---
license: cc-by-4.0
library_name: pytorch
pipeline_tag: image-feature-extraction
tags:
  - image-watermarking
  - watermark-security
  - content-binding
  - dinov2
  - pytorch
arxiv: 2609.32241
---

# CoverLock

Official checkpoints for **[Residual Transferability in Neural Image Watermarking](https://arxiv.org/abs/2609.32241)**.

[Project page](https://holdrain.github.io/Coverlock/) · [GitHub](https://github.com/holdrain/Coverlock) · [Paper](https://arxiv.org/abs/2609.32241)

CoverLock is a plug-and-play defense that binds a binary watermark payload to its cover image. It derives a robust image-dependent code from frozen DINOv2 features and applies that code to the payload through XOR. The original watermark encoder and decoder remain frozen and unmodified.

## Checkpoints

| File | DINOv2 backbone | Feature layer | Size |
|---|---|---:|---:|
| `coverlock_s.pt` | ViT-S/14 | 11 | 3.2 MB |
| `coverlock_b.pt` | ViT-B/14 | 11 | 4.7 MB |
| `coverlock_l.pt` | ViT-L/14 | 23 | 5.8 MB |
| `coverlock_g.pt` | ViT-G/14 | 39 | 7.9 MB |

The checkpoint contains the lightweight CoverLock head and its configuration. The corresponding frozen DINOv2 backbone is downloaded through PyTorch Hub on first use.

## Installation

```bash
pip install "git+https://github.com/holdrain/Coverlock.git"
pip install huggingface_hub
```

## Load a checkpoint

```python
from huggingface_hub import hf_hub_download
from coverlock import CoverLock

checkpoint = hf_hub_download(
    repo_id="zipingdong123/Coverlock",
    filename="coverlock_s.pt",
)

model = CoverLock.from_checkpoint(checkpoint, device="cuda")
```

Use `coverlock_b.pt`, `coverlock_l.pt`, or `coverlock_g.pt` to select a larger DINOv2 backbone.

## Bind and recover a watermark payload

CoverLock wraps an existing binary watermark codec. The sender binds the message to the cover image before embedding; the receiver repeats the operation after watermark decoding.

```python
import torch

# Sender
cover_code = model.encode_pil(cover_image)
bound_message = torch.logical_xor(message.bool(), cover_code)
watermarked_image = watermark_encoder(cover_image, bound_message)

# Receiver
decoded_message = watermark_decoder(received_image)
received_code = model.encode_pil(received_image)
recovered_message = torch.logical_xor(decoded_message, received_code)
```

`message`, `bound_message`, and `decoded_message` must have the same bit length. For watermark codecs with fewer than 256 message bits, use the same fixed subset of CoverLock bits at the sender and receiver.

## Command line

After installing the package, generate an image-conditioned code with:

```bash
coverlock encode \
  --checkpoint coverlock_s.pt \
  --image path/to/image.jpg \
  --device cuda
```

## Intended use

CoverLock is intended for research on neural image watermarking, residual-transfer forgery, and content-bound payloads. It is a wrapper around an existing binary watermark encoder and decoder, not a standalone watermark codec.

## Citation

```bibtex
@misc{dong2026residual,
  title         = {Residual Transferability in Neural Image Watermarking},
  author        = {Dong, Ziping and Li, Qi and Wang, Xinchao},
  year          = {2026},
  eprint        = {2609.32241},
  archivePrefix = {arXiv},
  primaryClass  = {cs.CR},
  url           = {https://arxiv.org/abs/2609.32241}
}
```