FiLM-CAM: Keyed Feature Modulation for Conditional-Access Watermarking

Why Conditional Watermarking?

Invisible watermarks are increasingly used to flag AI-generated media and to trace provenance. Organisations often don't want those watermarks to be open to all: they want to control who can embed, read and remove them. Today that means training and shipping a separate private model for every organisation.

We propose FiLM-CAM, a conditional-access image watermarking approach that enforces authorised encoding, decoding and removal through keyed feature modulation. A secret key conditions a Feature-wise Linear Modulation (FiLM) mechanism that transforms the internal representation of the watermark signal before embedding, coupling the payload to the key at the feature level rather than the pixel level. The same key must be presented to the decoder to recover the payload. We train the system to maximise the gap between authorised and unauthorised use, so extraction is reliable under the correct key and fails under incorrect keys.

The encoder is also trained to estimate the watermark residual regardless of whether a watermark is already present. Removal then needs no extra network: re-encode, subtract the residual, and refine iteratively, provided you hold the key. We evaluate FiLM-CAM across multiple encoder–decoder backbones and show that keyed feature modulation is an effective, architecture-agnostic conditional access module (CAM) for image watermarking.

Bit accuracy, correct key

0.99

On COCO, DIV2K and SA-1B, at ~47 dB PSNR

Bit accuracy, wrong key

0.53

Chance level is 0.50: the payload is unreadable

PSNR after authorised removal

57.9dB

COCO; regeneration attacks reach only 21–31 dB

Bit accuracy after wrong-key removal

0.81

The watermark survives an unauthorised removal attempt

Keyed feature modulation

A lightweight Conditional Access Module maps the key to per-channel scale and shift parameters (γ, β) that modulate the embedder bottleneck and the extractor head.

Logit-space composition

The residual is added in an atanh-transformed space with an image-dependent gain. Composing there gives cleaner, more invertible removal than plain pixel addition.

Removal with the same network

The embedder is reused to estimate the watermark residual. With the right key it is subtracted cleanly (≈54–58 dB); with a wrong key the watermark stays decodable.

Method

FiLM-CAM injects the key into the internal features of the embedder and extractor through a Conditional Access Module (CAM). Training proceeds in two stages: key-conditioned embedding and decoding, then key-conditioned removal.

Module

Conditional Access Module

A 100-bit key passes through a 3-layer MLP φ to a 64-d embedding shared by both networks. A linear layer ψ produces channel-wise scale and shift terms, applied at the embedder bottleneck and right before the extractor's prediction head.

\[ \begin{gathered} [\gamma_k,\beta_k]=\psi(\phi(k)) \\ \mathrm{CAM}(F,k)=\gamma_k\odot F+\beta_k \end{gathered} \]

Stage 1

Key-conditioned embedding

A U-Net embedder (13.3M params) and a ConvNeXt-Base extractor are trained with image-quality, message and adversarial losses. Each iteration adds a wrong-key step whose target is an invalid all-zero codeword, widening the authorised/unauthorised gap.

\[ \begin{aligned} \mathcal{L}^{\text{wrong}}_{\text{S1}} = {} & \lambda_{\text{img}}\mathcal{L}_{\text{img}}+\lambda_{\text{adv}}\mathcal{L}_{\text{GAN}} \\ & +\lambda_{\text{sec}}\mathcal{L}_{\text{BCE}}(\hat m',\mathbf{0}) \end{aligned} \]

Stage 2

Key-conditioned removal

A frozen Stage 1 embedder makes the reference residual. A trainable embedder sees the watermarked image and must reproduce it in logit space under the correct key, and shrink it to zero under a wrong key. The two stages alternate in 5-epoch cycles.

\[ \begin{gathered} \mathcal{L}^{\text{corr}}_{\text{S2}}=\lVert\Delta z_{\text{rem}}-\Delta z^\star\rVert_1 \\ \mathcal{L}^{\text{wrong}}_{\text{S2}}=\lVert\Delta z'_{\text{rem}}\rVert_1 \end{gathered} \]

Comparison with State-of-the-Art

With the correct key, FiLM-CAM decodes ~99% of bits at 46.6–48.2 dB PSNR, comparable to or better than state-of-the-art neural watermarking methods. With a wrong key, bit accuracy drops to 0.53–0.55 (chance level is 0.50).

Method	Payload	Bit acc. ↑	PSNR ↑	SSIM ↑	LPIPS ↓

† FiLM-CAM embeds a 100-bit payload, conditioned on a separate 100-bit key. Only the payload is recovered at decoding, and the key is not counted towards capacity. For wrong-key rows, bit accuracy near 0.50 is the desired outcome. “Noise” is the variant trained with the robustness noise layer.

Visual Results

FiLM-CAM outputs on 18 COCO images: cover, watermarked image, image after removal, and the embedding and removal residuals (amplified 10×). Drag the divider to compare two layers.

Cover Watermarked

Conditional Decoding

To measure how strongly unauthorised decoding fails, we report the bit error rate under a wrong key. Higher is better: 50% means the output is indistinguishable from random guessing.

FiLM-CAM is close to that ideal (46–47%). A key-based FNNS baseline still leaks a large part of the payload (23–29% BER). SSL also reaches 50% with a fully wrong carrier, but its accuracy rises steadily as the carrier gets closer to the true one. FiLM-CAM stays near chance up to ~80% key correctness and only recovers the payload once the key is almost exact (figure below).

Key-conditioning is visible in the residuals themselves: the same image and payload embedded under two different keys produce visibly different high-frequency patterns.

Wrong-key BER (%) ↑	COCO	DIV2K
SSL (wrong carrier)	50	50
Key-based FNNS	29	23
FiLM-CAM	47	46

Bit accuracy versus key correctness: SSL rises steadily from 50% to 100%, while FiLM-CAM stays near 50–60% up to 80% key correctness and climbs to 99.5% only as the key becomes fully correct. FiLM-CAM removal PSNR rises from about 55 to 59.5 dB. — **Key correctness.** Bit accuracy as a function of key correctness, the share of query-key bits that match the true key. SSL leaks the payload gradually as the carrier gets closer. FiLM-CAM stays near chance up to ~80% key correctness, then climbs steeply to ~99% for the exact key. Removal PSNR (green, right axis) also improves only as the key approaches the true one.

Embedding residuals for the same image under Key A and Key B differ; removal with the correct Key A reaches 55 dB while wrong keys B, C, D reach 49–50 dB. — **Key-dependent residuals.** Top: embedding the same image with Key A and Key B gives distinct residual patterns (their difference is shown on the right). Bottom: removal with the correct Key A reconstructs the cover at 55 dB. Wrong keys B, C and D leave a residual behind and reach only 49–50 dB.

Watermark Removal

Regeneration-based removal attacks reduce post-removal bit accuracy to chance but reach only 20–31 dB PSNR. With the correct key, FiLM-CAM removes the watermark at 54.0–57.9 dB PSNR in 5 ms. With a wrong key, post-removal bit accuracy stays at 0.78–0.81.

Removal fidelity vs. what's left of the watermark

Each dot is a removal method. Top-left = watermark erased and image intact.

FiLM-CAM, correct key FiLM-CAM, wrong key Removal baselines

Method	Removal PSNR ↑	Post-removal acc.	PSNR gain ↑	Time (ms) ↓

PSNR gain is relative to the watermarked image. For baselines and correct-key FiLM-CAM, post-removal accuracy near 0.50 means the watermark is erased. For the wrong key, higher is desirable: the watermark should survive an unauthorised removal attempt.

Re-Watermarking

Repeatedly embedding new watermarks on top of each other accumulates distortion fast. Embedding, removing and re-embedding (the workflow FiLM-CAM enables) keeps both the watermarked and recovered images close to the original over ten cycles.

Ablations

Variant (DIV2K)	Bit acc. ↑	WM PSNR ↑	Removal PSNR ↑	Post-removal acc. ↓
w/o FiLM (key fed directly)	0.85	36.9	47.3	0.62
w/o gain	0.99	36.0	44.0	0.51
w/o logit space (additive)	0.98	47.0	54.1	0.55
FiLM-CAM	0.99	46.7	55.4	0.54

Without FiLM

Feeding the key directly to the embedder stops training from converging: bit accuracy drops to 0.85 and removal quality to 47.3 dB.

Without the gain

Decoding stays intact, but watermarked and removal quality fall by over 10 dB, and iterative refinement no longer works.

Additive instead of logit space

Embeds just as well but removes less cleanly: 54.1 vs. 55.4 dB on DIV2K, and 55.5 vs. 59.3 dB on COCO.

Alpha sweep: as alpha increases from 0 to 100, extraction bit accuracy rises from 50% to about 99%, embed PSNR rises slightly, removal PSNR decreases from about 150 to 60 dB, and post-removal bit accuracy stays near 50%. — **Watermark strength α.** Larger α raises extraction accuracy to ~99%, while post-removal accuracy stays near chance: the remover still erases the watermark.

Removal PSNR vs. refinement iterations: correct key rises from 58.1 to about 60 dB, surpassing the cover-guided baseline of 59.48 dB; wrong key saturates around 56.4 dB. — **Iterative refinement.** With the correct key, removal PSNR climbs past the cover-guided baseline within a few iterations. A wrong key saturates ~3.5 dB lower.

Encoder–Decoder Backbones

Encoder	Decoder	Ext. acc. ↑	WM PSNR ↑	Rem. PSNR ↑	Post-rem. acc. ↓
MUNIT (TrustMark)	ResNet-50	0.97	41.3	54.0	0.67
FiLM-CAM encoder	ResNet-50	0.96	37.5	43.1	0.67
FiLM-CAM encoder	ConvNeXt-Tiny	0.99	38.6	49.8	0.65
FiLM-CAM encoder	ConvNeXtV2-Base	0.98	38.2	50.5	0.60
FiLM-CAM encoder	ConvNeXt-Base	0.99	46.7	55.4	0.54

DIV2K. The MUNIT row uses TrustMark's encoder, modified to include CAM and logit-space embedding.

Robustness Against Attacks

The noise-trained variant of FiLM-CAM reaches a mean bit accuracy of 96.0% across 21 perturbations on DIV2K, second to PixelSeal (98.0%). The lowest accuracies are under JPEG compression (85.1%) and grayscale conversion (75.7%).

Limitations

Conditional access prevents key-free decoding and key-free reconstructive removal, but not key-free destruction. Overwriting with another key, or strong diffusion-based regeneration, can disable detection without the key, as with learned watermarking in general. Such attacks do not recover the original cover image. Wrong-key removal also only partially preserves the payload (≈0.78–0.81 bit accuracy). A stronger objective could sharpen this asymmetry further.

BibTeX

This research was funded in part by Adobe Research and in part by DECaDE under the UKRI/EPSRC Grant reference EP/T022485/1.