# Robust-Wide: Robust Watermarking against Instruction-driven Image Editing

arXiv: https://arxiv.org/abs/2402.12688 · HTML: https://mlsanity.com/paper/2402.12688/

## Key facts

- Cited by 22 papers in the map (data through 14 Oct 2026).
- First posted on arXiv 20 Feb 2024.

## Built on by (most cited first, 22 of 22)

- [Robust Watermarking Using Generative Priors Against Image Editing: From Benchmarking to Advances](https://mlsanity.com/paper/2410.18775/) (2024)
- [OmniGuard: Hybrid Manipulation Localization via Augmented Versatile Deep Image Watermarking](https://mlsanity.com/paper/2412.01615/) (2024)
- [VideoShield: Regulating Diffusion-based Video Generation Models via Watermarking](https://mlsanity.com/paper/2501.14195/) (2025)
- [Mask Image Watermarking](https://mlsanity.com/paper/2504.12739/) (2025)
- [BlurGuard: A Simple Approach for Robustifying Image Protection Against AI-Powered Editing](https://mlsanity.com/paper/2511.00143/) (2025)
- [SuperMark: Robust and Training-free Image Watermarking via Diffusion-based Super-Resolution](https://mlsanity.com/paper/2412.10049/) (2024)
- [Diffusion-Based Image Editing: An Unforeseen Adversary to Robust Invisible Watermarks](https://mlsanity.com/paper/2511.05598/) (2025)
- [Sim-to-Real: An Unsupervised Noise Layer for Screen-Camera Watermarking Robustness](https://mlsanity.com/paper/2504.18906/) (2025)
- [LoT-Pass: Long-term-robust Image Watermarking for Image to Video Generation](https://mlsanity.com/paper/2509.17773/) (2025)
- [RDSplat: Robust Watermarking for 3D Gaussian Splatting Against 2D and 3D Diffusion Editing](https://mlsanity.com/paper/2512.06774/) (2025)
- [Unifying Watermarking via Dimension-Aware Mapping](https://mlsanity.com/paper/2602.03373/) (2026)
- [Rel-Zero: Harnessing Patch-Pair Invariance for Robust Zero-Watermarking Against AI Editing](https://mlsanity.com/paper/2603.17531/) (2026)
- [Removing the Watermark Is Not Enough: Forensic Stealth in Generative-AI Watermark Removal](https://mlsanity.com/paper/2605.09203/) (2026)
- [Are Watermarked Images Editable? SafeMark for Watermark-Preserving Text-Guided Image Editing](https://mlsanity.com/paper/2605.19511/) (2026)
- [Rotation-Invariant Spherical Watermarking via Third-Order SO(3) Representation Coupling](https://mlsanity.com/paper/2605.26702/) (2026)
- [StyleMark: A Robust Watermarking Method for Art Style Images Against Black-Box Arbitrary Style Transfer](https://mlsanity.com/paper/2412.07129/) (2024)
- [SimuFreeMark: A Noise-Simulation-Free Robust Watermarking Against Image Editing](https://mlsanity.com/paper/2511.11295/) (2025)
- [WaTeRFlow: Watermark Temporal Robustness via Flow Consistency](https://mlsanity.com/paper/2512.19048/) (2025)
- [High-Fidelity Face Content Recovery via Tamper-Resilient Versatile Watermarking](https://mlsanity.com/paper/2603.23940/) (2026)
- [AngelFingerprint: A Traceable, Explainable, and White-Box Stealthy Watermark for Text-Guided Image Editing](https://mlsanity.com/paper/2609.04709/) (2026)
- [Disentangle and Drop: Robust Universal Removal of Image Watermarks via Reconstructive Grayscale Residual Decomposition](https://mlsanity.com/paper/2609.31693/) (2026)
- [WARP: A Unified Benchmark for Invisible Image Watermarking -- Robustness and Protection Against Attacks](https://mlsanity.com/paper/2609.40031/) (2026)

## Abstract (arXiv)

Instruction-driven image editing allows users to quickly edit an image according to text instructions in a forward pass. Nevertheless, malicious users can easily exploit this technique to create fake images, which could cause a crisis of trust and harm the rights of the original image owners. Watermarking is a common solution to trace such malicious behavior. Unfortunately, instruction-driven image editing can significantly change the watermarked image at the semantic level, making current state-of-the-art watermarking methods ineffective. To remedy it, we propose Robust-Wide, the first robust watermarking methodology against instruction-driven image editing. Specifically, we follow the classic structure of deep robust watermarking, consisting of the encoder, noise layer, and decoder. To achieve robustness against semantic distortions, we introduce a novel Partial Instruction-driven Denoising Sampling Guidance (PIDSG) module, which consists of a large variety of instruction injections and substantial modifications of images at different semantic levels. With PIDSG, the encoder tends to embed the watermark into more robust and semantic-aware areas, which remains in existence even after severe image editing. Experiments demonstrate that Robust-Wide can effectively extract the watermark from the edited image with a low bit error rate of nearly 2.6% for 64-bit watermark messages. Meanwhile, it only induces a neglectable influence on the visual quality and editability of the original images. Moreover, Robust-Wide holds general robustness against different sampling configurations and other popular image editing methods such as ControlNet-InstructPix2Pix, MagicBrush, Inpainting, and DDIM Inversion. Codes and models are available at https://github.com/hurunyi/Robust-Wide.