Image watermarking methods are not tailored to handle small watermarked areas. This restricts applications in real-world scenarios where parts of the image may come from different sources or have been edited. We introduce a deep-learning model for localized image watermarking, dubbed the Watermark Anything Model (WAM). The WAM embedder imperceptibly modifies the input image, while the extractor segments the received image into watermarked and non-watermarked areas and recovers one or several hidden messages from the areas found to be watermarked. The models are jointly trained at low resolution and without perceptual constraints, then post-trained for imperceptibility and multiple watermarks. Experiments show that WAM is competitive with state-of-the art methods in terms of imperceptibility and robustness, especially against inpainting and splicing, even on high-resolution images. Moreover, it offers new capabilities: WAM can locate watermarked areas in spliced images and extract distinct 32-bit messages with less than 1 bit error from multiple small regions - no larger than 10% of the image surface - even for small $256\times 256$ images.

翻译：现有图像水印方法难以有效处理小范围水印区域，这限制了其在部分图像可能来自不同来源或经过编辑的实际场景中的应用。本文提出一种用于局部化图像水印的深度学习模型，称为Watermark Anything Model（WAM）。WAM嵌入器对输入图像进行不可感知的修改，而提取器则将接收到的图像分割为含水印区域与无水印区域，并从已识别的水印区域中恢复一个或多个隐藏消息。模型在低分辨率且无感知约束条件下进行联合训练，随后通过后训练实现不可感知性与多重水印能力。实验表明，WAM在不可感知性和鲁棒性方面与现有先进方法相比具有竞争力，尤其针对修复与拼接攻击，即使在高分辨率图像上亦表现优异。此外，该模型具备新功能：WAM能够定位拼接图像中的水印区域，并从多个不超过图像表面积10%的小区域（即使在$256\times 256$的小尺寸图像上）提取不同的32位消息，且错误率低于1比特。