InvZW: invariant feature learning via noise-adversarial training for robust image zero-watermarking

1 Introduction

Image watermarking is a widely used technique for embedding hidden information into digital media for purposes such as copyright protection and content authentication (Zhang et al., 2024). In contrast to standard watermarking methods that modify the cover image by embedding a watermark directly into its pixel or transform domain representation, zero-watermarking leaves the original image unchanged. Instead, it extracts robust features from the image and associates them with a watermark to form a signature, which is stored externally without altering the image. During usage, features extracted from a potentially marked image are used to either verify the watermark or recover it. This approach ensures that the visual integrity of the original image remains intact, making it ideal for scenarios where any modification is impermissible. While zero-watermarking has traditionally been associated with highly sensitive use cases, its non-intrusive and robust nature makes it broadly applicable. By enabling reliable copyright protection and content verification without altering the original content, it offers a practical and versatile solution across a wide range of image-based applications. There are two primary objectives of zero-watermarking: verification-based approaches, which confirm the presence of a watermark (Li et al., 2024), and multibit extraction-based methods, which aim to retrieve the full watermark content from the extracted features (Fierro-Radilla et al., 2019).

Recent advancements in deep learning have transformed the landscape of zero-watermarking by introducing learning-based approaches that leverage deep neural networks to extract high-level feature representations from images (Zhong et al., 2023). Instead of relying on handcrafted descriptors, these methods employ convolutional networks or transformers to learn features that are more robust to distortions (Fierro-Radilla et al., 2019; He et al., 2023; Han et al., 2024). A common approach involves using a deep network as a fixed feature extractor: features are drawn from the input image and combined with a watermark to generate a reference signature. During verification, the same feature extraction process is applied to a test image to determine watermark presence or recover watermark bits (see Figure 1). Beyond zero-watermarking, several deep image watermarking schemes (Vukotić et al., 2020; Fernandez et al., 2022) also leverage pre-trained networks, especially self-supervised models, as fixed feature extractors. These methods modify the input image to embed a watermark that becomes detectable in the feature space. By inheriting the robustness of self-supervised representations, they offer robustness to distortions without additional training. These approaches typically assume that off-the-shelf models, trained on large-scale image classification or self-supervised learning tasks, provide sufficient invariance to potential image distortions in watermarking.

Robustness is a critical consideration in image zero-watermarking, where the extracted features must remain stable under a wide range of distortions. These include common image processing attacks such as blurring and compression, as well as geometric transformations such as rotation, scaling, and cropping. These transformations can significantly alter image appearance while preserving semantics, posing a challenge for watermark retrieval. While existing methods have leveraged pre-trained feature extractors to achieve a degree of robustness, they are not explicitly designed for watermarking and often fall short when encountering unseen or complex distortions. This highlights the need for more specialized approaches that directly target invariance in the feature space, tailored to the demands of watermarking applications.

To this end, we propose a noise-adversarial training framework for learning invariant features specifically designed for multibit image zero-watermarking. Our method introduces three core novelties: (1) a new invariant feature learning scheme that is explicitly tailored for watermarking applications, ensuring that feature representations remain stable under diverse distortions; (2) a novel deep learning-based zero-watermarking method that leverages these learned features for watermark extraction without modifying the original image; and (3) a significant improvement in robustness, as our adversarial training approach enables the model to withstand a wide range of image processing and geometric transformations. Collectively, these components constitute a framework that advances the robustness and reliability of deep zero-watermarking.

2 Related work

This section reviews the most relevant areas, including invariant feature learning and deep learning-based zero-watermarking.

2.1 Invariant feature learning

Robust feature learning has its origins in convolutional neural networks (CNNs), which introduce some invariance and equivariance through architectural components such as convolutional filters and pooling operations (Lecun et al., 1998). Recent advancements have shifted towards unsupervised and data-driven approaches for determining robustness, reflecting a significant change in paradigm (Cubuk et al., 2019; Zhang and Arodz, 2021; Kong and Zhang, 2023). A key development is the use of autonomous invariance learning through methods like differentiable Kronecker-factored Laplace approximations, which eliminate the need for manual data augmentation selection by optimizing augmentation parameters directly during training (Immer et al., 2022). This enables models to learn transformation robustness from data, adapting to varied conditions without predefined assumptions. While Bayesian approaches to invariance learning have been successfully applied in simpler models like Gaussian processes (Wilk et al., 2018), extending these methods to deep networks remains a challenge. Some advances in scalable marginal likelihood approximations, such as those using the structured Gauss-Newton method, have made it feasible to apply these techniques in deep learning (MacKay, 1992; Martens and Grosse, 2015). This evolution marks a shift from predefined augmentation strategies towards adaptive, data-driven methods, which align closely with the goals of robust feature extraction.

Self-supervised learning (SSL) methods, such as SimCLR (Chen et al., 2020), BYOL (Grill et al., 2020), and DINO (Caron et al., 2021), contribute to this trend by implicitly learning invariance through contrastive objectives or teacher-student frameworks during training. However, these methods primarily focus on improving the quality of learned representations, not explicitly on enhancing robustness against a wide range of distortions. Some work has attempted to address this gap in graph neural networks through methods, which employs tailored objectives to disentangle invariant features from spurious correlations (Yao et al., 2024).

Our approach extends these principles by directly training a deep learning model for invariance, with a specific focus on enhancing robustness. Unlike SSL approaches that treat invariance as a byproduct, our method is designed to optimize feature stability under diverse image transformations. This makes it particularly suitable for applications of image watermarking, where robustness to distortions is critical.

2.2 Deep learning-based image zero-watermarking

A common strategy behind recent deep learning-based image zero-watermarking methods is to adopt an existing deep model, typically pre-trained on large-scale datasets, as a feature extractor and assume that the learned features offer sufficient robustness for watermarking tasks. Fierro-Radilla et al. (2019) utilized a CNN to extract features from the cover host image, which were then combined with a permuted binary watermark using an XOR operation to generate a master share for later verification. He et al. (2023) extended this pipeline by introducing fully connected layers to extract shallow features from multiple convolutional layers, while incorporating a shrinkage module for soft thresholding and a noise layer during training to enhance robustness. Han et al. (2024) further improved this approach by encrypting the watermark using a chaotic encryption scheme and employing the Swin Transformer (Liu et al., 2021) as the feature extractor to improve geometric invariance and overall robustness. Li et al. (2024) proposed a zero-watermarking framework that uses ConvNeXt and LK-PAN to extract local and global features, with a dedicated watermark block designed to enhance both robustness and discriminability without handcrafted features.

Beyond zero-watermarking, several deep image watermarking schemes (Vukotić et al., 2020; Fernandez et al., 2022) have explored the use of pre-trained networks, particularly self-supervised models—as fixed feature extractors. These methods embed watermarks by optimizing the input image while keeping the model weights frozen, allowing the watermark to be revealed in the feature space. By leveraging the inherent robustness of self-supervised representations, these approaches achieve resilience to common distortions without the need for retraining the feature extractor.

Current approaches typically assume that off-the-shelf models, trained for image classification or self-supervised tasks, offer sufficient invariance for watermarking. In contrast, we train a deep network specifically to learn invariant features tailored for watermarking, resulting in greater robustness across diverse transformations. Moreover, unlike many existing methods that rely on manually computing feature-watermark correlations for verification, our approach introduces a novel learning-based mechanism that derives the reference signature from the extracted invariant features and the target watermark, enabling more reliable and adaptive zero-watermarking.

3 Proposed methods

To simplify the discussion, we conceptually decompose the proposed framework into two primary modules, as illustrated in Figure 2. Module 1 performs invariant feature learning, where a deep network is trained to extract robust image features that remain stable under diverse distortions. Module 2 introduces a learning-based zero-watermarking scheme, which combines the extracted features with a given watermark to generate a reference signature for later extraction. The remainder of this section discusses the details of each module.

3.1 Module 1: invariant feature learning via noise-adversarial training

Figure 3 illustrates the proposed invariant feature learning module based on noise-adversarial training. The framework consists of three main components: a feature extractor, a discriminator, and a reconstructor. Given both original and distorted images, the feature extractor, implemented using a Transformer-based architecture, generates high-level representations intended to be invariant to distortions. The discriminator is trained to classify whether a given feature originates from an original or distorted image, while the feature extractor is trained adversarially to fool the discriminator. This minimax interaction encourages the extractor to produce features that are indistinguishable across distortions, thereby promoting invariance. To ensure that the learned features retain semantic content, the reconstructor is trained to reconstruct the original image from these features, forcing the invariant features to preserve meaningful information relevant to the image itself.

3.1.1 Feature extractor

The feature extractor F E is implemented using the Vision Transformer (ViT) architecture (Dosovitskiy, 2020), which is adapted here to learn features that are robust to image distortions. Given an input image x ∈ R 128×128×3, the image is divided into N = 64 non-overlapping patches, each of size 16 × 16. Each patch p i is flattened and projected into a d-dimensional latent space via a learnable linear transformation: z i = W p p i + b p, where W p ∈ R d × ( 16 × 16 × 3 ) and b p ∈ R d. To encode positional information, learnable positional encodings E pos , i are added to each patch embedding, resulting in z i ( 0 ) = z i + E pos , i.

The sequence of embedded patches is then passed through L = 12 stacked Transformer blocks, each consisting of a multi-head self-attention (MHSA) layer followed by a feed-forward network (FFN). Formally, each block applies z ( ℓ ) = L a y e r N o r m ( z ( ℓ − 1 ) + M H S A ( z ( ℓ − 1 ) ) ), followed by z ( ℓ ) = L a y e r N o r m ( z ( ℓ ) + F F N ( z ( ℓ ) ) ), for ℓ = 1 , … , L.

The output of the final Transformer block is a sequence of encoded patch tokens { z 1 ( L ) , z 2 ( L ) , … , z N ( L ) }, which collectively represent the image in a latent feature space. Both the original and distorted images are passed through the same feature extractor, and the model is trained using adversarial objectives to ensure that these learned representations remain invariant to distortions.

To enable spatial supervision, the sequence of encoded patch tokens is further linearly projected and reshaped into a spatial feature tensor F s ∈ R 128×128×3. This transformation is implemented via a linear projection applied to each patch token, followed by reshaping the sequence into a 2D grid aligned with the input resolution. The resulting spatial feature tensor is derived from the learned transformer representations (rather than the raw image) and is used as input to the discriminator and reconstructor modules described in the following subsections.

3.1.2 Discriminator

The discriminator is designed to classify whether a feature representation originates from an original or a distorted image. It follows a ViT-based architecture, structurally similar to the feature extractor, but adapted for binary classification.

Given the spatial feature tensor F s ∈ R 128×128×3 derived from encoded patch features, the discriminator first divides it into 64 non-overlapping patches of size 16 × 16. Each patch is flattened and linearly projected into a 64-dimensional latent space using a learnable embedding layer. To preserve spatial ordering, positional embeddings are added to each projected patch vector.

The sequence of patch embeddings is passed through a stack of L = 8 Transformer blocks. Each block contains a MHSA layer followed by a FFN as in Figure 3, with residual connections and layer normalization applied at each submodule. This architecture allows the model to capture both local and global relationships across the image patches.

After Transformer processing, the output corresponding to the classification token is extracted and passed through a dense classification head with a softmax activation: D ( F ) = S o f t m a x ( W d ⋅ F CLS + b d ) , where F CLS denotes the final embedding of the classification token, and W d ∈ R 1 × d and b d ∈ R are learnable parameters.

The discriminator is trained to distinguish between features derived from original and distorted images. Its gradients provide adversarial feedback to the feature extractor, encouraging the extractor to produce representations that are invariant to the applied distortions.

3.1.3 Reconstructor

To prevent feature collapse, where the feature extractor outputs a constant or trivial representation (e.g., all zeros) regardless of the input, we introduce a reconstructor module R as an auxiliary constraint. While such representations may appear invariant, they are semantically meaningless and unusable for watermarking. By enforcing that the extracted features must support accurate reconstruction of the original image, we ensure that the representations retain semantic information in addition to distortion invariance. If the features collapse, reconstruction fails with high error, which the model is penalized for, thereby effectively discouraging degenerate solutions. The reconstructor, illustrated in Figure 4, can be conceptually described as an autoencoder-like architecture designed to enforce semantic preservation in the learned features. It consists of an encoder path, a bottleneck, and a decoder path. The input to the reconstructor is the feature tensor F ∈ R 128×128×3 produced by the feature extractor.

The encoder comprises a series of convolutional blocks, each consisting of a 2D convolution layer followed by batch normalization and ReLU activation. These layers progressively reduce the spatial resolution from 128 × 128 to 8 × 8, while increasing the channel depth from 3 to 512. A 2D max pooling operation is applied at each stage to downsample the spatial dimensions. The resulting compressed representation at the bottleneck has dimensions 8 × 8 × 512, capturing high-level semantic information in a compact form. The decoder mirrors the encoder structure, utilizing transposed convolution layers to upsample the feature maps and gradually restore the spatial resolution. The channel dimensions are symmetrically reduced to reconstruct the image in its original shape. The final output of the decoder is a reconstructed image I ̂ = f recon ( F ), where a sigmoid activation is applied in the last layer to constrain pixel values between 0 and 1.

3.1.4 Training

The objective of the training process is to learn a feature extractor F E that produces representations invariant to image distortions, while preserving semantic information necessary for downstream tasks such as watermarking. The training consists of three components: updating the discriminator D, the feature extractor F E, and the reconstructor R. Given an input image x ∼ p ( x ), and its distorted version x ′ ∼ p T ( x ), we define the following loss functions and update routines.

3.1.4.1 Training the discriminator

The discriminator D is trained to distinguish between features extracted from clean and distorted images. It is optimized using a binary cross-entropy loss:

L D = E x ∼ p x log ⁡ D F E x + E x ′ ∼ p T x log 1 − D F E x ′ . (1)

This objective encourages D to assign high confidence to features extracted from clean images and low confidence to those from distorted images.

3.1.4.2 Training the feature extractor

The feature extractor is trained adversarially to fool the discriminator, making the distributions of F E ( x ) and F E ( x ′ ) indistinguishable. The adversarial loss is given by:

L adv = E x ′ ∼ p T x log 1 − D F E x ′ . (2)

To ensure that the features retain semantic information, the feature extractor is also optimized with a reconstruction loss via the reconstructor R, which reconstructs the input from the features: x ̂ = R ( F E ( x ) ) , x ̂ ′ = R ( F E ( x ′ ) ) . The reconstruction loss is a weighted combination of the Mean Squared Error (MSE) and the Structural Similarity Index (SSIM):

L R = λ S 1 − S S I M x , x ̂ + λ M ‖ x − x ̂ ‖ 2 2 . (3)

This loss is applied to both clean and distorted inputs, enforcing that features from either domain encode sufficient information for image recovery. The overall objective for the feature extractor combines the adversarial and reconstruction losses:where λ D controls the strength of the adversarial term. By minimizing L FE, the feature extractor learns to produce invariant but semantically rich representations.

L FE = λ D ⋅ L adv + L R , (4)

3.1.4.3 Training the reconstructor

The reconstructor R is trained jointly with F E to reconstruct the original image from the learned features. The same loss L R as in Equation 3 is minimized with respect to θ R, the parameters of the reconstructor. This supervision ensures that the features do not collapse to trivial encodings and remain informative. Algorithm 1 describes the proposed adversarial training for invariant feature learning.

Algorithm 1 Noise-adversarial training for invariant feature learning.

3.1.5 Theoretical perspective

The proposed noise-adversarial training framework can be interpreted through two complementary perspectives: the Information Bottleneck (IB) principle (Tishby and Zaslavsky, 2015) and domain adversarial learning (Ganin et al., 2016).

From the perspective of the Information Bottleneck, the learning objective can be viewed as encouraging a representation F that retains information about the underlying image content while reducing sensitivity to distortion. This can be conceptually related to the trade-off:where x denotes the original image and x ′ its distorted version. In our framework, this objective is not optimized explicitly. Instead, the adversarial loss encourages invariance by promoting similarity between feature distributions of x and x ′, while the reconstruction loss encourages the representation to preserve semantically relevant information.

max FE I F , x − β I F , x ′ , (5)

From a domain adversarial learning perspective, the distortion process can be interpreted as inducing a domain shift. The original image x and its distorted version x ′ may be viewed as samples from related domains that share semantic structure but differ in nuisance factors. The adversarial objective encourages the feature extractor to produce representations that are difficult to distinguish across these domains. This can be interpreted as promoting approximate alignment between feature distributions:

E x ∼ p x D F E x ≈ E x ′ ∼ p T x D F E x ′ . (6)

However, enforcing invariance alone may lead to degenerate representations. The reconstruction constraint serves as a complementary mechanism that encourages the learned features to remain informative and structured:thereby discouraging trivial or collapsed solutions. Taken together, these perspectives provide conceptual motivation for the proposed design, suggesting that the combination of adversarial alignment and reconstruction encourages the learning of invariant yet expressive feature representations for robust watermarking.

x ≈ R F E x , x ′ ≈ R F E x ′ , (7)

3.2 Module 2: Learning-based zero-watermarking with invariant feature

In the second module, we present a novel multibit zero-watermarking scheme that leverages the invariant feature representation learned in Module 1. As a zero-watermarking scheme, our method does not modify the original image. Instead, a reference signature is optimized per image-watermark pair such that the semantic content captured by the invariant features can be reliably associated with a binary watermark message.

3.2.1 Feature extraction and encoding

Given an image x, its invariant feature representation F = F E ( x ) ∈ R H × W × C is extracted using the trained feature extractor from Module 1. To reduce the dimensionality and obtain a compact vector form, we apply a transformation function Ψ, composed of global average pooling followed by a fully connected projection, yielding:

F ̃ = Ψ F , F ̃ ∈ R d . (8)

Let W ∈ { 0,1 } k be the target binary watermark message of length k, and let C ∈ R k × d denote a learnable reference signature matrix. The goal is to optimize C such that the inner product between each watermark bit vector C i ∈ R d and the feature vector F ̃ aligns with the corresponding bit W i. The predicted watermark is computed as:where σ ( ⋅ ) is the sigmoid activation function.

W ̂ i = σ F ̃ ⋅ C i , i = 1 , … , k , (9)

3.2.2 Loss function and optimization

To enforce alignment between the predicted watermark W ̂ and the target message W, we minimize a binary cross-entropy loss:

L W = − ∑ i = 1 k W i ⁡ log W ̂ i + 1 − W i log 1 − W ̂ i . (10)

To prevent overfitting and numerical instability, we regularize the reference signature matrix using an L 2 penalty: L C = ‖ C ‖ 2 2 . The overall optimization objective becomes: L total = L W + λ C L C , where λ C controls the regularization strength.

The reference signature C is optimized using gradient descent:where η is the learning rate. This optimization is performed per image-watermark pair during registration and does not involve updating the image or feature extractor. Similarly, the gradient of the total loss L total with respect to the parameters of the fully connected projection in Ψ is used to update the weights of this layer. This allows the transformation function Ψ to adapt to the watermark decoding task while keeping the feature extractor fixed.

C ← C − η ⋅ ∂ L total ∂ C , (11)

3.2.3 Watermark extraction

To extract the watermark, the distorted image is passed through the trained feature extractor and transformation function to yield F ̃ ′ = Ψ ( F E ( x ′ ) ). The predicted watermark is then computed as:

W ̂ i = σ F ̃ ′ ⋅ C i , i = 1 , … , k . (12)

A thresholding step is applied to recover the binary message:

W ̃ i = 1 , W ̂ i ≥ 0.5 , 0 , W ̂ i < 0.5 . (13)

Robust watermark recovery is enabled by the invariance of F E, which ensures that F ̃ ′ ≈ F ̃ even under substantial image distortions. Since the reference signature is optimized in feature space rather than image space, and the image is left unmodified, this approach fully conforms to the principles of zero-watermarking.

3.2.4 Method advantages

A key practical advantage of the proposed framework is its flexibility in associating multiple watermark messages with a single image. Since the reference signature C is optimized in the invariant feature space rather than embedded in the image, it can be independently learned for each pair of image-watermarks without modifying the original image or retraining the feature extractor. In our formulation, a reference signature tensor of size 128 × 128 × 3 is stored for each such pair. This enables a natural one-to-many mapping, where a single image can be linked to multiple watermark identities, each defined by a distinct reference signature. The storage requirement scales linearly with the number of assigned watermarks. During verification, the feature extracted from a query image is compared against candidate reference signatures, and only the correct signature produces a successful match, allowing reliable watermark identification and supporting user-specific ownership or multi-level authorization.

From a theoretical perspective, the proposed approach can be interpreted as solving a constrained optimization problem in the invariant feature space. Given a fixed, distortion-invariant representation F ̃, the training of C seeks to project F ̃ onto a set of learned directional codes { C 1 , … , C k } such that their inner products reflect a target binary vector W. The sigmoid activation and binary cross-entropy loss induce a soft margin between watermark bits, effectively identifying a hyperplane that separates F ̃ ⋅ C i ≥ 0.5 from < 0.5. By minimizing this loss, the solution converges to a directionally optimal configuration of C, tailored to the unique geometry of the input feature. This learning-based formulation generalizes well to unseen transformations, as the optimization finds reference codes that are not just memorized, but robustly aligned with the semantic content captured by F ̃.

Algorithm 2 Zero watermarking and extraction using invariant features.

4 Experimental result

This section presents evaluation of the proposed framework. Section 4.1 describes the datasets and preprocessing and augmentation strategies used for training and evaluation. Section 4.2 analyzes the quality and stability of the learned invariant features, including feature consistency under distortion and the quality of image reconstruction. Section 4.3 compares our method with existing self-supervised feature extractors, such as SimCLR, BYOL, and VICReg, using cosine similarity and linear evaluation metrics to assess feature robustness. Finally, Section 4.4 demonstrates the effectiveness of our learning-based zero-watermarking scheme, providing comparisons with competitive baselines under a range of distortions.

4.1 Dataset and feature training

To evaluate the effectiveness and robustness of the proposed framework, we conducted experiments across multiple datasets, each selected to serve a specific purpose. All images were resized to a resolution of 128 × 128 × 3 and normalized to the range [ 0,1 ] to ensure consistency and stable convergence during training.

For invariant feature learning and analysis (Section 4.2), we used a subset of 40,000 images from the MSCOCO dataset, which contains a diverse range of real-world scenes. To assess generalization, we evaluated the trained models on 5,000 MSCOCO images, as well as 5,000 images each from the Imagenette and Flickr30k datasets. These datasets introduce unseen variations in content and background, helping to validate the stability of the learned representations under domain shifts. Additionally, high-resolution robustness was tested using 900 images from the DIV2K dataset.

For linear evaluation (Section 4.3), we used 10,000 labeled images from the CIFAR-100 dataset to train a downstream classifier on frozen features, and evaluated it on a separate test set of 3,000 images. CIFAR-100 provides a well-established benchmark for assessing semantic discriminability of features across object categories.

The feature extractor was trained using the Adam optimizer with separate learning rates for each component: η FE = 0.0005 for the feature extractor, η D = 0.001 for the discriminator, and η R = 0.0001 for the reconstructor. As shown in Figure 5, the training loss curves indicate stable and consistent convergence across all components of our model. The Discriminator and Reconstructor losses decrease progressively, reflecting improved capability in distinguishing invariant features and reconstructing original content. Meanwhile, the Feature Extractor shows a steady increase in performance, suggesting it is learning more robust and invariant representations over time. The smooth convergence of these loss curves highlights the effectiveness of our training strategy and suggests that the model is becoming more accurate and generalizable.

Since the proposed framework learns and generalizes invariance through input distortions, we apply a range of geometric and photometric transformations during training and testing. Table 1 summarizes the distortion strategies used. Notably, during training, only geometric distortions (e.g., rotation, translation, shear) are applied, while at test time, a broader spectrum of distortions, including blurring, compression, and noise, is introduced. To ensure that image rotation does not result in content loss, we apply a combined rotation and resizing operation that preserves the full image content within the frame.This design enables us to evaluate the generalization capacity of the learned invariant features: although trained only with geometric distortions, the model demonstrates invariance to a wide variety of unseen image processing attacks such as salt-and-pepper noise and JPEG compression.

TABLE 1. Summary of distortions in training and testing.

4.2 Analysis of the proposed invariant feature

To assess the effectiveness of the proposed invariant feature learning framework, we conduct a detailed analysis of feature robustness and reconstruction quality across a variety of datasets and distortions. We divide the distortions into two categories: (1) common image processing distortions, such as blur, noise, and compression, and (2) geometric transformations, such as rotation, translation, and zoom. Our evaluation is performed on four datasets: MSCOCO, ImageNet, Flickr30k, and DIV2K, selected to cover a wide spectrum of image content and resolutions.

To quantify feature invariance, we compute the cosine similarity between the invariant feature vectors extracted from the original image x and a distorted version x ′. A higher similarity indicates stronger invariance to the applied transformation. Quality of the proposed reconstruction is evaluated using the peak signal-to-noise ratio (PSNR) between the original image x and its reconstruction x ̂ from the extracted features. These two metrics together offer a comprehensive view of both the stability and informativeness of the learned representations.

Table 2 reports the cosine similarity and PSNR under common image processing distortions. Despite being trained only with geometric augmentations, the model demonstrates strong generalization to unseen distortions. For instance, cosine similarity remains consistently high under blur and JPEG compression (≥0.93 across all datasets), indicating minimal impact on the feature representation. Gaussian noise and solarization result in modest drops in similarity, while salt-and-pepper noise introduces the largest variation, particularly on MSCOCO (0.92). Notably, Flickr30k and ImageNet show higher resilience to these pixel-level attacks, with cosine similarity values reaching up to 0.96.

TABLE 2. Feature cosine similarity and image reconstruction PSNR under common distortions (mean ± std over 5 runs).

The PSNR scores corroborate the feature analysis. MSCOCO, ImageNet, and Flickr30k achieve high reconstruction fidelity under most distortions, with blur and JPEG yielding PSNR values above 30 dB. In contrast, DIV2K, due to its higher resolution and finer detail, shows more degradation under extreme perturbations, particularly salt-and-pepper noise (27.3 dB) and solarization (26.0 dB). These results confirm that the learned features are both distortion-invariant and semantically expressive across multiple content domains.

Table 3 presents the results under geometric transformations. Rotation shows the highest feature invariance across all datasets (cosine similarity ≥0.95), followed by width and height shifts. Shear and zoom introduce slightly more disruption, with cosine similarity values dropping to 0.91–0.94 for ImageNet and DIV2K. Among geometric distortions, zoom exhibits the most pronounced impact on feature consistency, likely due to scale-dependent feature extraction challenges.

TABLE 3. Feature cosine similarity and image reconstruction PSNR under geometric transformations (mean ± std over 5 runs).

Reconstruction quality remains high for most geometric transformations, with PSNR values frequently exceeding 30 dB. For example, width shift on ImageNet achieves 33.5 dB, while even under rotation, MSCOCO retains a PSNR of 33.5 dB. However, zoom transformations reduce PSNR across all datasets, especially for Flickr30k (28.6 dB), indicating that scale variations affect both the spatial detail and feature structure more than other affine transformations.

The results show that the proposed framework effectively learns invariant features that generalize well to unseen distortions, including common image processing and geometric transformations. This robustness stems from the adversarial training setup, where the generator produces distortion-invariant features that the discriminator cannot distinguish. By aligning features across original and distorted images, the model learns to capture semantic content rather than distortion-specific cues. As a result, the features remain stable even under novel distortions at test time, enabling reliable watermark verification. To demonstrate that these features retain semantic information, reconstruction results are shown in Figure 6.

4.3 Comparative analysis of the proposed invariant feature

To evaluate the robustness and effectiveness of the proposed invariant feature learning framework, we compare it with five representative self-supervised learning (SSL) baselines: SimCLR (Chen et al., 2020), BYOL (Grill et al., 2020), Barlow Twins (Zbontar et al., 2021), Vicreg (Bardes et al., 2021), and VIBCREG (Lee and Aune, 2021). These methods were selected for their strong performance across SSL benchmarks and for covering diverse learning paradigms, including contrastive learning, redundancy reduction, and variance-invariance-covariance regularization. We assess the learned representations along two key axes: (1) feature invariance, i.e., the stability of feature embeddings under distortions, and (2) semantic descriptiveness, i.e., how well the features support classification when linearly probed. These two criteria together offer a comprehensive measure of robustness and utility for downstream watermarking tasks.

4.3.1 Invariant feature similarity

We first evaluate the degree to which each method preserves feature consistency under perturbations. Given an input image and a distorted variant, we extract feature embeddings using each method and compute the cosine similarity between the original and distorted features. A higher similarity indicates stronger invariance to the applied transformation. We test against five common distortions: Gaussian blur, JPEG compression, Gaussian noise, salt and pepper noise, and hue shift.

Although self-supervised learning (SSL) models provide strong general-purpose visual representations, their invariance is primarily driven by predefined augmentations and does not explicitly target distortion-specific variability that affects watermark consistency. As a result, SSL features may still exhibit instability under distortions such as compression, filtering, and geometric transformations.

In contrast, the proposed framework explicitly enforces distortion invariance through adversarial training, which minimizes feature discrepancies between clean and distorted inputs. At the same time, the reconstruction constraint ensures that the learned features retain sufficient semantic information and avoid collapse. This targeted invariance learning leads to more stable and reliable feature representations for multi-bit zero-watermark decoding under diverse distortions.

Table 4 reports the results across four datasets. The proposed method consistently outperforms the SSL baselines across all distortions and datasets. For instance, under Gaussian blur and JPEG compression, our model achieves cosine similarities up to 0.98, demonstrating high resistance to low-level degradations. Even under challenging conditions like salt and pepper noise and hue shifts, our model maintains higher feature consistency than all compared methods. These results validate the effectiveness of our adversarial invariant learning objective in producing distortion-invariant feature embeddings.

TABLE 4. Quantitative comparison of feature invariance (cosine similarity) across SSL methods under diverse distortions on multiple datasets.

4.3.2 Linear evaluation for semantic discriminability

To assess whether the learned features also retain semantic richness, we conduct a linear evaluation protocol. For each SSL method, including ours, we extract features from a frozen encoder and train a linear classifier on 10,000 clean CIFAR-100 training images. The classifiers are then evaluated on distorted test sets from both CIFAR-100 and Imagenette, using the same five distortion types.

Figure 7 presents heatmaps of Top-1 and Top-5 linear classification accuracy across CIFAR-100 and Imagenette under five types of distortions. The proposed method consistently achieves the highest accuracy across both datasets and distortion types, outperforming all compared SSL baselines. For instance, under Gaussian noise, our method achieves a Top-1 accuracy of 75.8% on CIFAR-100% and 82.9% on Imagenette, significantly surpassing the next best performers. Similarly, in the Top-5 evaluation, our method yields 92.0% and 92.8% accuracy under noise on CIFAR-100 and Imagenette, respectively. These results highlight the effectiveness of our approach not only in learning invariant representations but also in preserving semantic discriminability across object classes, making it well-suited for downstream watermarking tasks that demand both robustness and generalization. A sample set of original and distorted images used in these experiments is illustrated in Figure 8.

4.4 Robust zero watermarking

This subsection presents an evaluation of the proposed learning-based zero-watermarking scheme using the invariant features extracted in Module 1. We organize the analysis into three parts. First, we visualize the training dynamics of the reference signature C, including t-SNE projections before and after optimization, and monitor the convergence behavior of the watermark loss over time. Next, we quantify the robustness of the watermarking system across a wide range of image distortions by evaluating bit accuracy under varying transformation intensities. Finally, we compare our method against existing state-of-the-art zero-watermarking and other deep watermarking approaches, highlighting the performance gains achieved by our framework in terms of robustness and stability. While most previous studies have relied on pretrained models to extract features for robust zero-watermarking, we used our own invariant feature model to enhance robustness. Together, these experiments establish the practicality and generalizability of our proposed method. We evaluated the proposed method using binary watermark messages of varying lengths and report results using a 30-bit watermark to align with common practice in the literature and ensure fair comparison with prior work.

4.4.1 Visualization of reference signature learning

To understand the optimization dynamics of the learned reference signature C, we visualize both its geometric evolution in feature space and the corresponding training loss over time. Figure 9 presents two complementary views of this process: the structural arrangement of C via t-SNE projection, and the loss curves from training the watermark for a few representative image-watermark pairs.

As shown in Figure 9, we apply t-distributed Stochastic Neighbor Embedding (t-SNE) to project the high-dimensional reference vectors C ∈ R k × d into two dimensions, both before and after training. Each point represents the projection of one bit vector C i associated with a distorted image. Before training, the projected vectors appear scattered without clear structure, reflecting the random initialization. After optimization, the vectors form distinct and compact clusters in the embedding space. This emergent separation indicates that the learning process successfully aligns the reference signature with the distortion-invariant feature space. Notably, the improved spatial organization mirrors the expected behavior of our theoretical formulation, in which C is optimized to serve as a directional codebook that maximizes the margin between binary watermark bits. The optimization implicitly identifies a hyperplane such that F ̃ ⋅ C i ≥ 0.5 or < 0.5, depending on the bit label, enabling robust watermark recovery through simple dot-product thresholding.

Figure 10 shows the training loss curves over 50 epochs for five randomly selected images. The consistent and monotonic reduction in loss illustrates effective convergence of the reference optimization process, with the steep early drop reflecting rapid alignment with the underlying feature distribution. Together with the t-SNE results, this confirms that the learned signatures not only generalize across distorted views but are also geometrically structured in a way that supports discriminative watermark decoding. These findings reinforce the strength of learning-based watermark representation as a robust alternative to traditional hand-crafted correlation schemes.

4.4.2 Distortion tolerance range

Figure 11 illustrates the Bit Error Rate (BER) performance of the proposed watermarking system under six common example distortions: JPEG compression, Gaussian blur, cropping, Gaussian noise, salt and pepper noise, and hue adjustment. BER is computed as the ratio of incorrectly extracted bits to the total number of embedded bits, expressed as a percentage. All results are averaged over 1,000 test images, each containing a 30-bit binary watermark, resulting in a total of 30,000 evaluated bits per distortion setting.

For JPEG compression, BER consistently decreases as the quality factor improves, confirming strong robustness to compression artifacts. Gaussian blur exhibits a gradual BER increase with higher blur radii, while cropping and hue adjustment maintain relatively low BER values even at high distortion intensities. This indicates that the proposed method effectively preserves watermark integrity under spatial and color-shift perturbations. Noise-based distortions, especially Gaussian noise and salt and pepper noise, introduce relatively more significant degradation, with BER rising sharply under higher noise levels. Nonetheless, the absolute BER values remain low across all cases, ranging from 0.05% to a maximum of 8%, highlighting the overall robustness of the proposed method.

4.4.3 Comparison with existing watermarking methods

Table 5 highlights the key distinctions between the proposed framework and existing approaches. Traditional and deep zero-watermarking methods rely on fixed or task-driven features without explicitly enforcing distortion invariance, resulting in limited robustness under diverse corruptions. SSL-based representations provide general semantic invariance but are not optimized to suppress distortion-specific variability that directly affects watermark signatures.

TABLE 5. Comparison of watermarking paradigms and invariant representation properties.

In contrast, the proposed framework explicitly learns distortion-invariant representations through adversarial alignment between clean and distorted inputs, while a reconstruction constraint preserves semantic structure and prevents feature collapse. This combination enables stable feature representations that generalize beyond the distortions observed during training, providing improved robustness for multi-bit zero-watermarking under diverse real-world conditions.

To quantitatively evaluate the robustness of the proposed watermarking framework, we compare it against several representative models across three categories: (1) deep learning-based watermarking schemes that embed information into the image, (2) feature extractor-based watermarking methods that leverage pre-trained SSL models, and (3) zero-watermarking approaches with deep models. Each comparison focuses on bit-level accuracy or BER under various common distortions.

For a fair comparison, all methods were evaluated using a fixed watermark length of 30 bits per image. Additionally, watermarking embedding was controlled to ensure consistency across methods. In particular, for embedded watermarking schemes, watermarking were applied such that the resulting marked images maintained a PSNR of approximately 40 dB. This constraint was applied to ensure consistent visual quality across all methods, enabling a fair evaluation of robustness under similar imperceptibility conditions. Although some existing methods do not adopt this practice, using their original configurations could result in marked images with varying PSNR levels, leading to an imbalanced comparison. By standardizing the distortion budget, we provide a more objective and controlled benchmarking environment across both embedded and zero-watermarking schemes. In contrast, the proposed method and other zero-watermarking baselines do not alter the original image, preserving its fidelity by design.

Table 6 presents bit accuracy results under a wide range of distortions. We compare our method with HIDDEN (Zhu et al., 2018), a widely used encoder-decoder watermarking scheme, and Luo et al. (2020), which uses adversarial training to improve robustness. Our model consistently achieves the highest accuracy across most transformations, particularly under color-related distortions such as hue and saturation adjustment, where alternative methods degrade significantly. Moreover, our model shows stronger robustness under severe noise (e.g., Gaussian 0.10, Salt and Pepper 0.15), outperforming others by large margins. The average accuracy improvement of our model demonstrates superior generalization across both geometric and photometric distortions.

TABLE 6. Bit accuracy (%) comparison with watermarking models that embed information.

Table 7 compares our framework with two recent methods that utilize pre-trained SSL models for watermark retrieval: Vukotić et al. (2020), which uses convolutional networks, and Fernandez et al. (2022), which employs DINO features. Although these approaches demonstrate strong performance under identity-preserving transformations, they often struggle with heavy attacks and geometric alterations such as rotation or crop. In contrast, our model maintains perfect or near-perfect bit accuracy across all comparison distortions. Notably, under non-differentiable transformations like screenshots, our method preserves 98% bit accuracy, further validating the resilience conferred by our invariant feature learning.

TABLE 7. Bit accuracy (%) comparison with pretrained feature-based watermarking models.

Table 8 reports BER comparisons with a recent deep zero-watermarking method from He et al. (2023). Across several distortion types, including geometric transformations and Gaussian filtering, our method demonstrates competitive robustness and often achieves lower BER than the baseline. In particular, under rotation and scaling, as well as Gaussian filtering, the proposed framework consistently yields improved performance.

TABLE 8. BER (%) comparison across zero-watermarking models.

At the same time, the baseline method performs better under certain distortions, notably JPEG compression and median filtering. In particular, under strong JPEG compression (e.g., quality 30 and 70), the proposed method exhibits higher BER, indicating that although compression artifacts are captured by the learned invariant features, they are not explicitly optimized in the same way as handcrafted or distortion-specific designs. These differences reflect the distinct design principles of the two approaches. Existing methods rely on fixed or handcrafted feature stability, which can be effective under specific distortions such as compression, while our method focuses on learning invariant representations that generalize across diverse transformations, particularly geometric and filtering distortions.

Overall, the results suggest that the proposed invariant feature framework provides a flexible and generalizable representation, achieving strong performance across a wide range of distortions while exhibiting complementary behavior to existing methods.

4.5 Ablation study

To assess the importance of the Reconstructor module R, we conduct an ablation study by removing R from the training pipeline. As discussed in Section 3, R is introduced to prevent feature collapse where the feature extractor learns to produce constant or near-zero outputs that are trivially invariant but devoid of semantic content. Although such collapsed representations may fool the distortion discriminator, they lack the richness necessary to support watermarking or downstream tasks. The reconstructor acts as a semantic regularizer, ensuring that invariant features must still encode sufficient information to reconstruct the input image. This auxiliary constraint discourages degenerate solutions by penalizing high reconstruction error when semantic content is not preserved.

Table 9 shows a substantial drop in both linear classification accuracy (obtained by training a shallow classifier on top of frozen features) and watermark bit accuracy when the Reconstructor is removed. Specifically, linear accuracy drops from 81.67% to 63.31%, and bit accuracy degrades from 96.7% to 68.1%. These declines indicate that the learned features lose both discriminative and semantic structure in the absence of R, which directly impacts its ability to support watermark extraction or classification.

TABLE 9. Reconstructor improves feature semantics and watermark recovery.

To assess feature diversity, we compute the average pairwise cosine similarity between features extracted from different input images across the testing sets. Figure 12 shows heatmaps for models trained with and without the Reconstructor. With the Reconstructor, features exhibit strong diagonal patterns and varied similarities, indicating semantic distinction across inputs. Without it, features become nearly identical, resulting in uniformly high similarity - clear evidence of feature collapse.

To evaluate the role of adversarial training, we compare models trained with and without the adversarial objective while keeping other components unchanged. As shown in Table 10, removing adversarial training leads to a noticeable drop in both linear evaluation accuracy and watermark bit accuracy. This indicates that, without adversarial supervision, the learned features are less robust to distortions and less effective for reliable watermark decoding. In contrast, incorporating adversarial training significantly improves both semantic representation quality and watermark recovery performance, demonstrating its critical role in enforcing distortion-invariant features, preventing feature collapse and ensuring meaningful invariant representations.

TABLE 10. Adversarial training improves feature invariance and watermark recovery.

In addition, these findings empirically validate the theoretical formulation in Equation 5, where the goal is to maximize the mutual information I ( F , x ) between the learned features F and the original image x, while minimizing I ( F , x ′ ) with respect to distorted inputs x ′. The reconstruction loss enforces the first objective by requiring that F retain enough signal to recover x, thereby serving as a proxy for maximizing I ( F , x ). Without R, this semantic pathway is lost, and the model is free to collapse to trivial invariants. Thus, the reconstructor plays an essential role in balancing invariance and informativeness, acting as a critical regularizer for robust and meaningful representation.

4.6 Computational cost and scalability

The proposed framework consists of a ViT-based feature extractor, a discriminator, and a reconstructor. The feature extractor contains approximately 9M parameters, while the discriminator and reconstructor contain approximately 14M and 7M parameters, respectively. Despite the multi-component design, all modules operate on relatively small inputs of size 128 × 128, making training computationally practical. In our implementation, the full training process is conducted on a single GPU (Nvidia RTX 4090) and takes approximately 46 h. The framework can be further scaled by replacing the backbone with larger pre-trained models, without modifying the overall pipeline.

At inference time, only the feature extractor is required for watermark extraction, while the discriminator and reconstructor are used during training only. This significantly reduces the deployment cost and allows efficient inference comparable to standard feature extraction pipelines.

In terms of storage, the framework requires storing a reference signature tensor of size 128 × 128 × 3 for each image–watermark pair. The storage cost is therefore linear in the number of protected samples and depends on the numerical precision used for the stored features.

5 Conclusion

This paper presents InvZW, a deep learning-based framework for robust image zero-watermarking built upon invariant feature learning through noise-adversarial training. Unlike traditional or pretrained feature extractor-based methods, our approach explicitly learns distortion-invariant yet semantically meaningful representations via a combination of adversarial alignment and reconstruction constraints. These representations serve as a stable basis for a novel zero-watermarking scheme, where a binary watermark is associated with a reference signature optimized in the invariant feature space.

We demonstrate that the proposed framework not only achieves high robustness against diverse photometric and geometric distortions, but also enables accurate watermark recovery through a novel flexible embedding mechanism. Extensive evaluations show superior performance over representative deep watermarking methods, including encoder-decoder-based, self-supervised, and zero-watermarking baselines.

While this study focuses on a wide range of simulated digital distortions, future work will involve evaluating the proposed framework under real-world perturbations, such as camera-captured compression artifacts, sensor noise, and image degradations from mobile or embedded devices. This will help validate the framework’s applicability in operational deployment scenarios. The framework will also be extended in the future to video watermarking and real-time applications, as well as incorporating adaptive optimization strategies for signature learning under dynamic distortion environments. Moreover, future evaluations will explore the method’s robustness under more extreme and semantic distortions, such as style transfer and image enhancement, to further assess its generalization in real-world scenarios. The integration of learned invariance and adaptive encoding opens new possibilities for secure, high-fidelity media protection in both static and streaming contexts.

Generative AI statement

The author(s) declared that generative AI was used in the creation of this manuscript. Generative AI tools were used solely for language refinement to improve clarity and grammatical accuracy. All substantive content was originally written by the authors, and the manuscript was carefully reviewed and verified by the authors to ensure accuracy and integrity.

Any alternative text (alt text) provided alongside figures in this article has been generated by Frontiers with the support of artificial intelligence and reasonable efforts have been made to ensure accuracy, including review by the authors wherever possible. If you identify any issues, please contact us.

Publisher’s note

All claims expressed in this article are solely those of the authors and do not necessarily represent those of their affiliated organizations, or those of the publisher, the editors and the reviewers. Any product that may be evaluated in this article, or claim that may be made by its manufacturer, is not guaranteed or endorsed by the publisher.

Footnotes

Edited by: Sri Krishnan, Toronto Metropolitan University, Canada

Reviewed by: Duantengchuan Li, Wuhan University, China

Aakash Varma Nadimpalli, Amazon llc, United States