032×3008. blind_watermark's block ceiling rises proportionally — at 1024² it can carry ~16 k bits. May change the comparison.
k-means extraction for blind_watermark — could give a few pp uplift on our reported numbers.

These eval gaps need to close before the MWIP paper can honestly claim differentiation. The compression-only benchmark is not enough.

§7Reframing the MWIP paper

The "we have cryptographic key binding, they don't" pitch doesn't survive the observation that any bit-channel can carry a signed payload. The defensible pitch:

MWIP provides a 896-bit channel that maintains robustness across the full attack envelope — compression, geometric, regeneration, and adaptive — at PSNR comparable to classical baselines. The cryptographic provenance lives in the payload; the channel's job is to deliver it intact under realistic deployment attacks where classical schemes structurally fail.

For the related-work table:

Add blind_watermark as a strong classical baseline. Run at matched payloads (100 b for TrustMark / StegaStamp comparison; 896 b for MWIP headline; 2048 b for capacity comparison).
Break out bit_acc by attack category. Compression / geometric / filter / regeneration — do not hide blind_watermark's compression-band wins behind a single averaged number.
Show MWIP's distinct contribution is on the geometric + regeneration columns. That's the honest, defensible story.

blind_watermark — mechanism, benchmark, ideas to steal

§1Headline numbers

§2Mechanism (verified from source)

Design choices worth noting

Why it's slow (despite no NN)

§3Why it works as well as it does

(a) Domain alignment

(b) QIM step size as a single explicit knob

(c) Massive over-redundancy at low payloads

§4Where it fails

Known (from our eval)

Suspected (untested, high confidence)

Security

§5Ideas worth stealing for MWIP

§6What we haven't tested (and should)

§7Reframing the MWIP paper

§8References