Year: 2024
Type: preprint
Abstract: Watermark has been widely deployed by industry to detect AI-generated images. The robustness of such watermark-based detector against evasion attacks in the white-box and black-box settings is well understood in the literature. However, the robustness in the no-box setting is much less understood. In this work, we propose a new transfer evasion attack to image watermark in the no-box setting. Our transfer attack adds a perturbation to a watermarked image to evade multiple surrogate watermarking models trained by the attacker itself, and the perturbed watermarked image also evades the target watermarking model. Our major contribution is to show that, both theoretically and empirically, watermark-based AI-generated image detector based on existing watermarking methods is not robust to evasion attacks even if the attacker does not have access to the watermarking model nor the detection API. Our code is available at: https://github.com/hifi-hyp/Watermark-Transfer-Attack.
Source: arXiv (Cornell University)
Institution: Duke University
Language: English
Subfield: Artificial Intelligence
Field: Computer Science
Domain: Physical Sciences
Open Access status: green
Awards: G2996144953, CAREER: Graph-Based Security Analytics: New Algorithms, Robustness under Adversarial Settings, and Robustness Enhancements, Collaborative Research: SaTC: CORE: Small: Securing Recommender Systems against Data Poisoning Attacks, Collaborative Research: SaTC: EDU: A Lab-based Curriculum for Watermarking AI-Generated Content: Theory, Algorithms, and Robustness Testing, Collaborative Research: SaTC: CORE: Medium: Towards Secure Federated Learning, AI Institute for Edge Computing Leveraging Next Generation Networks (Athena)
OpenAlex ID: W4393214190