IConMark+SS: Hybrid Watermarking for AI Images

• The paper introduces IConMark+SS, a hybrid watermarking method that combines semantic prompt augmentation with a post-hoc watermark channel to enhance detection robustness.
• IConMark+SS embeds visible semantic cues during image generation alongside StegaStamp, ensuring human interpretability and resistance to geometric and photometric distortions.
• By fusing the outputs of two detectors using an OR rule, the system achieves up to 15.9% higher mean AUROC compared to baseline methods under various attack models.

IConMark+SS is a hybrid watermarking system for AI-generated images that combines the interpretable semantic watermark IConMark with the post-hoc watermark StegaStamp in order to provide both human-readable provenance cues and increased robustness against image manipulations. In the underlying framework, IConMark embeds a watermark during image generation by augmenting the prompt with interpretable concepts drawn from a private concept database, whereas StegaStamp is applied afterward as a second watermarking channel. Detection is fused by an OR rule: an image is labeled watermarked if either the IConMark detector or the StegaStamp detector returns a positive result. The method is introduced as part of "IConMark: Robust Interpretable Concept-Based Watermark For AI Images" (Sadasivan et al., 17 Jul 2025).

1. Conceptual basis and motivation

IConMark+SS is built on the premise that conventional AI-image watermarks are often imperceptible noise-based, difficult for humans to verify, and vulnerable to attacks such as purification, regeneration, model substitution, and other image transformations (Sadasivan et al., 17 Jul 2025). IConMark was proposed as an in-generation alternative: instead of inserting an invisible perturbation after image synthesis, it modifies the prompt so that the generated image contains a semantic signature. The watermark is therefore not a hidden pixel-level pattern alone, but a set of visually meaningful concepts such as “a brass table lamp,” “a metal blue street sign,” or “a crescent moon shape with two stars next to it.”

Within this design, IConMark is intended to be interpretable, machine-detectable, robust, and composable. Interpretability arises because humans can inspect whether the semantic concepts are present. Machine detectability arises because a VLM can query for those concepts. Robustness is motivated by the claim that semantic content survives many transformations better than tiny hidden perturbations. Composability follows from the fact that IConMark only changes the input prompt and therefore does not preclude the application of a second watermark.

IConMark+SS exists because the paper identifies complementary strengths between the two constituent methods. IConMark is described as robust in a semantic sense, especially to some geometric transformations, while StegaStamp is described as a strong post-hoc watermark that is known to be robust to many image manipulations. The hybrid is therefore structured to preserve the interpretability of IConMark while adding StegaStamp’s additional robustness.

2. System construction and decision rule

The IConMark component begins from a private concept database

$\mathcal{D} = \{c_1,\dots,c_N\},$

with $N=100$ concepts manually curated from ChatGPT-generated candidates. These concepts are described as diverse, background-friendly objects and scenes (Sadasivan et al., 17 Jul 2025).

For a prompt $p$, the system samples related concepts and inserts them into an augmented prompt $\tilde p_k$. The prompt template is reported as:

$$\text{``}p\text{ in the foreground. add following: } c_p^1, c_p^2, \ldots, c_p^k \text{. sharp, detailed.''}$$

The image generator $\mathcal{G}$ is Flux. In the experimental setup, the concept sampler is Llama-3.1-8B-Instruct, and the default IConMark setting is $k=9$.

IConMark+SS is then constructed in a two-stage generation pipeline. First, an IConMark watermarked image is generated. Second, StegaStamp is applied post-hoc to that IConMark-generated image. The resulting output is the final IConMark+SS image (Sadasivan et al., 17 Jul 2025).

Detection also proceeds in two branches. For a candidate image $x$, the IConMark detector uses IDEFICS3-8B-Llama3 as the visual LLM $\mathcal{V}$. It queries each database concept with:

$$\text{``Print yes or no. Is there something like } c_i \text{?''}$$

The IConMark detection score is the number of concepts from $N=100$0 detected in the image, and the image is declared watermarked if that score exceeds threshold $N=100$1. In parallel, the StegaStamp detector is run on the same image.

The hybrid decision rule is explicitly an OR-combination:

• if IConMark detects watermark, the image is watermarked;
• or if StegaStamp detects watermark, the image is watermarked;
• only if both fail is the image labeled non-watermarked.

The paper summarizes the logic as:

$N=100$2

Because this is a combined detector without a single scalar score, ROC curves are formed by sampling Pareto-optimal threshold pairs for the two detectors. A plausible implication is that the hybrid is not attempting to merge the two watermark channels into one representation; rather, it preserves separate detectors and exploits complementary failure modes.

3. Experimental configuration and attack model

The reported experiments use FLUX.1-dev (“Flux”) as generator, Llama-3.1-8B-Instruct as concept sampler, and IDEFICS3-8B-Llama3 as detector VLM (Sadasivan et al., 17 Jul 2025). Evaluation is conducted on 108 prompts from MS-COCO and 110 prompts from Open Image Preferences (OIP), with 10 images per prompt. The concept database size is $N=100$3, and the default IConMark parameter is $N=100$4. For robustness experiments on MS-COCO, the dataset size is halved to 1080 images.

The threat model comprises four composite attack categories. Affine includes random rotation in $N=100$5 and random cropping that keeps 70%–95% of the original area. Valuemetric includes brightness and contrast changes, Gaussian blur, additive Gaussian noise, and JPEG compression. Regen is image regeneration using a diffusion model with 300 diffusion steps. Warp is perspective warping with 0%–40% corner perturbation. These are explicitly framed as realistic degradations or attacks that can break watermarks.

This evaluation design is important for interpreting IConMark+SS. The hybrid is not presented as a detector for one narrowly defined corruption channel. Instead, it is evaluated across geometric, photometric, compression-related, and regeneration-based manipulations, which aligns with the paper’s claim that its strength derives from combining semantic and post-hoc watermarking.

4. Reported performance

The headline result is that IConMark+SS achieves a 15.9% higher mean AUROC for watermark detection than the strongest baseline, StegaStamp, across various datasets (Sadasivan et al., 17 Jul 2025). The same summary reports 10.8% for base IConMark and 14.5% for IConMark+TM. In the paper’s robustness conclusion, IConMark+SS is described as the clear winner overall.

The following AUC values are reported for IConMark+SS:

Setting	MS-COCO AUC	OIP AUC
No augmentations	100.00%	100.00%
Affine	96.32	86.41
Regen	99.05	97.46
Valuemetric	99.93	99.77
Warp	95.68	86.31
Overall average	98.12	93.99

Without attacks, the hybrid achieves AUC = 100.00%, Accuracy = 100.00%, T@5%F = 100.00%, and T@1%F = 100.00% on both MS-COCO and OIP. In the reported evaluation, the no-augmentation case is therefore perfect.

Under affine augmentations, IConMark+SS obtains Accuracy = 90.65 / 80.45, T@5%F = 84.63 / 32.27, and T@1%F = 51.11 / 13.64 on MS-COCO / OIP. The paper characterizes this as very close to IConMark and competitive with IConMark+TM, while still preserving the hybrid advantage of extra robustness.

Under regen augmentations, IConMark+SS is reported as the best among all methods, with Accuracy = 95.46 / 92.27, T@5%F = 95.19 / 81.36, and T@1%F = 79.44 / 69.09. The paper identifies this as one of the strongest indications that StegaStamp contributes meaningful robustness, because regeneration attacks are highly damaging to many watermarks.

Under valuemetric augmentations, IConMark+SS is again reported as the best, with Accuracy = 99.35 / 98.64, T@5%F = 99.44 / 98.64, and T@1%F = 99.26 / 97.73. This is the regime in which StegaStamp appears to help most, because its robustness to photometric and compression distortions complements IConMark.

Under warp augmentations, IConMark+SS is described as essentially tied with the best detectors, with Accuracy = 90.97 / 80.23, T@5%F = 72.69 / 31.82, and T@1%F = 41.67 / 13.18. The paper notes that IConMark is already strong in this regime and that the hybrid remains very competitive.

The paper’s summary interpretation is that IConMark+SS combines IConMark’s resilience to affine and warp augmentations with StegaStamp’s resilience to valuemetric augmentations, while remaining highly detectable across all tested manipulation classes.

5. Image quality, ablations, and semantic signal

The image-quality analysis reported in the paper is primarily for IConMark rather than separately for IConMark+SS (Sadasivan et al., 17 Jul 2025). The stated rationale is that the hybrid remains practical because the underlying IConMark watermark does not degrade image quality and the method is designed to preserve visual fidelity. This should be read carefully: the quality evidence is direct for IConMark and indirect for IConMark+SS.

For IConMark, the paper states that quality metrics improve or remain stable as $N=100$6 increases. The reported metrics include Clip Score, Diversity, Ratings, and Artifacts. On MS-COCO at $N=100$7, the selected values are:

• Clip Score: 0.033 ± 0.032
• Diversity: 0.349 ± 0.022
• Ratings: 6.282 ± 1.084
• Artifacts: 2.100 ± 0.632

These results are used to justify fixing $N=100$8, which is also the default setting inherited by the hybrid. The corresponding ablation reports that, on MS-COCO, AUROC rises from 76.05% at $N=100$9 to 97.46% at $p$0, while image quality does not degrade. This supports the use of relatively rich semantic augmentation in the hybrid pipeline.

The paper also reports a histogram showing that watermarked images have a much higher number of detected concepts than non-watermarked images. That result is significant because it validates the semantic watermark signal itself: the IConMark component is not merely inserting prompt text, but producing images in which the detector recovers substantially more database concepts. The appendix’s qualitative examples further illustrate that the semantic concepts are visually present, the images remain natural, and IConMark+SS is visually similar to other high-quality outputs while carrying stronger watermarking evidence.

A common misconception is to treat interpretability here as equivalent to purely manual verification. The method is human-readable in the sense that the semantic concepts can be inspected by humans, but the operational detector still uses a VLM, concept counting, and thresholding.

6. Relation to base IConMark, IConMark+TM, and adjacent watermarking work

Relative to base IConMark, IConMark+SS adds a second watermark channel without discarding the first. Base IConMark uses only semantic prompt augmentation and concept-based detection. IConMark+SS uses semantic watermarking plus post-hoc StegaStamp. Relative to IConMark+TM, the structure is analogous, except that TrustMark replaces StegaStamp. The paper reports that IConMark+SS is generally stronger than IConMark+TM in the experiments and slightly ahead in average AUROC, with 15.9% versus 14.5% higher mean AUROC than the strongest baseline (Sadasivan et al., 17 Jul 2025).

This positioning matters for understanding what IConMark+SS is not. It is not a purely post-hoc watermark, because generation is first modified semantically through IConMark. It is also not only a semantic watermark, because StegaStamp is subsequently added. The system is therefore best understood as a hybrid provenance scheme that fuses an interpretable in-generation watermark with a conventional post-hoc one.

In the broader watermarking literature, adjacent work may share robustness goals while differing in modality and embedding substrate. For example, "CoreMark: Toward Robust and Universal Text Watermarking Technique" addresses text watermarking through a CORE embedding paradigm based on character pixel structure and explicitly does not mention IConMark or IConMark+SS (Meng et al., 29 Jun 2025). Its relevance is therefore indirect: it supports the general observation that robustness can be pursued through structurally meaningful watermark carriers, but it does not provide a direct comparison for AI-image provenance.

A plausible implication of the IConMark+SS design is that hybrid watermarking can target different attack surfaces simultaneously: semantic content for one robustness profile, and post-hoc encoding for another. The paper’s reported results support that interpretation, especially in the contrast between IConMark’s strength under affine and warp transformations and StegaStamp’s contribution under valuemetric distortions.