Digital visual transmission and watermark protection of intangible cultural heritage art images based on the HAIWAN method

Every time an image of a shadow puppet, an embroidered festival costume, or a hand-glazed ceramic ornament travels across the internet, it faces a gauntlet of invisible assaults. Platforms compress it to save bandwidth, filters sharpen it for small screens, users crop it for social media posts, and screen-capture tools strip away the metadata that once identified it. For artworks tied to intangible cultural heritage — designs, glazing, textures, and styles that carry the authenticity of cultural expression — these composite distortions do more than degrade picture quality. They erode the ability of museums, galleries, and heritage institutions to prove who owns the digital copy. A new study published in Discover Artificial Intelligence proposes a two-layer artificial intelligence framework that tackles this problem from both sides: it attacks watermarks harder than ever during training, then hides copyright marks so robustly that they survive the onslaught.

The research, authored by Yukun Zhang of the Academy of Fine Arts at Weinan Normal University in China, addresses a fundamental tension in digital heritage protection. Watermarks must be imperceptible, because any visible alteration to dense patterns, delicate local decorations, or stylistic structures compromises both the aesthetic value and the cultural authenticity of the artwork. Yet watermarks must also be robust, because real-world transmission subjects images to platform compression, cropping, filtering, noise enhancement, and re-photography. If only robustness is emphasized, embedding disturbances can damage the fine local structures that make heritage art distinctive. If only invisibility is emphasized, the watermark quickly fails once the image is disseminated. Traditional watermarking schemes, the study argues, have never adequately modeled the full composite distortion distribution that heritage images actually encounter online.

Zhang’s solution begins with an attack simulator called the Hybrid-Adaptive Image Watermark Attack Network, or HAIWAN. Current protection methods typically rely on differentiable attack layers — simplified mathematical stand-ins for real transmission distortions — but these layers fail to capture the nonlinear, composite, and highly concealed nature of actual online interference. HAIWAN is designed as an independent strong-sample generator, deliberately separated from the watermark embedding backbone. During training, it continuously produces difficult attack samples that expand the distortion distribution the protection model must withstand. Crucially, because HAIWAN is excluded from the embedding and extraction processes during inference, it expands the training disturbance distribution without adding any computational cost to the deployed system.

Technically, HAIWAN reorganizes three components into a unified attack-generation path. First, a local stability enhancement unit — the Fast and Precise Block — applies residual feature updates while eliminating batch normalization, preserving the continuity of shallow perturbation features without heavy computational overhead. This architecture strengthens the network’s perception of local texture patterns, watermarks, and subtle texture correlations, which matters enormously for heritage artworks with dense patterns and delicate local ornaments. Second, parallel dilated convolution branches with multiple dilation rates replace continuous downsampling, expanding the receptive field while preserving the image’s main structure and capturing perturbation patterns at different spatial scales simultaneously. Third, constrained decoding and residual reconstruction convert the aggregated features into a deep perturbation residual that is added directly to the watermarked image. The result is an attack sample that retains recognizable structure — a weighted peak signal-to-noise ratio of 35.72 decibels and a structural similarity of 0.9187 — while inflicting maximum damage on watermark recovery.

How effective is this attack? Zhang compared HAIWAN against two baseline attack algorithms, WatermarkAttacker and WEvade, under unified inputs and consistent evaluation procedures. On three representative test images, HAIWAN produced bit error rates ranging from 18.18 to 20.98 percent and normalized correlation values from 75.21 to 77.97 percent — meaning it caused greater watermark extraction errors than either competitor. Notably, the normalized correlation values remained above 0.75, showing that substantial watermark correlation was preserved and the watermark was not completely removed. This is precisely the point: HAIWAN is not built as a weapon to strip watermarks from published images, but as a training adversary that generates difficult samples so the protection model learns to survive them. In cross-method generalization tests, HAIWAN maintained stronger destructive capability across different watermarking techniques, with bit error rates ranging from 0.5014 against a conventional DWT-DCT scheme to 0.3529 against the study’s own protection model — evidence that its multi-scale disturbance modeling interferes with both embedding traces and recovery features across diverse watermark mechanisms.

The second layer of the framework is the HAIWAN-guided Dual-domain Robust Blind Watermarking Protection model, abbreviated HDRB-WP. Rather than perturbing the full spatial domain — which risks irreversible damage to detail regions in texture-sensitive heritage images — the model exploits a dual-domain carrier built from the luminance channel. The luminance component retains principal intensity and contour information even after compression and screen recapture, so the low-frequency subband of the discrete wavelet transform provides a structurally stable embedding region. Within that subband, the discrete cosine transform maps the carrier into frequency-domain coefficients, allowing coefficient-level regulation of embedding modifications. This combination improves resistance to compression and filtering while reducing concentrated modification of the texture-sensitive regions that define heritage art.

Inside HDRB-WP, a Channel Attention Embedding Unit performs joint channel-spatial recalibration to decide where copyright information should be written. Channel attention emphasizes frequency-band information most relevant to copyright embedding, while spatial attention selects positions better suited to carrying hidden perturbations — effectively steering the watermark away from key decorative regions of the artwork. The embedding network then completes copyright writing through residual updates governed by an embedding strength coefficient. On the extraction side, a blind decoding network takes the dual-domain representation as input, uses residual feature enhancement as its core, and recovers the copyright mark under strong perturbation without requiring the original image. Training is driven by a joint optimization objective balancing image fidelity — measured with both pixel-level deviation and the perceptual LPIPS metric — watermark recovery through binary cross-entropy, adversarial constraints from a discriminator that pushes watermarked images to be indistinguishable from originals, and a robustness penalty computed over the full attack distribution.

The performance numbers are striking. The complete HDRB-WP model reduced the watermark bit error rate to 0.0169 and achieved watermark detection accuracy of 98.68 percent, outperforming the invertible-network IWRN scheme, which recorded 0.0284 and 97.26 percent respectively, and the single-encoder dual-decoder SEDD scheme. Under five conventional attack types — JPEG 50 compression, Gaussian noise, 3×3 median filtering, 10 percent cropping, and screen recapture — HDRB-WP controlled bit error rates within 0.0622 to 0.1119 on representative samples, while IWRN reached 0.1212 to 0.2248. The gap was most pronounced under screen recapture conditions, the scenario that most closely mimics real-world heritage image dissemination through display-camera recapture. Ablation experiments confirmed that every module contributes: removing the residual enhancement block degraded recovery accuracy, removing the dual-domain branch hurt both visual quality and recovery, and removing either the channel or spatial recalibration branch of the attention unit measurably weakened performance.

Perhaps the most compelling evidence for the attack-simulation approach comes from the guided training gain analysis. Before HAIWAN-guided training, HDRB-WP’s bit error rates under strong disturbances — JPEG 20, Gaussian noise with σ=30/255, 7×7 median filtering, 25 percent cropping, brightness adjustment of 1.35, and enhanced screen recapture — ranged from 15.48 to 29.87 percent. After attack simulation training, those rates dropped to 9.86 to 20.74 percent, with detection accuracy rising from 73.48–87.17 percent to 81.95–93.12 percent and normalized correlation climbing to as high as 0.9084. The improvements were largest under cropping and screen recapture, the distortions that conventional differentiable attack layers model least adequately. The deployed model remains lightweight: 4.89 million parameters, 29.63 milliseconds for embedding, and 17.38 milliseconds for extraction per image — fast enough for low-latency copyright verification in media-integrated communications.

The framework is not without limits. Under geometric desynchronization attacks — rotation of ±5 degrees, scaling by 0.75 or 1.25, 10 percent translation, and 5 percent perspective displacement — bit error rates ranged from 0.1816 to 0.2847, because HDRB-WP lacks a dedicated geometric registration module; crop and resize augmentation provides only partial tolerance. The study also notes that its reported robustness concerns payload recovery under transmission distortions rather than cryptographic resistance to key recovery, forgery, or collusion, and that intentional attacks still require complementary authentication and access-control mechanisms. Still, the implications for cultural heritage are significant. In exhibitions, the technique can protect the authenticity of intangible cultural heritage art as images circulate digitally; in online dissemination, it can support copyright verification after platform compression, image editing, and screen recapture. Zhang’s future work will pursue lightweight geometric synchronization and conflict-free multi-watermark allocation, enabling multiple institutions to verify collaborative copyright on the same heritage image. For a field where a single glaze pattern or embroidery stitch can embody centuries of cultural identity, an invisible mark that survives the internet’s full gauntlet may prove to be heritage’s most durable signature.

Subject of Research: Digital visual transmission and watermark protection of intangible cultural heritage art images based on the HAIWAN method

Article Title: Digital visual transmission and watermark protection of intangible cultural heritage art images based on the HAIWAN method

Article References: Zhang, Y. (2026). Digital visual transmission and watermark protection of intangible cultural heritage art images based on the HAIWAN method. Discover Artificial Intelligence, 6(1), Article 1537. https://doi.org/10.1007/s44163-026-02523-2

Image Credits: AI Generated

DOI: 10.1007/s44163-026-02523-2

Keywords: Digital, visual, transmission, watermark, protection, intangible, cultural, heritage, images, based, HAIWAN, method