PatchSeal: A Robust and Intangible Image Watermarking Framework for AIGC

Abstract

The rapid growth of artificial intelligence-generated content (AIGC) has created serious challenges for image copyright protection, since semantic edits and deep-fake manipulations can easily erase or distort embedded watermarks. Traditional robust watermarking methods, which are mainly designed to resist pixel-level distortions such as noise, compression or filtering, often fail when faced with content-level transformations generated by AIGC models. This paper presents PatchSeal, a robust and intangible image watermarking framework that combines multi-targeted and attention-oriented embedding with a focus-oriented masking. The proposed framework introduces a segmentation-assisted embedding strategy that distributes watermark bits across several prominent regions to improve resilience to semantic changes. An attention-based module, composed of a subject extraction branch and a channel weighting branch, adapts to the encoder towards texture-rich and semantically stable regions, improving both invisibility and robustness. Experiments conducted in three public object data sets show that PatchSeal achieves an average PSNR of 43.13 dB and a bit precision of 92.98 percent under various AIGC editing conditions, surpassing representative methods such as MBRS and FIN. These results demonstrate the effectiveness of the proposed method in resisting AIGC-driven manipulations and provide new practical paths and methodological insights for the design of robust watermarks in the AIGC era.

1. Introduction

The exponential growth of online image creation and sharing has increased the need for reliable copyright protection and traceability of origin. Invisible digital watermarking remains a practical and widely adopted solution because it preserves perceptual quality while enabling a post-hoc verification under common image processing operations. However, the rapid emergence of AI-generated content (AIGC), especially the image generation based on diffusion and instruction-based editing, has brought new challenges. These models perform semantic transformations that fundamentally change content structures, textures and spatial layouts, thus invalidating many of the robust assumptions underlying classical watermarking systems.

Recent learning-based watermarking research has significantly advanced robustness against pixel-level distortions through end-to-end encoder–noise–decoder optimization and improved distortion modeling. These approaches have evolved from training with real and simulated JPEG compression [1], to incorporating screen-shooting simulation layers that approximate perspective and illumination variations [2], and to adopting decoder-driven architectures that tightly couple embedding and extraction [3]. Meanwhile, the integration of watermarking with generative models has opened new possibilities, including watermarking within diffusion pipelines [4,5], latent-space watermarking [6], and tamper localization via embedded marks [7]. Formal robustness has also been strengthened through certified guarantees against removal and forgery attacks [8]. Despite these advances, most existing methods remain optimized for pixel-level or mildly geometric distortions and still degrade under semantic edits. Moreover, techniques that rely on white-box access to generators or editors are often impractical in real-world deployment scenarios, where editing platforms are typically black-box systems.

This paper targets robustness under AIGC-driven image editing as the primary threat model. We present a practical and imperceptible watermarking framework, PatchSeal, designed to withstand semantic transformations while maintaining high visual quality. The proposed framework distributes redundant watermark bits across multiple semantically meaningful regions using a multi-target dispersed embedding strategy and dynamically adjusts embedding strength through attention-guided masking. This design ensures that watermark information remains recoverable even when portions of an image are locally or globally modified. The framework is fully compatible with standard end-to-end training and does not require access to the internal parameters of proprietary editors.

The main contributions of this work are summarized as follows. First, a multi-target dispersed embedding strategy is introduced to allocate watermark redundancy across content-aware regions, reducing the risk of information loss under semantic edits. Second, an attention-guided masking module is developed to emphasize salient structures and texture-rich areas, improving both invisibility and robustness during recovery. Third, a comprehensive evaluation under instruction-driven editing and composite distortions demonstrates higher bit accuracy and comparable or better perceptual quality than representative baselines such as MBRS [1], PIMoG [2], and DeEND [3]. Additional studies also discuss complementarity with diffusion-integrated watermarking [5,6] and certified defenses [8], and include ablation experiments that clarify how semantic dispersion and attention mechanisms jointly enhance robustness.

The remainder of this paper is organized as follows. Section 2 reviews related work on learning-based watermarking and AIGC image editing. Section 3 presents the proposed framework, including the overall architecture, object-level embedding strategy, and attention-guided masking module. Section 4 reports experimental results in terms of perceptual quality, robustness, and ablation analysis, followed by discussions on limitations and future directions. Finally, Section 5 concludes the paper.

2. Related Works

Deep image watermarking has progressed from codec-specific heuristics to end-to-end learning frameworks that explicitly incorporate distortion modeling. The encoder–noise–decoder paradigm has become the mainstream design, enhancing robustness against non-differentiable distortions such as JPEG compression through a combination of real and simulated corruptions [1]. Further improvements have been achieved by disentangling forward and backward propagation [9] and by embedding or recovering watermarks in latent representation spaces such as self-supervised features [10] and implicit neural representations [11]. These studies suggest that curriculum design and distortion modeling, rather than handcrafted features, play a decisive role in robustness. However, existing pipelines mainly learn invariance to parameterized pixel-level perturbations and still perform poorly under semantic edits or large distribution shifts.

In real-world scenarios, geometric transformations and black-box channels remain major challenges. Screen-to-camera pipelines can be modeled through trainable layers that capture perspective, illumination, and moiré patterns, improving recovery after physical capture [2]. Recent research has introduced synchronization templates and relocking mechanisms to ensure consistency in video and camera-recorded content [12,13,14]. Geometry-aware models further improve immunity by combining wide-baseline alignment with local non-affine correction through deformable operators and attention mechanisms [15,16]. These approaches enhance practical robustness but depend on heavy simulation and complex training curricula, which increase computational cost and instability. Moreover, they do not effectively address semantic re-synthesis, such as object replacement or layout rewriting, which has become a common form of manipulation in AI-generated content (AIGC).

The rapid emergence of diffusion-based image generation and editing has shifted research from pixel-level perturbations to semantic integrity and proactive forensics [17]. EditGuard [7] unifies tamper localization and copyright tracing within a single diffusion pipeline. Latent-space watermarking [6] and diffusion-integrated watermarking [5] improve the balance between fidelity and robustness, while certified watermarking [8] provides formal guarantees against removal or forgery. Diffusion-aware strategies have also been extended to neural radiance fields and Gaussian-based representations [18,19,20,21], achieving better generalization across modalities. Despite these advances, many frameworks still rely on white-box access to the generator or restrictive norm-bounded assumptions, which limit their generalization to open-ended instruction-driven editing. Existing methods also offer limited coverage across diverse editors and editing intents, leaving a gap between generative robustness and practical deployment.

In parallel, deepfake protection research has evolved from post-hoc detection to proactive and traceable watermark-based defense [22]. Identity-aware watermarking and separable decoding enable reliable provenance tracing and semi-fragile localization [23]. Decoder-driven training, multi-source tracing, and dual-defense strategies further expand robustness against adaptive removal attacks [3,24,25]. Video-oriented pipelines report improved synchronization and strong resistance to screen capture [12,13]. Despite such progress, most methods still focus on pixel or geometric distortions and lack resilience to semantic transformations introduced by AIGC. Motivated by these limitations, this work introduces a generator-free watermarking framework that improves robustness under semantic transformations while preserving high perceptual quality. By embedding redundant payloads into semantically stable and texture-rich regions with lightweight synchronization, the method achieves a balanced trade-off among robustness, localizability, and deployability for practical watermarking in AIGC-driven environments.

3. Proposed Approach

This section presents PatchSeal, a robust image watermarking framework that maintains perceptual fidelity and remains reliable under semantic transformations and AI-generated content (AIGC) edits. The framework integrates three coordinated components: (i) object-level redundant embedding that disperses the payload across multiple salient regions, (ii) an attention mask generation module that modulates embedding strength in a content-aware manner, and (iii) localization with geometric rectification prior to decoding. The architecture follows an encoder, noise, decoder, and critic design together with a differentiable distortion curriculum that supports cross-editor generalization and stable training. The design provides concrete mechanisms and measurable guarantees, including an exponential reduction in failure probability as the number of object-level embeddings increases and an explicit perceptual budget controlled by the attention mask, with formal analysis provided later.

3.1. System Overview and Design Principles

Let $I_{\mathrm{co}}\in {\mathbb{R}}^{3\times H\times W}$ denote a cover image and $M\in {\{0,1\}}^L$ denote the watermark bits. The encoder E produces an embedded image $I_{\mathrm{en}}=E(I_{\mathrm{co}},M)$. A composite channel $\mathcal{C}$ acts on $I_{\mathrm{en}}$ and yields an attacked image $I_{\mathrm{no}}=\mathcal{C}\left(I_{\mathrm{en}}\right).$ The channel comprises three categories of disturbances: non-geometric perturbations such as JPEG compression, Gaussian blur, additive noise, pixel drop, and color jitter; geometric transformations such as rotation, cropping, and scaling; and AIGC edits that may partially regenerate or replace regions. The decoder D reconstructs an estimate $\widehat{M}=D\left(I_{\mathrm{no}}\right).$

PatchSeal is low-overhead and editor-agnostic. It leverages semantic structural invariance rather than editor-specific gradients. In the embedding phase, the Segment Anything Model (SAM) generates multiple object masks. Their centroids are expanded to form embedding masks that guide E to distribute watermark bits across several regions, which improves resistance to localized AIGC edits. During retrieval, a lightweight U²-Net detector predicts watermark regions and compensates geometric distortions prior to decoding.

Figure 1 summarizes the pipeline. The system includes an encoder E, a decoder D, a noise layer $\mathcal{T}(·)$ used during training, and a critic C. The attention mask $A_M$ regulates embedding to meet a perceptual budget, while $\mathcal{T}(·)$ samples randomized perturbations to improve robustness against diverse degradations. In contrast to methods that backpropagate through specific editors [5,9], PatchSeal relies on the structural stability of salient regions together with the distortion curriculum to limit editor-specific overfitting and reduce training cost, while maintaining cross-editor generalization [1,2,4].

3.2. Object-Level Embedding and Redundancy Design

Conventional schemes often embed a single global watermark, which is fragile when large semantic areas are regenerated or replaced [1]. PatchSeal adopts an object-level redundant embedding strategy that distributes an identical payload across K object-centric regions, which increases the survival probability under semantic edits [4].

As shown in Algorithm 1 [4], given a cover image $I_{\mathrm{co}}$, a segmentation backbone such as the Segment Anything Model (SAM) produces disjoint binary masks ${\left\{x_o^{\left(k\right)}\right\}}_{k=1}^K$. For each mask $x_o$, the centroid $(x_c,y_c)$ is computed from image moments.

$$\begin{array}{ccc}{m}_{00}=\sum _{(x,y)}{x}_o(x,y),\hfill & \hfill m_{10}=\sum _{(x,y)}x{x}_o(x,y),\hfill & \hfill m_{01}=\sum _{(x,y)}y{x}_o(x,y)\end{array}$$

(1)

$$\begin{array}{c}(x_c,y_c)=\left({\displaystyle \frac{m_{10}}{m_{00}}},{\displaystyle \frac{m_{01}}{m_{00}}}\right)\end{array}$$

(2)

A fixed-size patch centered at $(x_c,y_c)$ is cropped and used for embedding the message M.

Algorithm 1 Object-Level Dispersed Embedding [4] (PatchSeal)

Require: Cover image $I_{\mathrm{co}}$, message M, SAM, encoder $E_{{\theta }_E}$ Ensure: Watermarked image $I_{\mathrm{en}}$  ${\left\{x_o^{\left(k\right)}\right\}}_{k=1}^K\leftarrow \mathrm{SAM}\left(I_{\mathrm{co}}\right)$  for $k=1$ to K do     Compute $(x_c,y_c)$ from $x_o^{\left(k\right)}$ via image moments     Crop a fixed-size cover patch $x_{\mathrm{co}}^{\left(k\right)}$ centered at $(x_c,y_c)$     $x_{\mathrm{en}}^{\left(k\right)}\leftarrow E_{{\theta }_E}\left(x_{\mathrm{co}}^{\left(k\right)},M\right)$     Replace the corresponding region in $I_{\mathrm{co}}$ with $x_{\mathrm{en}}^{\left(k\right)}$  end for  return $I_{\mathrm{en}}$

Under independent block failures with probability $p_e^{\star }$, the probability that all K embedded instances fail satisfies

$$P_{\mathrm{fail}}\le {\left(p_e^{\star }\right)}^K,$$

(3)

which yields an exponential improvement as K increases. Placing patches near object interiors increases the chance that at least one instance remains intact when backgrounds are replaced or partially regenerated. Majority voting across recovered instances is performed at detection time (see Section 3.5), which further reduces the effective failure probability.

3.3. Attention Mask Generation Module

Embedding strength should adapt to local semantics and textural complexity. Different regions exhibit uneven tradeoffs between imperceptibility and robustness: signals injected into smooth backgrounds are more visible and are easily removed by background replacement, whereas signals placed inside semantically stable object interiors persist longer. To address this heterogeneity, an Attention Mask Generation Module (AM) adaptively regulates both the location and the strength of embedding. As shown in Figure 2, AM comprises two cooperative subnetworks: a Body Extraction Network (BEN) that estimates spatial subjectness and a Channel-Wise Weighting Network (CWN) that modulates feature channels. Their outputs are fused into a unified attention tensor that guides content-aware embedding.

3.3.1. Spatial Subjectness Extraction (BEN)

BEN assigns higher importance to object interiors and lower importance to backgrounds to concentrate watermark energy where semantic stability is high and visual sensitivity is low. The network adopts a ResNet-50 encoder-decoder without fully connected layers. The input cover patch is encoded into multi-scale features ${\left\{F_i\right\}}_{i=1}^5,F_i\in {\mathbb{R}}^{h_i\times w_i\times c_i}$. For efficiency, higher-level features $\{F_3,F_4,F_5\}$ are retained and compressed to 64 channels by two $3\times 3$ convolutions to form the decoder input. The decoder performs three upsampling and fusion stages to produce a soft spatial map $\mathrm{BodyMask}\in {[0,1]}^{h\times w}$ with larger values in object interiors.

Supervision uses a distance transform derived from a binary object mask $M_{\mathrm{obj}}$. For each pixel p inside the object,

$$D\left(p\right)=\underset{q\in {\Omega }_{\mathrm{bg}}}{\min }{\parallel p-q\parallel }_2,$$

(4)

followed by normalization to $[0,1]$. BEN is trained with

$${\mathcal{L}}_{\mathrm{BEN}}=\mathrm{BCE}\left(\mathrm{BodyMask},{\mathrm{BodyMask}}_{\mathrm{gt}}\right),$$

(5)

which establishes a reliable spatial prior for embedding.

3.3.2. Channel-Wise Weighting (CWN)

CWN refines embedding strength along the channel dimension. A $3\times 3$ Conv-BN-ReLU stem maps the cover patch to a 64-channel representation that is processed by four squeeze-and-excitation blocks. These blocks capture inter-channel dependencies and generate adaptive gates according to perceptual tolerance and texture richness. High-frequency or complex responses receive larger weights, while responses associated with smooth or salient areas are suppressed. After an additional Conv-BN-ReLU and a sigmoid function $\sigma (·)$, CWN outputs a gating tensor

$$\mathrm{WeightMask}=\sigma \left(f_{\mathrm{CWN}}\left(x_{\mathrm{co}}\right)\right)\in {[0,1]}^{h\times w\times c}.$$

(6)

3.3.3. Mask Fusion and Feature Modulation

Spatial and channel attentions are fused element-wise:

$$\mathbf{A}=\mathrm{WeightMask}\odot \mathrm{expand}\left(\mathrm{BodyMask}\right),$$

(7)

where $\odot$ denotes the Hadamard product and $\mathrm{expand}(·)$ broadcasts $\mathrm{BodyMask}$ to the channel dimension. Let $\Phi (·)$ be a learnable message carrier aligned with the cover patch. With an embedding budget $\lambda >0$, the attention-modulated embedding is

$$x_{\mathrm{en}}=x_{\mathrm{co}}+\lambda \mathbf{A}\odot \Phi \left(x_{\mathrm{co}},M\right).$$

(8)

This concentrates energy in semantically stable and perceptually tolerant regions and provides an explicit upper bound on distortion,

$${\parallel x_{\mathrm{en}}-x_{\mathrm{co}}\parallel }_2=\lambda {\parallel \mathbf{A}\odot \Phi (·)\parallel }_2\le \lambda {\parallel \Phi (·)\parallel }_2,$$

(9)

which links the attention mechanism to a controllable perceptual budget.

3.4. Watermarking Architecture and Distortion Modeling

PatchSeal adopts an encoder-decoder-critic design with a stochastic distortion layer used during training, following recent robust watermarking systems [1,2]. The encoder $E_{{\theta }_E}$ maps a cover image $x_{\mathrm{co}}$ and a message M to an embedded image

$$x_{\mathrm{en}}=E_{{\theta }_E}(x_{\mathrm{co}},M).$$

A critic $C_{{\theta }_C}$ encourages natural appearance of $x_{\mathrm{en}}$. The decoder $D_{{\theta }_D}$ reconstructs the message from a distorted input $x_{\mathrm{no}}$.

3.4.1. Fidelity and Adversarial Objectives

The encoder is trained to preserve pixel fidelity and structural similarity:

$${\mathcal{L}}_{E1}=\mathrm{MSE}\left(x_{\mathrm{co}},E_{{\theta }_E}(x_{\mathrm{co}},M)\right)+\alpha \left(1-\mathrm{SSIM}\left(x_{\mathrm{co}},E_{{\theta }_E}(x_{\mathrm{co}},M)\right)\right),$$

(10)

with $\alpha >0$. Adversarial learning uses a binary cross-entropy form. The critic minimizes

$${\mathcal{L}}_C=-{\mathbb{E}}_{x_{\mathrm{co}}}\left[\log C_{{\theta }_C}\left(x_{\mathrm{co}}\right)\right]-{\mathbb{E}}_{x_{\mathrm{co}},M}\left[\log \left(1-C_{{\theta }_C}\left(E_{{\theta }_E}(x_{\mathrm{co}},M)\right)\right)\right],$$

(11)

while the encoder maximizes the critic response on embedded images through

$${\mathcal{L}}_{E2}=-{\mathbb{E}}_{x_{\mathrm{co}},M}\left[\log C_{{\theta }_C}\left(E_{{\theta }_E}(x_{\mathrm{co}},M)\right)\right].$$

(12)

The decoder is trained with a reconstruction objective

$${\mathcal{L}}_D=\mathrm{MSE}\left(M,D_{{\theta }_D}\left(x_{\mathrm{no}}\right)\right).$$

(13)

3.4.2. Differentiable Distortion Curriculum

A differentiable noise layer $\mathcal{T}$ is inserted between $E_{{\theta }_E}$ and $D_{{\theta }_D}$ during training to expose the encoder-decoder pair to diverse degradations without relying on editor-specific gradients. Given $x_{\mathrm{en}}$, the distorted input is

$$x_{\mathrm{no}}=\mathcal{T}\left(x_{\mathrm{en}}\right)=\mathcal{T}\left(E_{{\theta }_E}(x_{\mathrm{co}},M)\right).$$

(14)

At each iteration, $\mathcal{T}$ samples a randomized composition of non-geometric distortions (JPEG compression, Gaussian blur, additive noise, color jitter, pixel drop) and geometric distortions (rotation, cropping, resizing, padding, picture-in-picture). Distortion intensities are drawn from predefined ranges to form a lightweight curriculum that improves generalization without explicit backpropagation through any editor pipeline [9]. This design encourages invariance to a broad spectrum of real-world degradations while maintaining stable optimization.

3.5. Watermark Localization and Optimization Strategy

Dispersed embedding creates uncertainty in both the location and the number of watermark instances. A detector $D_t$ based on the U²-Net architecture is employed to predict a binary mask $M_p$ that indicates candidate watermark regions in an attacked image $I_{\mathrm{no}}$. To support arbitrary resolutions, $I_{\mathrm{no}}$ is padded and partitioned into tiles of size $(H_t,W_t)$. Each tile is processed independently, and the tile-level masks are merged to obtain a full-resolution prediction.

The detector is trained to achieve accurate coverage and sharp boundaries. The objective combines pixel-wise binary cross-entropy with an overlap term:

$${\mathcal{L}}_{D_t}=\mathrm{BCE}\left(M_p,M_g\right)+\beta \left(1-\mathrm{IoU}\left(M_p,M_g\right)\right),$$

(15)

where $M_g$ is the ground-truth mask, $\mathrm{IoU}$ denotes intersection-over-union, and $\beta >0$ balances region fidelity and boundary accuracy. The use of $1-\mathrm{IoU}$ ensures that minimizing ${\mathcal{L}}_{D_t}$ increases the overlap.

For each connected component of $M_p$, an affine transform ${\widehat{\mathcal{A}}}_j$ is estimated to align the predicted region to the canonical embedding geometry. The rectified patch is obtained by inverse warping, ${\tilde{x}}_{\mathrm{no}}^{\left(j\right)}={\widehat{\mathcal{A}}}_j^{-1}\left(I_{\mathrm{no}}\right),$ and is fed to the decoder to recover a local message estimate, ${\widehat{M}}_j=D_{{\theta }_D}\left({\tilde{x}}_{\mathrm{no}}^{\left(j\right)}\right).$ A majority vote over $\left\{{\widehat{M}}_j\right\}$ yields the final reconstruction $\widehat{M}$, which compensates for partial detection errors and local corruptions. The geometric rectification step improves decoder stability by reducing spatial misalignment before bit extraction.

The overall training objective balances imperceptible embedding, adversarial realism, message fidelity, detection accuracy, and attention supervision:

$$\mathcal{L}={\lambda }_1{\mathcal{L}}_{E1}+{\lambda }_2{\mathcal{L}}_{E2}+{\lambda }_3{\mathcal{L}}_D+{\lambda }_4{\mathcal{L}}_{D_t}+{\lambda }_5{\mathcal{L}}_{\mathrm{BEN}},$$

(16)

with ${\lambda }_i>0$. Segmentation and centroid estimation scale as $O\left(HW\right)$. Embedding or extracting K patches scales linearly with K. Tiled detection introduces an additional factor of $\lceil H/H_t\rceil \lceil W/W_t\rceil$.

From a probabilistic standpoint, redundant embedding over K object-centric regions yields $P_{\mathrm{fail}}\le {\left(p_e^{\star }\right)}^K$, under independent per-region failures with rate $p_e^{\star }\in (0,1)$, which explains the exponential reduction in decoding failure as K increases. The attention mechanism enforces a perceptual budget through the bound established in Section 3.3,

$${\parallel x_{\mathrm{en}}-x_{\mathrm{co}}\parallel }_2\le \lambda {\parallel \Phi (x_{\mathrm{co}},M)\parallel }_2,$$

(17)

and geometric rectification ensures that small affine estimation errors translate into bounded perturbations at the decoder input.

4. Performance Evaluation

We evaluate PatchSeal with two goals. The first is visual fidelity. The second is robustness under classic corruptions, AIGC edits, and composed pipelines that reflect practice. We use strong baselines and standard saliency datasets. We report complete settings for reproducibility and follow a simple protocol so that results are easy to verify and compare.

4.1. Experimental Setup and Metrics

(1) Datasets: Experiments use DUTS [26], DUT-OMRON [27], HKU-IS [28], and PASCAL-S [29]. Training draws 10,553 images from DUTS-TR and 5168 from DUT-OMRON. A validation split holds out 1000 images from DUTS-TR and 500 from DUT-OMRON. The remaining 9553 and 4668 images form a 14,221-image training set. Generalization is evaluated on the DUTS test split, HKU-IS, and PASCAL-S, which are disjoint from training. During training, saliency masks are used to prompt SAM and obtain object masks. Centroids are computed and expanded to define embedding regions. For local edits, 100 ImageNet images are used to paste patches with random rotation and scale. LaMa [30] performs inpainting under irregular, rectangular, and saliency masks. For instruction-driven global edits, the editor in [31] is employed.

(2) Evaluation setup: All models are implemented in PyTorch 2.2.2 and trained on Ubuntu 20.04 with an Intel Xeon Platinum 8352V CPU, an NVIDIA RTX 4090 GPU with 24 GB memory, and 90 GB system memory. Optimization uses AdamW with learning rate $1\times {10}^{-4}$. The encoder fidelity loss ${\mathcal{L}}_{E1}$ balances MSE and SSIM with coefficient $\alpha =0.005$. Global loss weights follow the formulation in Section 3.5: ${\lambda }_1=0.2$, ${\lambda }_2=0.001$, and ${\lambda }_3=1$. The attention mask loss weight is set to ${\lambda }_5=32$. The detector loss ${\mathcal{L}}_{D_t}$ uses $\beta =0.1$. For the embedding network, the input patch size is $128\times 128$. The number of embedded instances equals the number of non-overlapping salient masks. Training runs for 125 epochs with a batch size of 64. For the detection module, the input is $512\times 512$ with 100 training epochs and batch size 12.

(3) Metrics: Fidelity is measured by PSNR and SSIM. Recovery reliability is measured by bit accuracy (BA).

PSNR and MSE:

$$\mathrm{PSNR}=10{\log }_{10}\left({\displaystyle \frac{{\mathrm{MAX}}_I^2}{\mathrm{MSE}}}\right),\mathrm{MSE}={\displaystyle \frac{1}{N}}\sum _{i=1}^N{\left(I_{\mathrm{co}}\left(i\right)-I_{\mathrm{en}}\left(i\right)\right)}^2.$$

SSIM:

$$\mathrm{SSIM}(x,y)={\displaystyle \frac{(2{\mu }_x{\mu }_y+c_1)(2{\sigma }_{xy}+c_2)}{({\mu }_x^2+{\mu }_y^2+c_1)({\sigma }_x^2+{\sigma }_y^2+c_2)}}.$$

Bit accuracy:

$$\mathrm{BA}={\displaystyle \frac{1}{L}}\sum _{i=1}^L\mathbb{I}\left({\widehat{w}}_i=w_i\right),$$

where L is the message length, $w_i$ is the i-th bit, and ${\widehat{w}}_i$ is its estimate.

4.2. Visual Fidelity

As shown in Figure 3, the visual results and residual maps on DUTS, HKU-IS, and PASCAL-S indicate that PatchSeal concentrates small perturbations in texture-rich or low-saliency areas and avoids structural artifacts. In contrast, MBRS and ARWGAN exhibit boundary chroma noise and CIN produces mild blur. Quantitatively, PatchSeal achieves the highest PSNR and SSIM on all test sets. Averaged over the three datasets, the PSNR exceeds MBRS, ARWGAN, and CIN by 10.71 dB, 6.01 dB, and 1.54 dB, and the SSIM is higher by 0.1902, 0.0396, and 0.0085. On PASCAL-S, the scores reach 44.38 dB and 0.9951, which implies negligible perceptual deviation. The behavior aligns with the design: object-level dispersed embedding limits the spatial footprint and reduces global distortion, and attention-guided masks place bits within semantically stable and visually tolerant regions. A minor limitation appears in low-texture scenes with strong edges, where residual energy along edge bands can increase slightly while remaining sub-perceptual. This can be mitigated by down-weighting edge bands in the attention mask or adding edge-preserving regularization.

4.3. Robustness Evaluation

All robustness tests are read jointly to provide a unified view of performance. Table 1 reports three groups: Part A for single distortions, Part B for AIGC edits, and Part C for composed pipelines.

(1) Single distortions. PatchSeal is strongest overall, with pronounced gains under rotation, padding, and picture-in-picture. Detector-guided relocking, together with dispersed redundancy, supplies alignment cues when geometry changes. Small gaps appear where CIN leads on Gaussian noise and resize, and ARWGAN leads on crop. These cases suggest stronger scale-equivariant augmentation and anti-aliasing filters during training.

(2) AIGC editing. Part B considers local paste and inpainting at two strengths and a global instruction-driven edit. PatchSeal keeps BA above 90% for all local edits and is clearly better on the global edit. Object-aware dispersion preserves redundancy across salient instances and attention masks emphasize semantically stable regions. These choices matter most when edits alter content rather than only pixels.

(3) Composed pipelines. Part C evaluates compositions that are closer to practice. PatchSeal achieves the highest average BA across all compositions, with a larger margin when rotation is present. JPEG followed by inpainting is harder: PatchSeal is slightly below MBRS and ARWGAN by 1.16% and 0.66%. Compression weakens low-amplitude cues before mask-based removal. Pre-compression regularization and feature-level anchors may help. Averaged over all compositions, PatchSeal improves upon MBRS, ARWGAN, and CIN by $+14.92\%$, $+3.67\%$, and $+16.38\%$.

Table 1. BA (%) ↑ under single distortions, AIGC edits, and composed pipelines.

A. Single distortions	MBRS	ARWGAN	CIN	PatchSeal
None	97.49	100.00	99.99	99.90
JPEG (Non-Geom.)	96.13	97.68	95.88	98.49
Gaussian Blur (Non-Geom.)	97.04	99.28	99.76	99.78
Gaussian Noise (Non-Geom.)	97.38	99.32	99.88	99.83
Drop (Non-Geom.)	96.64	98.17	96.57	98.84
Color Adjust (Non-Geom.)	97.30	95.71	99.54	99.86
Rotation (Geom.)	69.19	86.89	68.23	93.93
Crop (Geom.)	67.79	99.26	99.70	94.60
Padding (Geom.)	69.40	91.95	92.32	97.79
Picture in Picture (Geom.)	58.35	94.41	93.52	96.42
Resize (Geom.)	97.41	95.50	98.10	96.13
B. AIGC editing	MBRS	ARWGAN	CIN	PatchSeal
Paste (20%)	93.85	93.82	95.22	97.11
Paste (35%)	88.88	89.55	93.83	93.31
Inpaint (20%)	93.65	93.10	83.14	95.56
Inpaint (35%)	91.37	90.63	77.36	90.29
Global Edit	77.62	82.58	73.26	88.64
C. Composed pipelines	MBRS	ARWGAN	CIN	PatchSeal
JPEG + Gaussian Blur	95.39	96.13	95.24	97.64
JPEG + Rotation	68.69	86.26	67.31	86.59
Rotation + Resize	69.03	84.97	67.87	90.34
JPEG + Inpaint	92.19	91.69	78.76	91.03
Rotation + Inpaint	66.78	82.77	65.66	85.16
Inpaint + Global Edit	76.06	78.96	70.52	87.25
JPEG + Rotation + Inpaint	66.27	80.60	66.84	84.74

Note. Non-Geom. denotes intensity-only distortions with fixed coordinates (JPEG, blur, noise, pixel drop, color adjust). Geom. denotes geometric transforms that change alignment (rotation, crop, padding, resize, picture-in-picture). AIGC editing includes local Paste/Inpaint (20%/35% edited area) and a Global Edit. Composed pipelines apply operations in the listed order. Entries are BA (%) as in Section 4.1; higher is better.

Table 1. BA (%) ↑ under single distortions, AIGC edits, and composed pipelines.

A. Single distortions	MBRS	ARWGAN	CIN	PatchSeal
None	97.49	100.00	99.99	99.90
JPEG (Non-Geom.)	96.13	97.68	95.88	98.49
Gaussian Blur (Non-Geom.)	97.04	99.28	99.76	99.78
Gaussian Noise (Non-Geom.)	97.38	99.32	99.88	99.83
Drop (Non-Geom.)	96.64	98.17	96.57	98.84
Color Adjust (Non-Geom.)	97.30	95.71	99.54	99.86
Rotation (Geom.)	69.19	86.89	68.23	93.93
Crop (Geom.)	67.79	99.26	99.70	94.60
Padding (Geom.)	69.40	91.95	92.32	97.79
Picture in Picture (Geom.)	58.35	94.41	93.52	96.42
Resize (Geom.)	97.41	95.50	98.10	96.13
B. AIGC editing	MBRS	ARWGAN	CIN	PatchSeal
Paste (20%)	93.85	93.82	95.22	97.11
Paste (35%)	88.88	89.55	93.83	93.31
Inpaint (20%)	93.65	93.10	83.14	95.56
Inpaint (35%)	91.37	90.63	77.36	90.29
Global Edit	77.62	82.58	73.26	88.64
C. Composed pipelines	MBRS	ARWGAN	CIN	PatchSeal
JPEG + Gaussian Blur	95.39	96.13	95.24	97.64
JPEG + Rotation	68.69	86.26	67.31	86.59
Rotation + Resize	69.03	84.97	67.87	90.34
JPEG + Inpaint	92.19	91.69	78.76	91.03
Rotation + Inpaint	66.78	82.77	65.66	85.16
Inpaint + Global Edit	76.06	78.96	70.52	87.25
JPEG + Rotation + Inpaint	66.27	80.60	66.84	84.74

Note. Non-Geom. denotes intensity-only distortions with fixed coordinates (JPEG, blur, noise, pixel drop, color adjust). Geom. denotes geometric transforms that change alignment (rotation, crop, padding, resize, picture-in-picture). AIGC editing includes local Paste/Inpaint (20%/35% edited area) and a Global Edit. Composed pipelines apply operations in the listed order. Entries are BA (%) as in Section 4.1; higher is better.

4.4. Ablations and Multi-Target Dispersion

Three design factors are assessed: the dispersion strategy, the attention masks, and the number of embedded watermarks. Results indicate that PatchSeal benefits from object-aware placement and moderate redundancy, with consistent gains in imperceptibility and recovery.

(1) Dispersion strategy. Replacing object-aware dispersion with random placement (PatchSeal-R ) reduces BA by 1.11% under non-geometric corruptions, with a 3.87% drop on Drop. Under geometric changes, BA falls by 2.73% on Crop. For AIGC edits the gap widens: BA decreases by 2.48% on Paste, by 4.51% on Inpaint, and by 6.86% for the Global edit. These trends are consistent with how edits interact with image content. Drop and crop often affect borders, while salient instances tend to occupy central regions. Random dispersion places bits near vulnerable edges. Object-aware dispersion concentrates payload inside salient instances, which preserves synchronization and reduces exposure to content removal.

(2) Attention masks. Removing attention masks weakens both fidelity and robustness on DUTS. PatchSeal-N attains PSNR 42.05, SSIM 0.9887, and BA 95.97, compared with 42.78, 0.9915, and 96.66 for PatchSeal. Attention guides embedding toward texture-rich and semantically stable regions. This lowers visible residue and improves survival under resampling and edits. The effect size in PSNR and SSIM is modest but consistent, and translates into a measurable BA gain of 0.69%.

(3) Number of watermarks. The number of embedded instances varies from one to four on the DUTS test set (Figure 4). With one watermark, PSNR and SSIM are 43.68 dB and 0.9931. As the number increases, PSNR decreases by 6.87% from one to two, by 3.24% from two to three, and by 2.74% from three to four. With four instances, the scores remain at 38.28 dB and 0.9805. Redundancy improves recovery: Two watermarks raise BA by about 3% over one, and BA is at least 98% with three. A slight BA dip at four suggests overlap and mask boundary effects. Considering fidelity, robustness, and deployment cost, embedding two or three dispersed instances are a sound operating point.

Across all ablations, object-aware dispersion and attention-guided placement are the primary contributors to the observed improvements. They confine energy to perceptually tolerant regions, maintain alignment after edits, and deliver higher BA without visible artifacts.

4.5. Discussion and Limitations

PatchSeal improves fidelity and robustness under classic corruptions, AIGC edits, and composed pipelines. Gains are most visible when geometry changes, which indicates that object-aware dispersion and detector relocking provide stable alignment cues. Two residual challenges are discussed.

Small gaps appear on Gaussian noise, resize, and crop where CIN or ARWGAN are slightly higher. A likely cause is a mismatch between the training distortions and the high-frequency statistics of these tests. Resampling can also introduce anti-aliasing that suppresses low-amplitude signals. JPEG followed by inpainting is harder. Compression weakens residuals and mask-guided inpainting removes local structure, which limits relocking. A broader curriculum with scale-aware augmentation and resampling-aware filters can help. Pre-compression regularization, invariant anchors in the detector, and inpainting-aware training are also promising. Pairing compression with semantic removal during training is expected to raise the worst case.

Dispersed embedding works well on medium and large targets, but performance on small objects can drop. Capacity is limited and edits affect a larger fraction of the object, so cues become fragile. Mild edge-band residuals are observed in low-texture scenes with strong contrast. These remain sub-perceptual but indicate sensitivity near mask boundaries. In practice many images exceed 1080p and contain richer texture, which changes embedding strength, local aliasing, and detector confidence. Future work includes scale-aware dispersion, adaptive per-instance payloads, and masks that avoid thin structures. Additional steps include edge-preserving regularization and boundary smoothing, multi-resolution pyramids during training, evaluation at native resolution, and a study of memory and latency trade-offs to balance capacity, imperceptibility, and synchronization in realistic settings.

5. Conclusions and Future Work

This paper studies the impact of AIGC image editing on watermark robustness and presents PatchSeal, which combines multi-target dispersed embedding with attention-guided placement. SAM provides object masks for embedding and U2-Net supports accurate localization during retrieval, while inverse transforms relock geometry. Experiments on DUTS, DUT-OMRON, and HKU-IS show higher PSNR and SSIM and higher bit accuracy than strong baselines under single and composed attacks. Visual evidence and ablations support the mechanism and show that perturbations remain imperceptible. Future work will expand the distortion curriculum with stronger instruction-driven editors, screen-camera capture, and longer pipelines. We will study scale-aware dispersion for small objects, edge-preserving regularization, and adaptive weights that downplay fragile regions. We also plan certified robustness analysis, tighter capacity control, latency reduction, and broader benchmarks to support fair and reproducible comparison.