TML 2026 · Task 4, Watermark Forgery, team_V

Forging image watermarks by scheme identification and native re-encoding. This repository is a self-contained package that reproduces our best leaderboard submission and documents how we got there. It ships only what is needed, no virtual-environments and no large model repositories.

Best public score: S_final = 0.8553 (all eight schemes forged by native re-encoding).

---

The task

For each of 8 unknown watermarking schemes WM_1..WM_8 we are given 25 watermarked carrier images that all carry one shared hidden message. We must transplant that watermark onto 25 assigned clean target images (different images, true transplantation) so that a hidden detector reads the message, while keeping each image perceptually close to its target. WM_k maps to targets 25(k−1)+1 .. 25k.

The score is S_final = S_det · S_qlt, with S_det = max(0, 2·(bitacc − 0.5)) and S_qlt = exp(−8·LPIPS). LPIPS is measurable locally; bit-accuracy is not (there is no public detector), so the only detection signal is the leaderboard (1 submission / 60 min, best-kept, 30% public).

Our approach in one line

Identify each scheme, then re-embed the recovered message with the scheme's own genuine encoder so the forgery is a real watermark (bit-accuracy 1.0, and it generalizes). A blind additive transplant fails on frequency-domain and content-adaptive marks. We identified all 8 schemes; the eighth (WM_3) took longest, a content-adaptive learned mark that resists the averaging attack, but it is ArtificialGANFingerprints (a StegaStamp autoencoder), which we identified by decode-consistency and re-embed with the matching encoder.

What we did for each watermark

All eight forges are genuine native re-encodes, so they decode at high bit-accuracy (1.0 for the seven with public decoders, 0.96 mean for WM_3) and generalize across the public/private split. With WM_3 now native, the remaining gap to the top of the board is the quality and robustness of the public encoders, not a missing scheme.

---

Reproduce the best submission (one command, offline)

pip install -r requirements.txt
python3 build_best.py
# -> submissions/candidate_best.zip   (200 flat PNGs, 1.png..200.png)

build_best.py needs the 200 clean targets under data/extracted/clean_targets/ (for the WM_1 residual amplification and the per-scheme LPIPS table) and the eight native forges under forged_native_masked/. All eight forges, WM_3 included, are already frozen there, so the script simply loads them, amplifies WM_1 at s=1.5, assembles the 200 images, validates the flat-zip contract, and prints the per-scheme LPIPS / S_qlt table. To re-derive the WM_3 forge from scratch, run python3 encoders/afgf_wm3_encode.py (self-contained, auto-downloads the AFGF weights; reproduces the frozen forged_native_masked/WM_3/ byte-for-byte).

Submit it

echo "TML_API_KEY=<your key>" > .env
python3 -m src.submit submissions/candidate_best.zip --yes

Endpoint POST http://34.63.153.158/submit/22-forging-task; 1 submission / 60 min, best-kept. Leaderboard: http://34.63.153.158/leaderboard_page. Provide your own API key, none is bundled, and the .env file is git-ignored.

Without --yes, src/submit.py performs a dry run that validates the zip and the key but does not submit.

---

What's in this repository

build_best.py            # the reproduce script (one command, offline)
requirements.txt         # pip dependencies (numpy, torch, torchvision, lpips, Pillow, ...)
fetch_data.py            # optional: re-download the full course dataset from Hugging Face
report/report.pdf        # the report (approach + results); report.tex is the LaTeX source
HOW_WE_GOT_HERE.md       # readable narrative of the strategy, what worked, and what didn't
EXPERIMENT_LOG.md        # full experiment & decision log: every submission, number, and lesson
src/wmforge.py           # core forging library + the WM_1/2/7 encoders/decoders
src/submit.py            # leaderboard submit + score reader (dry-run by default)
encoders/                # how each native forge was produced; afgf_wm3_encode.py is self-contained
forged_native_masked/    # the 8 native forge outputs (25 PNGs each), inputs to build_best.py
data/extracted/          # clean_targets (200) + watermarked_sources/WM_3 (25 carriers)

Not included (large artifacts)

To keep the package light we omit the per-scheme model repositories (*_repo), all virtual-environments, the full data/Dataset.zip, alternate candidate submissions, and the AFGF checkpoints (auto-downloaded by encoders/afgf_wm3_encode.py). All eight native forges are already frozen under forged_native_masked/, so build_best.py runs offline with just the clean targets. Run python3 fetch_data.py to download all eight schemes' carriers if you want to re-derive the native forges from scratch with the encoders/ scripts.

Start with HOW_WE_GOT_HERE.md for the narrative, EXPERIMENT_LOG.md for the full log, and report/report.pdf for the write-up.