One-page overview of the deployed demo model and how it compares to existing watermark / steganography methods. This page covers what the demo carries, what it survives, and where it sits among prior work. For the full pipeline, training recipe, ECC layout, API, and diagnostics → model. For the design rationale (why patch-tile, why α=1, what was rejected) → design.
An invertible-neural-network (INN) carrier that embeds a fixed 896-bit data payload in any RGB image
— recoverable from the watermarked container after real platform pipelines (resize + JPEG + chained re-encodes).
Payload format [ H(128) | sig(512) | pk(256) ]: a robust hash of the image, an Ed25519 signature
over that hash, and the signer's public key. Verification is fully offline; there is no manifest sidecar.
| field | value |
|---|---|
| checkpoint | autohide / 1024bit_noamp_keepckpt / idea097_design001 / ckpt_latest.pt |
| backbone | DKiS INN — 8 coupling blocks · LightConvBlock subnets · 0.167 M params · 0.7 MB fp32 |
| data payload | [ H(128) | sig(512) | pk(256) ] · 896 b |
| embedded in pixels | 1024 b codeword — BCH(127, 99) Slepian-Wolf on H + outer RS(128, 100) |
| training | 30 k steps, 256² fixed res, AdamW 4e-4, smooth Bernoulli α-ramp (5–15 k), 2026-05-17 |
| threat model | compression-only — single & chained JPEG, in-pipeline resize, platform chains (Insta / X / WhatsApp / WeChat). Crop / rotate / large-resize / noise / blur = reject by design. |
| inference (est.) | ~25 ms per 12 MP image · ~17 TFLOPS fp16 NPU · ~6–12 ms with int8 quant |
See model § Architecture for the embed/extract diagram and model § Payload & ECC for the Slepian-Wolf bit-budget trick.
100 DIV2K val · 14 in-scope attacks across 7 sizes (256² → 2048×1536 + random). Worst attack = chain_wechat.
| avg (7 sizes) | @ 1024² only | note | |
|---|---|---|---|
| bit_acc avg | 0.995 | 0.999 | mean over the 14-attack suite |
| bit_acc min (worst attack) | 0.955 | 0.992 | chain_wechat; at 1024² every in-scope attack ≥ 0.99 |
| PSNR clean (cover vs. container) | 37.4 dB | 37.4 dB | 1024² fixed |
| SSIM clean | 0.940 | 0.940 | indistinguishable on a feed-scale display |
| RS-success bit_acc floor (verify gate) | ~ 0.986 | ~ 0.986 | iid; RS(128,100) tolerates 14/128 byte errors. Clustered patch-tile errors push the realised floor somewhat lower. |
Source: autohide/experiments/1024bit_noamp_keepckpt/idea097_design001/eval.json.
Full per-attack breakdown on the dashboard index;
see model § Results for the v1 → v2 ablation and PSNR-vs-size curve.
Existing image-watermark / steganography systems force a trade between (i) on-camera deployability, (ii) pixel-level (manifest-free) carriage, (iii) cryptographic content binding, and (iv) public verifiability. No prior system covers all four. MWIP is built to.
| method | on-camera | pixel-embedded | cryptographic content-binding | manifest-free | public verification |
|---|---|---|---|---|---|
| TrustMark + C2PA (Adobe, 2023) | yes | yes | via manifest only | no (100-bit ID → manifest) | yes (cert chain) |
| MetaSeal (TMLR 2026) | no (~1.5 s on L40S, ~300 M params) | yes | yes (ECDSA + caption anchor) | partial (pk in manifest; caption-collision exploit) | yes |
| DKiS (Yang 2025) | no | yes | no (symmetric key) | N/A | no |
| StegaStamp (CVPR 2020) | partial | yes | no | N/A | no |
| HiDDeN (ECCV 2018) | yes | yes | no (raw bits) | N/A | no |
| RoSteALS (2023) | no (latent-diffusion backbone) | yes | no | N/A | no |
MWIP (this work · idea097/d001) |
yes (0.167 M params, ~25 ms / 12 MP) | yes (1024 b ECC in pixels) | yes (Ed25519 over robust PDQ hash, embedded) | yes (no sidecar) | yes (pk also embedded) |
One specific variant per row; every cell sourced from the same paper table (cited in the source column). Apples to oranges — test sets, noise models, and payloads differ — so this is order-of-magnitude, not a ranking. Apples-to-apples on our DIV2K sweep is queued in plan.
| variant | payload | params · disk | 12 MP fp16 | PSNR / SSIM | bit_acc under noise |
source · noise model |
|---|---|---|---|---|---|---|
| TrustMark-Q αmax=27.5 | 100 b | 21 M · 85 MB | ~ 100 ms | 43.3 dB / 0.99 | 0.95 ± 0.09 | TM1 · random JPEG (q∈[50,100], "Medium" preset) / resize / crop / blur / color |
| StegaStamp | 100 b | ~25 M · ~100 MB | ~ 200 ms | 37.5 dB / 0.99 | 0.72 ± 0.10 | TM1 (same mix) |
| RoSteALS | 100 b | ~500 M (latent-diff) | seconds | 30.0 dB / 0.92 | 0.94 ± 0.09 | TM1 (same mix) |
| MetaSeal | ~2,816 b | ~300 M · ~1.2 GB | ~ 1.5 s | 34.4 dB / 0.965 | n/a (curves only) | MS2 + MSF7 · "stable" only inside JPEG q ≥ 85, noise σ² < 0.05, blur σ < 0.7 |
| HiDDeN 32-bit | 32 b | ~1 M · ~4 MB | ~ 30 ms | 37.4 dB / 0.987 | 0.96 clean only | MS2 · clean |
| DKiS (full-image steg) | image, not bits | ~4 M · ~16 MB | ~ 600 ms | — | — | different problem class — listed for context |
| MWIP (this work) | 896 b data · 1024 b in pixels | 0.167 M · 0.7 MB | ~ 25 ms | 37.4 dB / 0.940 | 0.992 @ 1024² 0.955 7-size avg |
eval.json · chain_wechat = resize 0.3× → JPEG q=50 (worst of 14) |
Sources. TM1 = TrustMark Tab. 1, DIV2K column (Bui et al, arXiv:2311.18297).
MS2 / MSF7 = MetaSeal Tab. 2 / Fig. 7, DIV2K (Fei et al, arXiv:2509.10766, 2026).
eval.json = autohide/.../idea097_design001/eval.json on our 14-attack DIV2K sweep.
Empty cells = the paper does not publish a directly-comparable number (we don't fill these with
paraphrased guesses — an earlier draft had a fabricated MetaSeal cell that didn't exist in the paper).
TrustMark+C2PA loses cryptographic binding once the C2PA manifest is stripped (the 100-bit ID just points to it).
MetaSeal ECDSA-binds content but to a ViT+GPT-2 caption (collision-exploitable) and is ~300 M params — too heavy for on-camera embed.
DKiS embeds bits invertibly but uses a symmetric key (anyone who can verify can also forge).
StegaStamp / HiDDeN / RoSteALS are bit carriers with no security model.
MWIP signs a robust PDQ hash, embeds signature + pk in pixels via an ECC-wrapped INN payload, runs in <30 ms on a phone NPU,
verifies fully offline with no manifest sidecar — security reduces to Ed25519 + collision-resistance of H in the threat model.
14 in-scope attacks. Numbers below are at 1024² (target deployment scale); see model.html for the full size × attack sweep.
| category | attack | bit_acc @ 1024² |
|---|---|---|
| clean | — | 1.000 |
| single JPEG | q90 / q70 / q50 / q30 | 1.000 / 1.000 / 1.000 / 1.000 |
| JPEG chain | 85→60 · 70×3 | 1.000 / 1.000 |
| resize only | 0.9 / 0.7 / 0.5 | 1.000 / 1.000 / 1.000 |
| Instagram feed | chain_insta (0.5 + Q85) | 1.000 |
| X / Twitter | chain_x (0.4 + Q75) | 1.000 |
| WhatsApp Std / FB feed | chain_whatsapp_std (0.5 + Q70) | 1.000 |
chain_wechat (0.3 + Q50) | 0.992 |
Goal at 1024² is bit_acc ≥ 0.99 on WeChat (the worst real-platform pipeline at native capture scale). Achieved 0.992. Avg across 7 sizes drops to 0.955 on WeChat — dominated by 256² where the patch grid is tightest.
H and the verifier rejects. By design — see design § Threat-model scope.