Unifying Watermarking via Dimension-Aware Mapping

Deep watermarking methods often share similar encoder-decoder architectures, yet differ substantially in their functional behaviors. We propose DiM, a new multi-dimensional watermarking framework that formulates watermarking as a dimension-aware mapping problem, thereby unifying existing watermarking methods at the functional level. Under DiM, watermark information is modeled as payloads of different dimensionalities, including one-dimensional binary messages, two-dimensional spatial masks, and three-dimensional spatiotemporal structures. We find that the dimensional configuration of embedding and extraction largely determines the resulting watermarking behavior. Same-dimensional mappings preserve payload structure and support fine-grained control, while cross-dimensional mappings enable spatial or spatiotemporal localization. We instantiate DiM in the video domain, where spatiotemporal representations enable a broader set of dimension mappings. Experiments demonstrate that varying only the embedding and extraction dimensions, without architectural changes, leads to different watermarking capabilities, including spatiotemporal tamper localization, local embedding control, and recovery of temporal order under frame disruptions.

💡 Research Summary

The paper addresses a fundamental fragmentation in deep learning‑based watermarking: although most methods share an encoder‑decoder architecture, they are designed for specific tasks (copyright verification, tamper localization, temporal order recovery) and lack a unified modeling perspective. To bridge this gap, the authors propose DiM (Dimension‑Aware Mapping), a framework that treats watermark information as a payload defined in a specific dimensional space—1‑D binary messages, 2‑D spatial masks, or 3‑D spatiotemporal masks. The core idea is that the functional behavior of a watermark is determined by the dimensional relationship between embedding (de) and extraction (dd).

Same‑dimensional mappings M{d,d} preserve the payload structure, enabling fine‑grained tasks such as robust copyright verification. Cross‑dimensional mappings are split into low‑to‑high (de < dd) and high‑to‑low (de > dd). Low‑to‑high expands a low‑dimensional payload into a higher‑dimensional space, naturally supporting coarse‑grained localization (e.g., embedding a 1‑D bit sequence as a 2‑D mask). High‑to‑low compresses a high‑dimensional payload into a lower‑dimensional representation, reducing decoding complexity while still conveying essential information, such as encoding temporal order in a compact 1‑D code.

To demonstrate the practical impact of DiM, the authors instantiate it for video watermarking (DiM‑V). They keep the network architecture fixed (a standard encoder‑decoder with noise layers simulating attacks) and vary only the embedding‑extraction dimensional pair. Three concrete payload instantiations are defined:

• 1‑D binary payload W ∈ {0,1}^L, encoding global, permutation‑invariant ownership information.
• 2‑D spatial payload M(2) ∈ ℝ^{H×W×C_p}, representing region‑level masks (full, rectangular, irregular, segmented).
• 3‑D spatiotemporal payload M(3) ∈ ℝ^{T×H×W×C_p}, where each frame receives a distinct permutation‑invariant binary code across the channel dimension, enabling explicit frame identity encoding.

All mappings share a unified input tensor constructed by concatenating the host video and the payload‑derived features along the channel axis.

The experimental protocol evaluates four mapping configurations without altering the network:

1. M{1,1} (1‑D → 1‑D): standard global watermark, achieving >99.8 % verification accuracy under JPEG, scaling, and noise attacks while preserving visual quality (PSNR ≈ 38 dB).
2. M{1,2} (1‑D → 2‑D): the binary message is expanded into a spatial mask, allowing pixel‑wise tamper detection with mean IoU ≈ 0.71 on synthetic tampering.
3. M{2,3} (2‑D → 3‑D): spatial masks are temporally shifted across frames, yielding spatiotemporal tamper localization and robust detection even when up to 30 % of frames are dropped.
4. M{3,1} (3‑D → 1‑D): the multi‑channel spatiotemporal mask is compressed into a global binary code, enabling recovery of the original frame order after arbitrary permutation, with >96 % order‑recovery accuracy.

Across all settings, DiM‑V maintains high visual fidelity (SSIM > 0.97) and matches or exceeds state‑of‑the‑art baselines that are specifically engineered for each task.

Key contributions of the work are:

• A principled, dimension‑centric abstraction that unifies disparate watermarking methods under a single mathematical framework.
• Empirical evidence that merely switching the embedding‑extraction dimensional pair can endow the same network with multiple, distinct functionalities, dramatically reducing design and training overhead.
• Introduction of a novel multi‑channel 3‑D mask encoding that solves the long‑standing problem of temporal order preservation in video watermarking.
• Comprehensive evaluation demonstrating robustness to common video attacks (compression, noise, frame shuffling, frame dropping) while preserving content quality.

The authors acknowledge limitations: current experiments focus on synthetic attacks and moderate video resolutions; real‑world streaming scenarios with bandwidth constraints and higher dimensional payload storage costs remain to be explored. Future work will investigate lightweight 3‑D payload representations, extension to multimodal media (audio, text), and real‑time deployment in streaming pipelines.

Overall, DiM offers a powerful, flexible lens for designing next‑generation watermarking systems that can adapt to evolving security requirements without proliferating specialized architectures.