Learnable Watermark Embedder

• The learnable watermark embedder integrates data-driven modules and optimization objectives to embed statistically verifiable watermarks into AI-generated content.
• It employs techniques like FFT-based tensor addition, adversarial perturbations, and neural autoencoders to achieve imperceptible yet robust watermarking.
• Empirical evaluations demonstrate strong detection guarantees and plug-and-play adaptability across images, audio, and text modalities with minimal fidelity loss.

A learnable watermark embedder is a parameterized algorithm that injects a statistically verifiable watermark into AI-generated content—such as images, audio, or text—by optimizing its own components and, often, those of a detector. Unlike fixed pattern schemes or hand-designed overlays, the process is driven by data and learnable modules (tensors, neural networks, embedding vectors), frequently incorporating explicit training objectives and collaborative learning with the detection model. This approach enables robust, imperceptible, and adaptively verifiable watermarks suitable for ownership, provenance, and integrity applications, with compatibility across diverse generative architectures. Below, the design principles, mathematical formulations, training and inference methodologies, and empirical findings of leading approaches are presented. All statements and results are sourced verbatim or by direct paraphrase from the cited works.

1. Structural Principles and Design of Learnable Watermark Embedders

Modern learnable watermark embedders eschew rigid encoder–decoder architectures in favor of flexible, often plug-and-play tensor or network-based modules. The embedding mechanism typically falls into one of several broad categories:

• Frequency + Spatial Tensor Addition: RAW (Xian et al., 23 Jan 2024) stores two optimizable tensors $u,v\in\mathbb{R}^{C\times W\times H}$ and injects them via

$$E_{\boldsymbol{w}}(X) = F^{-1}(F(X) + c_1\, v) + c_2\, u,$$

where $F$ is the FFT, $c_1, c_2$ are scaling strengths, and $X$ is the image. No network forward pass is required for embedding; the watermark is compatible post-training with any $C\times W\times H$ image source.

• Adversarial/Contrastive Embedding: AWEncoder (Zhang et al., 2022) and Watermarking Pre-trained Encoders (Wu et al., 2022) craft adversarial perturbations or untargeted backdoors, respectively, optimizing embedding-space divergence while preserving clean performance. Here, the "watermark" may be a universal perturbation vector $w_{\rm adv}$ or a trainable trigger pattern applied in the input space, baked into the encoder by minimizing composite classification and contrastive losses.
• Neural Network–Based Autoencoders: ReMark (Semyonov et al., 2023), WaterFlow (Shukla et al., 15 Apr 2025), and WAM (Sander et al., 11 Nov 2024) employ autoencoder architectures to overlay, spatially distribute, and reconstruct watermarks. Architectural adaptation includes receptive-field driven watermark sizing [ReMark], invertible flows for latent domain expressivity [WaterFlow], or segmentation-style extractors for localized watermark recovery [WAM].
• Model-Parameter or Output-Layer Manipulation: Works such as Yet Another Watermark for LLMs (Bao et al., 16 Sep 2025) and Learning to Watermark LLM-generated Text via RL (Xu et al., 13 Mar 2024) interweave watermark signals with the underlying generative model by parameter manipulation or reinforcement learning–driven fine-tuning, embedding detection cues directly in the model's weights or output distributions.

2. Embedding Objective, Loss Functions, and Detection Guarantees

Unlike heuristic methods, learnable embedders anchor watermark presence and recovery on rigorous, data-driven objectives—almost universally drawing on cross-entropy, perceptual, or classification-guided losses:

• Classification-Guided Loss (RAW (Xian et al., 23 Jan 2024)):

$$L_0 = \sum_X \left[\, Y\log V_\theta(X) + (1-Y)\log(1 - V_\theta(X)) \right]$$

The embedder and detector parameters ($\theta_w$, $\theta$) are updated jointly.

• Adversarial and Contrastive Losses ([AWEncoder, (Zhang et al., 2022)]; [Watermarking Pre-trained Encoders, (Wu et al., 2022)]):
  • Embedding loss:

  $$L_{\rm adv} = \mathbb{E}_{x}[ 1 - \mathrm{sim}(E_\theta(x + w_{\rm adv}), E_\theta(x_{\rm tar})) ]$$ - Watermark loss:

  $$L_{\rm wat} = \mathbb{E}_x [ \mathrm{KL}( \sigma(E_\theta(x)) \| \sigma(E_\theta(x + w_{\rm adv})) ) ]$$

• Imperceptibility Constraint: Regularization is managed either by explicit perceptual losses (SSIM, LPIPS [WaterFlow, DiffMark]) or by limiting watermark strength via small coefficients ($c_1, c_2$) [RAW].
• Detection Guarantees (RAW (Xian et al., 23 Jan 2024)): Achieved via conformal thresholding and randomized smoothing, which delivers provable, distribution-free bounds on false positive rate ($P_{FA} \leq \alpha$ for chosen threshold $\tau$ and adversarial attack bounded by $\gamma$).

3. Joint and Alternating Training with Detector Modules

A core tenet is alternating or simultaneous optimization of embedder and detector:

• RAW-style Alternating Updates:

1. Clip watermark-embedded images to $[0,1]$.
2. Update watermark tensors using SignSGD.
3. Update classifier parameters using SGD.
4. Monitor perceptual fidelity via FID/CLIP scores.

• Contrastive Co-training ([AWEncoder, (Zhang et al., 2022)]): Pretrain encoder, adversarially generate the watermark perturbation, and jointly fine-tune with a combined contrastive and watermark loss, preserving transferability to downstream tasks.
• RL-based Co-training ([Learning to Watermark LLM-generated Text via RL, (Xu et al., 13 Mar 2024)]): Iteratively update model via PPO to maximize detector score, penalize deviation from base model, and retrain detector on watermarked/generated outputs.

4. Inference Procedures and On-the-Fly Embedding

A majority of frameworks are designed for plug-and-play watermark injection and detection, requiring minimal computation and zero access to model internals:

• RAW: A single FFT, tensor additions, inverse FFT, and clipping; the mechanism is agnostic to the image generator.
• Object-level T2I Watermarking ([Your Text Encoder Can Be ..., (Devulapally et al., 15 Mar 2025)]): Only a single text embedding vector is learned; at generation, prompts are augmented with the watermark token to localize embedding to specified image regions.
• Black-box LLM Detection ([Yet Another Watermark ..., (Bao et al., 16 Sep 2025)]): Detection relies entirely on output token statistics, requiring no model access beyond sample generation and a secret key.

5. Robustness, Empirical Validation, and Comparative Analysis

Evaluations span image, audio, and text generative pipelines under extensive manipulation and adversarial attack scenarios. Key results include:

Method	Modality	Robustness (AUROC, TPR, Bit Acc)¹	Fidelity²	Embedding Speed³
RAW	Images	AUROC↑0.82→0.92 under attack	FID/CLIP unchanged	30×–200× SOTA
WaterFlow	Images	AUC≈0.98, WDR≈0.99 (Combo attacks)	SSIM≈0.95	6.4s/image
DiffMark	Images	Deepfake BER≈2.8% (best)	PSNR=41.96dB
GaussMarker	Images	TPR@1%FPR≈0.998, bit acc≈0.99	FID within 0.2%
IDEAW	Audio	Acc=99.44%, SNR=35.4dB, >98% under 8 attacks		40–50% faster locating
LTW	Text	AUROC≈1.0, TPR≈1.0, Perplexity↓30%
Yet Another Watermark	Text	z-score=6.49, PPL=3.93	≈1–5% PPL shift

¹ AUROC, TPR, Bit accuracy, WDR, and BER as defined per method; see above for references. ² FID/CLIP for images; PSNR/SSIM/LPIPS for image metrics; SNR for audio. "Fidelity unchanged" indicates minimal impact on generative quality. ³ Compared with previous state-of-the-art, where relevant.

Critical outcomes include strict preservation of perceptual fidelity, resilience under image manipulations (rotation, cropping, JPEG compression), adversarial removal attacks, Deepfake manipulations, paraphrasing in LLM outputs, pruning and fine-tuning in contrastive encoders, and highly parameter-efficient design (e.g., single vector in object-level T2I watermarking vs. full-model retraining).

6. Limitations, Extensions, and Open Directions

Despite superior performance, certain limitations are persistent:

• Data and Compute Requirements: Fine-tuning or RL-based co-training often mandates substantial data and compute investment (RLHF-scale resource requirements (Xu et al., 13 Mar 2024)), though plug-and-play modules sharply reduce costs.
• Hyperparameter Sensitivity: Trade-off between watermark strength and imperceptibility is typically managed by careful choice of coefficients ($c_1$, $c_2$, $\sigma^2$, etc.) or grid-search in output-layer scaling parameters ($\alpha$, $\gamma$) (Bao et al., 16 Sep 2025).
• Transferability and Adaptation: While many watermarks survive moderate downstream adaptation (DiffMark, SleeperMark), extreme architectural changes or adversarial training may defeat detection unless the training set and detector are periodically updated.

Potential extensions described include:

• Application of adversarial watermarking methods to other self-supervised frameworks (BYOL, SwAV (Zhang et al., 2022));
• Federated watermark sharing across distributed ensembles;
• Cryptographic analyses and formal guarantees on detection;
• Segmentation-style extractors for multi-region watermarking in spliced images (Sander et al., 11 Nov 2024).

7. Model-Agnosticism and Practical Deployment

A prominent property is compatibility with arbitrary content sources:

• Image: RAW, WaterFlow, GaussMarker, SleeperMark, ReMark, and WAM support diffusion, GAN, and real-image sources, requiring neither internal model access nor architectural constraints.
• Audio: IDEAW provides robust watermarking for time- and transform-domain signals under adversarial attacks.
• Text: Selective watermarking is achieved through either output-layer modification (LLMs), multi-objective Pareto optimization, or RL-based model-level signal embedding.

Plug-and-play capability enables integration in diverse production pipelines, including high-fidelity diffusion tools (Stable Diffusion, DeepFloyd-IF), real-time video analytics, and massive-scale LLM deployment.

---

Learnable watermark embedders synthesize parametrization, training, and robust detection into models that are verifiable, imperceptible, and adaptable to evolving generative content. Their empirical advantages reflect a data-driven transition from rigid, fragile watermarking schemes to flexible, performance-optimized solutions—now widely adopted as best practice in both industrial and research settings (Xian et al., 23 Jan 2024, Zhang et al., 2022, Shukla et al., 15 Apr 2025, Sander et al., 11 Nov 2024).