This is a spread-spectrum watermark in the DCT domain — the same family of technique behind private (non-blind) image watermarking schemes and the correlation detectors used by content-provenance systems.
2D DCT-II: F(u,v) = C(u)C(v) Σx Σy f(x,y) cos[(2x+1)uπ/2N] cos[(2y+1)vπ/2N]
Embed: F'(u,v) = F(u,v) + α·|F(u,v)|·W(u,v) for the K largest |F(u,v)| (excl. DC)
Extract: Ŵ(u,v) = (F'att(u,v) − F(u,v)) / (α·|F(u,v)|)
Detect: ρ = (Ŵ·W) / (‖Ŵ‖‖W‖) declare "watermarked" if ρ > 0.35
- α (embedding strength) — how strongly the pseudo-random key W is added to the largest-magnitude AC coefficients. Cox et al.'s original insight: hide the mark in perceptually significant components, because an attacker can't remove it there without visibly damaging the content itself.
- JPEG quality — the attacked image is re-transformed and its DCT coefficients rounded to a quantization step that widens as quality drops, exactly how lossy re-compression erodes fine coefficient detail.
- Noise σ — Gaussian pixel noise added before re-compression, modelling screenshot/re-encode/transmission noise.
- Border crop — a share of the image edge is blanked out, simulating a crop or overlay that removes watermark energy along with content.
- The left voxel grid is the actual pixel data the detector receives; the right grid is |F'att(u,v)| — bright red bars are the K watermarked frequency bins, and you can watch them flatten toward the noise floor as attacks intensify. The center gauge tracks ρ live.
Real-world relevance: this correlation-detector math underlies content-authenticity systems (e.g. C2PA-style provenance and invisible-watermark tools like SynthID) that try to keep AI-generated media traceable — and it is exactly why "robustness vs. imperceptibility vs. removability" is still an open arms race.