Perceptual Cost of Watermark Strength: Testing TrustMark's Content-Uniformity

Invisible watermarking is used to authenticate and trace edited and AI-generated images, but embedding a watermark necessarily perturbs image content. Most of the existing watermarking models such as TrustMark (Bui et al., 2023), InvisMark (Xu et al., 2025), HiDDeN (Zhu et al., 2018), and StegaStamp (Tancik et al., 2020) are trained using a subset of the same loss functions such as MSE, LPIPS, frequency loss, and a GAN loss which are designed to keep quality degradation invisible, minimal, and, implicitly, independent of image content. The same loss is applied uniformly regardless of what is being watermarked. We test this content-independency of a popular representative, TrustMark, by measuring the visual difference between original and watermarked images at two embedding strengths using ColorVideoVDP (Mantiuk et al., 2024), a full-reference difference metric reported on the Just-Objectionable-Difference (JOD) scale, where a 1-JOD difference corresponds to 75% of observers detecting a quality change in a pairwise comparison. We watermark 41,997 images randomly sampled from four datasets with varying content type namely CelebA, CelebA-HQ, Google Open Images Crowdsource, and ImageNet1K using strength parameters λ=1 and λ=2 where λ=2 falls just outside TrustMark’s own reported reasonable operating range (λ∈ [0.75,1.50]), making this a direct test of behavior at and beyond the model’s validated boundary. We observe that, quality drops monotonically from λ=1 to λ=2 across the entire image set without a single exception (41,997 images). Interestingly, relative quality rankings remain stable across both strengths (Spearman ρ=0.969–0.986 across datasets), and 89–92% of each dataset’s best 10% and 80–87% of its worst 10% stay within the same category at both strengths. This indicates that image content, determines relative ranking. What is not uniform is the magnitude of degradation: the worst-quality 10% of images lose more JOD than the best-quality 10% (e.g., ImageNet1K’s worst 10% drops 9.32→8.54, its best 10% only 9.78→9.36), and the score distribution’s spread nearly doubles at λ=2 (1.74×–2.01× increase in standard deviation across datasets). The results indicate that TrustMark’s quality losses, while effective at holding average imperceptibility roughly constant, do not enforce uniform imperceptibility across content and this non-uniformity is already measurable at the edge of the model’s own validated strength range. This raises the question of whether a more advanced loss weighting strategy, such as content-adaptive weight, would better preserve the stated invisibility goal across the full diversity of real-world image content which is a limitation that we hypothesize is general to watermarking models rather than unique to TrustMark.