An Experimental Study on Image Quality, Robustness, and Border Artifacts in Decoupled RGB Refinement in Diffusion Watermarking

Generative text-to-image models, especially Latent Diffusion Models (LDMs) [2], can now create realistic images from text prompts. As AI-generated images become more widespread, digital watermarking has become an essential technique for copyright protection and content verification. In diffusion models, watermarks can be embedded directly into the latent representations during the generation process. However, diffusion watermarking often faces a fundamental challenge: the trade-off between image quality and extraction robustness. When secret bits are strongly embedded into the latent space, the output image can contain visible noise and lower visual quality. On the other hand, if we apply standard filtering to clean up the image, we risk removing the high-frequency signals needed to extract the watermark correctly after image distortions. To address this issue, recent methods decouple the process [2] by using a post-hoc RGB residual refiner after latent generation. In this work, we conduct an experimental evaluation to study how this decoupled approach performs on unseen datasets and under various distortion attacks. The main parts of our study are: 1) Testing on Four Datasets: We evaluate image quality and watermark extraction on four standard benchmarks (Kodak24, BSD100, DIV2K, and Flickr2K) to see how well the refiner works on different image types. 2) Comparison with Stable Signature: We compare the O256 + Refinement framework with Meta AI’s Stable Signature [1] under 11 common image attacks (such as JPEG compression, blur, noise, and filtering). 3) Analysis of Border Artifacts: We study the spatial error distribution in the refined images, identify an 8-pixel border error caused by zero-padding, and test how changing the clamping parameter affects overall quality.

A.Traditional watermarking methods embed hidden information into spatial pixels or frequency transforms. With deep learning, end-to-end encoder-decoder networks, such as HiDDeN [3] and StegaStamp [4], showed that neural networks can learn to hide secret bits inside images and recover them after differentiable distortions like noise and JPEG compression. Fig. 1: Overview of the evaluated two-stage watermarking workflow. B. Watermarking in Diffusion Models Recently, researchers have introduced watermarking into diffusion generation. Tree-Ring watermarking [5] embeds key patterns into the initial noise vector in the Fourier domain. Zhao et al. [6] studied training recipes for diffusion watermarks. Another prominent method is Stable Signature [1], which fine-tunes the VAE decoder weights using a pre-trained extractor so that every generated image carries a hidden message. Other frameworks, such as O256, embed watermarks in the latent space and use a lightweight post-processing refiner in pixel space to recover image quality. C. Image Quality and Perceptual Metrics Evaluating watermarked images requires measuring both pixel fidelity and structural similarity. Standard metrics include Peak Signal-to-Noise Ratio (PSNR), Structural Similarity Index (SSIM) [8], and Learned Perceptual Image Patch Similarity (LPIPS) [7]. In residual refinement, it is important to observe whether local pixel changes affect overall image appearance or introduce localized errors near image boundaries.

The evaluated watermarking framework has two main stages: latent diffusion watermarking (O256) followed by a post-hoc RGB Residual Refiner (Rθ), as shown in Fig. 1. A. O256 Latent Watermarking Stage In the first stage, a secret binary message m ∈ {0, 1}k (such as 32 or 64 bits) is encoded into the initial latent noise. Guided by the text prompt, the reverse diffusion process denoises the latent representation to produce watermarked latent z0. The VAE decoder D then converts this latent vector into an initial RGB image: Ibase = D(z0) (1) Because the latent space is modified to make the watermark robust, the base image Ibase has visible noise and lower quality, typically around 22.97–25.56 dB PSNR and 0.65–0.71 SSIM. B. RGB Residual Refinement Stage To improve image quality without retraining the entire diffusion model, a lightweight convolutional network called the RGB Residual Refiner Rθ is applied in pixel space. The refiner takes Ibase as input and predicts a small residual adjustment map ∆I: ∆I = Rθ(Ibase) (2) To make sure the refiner does not erase the embedded watermark signals, the predicted adjustments are bounded using a clamping parameter (max delta = 0.50): ∆Iclamped = clamp(∆I, −0.50, 0.50) (3) The final output is Irefined = clip(Ibase +∆Iclamped, 0, 1). This step raises image quality up to 32.44–34.79 dB PSNR across test sets. C. Attack Testing and Watermark Extraction To test how well the watermark survives distortions, the refined image Irefined is passed through various attack layers A(·), such as JPEG compression, Gaussian blur, noise, and dropout. Then, a pre-trained extractor network E reads the distorted image and predicts the secret message: mˆ = E(A(Irefined)) (4) We measure the extraction performance using Bit Accuracy (BA %), which is the percentage of bits correctly recovered compared to the original message m.

A. Experimental Setup • Datasets: We test on four standard image datasets: Kodak24 (24 images), BSD100 (100 images), DIV2K (100 images), and Flickr2K (500 images), all resized to 256 × 256 pixels. • Evaluated Methods: We compare three setups: (1) Meta AI’s Stable Signature [1], (2) Baseline O256 (without refinement), and (3) O256 + Refinement (with post-hoc RGB refiner). • Attack Layers: We test 11 non-geometric attacks: JPEG compression (Q = 30, 40, 50), Gaussian blur (σ = 2, 3, 4), Gaussian noise, median filtering (w = 5), salt-and-pepper noise, and dropout (Paper_Dropout_r03). • Evaluation Metrics: Image quality is measured by PSNR (dB), SSIM [8], and LPIPS [7]. Watermark robustness is measured by Clean Bit Accuracy and Average Non-Geometric Bit Accuracy (Avg BA %). TABLE I: Performance Comparison Across 4 Benchmark Datasets. Dataset Method PSNR SSIM Clean BA Avg BA Min BA Stable Signature 32.52 0.8931 99.83% 71.19% 50.61% Kodak24 (24) O256 (Base Model) 25.56 0.7162 99.87% 98.28% 88.54% O256 + Refiner 34.04 0.9834 100.00% 98.52% 89.06% Stable Signature 32.56 0.9019 99.60% 71.47% 50.50% BSD100 (100) O256 (Base Model) 24.68 0.6610 100.00% 98.41% 90.16% O256 + Refiner 34.79 0.9874 99.94% 98.59% 90.97% Stable Signature 32.29 0.9130 99.50% 72.75% 51.02% DIV2K (100) O256 (Base Model) 22.97 0.6690 100.00% 98.26% 87.22% O256 + Refiner 32.51 0.9747 99.72% 98.14% 87.19% Stable Signature 32.34 0.9123 99.51% 72.70% 50.34% Flickr2K (500) O256 (Base Model) 22.99 0.6547 99.99% 98.05% 85.33% O256 + Refiner 32.44 0.9750 99.80% 98.09% 86.33% TABLE II: Per-Attack Bit Accuracy Breakdown (%) on Kodak24. and > 0.97 SSIM across all four datasets, while main-taining high watermark extraction accuracy (> 98%). 2) Robustness across Attack Types: As detailed in Table II, we categorize the 11 distortion attacks into three distinct groups to better understand model behaviors: • Compression Attacks (JPEG Q30, Q40, Q50): Both O256 variants maintain near-perfect accuracy (> 99.2%), whereas Stable Signature shows slight degradation at lower quality factors (88.11% at Q30). • Smoothing and Filtering (Gaussian Blur, Median Fil-ter): Stable Signature experiences significant drops under heavy blur (55.64%–63.54%), while O256 retains 100.00% extraction, indicating that latent embedding provides stronger resilience to spatial smoothing. • Noise and Dropout Perturbations: Stable Signature handles random pixel dropout effectively (99.74%) but drops near random guessing (50.61%) under Gaussian noise. Conversely, O256 + Refinement achieves 97.92% on Gaussian noise and 89.06% on dropout.

Besides measuring average quality across the whole image, we also look at how errors are distributed spatially. As illustrated in Fig. 2, the base model shows diffuse watermark noise, while the refined image displays restored textures along with a distinct localized boundary effect. A. The 8-Pixel Border Error When we divide images into an outer 8-pixel border and an interior center region, we find that the MSE at the border is consistently higher than in the center across all four datasets (Fig. 3(a)): • Kodak24: Border MSE = 1.64 × 10−3 vs. Interior MSE = 0.26 × 10−3 (7.50×). • BSD100: Border MSE = 1.34 × 10−3 vs. Interior MSE = 0.22 × 10−3 (6.60×). • DIV2K & Flickr2K: Border MSE reaches 1.99 × 10−3 and 1.86 × 10−3 (4.99× and 4.72×). This indicates that the border error is not an isolated occurrence on a single dataset, but rather a consistent spatial pattern present across different resolutions and image distributions. B. Zero-Padding in Convolutional Layers This border error is mainly related to the standard zero-padding (padding=1) in the 5-layer convolutional refiner. Because zero values are padded around the image edges, feature signals near boundaries gradually fade across deeper layers. When max delta = 0.50, the refiner outputs larger pixel corrections near the edges, creating visible border bands as shown in Fig. 2(e). C. Effect of Clamping max delta As shown in Fig. 3(b), if we try to reduce the border artifact by lowering max delta from 0.50 to 0.25 or 0.10, the border MSE decreases slightly, but the overall image PSNR drops sharply from 33.5 dB to 27.3 dB and 24.5 dB. This indicates that simple threshold clamping is not enough to solve border errors without sacrificing overall image quality.

In this paper, we presented an experimental evaluation of the O256 RGB-refined diffusion watermarking framework. Our tests on Kodak24, BSD100, DIV2K, and Flickr2K show that adding a post-hoc RGB refiner effectively improves the visual quality of base O256 images while preserving high watermark extraction accuracy across 11 distortion attacks. In addition, our spatial analysis examined an 8-pixel border error caused by convolutional zero-padding and discussed the trade-off of threshold clamping. These results provide useful experimental observations for understanding decoupled watermarking models in diffusion systems.