FROST:Improving Image Fidelity and Watermark Robustness without Updating the Base Model

Invisible image watermarking aims to preserve the visual quality of cover images while enabling reliable recovery of embedded messages after image transformations. In autoencoder-based systems such as RoSteALS, output distortion can arise from both message embedding and image reconstruction. We introduce FROST (Frozen-Reader Output-Space Tuning), a framework for improving image fidelity and message recovery robustness without updating the pretrained watermarking model. Its trainable component, the FROST Module, is attached after the image decoder and predicts an additive residual conditioned on the watermarked image and the embedded message. All existing image and message encoders and decoders remain frozen. The complete FROST Adapter combines this module with reconstruction-error correction and high-frequency residual suppression at inference time. Component-wise comparisons show that the module improves bit accuracy under image corruptions, whereas the subsequent residual processing improves fidelity. With 100-bit messages, the complete framework increases PSNR on CLIC from 29.10 to 33.66 dB. Across CLIC and MetFaces, the reported mean bit accuracy over 15 ImageNet-C corruptions increases from 94.18% to 95.74% at severity 3 and from 89.17% to 91.67% at severity 5. Experiments with a KLf8 backbone also improve PSNR, SSIM, and average bit accuracy under corruption. However, LPIPS improvements are not consistent across datasets and backbones. These results demonstrate that learned output adjustment and inferencetime residual processing can improve evaluated watermarking systems while preserving their pretrained components.