From Oracle to Predicted Masks: Auditing Protection Failures in Grayscale Fundus Image Watermarking on IDRiD

Watermark exclusion masks are often evaluated with reference annotations, although image issuance requires a mask that can be generated without them. We measured the difference on 27 IDRiD test fundus images using a sidecar-dependent block-DCT watermark in eight-bit grayscale. With a 64-bit payload, replacing background-only placement by a predicted protection mask reduced mean altered annotated pixels from 479.2 to 221.4 per image (paired mean reduction 257.9; 95% image-bootstrap CI 187.0–337.6). Alterations remained in 23 of 27 images. Class analysis showed no mean reduction for hemorrhages at 64 bits, while optic-disc changes declined by 162.8 pixels; the optic disc is normal anatomy. The lesion-only reduction was 31.2%, compared with 53.8% for the full union. A secondary mask augmented the prediction with a validation-selected green-channel contrast rule. On IDRiD, it reduced mean hemorrhage changes from 146.3 to 46.2 and microaneurysm changes from 12.0 to zero, while optic-disc changes rose from 11.5 to 19.0. On 148 annotated images from 68 visit folders in e-ophtha-MA, the fixed contrast rule reduced mean changes in the combined microaneurysm/small-hemorrhage annotation from 3.00 to 0.23 versus background-only placement (paired reduction 2.77; 95% visit-bootstrap CI 1.01–5.01). The original watermark was recovered exactly after JPEG compression, low-level noise and known-frame resizing, but failed under 3×3 median filtering. A five-head comparator yielded 222.8 mean union changes and 67.6% fewer eligible blocks than the original predictor. Median-filtered 64-bit outputs collapsed to zeros across 20 key/message draws; tested Hamming coding did not restore recovery. The results identify a class-dependent gap between reference and usable masks; the external label did not isolate hemorrhages, and frozen original-model transfer yielded only 3.42% mean exclusion recall.