IConMark+TM: Hybrid Interpretable Watermarking

• IConMark+TM is a hybrid watermarking method that integrates prompt-level semantic embedding with TrustMark’s post-hoc 100-bit key encoding to combat adversarial attacks.
• It utilizes a two-stage process where semantic concepts are embedded during image generation followed by a nearly imperceptible neural watermark as a post-hoc security layer.
• The approach achieves high AUROC detection rates under various manipulations, offering both human-interpretable verification and robust machine decoding.

IConMark+TM is a hybrid AI-image watermarking scheme that combines interpretable concept-based watermarking at generation time with a post-hoc neural watermark based on TrustMark. Introduced as part of "IConMark: Robust Interpretable Concept-Based Watermark For AI Images" (Sadasivan et al., 17 Jul 2025), it is designed to distinguish AI-generated images from real images under image manipulations and adversarial pressure while retaining a human-readable watermark layer. The scheme wraps two watermarking stages around the Flux generator: a prompt-level semantic embedding stage that inserts related concepts into the image content itself, and a TrustMark stage that embeds a 100-bit key as a nearly imperceptible perturbation. The resulting system is positioned as a first step toward interpretable watermarking and as a hybrid method that can complement conventional post-hoc schemes (Sadasivan et al., 17 Jul 2025).

1. Conceptual basis and scope

The motivating problem is the rapid rise of generative AI and synthetic media, which makes distinguishing AI-generated images from real ones crucial for misinformation mitigation and digital authenticity. The paper contrasts IConMark with traditional watermarking techniques that rely on adding noise or perturbations to images and reports that such techniques have shown vulnerabilities to adversarial attacks. IConMark instead embeds meaningful semantic attributes into the generated image, making the watermark interpretable to humans and, in the authors’ framing, resilient to adversarial manipulation (Sadasivan et al., 17 Jul 2025).

IConMark+TM extends this idea by combining the semantic watermark with TrustMark. In this hybrid construction, interpretability and post-hoc encoding are not alternatives but parallel watermark channels. A common simplification is to treat IConMark+TM as merely a stronger post-hoc watermark. That characterization is incomplete: the method is explicitly two-stage, with one stage operating through prompt augmentation before image synthesis and the second stage operating on the synthesized image afterward. This suggests that the scheme is intended to diversify failure modes rather than to optimize a single embedding mechanism.

The paper’s abstract reports that the base watermarking technique and its variants achieve higher mean AUROC scores for watermark detection than the best baseline on various datasets: 10.8% for IConMark, 14.5% for IConMark+TM, and 15.9% for IConMark+SS (Sadasivan et al., 17 Jul 2025).

2. Two-stage architecture and embedding pipeline

IConMark+TM consists of two watermarking stages wrapped around a modern AI-image generator, Flux. The first stage is IConMark prompt-level embedding; the second is TrustMark post-hoc embedding (Sadasivan et al., 17 Jul 2025).

Stage	Input and output	Function
IConMark prompt-level embedding	Input: user text prompt $p$; output: $\hat{x}$	Samples related concepts from a private database and augments the prompt before generation
TrustMark post-hoc embedding	Input: $\hat{x}$ and 100-bit key $w$; output: $x'$	Embeds $w$ as a nearly imperceptible perturbation
Final detection	Input: candidate image $x$	Declares watermarked if either IConMark or TrustMark is detected

In Stage 1, a Concept Sampler $\mathcal{L}$, instantiated as Llama3.1-8B-Instruct, queries a private concept database $\mathcal{D} = \{c_1,\dots,c_N\}$ and returns a set of $k$ related concepts $\hat{x}$0. A Prompt Augmentor then constructs

$\hat{x}$1

and Flux generates the IConMark-only image

$\hat{x}$2

The paper characterizes this stage as leaving a purely semantic, human-interpretable watermark buried in the image content itself (Sadasivan et al., 17 Jul 2025).

In Stage 2, the output $\hat{x}$3 is passed to TrustMark’s encoder, which embeds a 100-bit key $\hat{x}$4:

$\hat{x}$5

The image $\hat{x}$6 is then released to end users. At inference time, the detector runs both detectors in parallel and reports “watermarked” if either stage flags a watermark (Sadasivan et al., 17 Jul 2025).

This architecture is important because it combines a semantic watermark that is visible in scene content with a conventional encoded watermark that is not meant to be perceptually apparent. A plausible implication is that an attacker must suppress both semantic traces and post-hoc perturbation traces to defeat the system completely.

3. Interpretable concept representation

The interpretability of IConMark+TM derives from the IConMark component. The private database is specified as $\hat{x}$7 and contains short, concrete phrases such as “a brass table lamp” or “a moss-covered tree trunk with a hole” (Sadasivan et al., 17 Jul 2025).

IConMark’s “encoder” is not a learned image-space encoder. Instead, it is a prompt-level annotator that selects $\hat{x}$8 concepts $\hat{x}$9 related to the original prompt via the Llama model $\hat{x}$0. The generative model then weaves these objects into the scene. Because the method operates through prompt augmentation rather than through a learned encoder, the paper states that IConMark’s “loss” is entirely implicit in the generative model’s semantic attention (Sadasivan et al., 17 Jul 2025).

For decoding the semantic watermark, the method uses a visual-LLM $\hat{x}$1, instantiated as IDEFICS3-8B-Llama3. For each concept $\hat{x}$2, the system issues the prompt:

Print yes or no. Is there something like ‘$\hat{x}$3’?

and records a binary answer. The paper emphasizes that each concept is a familiar object or scene element, which allows a human inspector to perform manual verification by directly checking whether the described object appears in the image. The example given is “Yes—I see a red brick fireplace” (Sadasivan et al., 17 Jul 2025).

This interpretability dimension distinguishes IConMark+TM from watermarking methods whose embedded signal is only machine-accessible. It does not eliminate the need for automated detection, but it adds an observable semantic layer that can be inspected without access to decoder internals.

4. Detection logic and robustness mechanism

The IConMark detector evaluates the presence of concepts in the candidate image $\hat{x}$4. For each $\hat{x}$5, it queries the visual-LLM and computes

$\hat{x}$6

If $\hat{x}$7, the system declares “IConMark present.” In practice, the paper sets $\hat{x}$8 for $\hat{x}$9 (Sadasivan et al., 17 Jul 2025).

TrustMark detection proceeds differently. The decoder produces $w$0, after which the Hamming distance to the secret key $w$1 is evaluated. If the bit-error-rate is below a set threshold, given in the paper as an example of 10%, the system declares “TrustMark present” (Sadasivan et al., 17 Jul 2025).

The IConMark+TM decision rule is then an OR-fusion:

• watermarked if “IConMark present” OR “TrustMark present.”

The paper explicitly states that this OR-fusion makes IConMark+TM resilient to any family of attacks that might remove one watermark but not the other (Sadasivan et al., 17 Jul 2025). In operational terms, the hybrid uses detector complementarity rather than detector agreement. That is a consequential design choice: it biases the system toward robustness against heterogeneous manipulations rather than toward a stricter notion of joint confirmation.

A common misconception is that interpretability alone constitutes the detection rule. In IConMark+TM, interpretability is only one branch. The full decision procedure combines a semantic detector and a bit-decoding detector in parallel.

5. Mathematical formulation and empirical evaluation

TrustMark contributes the only explicit learned encoder-decoder objective in the hybrid. The paper defines

$w$2

and states that they are trained with the loss

$w$3

At embed time for IConMark+TM, the already-trained TrustMark encoder is simply applied to the IConMark image $w$4 (Sadasivan et al., 17 Jul 2025).

The reported evaluation uses MS-COCO captions with 108 prompts and 10 images each, Open Image Preferences (OIP) with 110 prompts and 10 images, and for robustness tests evaluates half the MS-COCO set $w$5 images) under affine, valuemetric, regen, and warp augmentations. The reported detection metrics are AUROC, Accuracy, TPR@5% FPR, and TPR@1% FPR (Sadasivan et al., 17 Jul 2025).

Method	Mean AUROC under no augmentations (%)	Average AUROC over four augmentation families (%)
DWTDCT	100.00	66.0 / 66.8
TrustMark	100.00	74.0 / 74.6
StegaStamp	100.00	80.3 / 80.1
IConMark ($w$6)	97.46 / 87.92	95.8 / 86.1
IConMark+TM	100.00	97.2 / 92.1
IConMark+SS	100.00	98.1 / 94.0

The table reports MS-COCO / OIP values where two numbers are given. Relative to the best single-method baseline, identified in the paper as StegaStamp, the average gains over the four augmentation families are reported as +15.5% / +6.0% for IConMark, +16.9% / +11.9% for IConMark+TM, and +17.8% / +13.9% for IConMark+SS (Sadasivan et al., 17 Jul 2025).

For generation quality, the paper states that with $w$7 concepts, IConMark yields negligible degradation in CLIP-score, aesthetic rating, or artifact count, and often slightly higher diversity. The comparative discussion further states that image-quality trade-off is almost nonexistent because adding concepts simply asks Flux to place small background objects and the TrustMark perturbation is visually imperceptible (Sadasivan et al., 17 Jul 2025).

6. Comparative position, limitations of interpretation, and reported significance

The comparative analysis in the paper assigns different robustness profiles to the component methods. StegaStamp is described as strong under valuemetric augmentations such as JPEG and blur but as collapsing under affine or regen. TrustMark alone is reported to suffer under affine and warp. IConMark alone is reported to excel on geometric augmentations, specifically affine and warp, but to perform only moderately on photometric and regeneration settings. IConMark+TM is then characterized as capturing the geometric strength of IConMark plus the post-hoc encoding power of TrustMark, lifting average AUROC from 80% to over 97% (Sadasivan et al., 17 Jul 2025).

This comparison clarifies the role of the hybrid. IConMark+TM is not described as replacing either semantic watermarking or post-hoc watermarking in isolation; rather, it is presented as a composition that exploits complementary robustness regimes. IConMark+SS is reported as slightly stronger still because StegaStamp is most robust to valuemetric distortions (Sadasivan et al., 17 Jul 2025).

Interpretability should not be conflated with guaranteed security. The data support a narrower claim: the semantic watermark is human-readable and manually verifiable, and the OR-fused detector is resilient when one watermark is removed but the other survives. Broader claims about universal resistance to all attacks would go beyond the provided evidence. What the paper does claim, in its own summary, is that by fusing an interpretable, in-generation prompt-based watermark with a learned post-hoc scheme, IConMark+TM achieves human-readable watermarks, robustness to adversarial purification and common augmentations, near-perfect detection in the wild, and zero perceptual or generation-quality penalty (Sadasivan et al., 17 Jul 2025).

Within the taxonomy implied by the paper, IConMark+TM occupies the intersection of semantic watermarking, interpretable watermarking, and hybrid watermark fusion. Its main technical distinction is that the watermark is simultaneously part of the image’s semantic scene structure and part of a machine-decoded 100-bit signal. This suggests a model in which watermark robustness is distributed across heterogeneous channels rather than concentrated in a single embedding mechanism.