Simulated Ensemble Attack (SEA)

Updated 7 July 2026

Simulated Ensemble Attack (SEA) is a dual-domain method combining a CNN-based spatial path with a Transformer-based frequency path to simulate real-world post-processing distortions.
It actively trains watermarking systems by modeling diverse degradations—such as cropping, noise, and compression—to ensure reliable watermark decoding even after severe perturbations.
Empirical evaluations, particularly using the Model Parallel configuration, demonstrate significant improvements in bit accuracy and robustness compared to previous watermarking approaches.

Searching arXiv for the specified paper and directly related SEA terminology to ground the article in current literature. Simulated Ensemble Attack (SEA) denotes the ensemble attack network used to train robust post-processing image watermarking systems in “Enhancing Robustness in Post-Processing Watermarking: An Ensemble Attack Network Using CNNs and Transformers” (Huang et al., 3 Sep 2025). In that formulation, SEA models a distribution of real-world post-processing distortions during training by combining a CNN-based attack network in the spatial domain with a Transformer-based attack network in the frequency domain. The objective is to make an embedded watermark decodable after common degradations, geometric transforms, and modern regeneration attacks, while preserving the flexibility of post-processing watermarking, which can be applied to outputs from arbitrary generative models without access to their internal structure and can assign personalized payloads on a per-image basis (Huang et al., 3 Sep 2025).

1. Conceptual setting and threat model

SEA is situated in post-processing watermarking rather than in-processing watermarking. The distinction is operationally important: post-processing watermarking embeds a watermark after image generation, so it can be applied to outputs from GANs and diffusion models without needing access to the generator’s internals, and it permits unique watermarks for individual images (Huang et al., 3 Sep 2025). The paper frames SEA as a training-time mechanism for robustness enhancement rather than as a test-time attack.

The threat model is broad. Watermarked images may undergo cropping, resizing, blur, noise, brightness and contrast changes, JPEG compression, rotation, and regeneration attacks that re-encode or denoise images through VAEs or diffusion models. SEA is designed so that the decoder continues to recover the payload after these stressors. This emphasis on learned simulation of distortions differentiates SEA from training procedures that rely only on fixed operators.

A common misconception is that the method is primarily about attacking watermarking systems. In the cited formulation, the attack network is adversarial only in the training sense: it is optimized to produce difficult yet realistic perturbations so that the watermarking model becomes more robust. This suggests that SEA is best understood as a learned robustness-inducing channel model for post-processing watermarking, not as a stand-alone watermark removal pipeline.

2. Formalization and watermarking pipeline

The paper formalizes watermarking with a differentiable encoder $f_\phi$ and decoder $g_\psi$ . Let $x$ denote a cover image and $w \in \{0,1\}^L$ a binary message of $L$ bits. The encoder maps

$f_\phi(x, w) \to x_w,$

where $x_w$ is the watermarked image. The decoder maps

$g_\psi(x') \to \hat{W},$

where $\hat{W} \in \{0,1\}^L$ is the decoded watermark from a possibly attacked image $x'$ (Huang et al., 3 Sep 2025).

The evaluation metric is decoding accuracy in terms of bit accuracy:

$g_\psi$ 0

with $g_\psi$ 1 the indicator function. The paper reports extensive evaluation on the WAVES benchmark using average bit accuracy as the metric.

Following the DA framework, the pipeline also includes channel coding through NECST. A 30-bit message is expanded to 120 bits for redundancy. Using the notation in the paper, the components are:

$g_\psi$ 2
$g_\psi$ 3
$g_\psi$ 4
$g_\psi$ 5, and $g_\psi$ 6
$g_\psi$ 7 or $g_\psi$ 8

SEA instantiates $g_\psi$ 9 as an ensemble of learned attack networks that approximate a distribution of real-world distortions. The paper writes this probabilistically as sampling an attack operator $x$ 0 from a distribution $x$ 1:

$x$ 2

The induced distribution depends on routing probabilities such as $x$ 3 and $x$ 4, the blending parameter $x$ 5, and whether cascade or parallel composition is used (Huang et al., 3 Sep 2025).

3. Ensemble attack architecture

SEA combines two learned attack paths with complementary inductive biases. The spatial path is a CNN-based attack network operating in pixel space. It is described as a CNN re-implementation of DA’s learned attack network and is trained to mimic resizing and cropping, cutout or erasing, brightness perturbation, blur, rotation, and related post-processing operations. These perturbations are learned and differentiable rather than fixed operators (Huang et al., 3 Sep 2025).

The frequency path is a Transformer-based attack network operating after a DCT transform in YUV space. The Y channel carries luminance and the U and V channels carry chrominance. The method applies 2D block-DCT on non-overlapping $x$ 6 blocks in each channel, masks high-frequency components before perturbation, tokenizes the coefficients by grouping the same frequency across blocks, applies multi-head self-attention over these frequency tokens, and then reconstructs the attacked image through inverse DCT followed by YUV-to-RGB conversion (Huang et al., 3 Sep 2025).

The attention mechanism is given as

$x$ 7

Here, $x$ 8 denotes the input embeddings, $x$ 9 the key dimensionality, and $w \in \{0,1\}^L$ 0, $w \in \{0,1\}^L$ 1, and $w \in \{0,1\}^L$ 2 the trainable projection matrices (Huang et al., 3 Sep 2025).

The DCT formulation used on an $w \in \{0,1\}^L$ 3 block is

$w \in \{0,1\}^L$ 4

where $w \in \{0,1\}^L$ 5 and $w \in \{0,1\}^L$ 6 are normalizing factors, $w \in \{0,1\}^L$ 7 is the pixel intensity at $w \in \{0,1\}^L$ 8, and $w \in \{0,1\}^L$ 9 is the DCT coefficient at $L$ 0 (Huang et al., 3 Sep 2025).

The paper’s central architectural claim is that the spatial CNN and the frequency-domain DCT-Transformer capture different classes of degradations. Empirically, the CNN performs best on resizedcrop, erasing, and brightness, whereas the DCT-Transformer excels on contrast, noise, and compression. This suggests that SEA’s effectiveness depends less on simple model multiplicity than on domain-complementary simulation capacity (Huang et al., 3 Sep 2025).

4. Ensemble composition strategies

SEA is instantiated in four ensemble configurations, each combining one CNN path and one DCT-Transformer path (Huang et al., 3 Sep 2025).

Configuration	Construction	Reported characterization
Model Cascade	$L$ 1 DCT-Transformer $L$ 2 CNN $L$ 3	Sequential composition increases attack diversity
Model Parallel	Route $L$ 4 to either CNN or DCT-Transformer with probability $L$ 5	Highest average robustness
Random Blend	Route $L$ 6 and $L$ 7 separately, then blend with $L$ 8	Effective but below Model Parallel on average
Aggregate Blend	Pass both $L$ 9 and $f_\phi(x, w) \to x_w,$ 0 through both paths, randomly select outputs, then blend with $f_\phi(x, w) \to x_w,$ 1	Effective but below Model Parallel on average

In Model Parallel, the image is stochastically routed to either $f_\phi(x, w) \to x_w,$ 2 or $f_\phi(x, w) \to x_w,$ 3:

$f_\phi(x, w) \to x_w,$ 4

In the blend variants, the final attacked image is computed as

$f_\phi(x, w) \to x_w,$ 5

with $f_\phi(x, w) \to x_w,$ 6 sampled randomly per iteration (Huang et al., 3 Sep 2025).

Among these options, Model Parallel is reported to achieve the highest average robustness. The paper states that this is likely due to more balanced, non-overfitting exposure to diverse distortions. Because the stated explanation is qualified rather than proven, it is best read as an empirical interpretation rather than as a formal theorem.

5. Optimization objectives and implementation

SEA jointly optimizes the watermark encoder, watermark decoder, and attack network, while NECST channel coding is trained independently (Huang et al., 3 Sep 2025). The channel coding loss is binary cross-entropy over bits:

$f_\phi(x, w) \to x_w,$ 7

The watermark encoder loss is

$f_\phi(x, w) \to x_w,$ 8

where $f_\phi(x, w) \to x_w,$ 9 is a GAN-style perceptual loss via a discriminator, with $x_w$ 0 and $x_w$ 1.

The watermark decoder loss is

$x_w$ 2

with $x_w$ 3 and $x_w$ 4.

The attack network loss is

$x_w$ 5

with $x_w$ 6 and $x_w$ 7. The first term preserves visual similarity, whereas the second encourages stronger attacks that increase decoding difficulty and thereby force robustness. The paper notes that excessively large $x_w$ 8 harms training stability and Identity performance, especially in the spatial domain, and that operating in the DCT domain alleviates this trade-off (Huang et al., 3 Sep 2025).

The paper also gives a conceptual robust min–max view:

$x_w$ 9

Here, $g_\psi(x') \to \hat{W},$ 0 is a differentiable surrogate for bit error, implemented as MSE over redundant codes, while true bit accuracy is reserved for evaluation.

The implementation details reported for reproducibility include COCO and CelebA resized to $g_\psi(x') \to \hat{W},$ 1, a 30-bit payload expanded to 120 bits, a HiDDeN-like encoder and decoder with discriminator, a DA-style CNN attack network, and a ViT-like DCT-Transformer with $g_\psi(x') \to \hat{W},$ 2 patches, 256-dimensional embeddings, $g_\psi(x') \to \hat{W},$ 3 encoder layers, $g_\psi(x') \to \hat{W},$ 4 heads, tokens arranged by frequency band across blocks, and no positional embeddings. Learning rates are $g_\psi(x') \to \hat{W},$ 5 for the Transformer attack with weight decay $g_\psi(x') \to \hat{W},$ 6 and $g_\psi(x') \to \hat{W},$ 7 for the CNN attack and watermarking components. The ensemble routing thresholds are $g_\psi(x') \to \hat{W},$ 8 (Huang et al., 3 Sep 2025).

6. Empirical performance, ablations, and trade-offs

The principal evaluation is on WAVES, which defines Distortion Attacks, Embedding Attacks, and Regeneration Attacks; the paper additionally evaluates Manipulation Attacks using image editing models (Huang et al., 3 Sep 2025). Model Parallel is reported as the best-performing ensemble variant. For COCO Distortion Attacks, the paper reports for Model Parallel an average bit accuracy of approximately 86.442 with Identity 99.851 and strong compression and noise robustness.

The headline reported improvements are substantial. On Distortion Attacks, SEA improves HiDDeN relative to DA by 6.995% on COCO and 7.317% on CelebA, and improves StegaStamp by 5.395% on COCO and 5.043% on CelebA. With a decoder trained using SEA/MP, Stable Signature gains 8.386% average bit accuracy on Distortion Attacks. On Embedding Attacks, HiDDeN and StegaStamp with SEA/MP reach nearly 100% bit accuracy, while Stable Signature reaches 90.078%. On Regeneration Attacks, SEA/MP improves StegaStamp by 18.743% average bit accuracy, exceeds DA by 3.537%, and is comparable to Stable Signature. On Manipulation Attacks, SEA/MP outperforms DA and StegaStamp by 9.963% against StyleRes on CelebA and by 7.551% against InstructPix2Pix on COCO (Huang et al., 3 Sep 2025).

The ablation results further specify where performance originates. For the DCT-Transformer, $g_\psi(x') \to \hat{W},$ 9 and $\hat{W} \in \{0,1\}^L$ 0 perform best; deeper Transformers do not help, which the paper attributes to potential overfitting. Removing positional embeddings improves performance in the frequency setting, and YUV significantly outperforms RGB for DCT-domain attacks. These observations align with the design claim that absolute spatial positions are less critical when the model is organized around frequency-coherent tokens.

SEA also introduces a measured quality–robustness trade-off. The paper reports that SEA/MP slightly reduces PSNR and SSIM relative to some baselines, while images remain high-quality: HiDDeN_MP achieves PSNR (RGB) approximately 31.06 and SSIM approximately 0.947, and StegaStamp_MP achieves PSNR (RGB) approximately 37.62 and SSIM approximately 0.982. Identity robustness remains near 99.9% for StegaStamp_MP and approximately 99.85% for HiDDeN_MP. The stated limitations are increased compute cost from using both CNN and Transformer attack paths, slightly lower PSNR and SSIM than some baselines, and the need to tune the loss weights and routing probabilities (Huang et al., 3 Sep 2025).

The term “Simulated Ensemble Attack” is not unique across recent arXiv literature. In the watermarking context, SEA refers to the ensemble attack network described above (Huang et al., 3 Sep 2025). In “Ensemble Noise Simulation to Handle Uncertainty about Gradient-based Adversarial Attacks,” the paper does not explicitly use the SEA name, but its method corresponds to a mixture of gradient-based perturbations across multiple source architectures to train a Denoising Autoencoder against attacker uncertainty (Mahfuz et al., 2020). In “Simulated Ensemble Attack: Transferring Jailbreaks Across Fine-tuned Vision-LLMs,” SEA denotes a grey-box jailbreak method that combines Fine-tuning Trajectory Simulation and Targeted Prompt Guidance to transfer adversarial images across fine-tuned VLMs (Wang et al., 3 Aug 2025). By contrast, “Use as Many Surrogates as You Want: Selective Ensemble Attack to Unleash Transferability without Sacrificing Resource Efficiency” uses the same acronym for “Selective Ensemble Attack,” not “Simulated Ensemble Attack” (Yang et al., 19 May 2025), while “T-SEA: Transfer-based Self-Ensemble Attack on Object Detection” uses SEA to mean “Self-Ensemble Attack” (Huang et al., 2022).

This nomenclature overlap matters because the acronym alone does not identify a single technical object. In the literature summarized here, SEA can denote a watermarking-time learned distortion ensemble, a transfer-based VLM jailbreak strategy, a defense-oriented ensemble noise simulation framework, a resource-efficient surrogate-selection method, or a self-ensemble patch attack. A plausible implication is that the most stable identifier is the application domain plus the full paper title rather than the acronym in isolation.

Within the watermarking literature specifically, another misconception is to equate SEA with explicit differentiable JPEG or with a purely spatial augmentation scheme. The paper instead argues for a dual-domain ensemble: CNNs handle local spatial perturbations with limited receptive fields, while Transformers operating on DCT coefficients capture long-range, structured perturbations resembling compression and noise. In that sense, SEA is neither a fixed corruption library nor merely a broader data augmentation routine; it is a jointly trained adversarial simulator of post-processing channels intended to improve robustness of post-processing watermarking systems (Huang et al., 3 Sep 2025).