From Global Verification to Fine-Grained Tamper Localization: Exploiting Spatial Reliability in Robust Watermark Decoders

Robust image watermarking has become an effective tool for content authentication, yet existing systems are primarily designed for global message recovery and provide little information about where image integrity has been compromised. In this work, we show that globally trained watermark decoders already contain a previously overlooked, message-conditioned spatial integrity representation. By probing intermediate features of frozen pretrained watermark decoders, we find that local consistency with the authentic embedded message progressively emerges together with message recovery: intact regions retain strong support for the embedded watermark, whereas manipulated regions exhibit degraded local consistency. Counterfactual experiments with shuffled and random messages further show that this spatial separation is specifically tied to the authentic watermark rather than generic editing artifacts or message-independent feature instability. Building on this observation, we introduce a lightweight decoder-side tamper localization framework that extracts spatially distributed watermark evidence from intermediate decoder features, measures its consistency with the embedded message to construct an unreliability map, and combines this active watermark cue with RGB appearance for pixel-level localization. Importantly, the original watermark encoder and global decoder remain entirely frozen, requiring no modification to the deployed watermarking pipeline. Our findings reveal that robust watermark decoders encode substantially richer spatial information than their global objectives explicitly require, providing a new route for extending existing watermark systems from global verification to fine-grained tamper localization.