Watermark similarity restoration on InceptionV3 0.2 NSO cat-ops attack ratio
100Clean SimilarityCANON
Evaluation results
| Method | Links | |||||||
|---|---|---|---|---|---|---|---|---|
| CANONWatermark Scheme=uchida17, Attack Variant=zero2026.03 | 100 | 0 | 0 | — | 39.84 | 100 | 53.91 | |
| CANONWatermark Scheme=uchida17, Attack Variant=clique2026.03 | 100 | 0 | 0 | — | 47.66 | 100 | 53.91 | |
| CANONWatermark Scheme=uchida17, Attack Variant=split2026.03 | 100 | 0 | 0 | — | 56.25 | 100 | 59.38 | |
| CANONWatermark Scheme=uchida17, Attack Variant=mix-opseq2026.03 | 100 | 0 | 0 | — | 50 | 100 | 55.47 | |
| CANONWatermark Scheme=uchida17, Attack Variant=mix-opseq (per-merge-group)2026.03 | 100 | 0 | 0 | — | 50 | 100 | 55.47 | |
| CANONWatermark Scheme=greedy, Attack Variant=zero2026.03 | 100 | 0 | 0 | — | 59.38 | 100 | 57.03 | |
| CANONWatermark Scheme=greedy, Attack Variant=clique2026.03 | 100 | 0 | 0 | — | 57.81 | 100 | 57.03 | |
| CANONWatermark Scheme=greedy, Attack Variant=split2026.03 | 100 | 0 | 0 | — | 51.56 | 100 | 51.56 | |
| CANONWatermark Scheme=greedy, Attack Variant=mix-opseq2026.03 | 100 | 0 | 0 | — | 50.78 | 100 | 52.34 | |
| CANONWatermark Scheme=greedy, Attack Variant=mix-opseq (per-merge-group)2026.03 | 100 | 0 | 0 | — | 46.09 | 100 | 44.53 | |
| CANONWatermark Scheme=lottery, Attack Variant=zero2026.03 | 100 | 0 | 0 | — | 48.44 | 100 | 47.66 | |
| CANONWatermark Scheme=lottery, Attack Variant=clique2026.03 | 100 | 0 | 0 | — | 47.66 | 100 | 47.66 | |
| CANONWatermark Scheme=lottery, Attack Variant=split2026.03 | 100 | 0 | 0 | — | 46.88 | 100 | 46.09 | |
| CANONWatermark Scheme=lottery, Attack Variant=mix-opseq2026.03 | 100 | 0 | 0 | — | 46.88 | 100 | 48.44 | |
| CANONWatermark Scheme=lottery, Attack Variant=mix-opseq (per-merge-group)2026.03 | 100 | 0 | 0 | — | 39.06 | 100 | 45.31 | |
| CANONWatermark Scheme=ipr_gan, Attack Variant=zero2026.03 | 100 | 0 | 0 | — | 50.78 | 100 | 50 | |
| CANONWatermark Scheme=ipr_gan, Attack Variant=clique2026.03 | 100 | 0 | 0 | — | 54.69 | 100 | 50 | |
| CANONWatermark Scheme=ipr_gan, Attack Variant=split2026.03 | 100 | 0 | 0 | — | 51.56 | 100 | 52.34 | |
| CANONWatermark Scheme=ipr_gan, Attack Variant=mix-opseq2026.03 | 100 | 0 | 0 | — | 50 | 100 | 53.91 | |
| CANONWatermark Scheme=ipr_gan, Attack Variant=mix-opseq (per-merge-group)2026.03 | 100 | 0 | 0 | — | 50 | 100 | 53.91 | |
| CANONWatermark Scheme=ipr_ic, Attack Variant=zero2026.03 | 100 | 0 | 0 | — | 55.47 | 100 | 51.56 | |
| CANONWatermark Scheme=ipr_ic, Attack Variant=clique2026.03 | 100 | 0 | 0 | — | 53.91 | 100 | 51.56 | |
| CANONWatermark Scheme=ipr_ic, Attack Variant=split2026.03 | 100 | 0 | 0 | — | 47.66 | 100 | 45.31 | |
| CANONWatermark Scheme=ipr_ic, Attack Variant=mix-opseq2026.03 | 100 | 0 | 0 | — | 59.38 | 100 | 44.53 | |
| CANONWatermark Scheme=ipr_ic, Attack Variant=mix-opseq (per-merge-group)2026.03 | 100 | 0 | 0 | — | 59.38 | 100 | 44.53 | |
| CANONWatermark Scheme=deepsigns, Attack Variant=zero2026.03 | 100 | 0 | 0 | — | 57.81 | 100 | 45.31 | |
| CANONWatermark Scheme=deepsigns, Attack Variant=clique2026.03 | 100 | 0 | 0 | — | 60.94 | 100 | 45.31 | |
| CANONWatermark Scheme=deepsigns, Attack Variant=split2026.03 | 100 | 0 | 0 | — | 55.47 | 100 | 46.88 | |
| CANONWatermark Scheme=deepsigns, Attack Variant=mix-opseq2026.03 | 100 | 0 | 0 | — | 53.91 | 100 | 48.44 | |
| CANONWatermark Scheme=deepsigns, Attack Variant=mix-opseq (per-merge-group)2026.03 | 100 | 0 | 0 | — | 53.91 | 100 | 48.44 | |
| CANONWatermark Scheme=deepipr, Attack Variant=zero2026.03 | 100 | 0 | 0 | — | 40.62 | 100 | 46.88 | |
| CANONWatermark Scheme=deepipr, Attack Variant=clique2026.03 | 100 | 0 | 0 | — | 40.62 | 100 | 46.88 | |
| CANONWatermark Scheme=deepipr, Attack Variant=split2026.03 | 100 | 0 | 0 | — | 40.62 | 100 | 42.19 | |
| CANONWatermark Scheme=deepipr, Attack Variant=mix-opseq2026.03 | 100 | 0 | 0 | — | 40.62 | 100 | 32.81 | |
| CANONWatermark Scheme=deepipr, Attack Variant=mix-opseq (per-merge-group)2026.03 | 100 | 0 | 0 | — | 40.62 | 100 | 32.81 | |
| CANONWatermark Scheme=passport_aware, Attack Variant=zero2026.03 | 100 | 0 | 0 | — | 48.44 | 100 | 49.22 | |
| CANONWatermark Scheme=passport_aware, Attack Variant=clique2026.03 | 100 | 0 | 0 | — | 47.66 | 100 | 49.22 | |
| CANONWatermark Scheme=passport_aware, Attack Variant=split2026.03 | 100 | 0 | 0 | — | 53.91 | 100 | 44.53 | |
| CANONWatermark Scheme=passport_aware, Attack Variant=mix-opseq2026.03 | 100 | 0 | 0 | — | 44.53 | 100 | 50 | |
| CANONWatermark Scheme=passport_aware, Attack Variant=mix-opseq (per-merge-group)2026.03 | 100 | 0 | 0 | — | 44.53 | 100 | 50 | |
| CANONWatermark Scheme=riga21, Attack Variant=zero2026.03 | 96.88 | 0 | 0 | — | 44.53 | 96.88 | 96.88 | |
| CANONWatermark Scheme=riga21, Attack Variant=clique2026.03 | 96.88 | 0 | 0 | — | 44.53 | 96.88 | 96.88 | |
| CANONWatermark Scheme=riga21, Attack Variant=split2026.03 | 96.88 | 0 | 0 | — | 44.53 | 96.88 | 97.66 | |
| CANONWatermark Scheme=riga21, Attack Variant=mix-opseq2026.03 | 96.88 | 0 | 0 | — | 44.53 | 96.88 | 97.66 | |
| CANONWatermark Scheme=riga21, Attack Variant=mix-opseq (per-merge-group)2026.03 | 96.88 | 0 | 0 | — | 44.53 | 96.88 | 97.66 |