Meta-Watermarking for Detection Recovery Under Attack Shift: Empirical Analysis of FOMAML-Based Fast Adaptation

Abstract

Diffusion-model watermark detectors are usually evaluated under fixed attack distributions, although deployed systems face continual attack shift. When out-of-distribution attacks reduce detection quality, full retraining is too slow for latency-sensitive verification services. This paper formulates watermark detection recovery as a task-level adaptation problem and proposes a meta-watermarking framework that learns a shared detector initialization via first-order Model-Agnostic Meta-Learning (FOMAML) on 10-dimensional ROBIN ring-frequency features. Recovery is measured by the minimum adaptation step <inline-formula> <tex-math notation="LaTeX">$k^{*}$ </tex-math></inline-formula> needed to satisfy a fixed TPR/FPR operating point. Across six data scales (16–512 images), seven attack types, and four methods, the meta-initialized 11-parameter logistic detector achieves zero-shot recovery (<inline-formula> <tex-math notation="LaTeX">$k^{*}=0$ </tex-math></inline-formula>) on unseen rotation attacks at <inline-formula> <tex-math notation="LaTeX">$N=128$ </tex-math></inline-formula>, with TPR= 0.875 and FPR= 0.063, whereas full retraining requires <inline-formula> <tex-math notation="LaTeX">$k^{*}=2$ </tex-math></inline-formula>. Threshold-only recalibration fails at this scale on rotation, indicating that learned initialization remains beneficial at moderate data budgets. After feature extraction, the detector classifies in 0.079 ms per image, about <inline-formula> <tex-math notation="LaTeX">$43{,}000\times $ </tex-math></inline-formula> smaller than the shared DDIM inversion stage that dominates end-to-end latency. Exploratory Spearman trends over the five single-seed scales (<inline-formula> <tex-math notation="LaTeX">$N=16$ </tex-math></inline-formula>–256) suggested faster recovery with scale, but including the <inline-formula> <tex-math notation="LaTeX">$N=512$ </tex-math></inline-formula> stress test (<inline-formula> <tex-math notation="LaTeX">$n=6$ </tex-math></inline-formula>) removes this correlation, and the multi-seed recovery rates are non-monotonic, so the trend does not generalize across all tested scales. The results are therefore consistent with meta-initialization as a practical recovery mechanism for the tested rotation attack shift, while recovery under high-noise conditions remains limited.