Why a good watermark survives cropping, resizing, and re-encoding
Stolen images get cropped, shrunk, and recompressed before reposting. Here is why naive watermarks break under that, and why a good one keeps reading.
A watermark that only works on a perfect, untouched copy is close to useless, because real theft is never that clean. By the time your photo is reposted, it has usually been cropped to fit a different layout, resized for a marketplace, and recompressed at least once. The real test of a watermark is whether it still reads after all of that.
Why the naive versions break
Early attempts at invisible watermarking were fragile. The most common trick was to hide a code in the least significant bits of the pixel values, the tiny part of each number that barely affects the color. It is invisible, but it is also the first thing destroyed when an image is recompressed, because compression throws away exactly the fine detail the code was hiding in. Resize the image and the pixels are resampled, scrambling the pattern. Crop it and the part holding the code might simply be gone.
So the challenge is not hiding a code. That is easy. The challenge is hiding one that is still there after the image has been knocked around.
The two ideas that make it survive
A modern, resilient watermark leans on two ideas.
Spread it everywhere. Instead of putting the code in one place or one fragile layer, it is woven across the entire image. A crop removes part of the mark but leaves a lot of it. There is no single region whose loss erases the whole thing.
Build in redundancy. The code is stored with error correction, the same principle that lets a scratched disc still play or a damaged barcode still scan. The information is repeated and encoded so that even a degraded, partial reading can be reconstructed into a confident result. A copy does not need to be perfect, it just needs to retain enough.
Put together, these mean the mark degrades gracefully. Damage reduces the margin rather than flipping it from working to broken.
Why neural watermarking raised the bar
The current generation goes further by using neural networks trained on the whole problem at once. The system learns to embed a code that humans cannot see and to read that code back after the image has been through the manipulations that happen in the wild: JPEG recompression, resizing, cropping, format conversion, and more. Because resilience is part of what it is trained for, it holds up against the real attacks rather than only gentle ones. Tilkie is built on TrustMark, a neural watermarking engine backed by Adobe, for exactly this reason.
What this does not cover
Resilience is not a claim that a watermark is indestructible. Push any mark far enough, with heavy enough degradation, and you can eventually defeat it, but at that point you have damaged the image so much that it is no longer useful for selling the product, which was the thief’s whole reason for taking it. The practical bar is surviving the edits a thief actually makes while keeping the photo worth stealing, and that is the bar a good watermark is designed to clear.
The same resilience is what lets the mark survive a screenshot, and it is the reason a pixel-level watermark protects where metadata does not. If you want the foundations first, start with what is invisible watermarking.
Tilkie applies this to your Shopify catalog so that a cropped, resized, recompressed copy still reports your mark, which is what turns a detection into proof you can act on.