Create a Privacy-Preserving Invisible Image Watermarking System using Concrete ML

[zaccherinij]

Overview

Invisible image watermarking is a technique used to embed hidden information within digital images without visibly altering their appearance. This challenge focuses on implementing this technology using Fully Homomorphic Encryption (FHE), specifically through Concrete ML, to enhance privacy and security in the watermarking process.

The goal is to develop a system that can perform invisible watermarking operations on encrypted images. This approach is particularly relevant in light of recent developments in Generative AI and regulatory efforts like the EU AI Act, which push for reliable digital watermarking of AI-generated content.

FHE could enable a trustless service that allows standardization across all generated images, addressing the growing need for attribution and traceability in GenAI outputs.

Applications include:

• Copyright Protection: Prove ownership.
• Authentication: Verify the authenticity of images based on embedded watermarks.
• Tamper Detection: Identify and localize manipulations.
• Digital Media Tracking: Monitor distribution and usage of images across platforms.

With FHE, all these applications can be performed without exposing the original content to the watermarking service, ensuring privacy and compliance with emerging regulations.

Key Objectives

• Implement invisible image watermarking using FHE techniques.
• Demonstrate the effectiveness of FHE in protecting sensitive image data.
• Balance efficiency and efficacy in encrypted watermark embedding and extraction.

Methodologies

Participants should explore FHE-compatible approaches for image watermarking such as:

• Transform domain techniques (e.g., DWT, DCT, DFT) within the FHE framework.
• FHE-friendly neural network architectures for watermarking.
• LSB (Least Significant Bit) embedding.

While simpler methods like LSB embedding may be easier to implement, their performance under transformations may not be as strong compared to more complex methods, and this will be factored into the evaluation.

What We Expect

Your solution should use Concrete ML to implement an FHE-based invisible watermarking system. Key considerations include:

• Working with smaller image sizes (e.g., 32x32 or 48x48) to manage computational complexity.
• Implementing pre-processing steps on clear data before applying FHE techniques.

We expect your submission to contain:

• A report detailing the method and technical choices you made.
• A notebook demonstrating your model on some images to showcase performance and watermark embedding and extraction accuracy.

Evaluation Criteria

Submissions will be evaluated based on:

• Innovation: The creativity and originality of the approach within the constraints of FHE.
• Performance: Efficiency of the implementation in terms of computational resources and time.
• Clarity: Quality of the report and the notebook, and how well they explain and demonstrate the solution.
• JPEG Robustness: Solutions that handle JPEG compression will be given extra consideration.

Reward

🥇Best submission: up to €5,000.

To be considered the best submission, a solution must be efficient, effective, and demonstrate a deep understanding of the core problem. Alongside technical correctness, it should be submitted with clean code, clear explanations, and comprehensive documentation.

🥈Second-best submission: up to €3,000.

For a solution to be considered the second-best submission, it should be both efficient and effective. While the documentation may not be as exhaustive as the best submission, it should cover the key aspects of the solution.

🥉Third-best submission: up to €2,000.

The third-best submission is one that presents a solution that effectively tackles the challenge at hand, even if it may have certain areas for improvement in terms of efficiency or depth of understanding. Documentation should be present, covering the essential components of the solution.

Reward amounts are decided based on code quality, model accuracy scores, and speed performance on a m6i.metal AWS server. When multiple solutions of comparable scope are submitted, they are compared based on the accuracy metrics and computation times.

Related links and references

• Concrete ML documentation
• Concrete ML repository
• Invisible image watermarking python library
• Deepmind blog
• Meta blog
• Huggingface blog

👉 Register

Step 1: Registration

Click here to register for the Bounty that you want to participate in. Fill out the registration form with your information. Once you fill out the form, you will receive a confirmation email with a link to the submission portal for when you are ready to submit your code.

Note

Check your spam folder in case you don't receive the confirmation email. If you haven't received it within 24 hours, please contact us by email at bounty@zama.ai.

Step 2: Work on the Challenge

Read through the Bounty details and requirements carefully. Use the provided resources and create your own GitHub repository to store your code.
If you have any questions during your work, feel free to comment directly in the Bounty issue and our team will be happy to assist you.

Step 3: Submission

Once you have completed your work, upload your completed work to the submission portal using the link provided in the confirmation email.

Note

The deadline for submission is February 9th, 2025 (23:59 Anywhere on Earth). Late submissions will not be considered.

We wish you the best of luck with the challenge!

✅ Support

• Comment on this issue with any questions regarding this bounty.
• Email for private questions: bounty@zama.ai.
• Join the Zama community channels here.

[pandasamanvaya]

Couple of questions -

• Should the watermark be text/bytes or it should be an image?
• Will the watermark also be encrypted?

[jfrery]

Should the watermark be text/bytes or it should be an image?

The watermark could text / bytes yes as long as it follows the bounty constraints; the watermark should be invisible.

Will the watermark also be encrypted?

You can assume the watermark is not encrypted.

[aaravm]

Is the 32*32 image constraints necessary? My model is working reasonably well with larger images too..

[aaravm]

Also, what are the metrics for evaluation? Is the accuracy to be printed for the watermarked image newly made or the watermark extracted at the end from the watermarked image? @jfrery

[jfrery]

The 32×32 image size isn't strictly required. You can demonstrate your model's scalability with larger images if it maintains FHE functionality. That would be a nice analysis.

Evaluation focuses on two key aspects:

• Watermarked vs original image: The more similar, the better. The watermark should be as invisible as possible.

• Extracted watermark accuracy: Measured both before and after transformations (e.g., JPEG compression)

Performance is assessed based on these metrics, computational efficiency, and code quality.