Pitfalls of zero-bit watermarking

Zero-bit watermarking is one of the two watermarking techniques that let us watermark digital media, the other being multi-bit.

Essentially, one could argue that they are the same, given that the only difference between them is payload size: zero bits vs. multiple bits per unit of time or space.

But the thing is, one can argue that zero-bit watermarking carries no actual payload. Then what is it?

Jokingly, when I want to provoke our research team, I tell them that zero-bit is a textbook example of overfitting. And I am only half joking.

You see, given that the zero-bit detector can only give us a binary decision on whether something is AI or not, one must ask the question, “What part of the signal makes the network decide whether something is watermarked or not?” Unlike multi-bit watermarking, where a successful payload extraction is hard proof of watermark presence, zero-bit watermarking can only rely on a detector decision.

So, being a devil’s advocate, I could call it a binary classifier. But what does it then classify? Well, the output of the embedder!

So, in a philosophical sense, it really does behave like a deepfake detector, or any kind of detector. And the problem with detectors is... false positive rate FPR!

You see, a junior researcher in watermarking building a zero-bit watermarking model will do the following:

• construct an embedder and detector pair
• put constraints on quality and robustness
• finish training and run the evaluation of the model

And in the last step, he will, most likely, achieve SOTA results. Why? Well, his binary classifier will work on clean data. Then, just to show how awesome his solution is, this researcher will pass his data to a layer of attacks, and surprisingly, they will all come out as watermarked! That’s it, he is a genius, and he solved the problem.

But the thing is... his detector is awful. It was overfitted to always say YES, no matter what the input is, and its FPR will be up to 50%.

Okay, no one succeeds on the first try, but then what? A fine-tune on FPR! A brilliant idea, and I would do the same. However, his quality criteria were easily satisfied on the first go for one reason only: he was never embedding a watermark, even without knowing it. Now, if we need to reduce the FPR, the watermark will start appearing on the embedding side, and it will bring down the output quality.

And this is where this game becomes hard to crack. You are in a vicious circle. One problem creates another. Solving it produces another problem.

Now, being a good Samaritan, I’ll tell you how to solve it. Read our papers. They are free. The answer is there. Maybe not the latest edge, but you can find just enough to start.

In a nutshell, we believe in a zero-bit payload. We force our embedders to generate it, and stretch it within the spectrum. Our detectors decide on it. But the philosophical question of its existence remains.

But, truth be told, we also avoid zero-bit watermarking whenever we can, and we advise our customers not to use it. Our models achieve SOTA FPR performance in zero-bit watermarking even under adversarial attacks, but we can never claim 0%. That’s not true for multi-bit watermarking. Payload presence is the best proof of whether something is watermarked or not.

And the bonus piece of wisdom? This is one of the reasons text watermarking sucks. Add deepfake detectors while we are at it; I am on a roll. Those are forced solutions, and they do the job to some extent, but they are not good provenance tools.