CoverLock
Official checkpoints for Residual Transferability in Neural Image Watermarking.
Project page · GitHub · Paper
CoverLock is a plug-and-play defense that binds a binary watermark payload to its cover image. It derives a robust image-dependent code from frozen DINOv2 features and applies that code to the payload through XOR. The original watermark encoder and decoder remain frozen and unmodified.
Checkpoints
| File | DINOv2 backbone | Feature layer | Size |
|---|---|---|---|
coverlock_s.pt | ViT-S/14 | 11 | 3.2 MB |
coverlock_b.pt | ViT-B/14 | 11 | 4.7 MB |
coverlock_l.pt | ViT-L/14 | 23 | 5.8 MB |
coverlock_g.pt | ViT-G/14 | 39 | 7.9 MB |
The checkpoint contains the lightweight CoverLock head and its configuration. The corresponding frozen DINOv2 backbone is downloaded through PyTorch Hub on first use.
Installation
pip install "git+https://github.com/holdrain/Coverlock.git"
pip install huggingface_hub
Load a checkpoint
from huggingface_hub import hf_hub_download
from coverlock import CoverLock
checkpoint = hf_hub_download(
repo_id="zipingdong123/Coverlock",
filename="coverlock_s.pt",
)
model = CoverLock.from_checkpoint(checkpoint, device="cuda")
Use coverlock_b.pt, coverlock_l.pt, or coverlock_g.pt to select a larger DINOv2 backbone.
Bind and recover a watermark payload
CoverLock wraps an existing binary watermark codec. The sender binds the message to the cover image before embedding; the receiver repeats the operation after watermark decoding.
import torch
# Sender
cover_code = model.encode_pil(cover_image)
bound_message = torch.logical_xor(message.bool(), cover_code)
watermarked_image = watermark_encoder(cover_image, bound_message)
# Receiver
decoded_message = watermark_decoder(received_image)
received_code = model.encode_pil(received_image)
recovered_message = torch.logical_xor(decoded_message, received_code)
message, bound_message, and decoded_message must have the same bit length. For watermark codecs with fewer than 256 message bits, use the same fixed subset of CoverLock bits at the sender and receiver.
Command line
After installing the package, generate an image-conditioned code with:
coverlock encode \
--checkpoint coverlock_s.pt \
--image path/to/image.jpg \
--device cuda
Intended use
CoverLock is intended for research on neural image watermarking, residual-transfer forgery, and content-bound payloads. It is a wrapper around an existing binary watermark encoder and decoder, not a standalone watermark codec.
Citation
@misc{dong2026residual,
title = {Residual Transferability in Neural Image Watermarking},
author = {Dong, Ziping and Li, Qi and Wang, Xinchao},
year = {2026},
eprint = {2609.32241},
archivePrefix = {arXiv},
primaryClass = {cs.CR},
url = {https://arxiv.org/abs/2609.32241}
}