PaperlayerView exact revision on arXiv

Source-linked AI summary

Evading Watermark based Detection of AI-Generated Content

Zhengyuan Jiang, Jinghuai Zhang, Neil Zhenqiang Gong

arXiv:2305.03807v5cs.LGcs.CRcs.CV

TL;DR

Watermark-based detection of AI-generated images had been tested against popular post-processing but not adversarial post-processing. This paper proposes WEvade, a perturbation-based attack, and finds it evades detection with smaller perturbations than existing methods while maintaining image quality.

  • Problem

    Existing studies evaluated learning-based watermark robustness against popular post-processing, leaving robustness against adversarial post-processing unexplored.

    Source: §1 · p. 2

  • Method

    WEvade adds a small, human-imperceptible perturbation to a watermarked image to make watermark-based detectors classify it as non-AI-generated.

    Source: §1 · p. 2

  • Results

    Across multiple datasets and watermarking methods, WEvade outperforms existing post-processing methods, which require larger perturbations for comparable evasion and sacrifice image quality.

    Source: §1 · p. 3

  • Takeaways & Limitations

    Watermark-based detection of AI-generated images is vulnerable to strategic adversarial post-processing, and simply extending standard adversarial examples is insufficient.

    Source: §9 · p. 14

    The study focuses on AI-generated images, and ℓp norms and SSIM are approximate measures of perturbation impact on visual quality.

    Source: §8 · pp. 13–14

Abstract

from arXiv · show

A generative AI model can generate extremely realistic-looking content, posing growing challenges to the authenticity of information. To address the challenges, watermark has been leveraged to detect AI-generated content. Specifically, a watermark is embedded into an AI-generated content before it is released. A content is detected as AI-generated if a similar watermark can be decoded from it. In this work, we perform a systematic study on the robustness of such watermark-based AI-generated content detection. We focus on AI-generated images. Our work shows that an attacker can post-process a watermarked image via adding a small, human-imperceptible perturbation to it, such that the post-processed image evades detection while maintaining its visual quality. We show the effectiveness of our attack both theoretically and empirically. Moreover, to evade detection, our adversarial post-processing method adds much smaller perturbations to AI-generated images and thus better maintain their visual quality than existing popular post-processing methods such as JPEG compression, Gaussian blur, and Brightness/Contrast. Our work shows the insufficiency of existing watermark-based detection of AI-generated content, highlighting the urgent needs of new methods. Our code is publicly available: https://github.com/zhengyuan-jiang/WEvade.

1 INTRODUCTION

Watermark-based detection embeds a watermark in AI-generated images and identifies them by decoding a similar watermark, but the robustness of these detectors to adversarial post-processing had not been explored. WEvade targets that gap with small perturbations, and the paper reports theoretical and empirical evasion results.

1 INTRODUCTION

  • Prior robustness studies tested learning-based watermarking against common post-processing, leaving robustness to adversarial post-processing unexplored.Watermark-based detection embeds a watermark in generated content and identifies it when a similar watermark is decoded; detection uses a bitwise-accuracy threshold above 0.5.Source: §1 · pp. 1–2
  • WEvade adds a small, human-imperceptible perturbation to a watermarked image so a watermark-based detector falsely classifies it as non-AI-generated.The paper frames the attack as adversarial examples tailored to watermarking's characteristics.Source: §1 · p. 2
  • In the white-box setting, WEvade-W-II drives the decoded watermark toward a random watermark, whose expected bitwise accuracy is close to 0.5 without knowing the ground-truth watermark.WEvade-W-I instead flips every decoded bit, but the proposed double-tail detector can detect that strategy.Source: §1 · p. 2
  • In the black-box setting, WEvade-B-S uses a surrogate decoder, while WEvade-B-Q adapts HopSkipJump with a closer starting image and stops when perturbation begins to increase.These changes address large perturbations from random initialization and query budgets that can enlarge perturbations.Source: §1 · pp. 2–3
  • WEvade-B-Q achieves an evasion rate of 1, while WEvade-W-I's rate falls from 1 against a standard single-tail detector to 0 against the proposed double-tail detector.The paper also derives a lower bound for WEvade-W-II and derives WEvade-B-S's rate based on similarity between surrogate and target decoder watermarks.Source: §1 · p. 3
  • Across datasets and watermarking methods, WEvade evades detection with smaller perturbations than existing post-processing methods, which sacrifice image quality, including against adversarially trained detectors.Figure 1 illustrates HiDDeN images processed to evade detection; the results describe decoded watermark bitwise accuracy close to 0.55.Source: Figure 1 · p. 2, §1 · p. 3

2 RELATED WORK

Prior work on proactive AI-content detection left its robustness to evasion less explored than passive detection. Image watermarking includes hand-crafted and learned encoders and decoders; adversarial training helps against common post-processing but does not prevent WEvade.

2.1 Detecting AI-generated Content

  • Proactive detectors embed a watermark when content is generated, but their robustness to evasion attacks is less explored than that of passive detectors.Prior studies suggested proactive detectors were more robust than passive ones; this work reports they are not as robust as previously thought.Source: §2.1 · p. 3

2.2 Watermarking Methods

  • Image watermarking methods use either hand-crafted encoder and decoder heuristics or learned neural-network encoders and decoders.Invisible-watermark, adopted by Stable Diffusion, embeds bits by altering selected frequency coefficients after wavelet and cosine transforms.Source: §2.2 · p. 3
  • Adversarial training inserts a post-processing layer between encoder and decoder, training them to recover the watermark after selected processing; it improves robustness to popular methods but remains vulnerable to WEvade.The selected methods can include JPEG compression, Gaussian noise, Gaussian blur, Brightness/Contrast, and WEvade.Source: §2.2 · p. 4
  • WEvade also applies when a watermark encoder is embedded into a generative model, because the detection methods still rely on a decoder.The attack is agnostic to how the watermark is embedded in the generated image.Source: §2.2 · p. 4

3 WATERMARK-BASED DETECTORS

Watermark detectors classify images by comparing decoded-watermark bitwise accuracy with a threshold; the proposed double-tail detector also flags unusually low accuracy to address a simple adversarial evasion. The section describes threshold-based false-positive control and several possible deployment settings.

Detection setup

  • The detector decodes a watermark and compares it with the ground-truth watermark using bitwise accuracy; original-image accuracy is modeled as B(n, 0.5)/n.The watermark length n is the number of bits, and bitwise accuracy is the fraction of matching bits.Source: §3 · p. 4, Figure 3 · p. 4

Single-tail detector

  • A single-tail detector labels an image AI-generated when decoded-watermark bitwise accuracy exceeds τ, with τ chosen to bound false positives.The false-positive rate is analyzed under a uniformly random ground-truth watermark; for η=10^-4, the stated threshold is approximately 0.621.Source: §3 · pp. 4–5

Double-tail detector

  • The double-tail detector flags decoded-watermark accuracy above τ or below 1−τ, targeting attacks that drive accuracy toward zero.It is proposed to address the evasion of a single-tail detector by standard adversarial perturbations.Source: §3 · p. 5

Deployment scenarios

  • The paper envisions detection-as-a-service, end-user, public, and third-party deployment scenarios.Public and third-party users may select their own detection thresholds.Source: §3 · p. 5

4 THREAT MODEL

The threat model considers an attacker who starts with a watermarked image and seeks to evade detection using a small, human-imperceptible perturbation. It distinguishes decoder-access attacks from attacks limited to querying a particular detector.

Attacker’s goal

  • The attacker aims to turn a watermarked image into one falsely labeled non-AI-generated by adding a small, human-imperceptible perturbation.The stated goal includes maintaining visual quality.Source: §4 · p. 5

White-box

  • In the white-box setting, the attacker has decoder access but not the encoder or ground-truth watermark, and seeks evasion across thresholds τ>0.5.The assumed decoder access can arise through public release, reverse engineering, leakage, or data exposure.Source: §4 · p. 5

Black-box

  • In the black-box setting, the attacker sees only binary outputs from a particular target detector and seeks to evade that detector.The assumed capability permits multiple queries; the paper reports that experiments require only dozens of queries.Source: §4 · pp. 5–6

5 OUR WEVADE

WEvade formulates perturbations to evade watermark detectors under white-box and black-box access. Its white-box approach first considers bit-flipping, then targets watermark accuracy near 0.5; its black-box approaches use a surrogate model or queries to the target detector.

5.1 White-box Setting

  • The white-box setting assumes decoder access and formulates attacks to evade detectors with any threshold τ>0.5.The overall method first extends standard adversarial examples, then introduces a new optimization problem and solver.Source: §5.1 · p. 6

5.1.1 Extending Standard Adversarial Examples to Watermarking

  • The initial white-box attack flips every decoded watermark bit, but the resulting low bitwise accuracy can be detected by the double-tail detector.WEvade-W-I formulates a perturbation problem around the flipped decoded watermark.Source: §5.1.1 · p. 6, §5.1.2 · p. 6

5.1.2 Formulating a New Optimization Problem (WEvade-W-II).

  • WEvade-W-II seeks a small perturbation that makes decoded-watermark accuracy close to 0.5, but the ground-truth watermark is unavailable to the attacker.It uses a uniformly random target watermark and reformulates the optimization to make gradient-based search more tractable.Source: §5.1.2 · pp. 6–7

5.1.3 Solving the Optimization Problems.

  • For a fixed perturbation bound, the solver uses projected gradient descent; binary search over the bound seeks the smallest perturbation satisfying the constraints.The described routine projects perturbations whose ℓ∞-norm exceeds the current bound.Source: §5.1.3 · p. 7

5.2 Black-box Setting

  • The query-based black-box method adapts HopSkipJump to find an evading image while reducing perturbation, whereas the surrogate approach uses a locally trained encoder and decoder.WEvade-B-S improves HopSkipJump initialization with a JPEG-processed image when one evades detection and stops early after repeated perturbation increases.Source: §5.2 · p. 7

6 THEORETICAL ANALYSIS

The analysis defines evasion rate as the probability that an attacked watermarked image is falsely detected as non-AI-generated, and derives guarantees or lower bounds across detector settings. White-box guarantees differ by attack and detector type; black-box guarantees depend on surrogate-decoder similarity or an initially evading image.

6 THEORETICAL ANALYSIS

  • The analysis defines evasion rate as the probability that an attacked watermarked image is falsely detected as non-AI-generated.The probability may reflect randomness in the attack, such as selecting a target watermark in WEvade-W-II.Source: §6 · p. 8

6.1 White-box Setting

  • WEvade-W-I guarantees evasion rate 1 against a single-tail detector but rate 0 against a double-tail detector when the original image is detectable.The theorem assumes a detector threshold τ > 0.5.Source: §6.1 · p. 8
  • WEvade-W-II gives evasion-rate lower bounds for both detector types, depending on threshold τ, attacker parameter ε, and watermark length n.The lower bound is larger for a detector with a larger τ.Source: §6.1 · p. 8

6.2 Black-box Setting

  • For WEvade-B-S, lower bounds against both detector types require the surrogate and target decoders to be (β,γ)-similar.The definition requires bitwise accuracy of at least β with probability at least γ on a uniformly sampled watermarked image.Source: §6.2 · p. 8
  • WEvade-B-Q has evasion rate 1 for the target detector because it reduces perturbation while maintaining an initially evading image.This guarantee applies only to the target detector.Source: §6.2 · p. 8

7 EVALUATION

The evaluation tests HiDDeN and UDH across COCO, ImageNet, and Conceptual Caption, alongside Stable Diffusion’s watermark; it measures detection and perturbation under several attack settings. WEvade generally evades detection with smaller perturbations than existing post-processing methods, including against Stable Diffusion’s detector.

7.1 Experimental Setup

  • The experiments use 10,000 training images per dataset and 100 test images, evaluating bitwise accuracy, evasion rate, and average ℓ∞ perturbation.The datasets are COCO, ImageNet, and Conceptual Caption; the study includes HiDDeN and UDH, with 30-bit and 256-bit watermarks, respectively.Source: §7.1 · pp. 8–9

7.2 Detection Results without Attacks

  • Without attacks, both detectors have FPR and FNR close to 0 over τ=0.7–0.95 for HiDDeN and τ=0.6–0.99 for UDH across the three datasets.The reliable threshold range is wider for UDH, which uses a 256-bit watermark versus HiDDeN’s 30-bit watermark.Source: Figure 4 · p. 9, §7.2 · pp. 9–10

7.3 Attack Results in the White-box Setting

  • At comparable evasion rates, WEvade-W-II requires much smaller perturbations than existing post-processing methods in the white-box setting.The comparison gives existing methods threshold-specific tuning, while WEvade-W-II does not assume knowledge of the detector threshold.Source: Figure 7 · p. 10, §7.3 · p. 10
  • WEvade-W-I achieves evasion rate 1 against the single-tail detector but 0 against the double-tail detector; for the double-tail detector, WEvade-W-II performs better with smaller perturbations.For WEvade-W-II, increasing ε lowers average perturbation but also lowers evasion rate; its theoretical lower bound rises with watermark length.Source: §7.3 · pp. 10–11
  • Adversarial training improves robustness but does not prevent small-perturbation evasion by WEvade-W-II or WEvade-B-Q.For WEvade-W-II, evasion rates are unchanged but average perturbations increase; for WEvade-B-Q, more queries are needed, yet a moderate query count can still achieve small perturbations.Source: Figure 11 · p. 11, §7.3 · p. 11, §7.4 · p. 12

7.4 Attack Results in the Black-box Setting

  • WEvade-B-Q always achieves an evasion rate of 1, while WEvade-B-S’s rate falls to 0 as the threshold decreases.WEvade-B-Q requires larger perturbations as the threshold decreases; WEvade-B-S uses threshold-agnostic perturbations.Source: Figure 12 · p. 11, §7.4 · pp. 11–12
  • With a 30-query budget on COCO, WEvade-B-Q adds average perturbation 0.032, versus 0.211 for JPEG, 0.109 for Gaussian noise, 0.395 for Gaussian blur, and 0.439 for Brightness/Contrast.For UDH on COCO, WEvade-B-Q also adds much smaller perturbations than HopSkipJump; the paper attributes this to its JPEG initialization and early stopping.Source: §7.4 · p. 12

7.5 Attacking Stable Diffusion’s Detector

  • For Stable Diffusion’s 136-bit watermark, JPEG quality around 80 reduces bitwise accuracy to around 0.5, while WEvade-B-Q evades detection with much smaller perturbations.Both JPEG and WEvade-B-Q evade the detector without sacrificing image quality in the reported example.Source: Figure 16 · p. 13, §7.5 · p. 13

8 DISCUSSION AND LIMITATIONS

The discussion broadens perturbation evaluation beyond ℓ∞ and identifies provable robustness and text watermarking as future directions.

Other metrics to quantify perturbation

  • WEvade adds smaller perturbations than existing methods under ℓ2-norm or SSIM comparisons at matched evasion rates.Figure 18 uses the HiDDeN watermark and COCO dataset in the white-box setting.Source: §8 · p. 13, Figure 18 · p. 13
  • ℓp-norms and SSIM are approximate measures of visual impact, and small ℓp-norms may be neither sufficient nor necessary to preserve visual quality.The authors identify visual-quality metrics specific to generative AI as future work.Source: §8 · p. 13

Provably robust watermarking methods

  • Existing watermarking methods lack provable robustness guarantees, motivating methods that preserve decoded-watermark similarity under bounded perturbations.The discussion gives an example in which a bounded ℓ∞ perturbation guarantees bitwise accuracy of 0.85, sufficient for a detector threshold of 0.8.Source: §8 · p. 13

Text watermarking

  • The image-focused adversarial post-processing ideas may generalize to text watermarking, which the authors leave for future work.The discussion notes that non-learning-based text watermarking is not robust to common post-processing such as paraphrasing.Source: §8 · p. 14

9 CONCLUSION AND FUTURE WORK

The authors conclude that small, human-imperceptible perturbations can evade watermark-based image detection, while standard adversarial-example extensions are insufficient. They identify provably robust detectors as future work.

Conclusion

  • Small, human-imperceptible perturbations can make AI-generated watermarked images evade detection.The authors characterize watermark-based detection as vulnerable to strategic adversarial post-processing.Source: §9 · p. 14
  • Simply extending standard adversarial examples to watermarking is insufficient because it does not account for watermarking’s unique characteristics.Source: §9 · p. 14

Future work

  • The authors identify watermark-based detectors with provable robustness guarantees as future work.Source: §9 · p. 14

Algorithm 1 WEvade-W-I and WEvade-W-II

The displayed algorithm checks whether either WEvade-W-I or WEvade-W-II satisfies its corresponding equation condition.

Algorithm 1

A PROOF OF THEOREM 1

The proof uses the correct-detection conditions for standard and adaptive detectors to derive inequalities involving decoded-watermark bitwise accuracy.

Proof

  • For a correctly detected image under the standard detector, decoded-watermark bitwise accuracy exceeds the threshold, which is greater than 0.5.Source: A PROOF OF THEOREM 1 · p. 15
  • For the adaptive detector, correct detection implies bitwise accuracy is above τ or below 1 − τ; the perturbed image’s accuracy is its complement.Source: A PROOF OF THEOREM 1 · p. 15

B PROOF OF THEOREM 2

The proof uses the distance between a randomly selected watermark and the ground-truth watermark to derive a binomial-distribution bound. The accompanying figures examine how post-processing parameters affect accuracy and perturbation, and compare perturbations required for evasion at matched rates.

B PROOF OF THEOREM 2

  • The passage records the notation D(I_pw) = w_Ipw and then introduces Equation 9; its contents and any later distance argument are not stated in this cited excerpt.Source: B PROOF OF THEOREM 2 · p. 16
  • A uniformly random target watermark has bitwise distance from the ground-truth watermark distributed as B(n, 0.5), with P(t) defined as the cumulative distribution function of that binomial variable.The proof invokes the triangle inequality to relate this distance to the decoded watermark.Source: B PROOF OF THEOREM 2 · p. 16
  • Figure 23 reports average bitwise accuracy and perturbation as existing methods’ parameter values vary, across COCO, ImageNet, and CC with UDH.The three datasets occupy separate figure rows.Source: Figure 23 · p. 17
  • Figure 24 compares average perturbation across detector thresholds for methods set to match WEvade-W-II’s evasion rate in the white-box UDH setting.The caption does not provide the plotted values or identify a winner.Source: Figure 24 · p. 17

C PROOF OF THEOREM 3

The supplied proof material combines a black-box comparison and an algorithmic description with proof steps for Theorems 3 and 4. The figures report perturbation and evasion comparisons under specified detector, dataset, and threshold conditions.

C PROOF OF THEOREM 3

  • At τ = 0.95, empirical FNR is 99.6%, so existing methods add zero perturbation for a large fraction of watermarked images under this evaluation; below 0.9, they require much larger perturbations.This comparison uses adversarially trained HiDDeN on COCO, with average bitwise accuracy around 0.87.Source: Figure 25 · p. 18
  • The black-box figures compare WEvade-B-S with WEvade-B-Q on evasion rates and average perturbations, and examine initialization and early stopping for WEvade-B-Q.The comparison uses UDH; the initialization and early-stopping figure uses UDH on COCO.Source: Figure 26 · p. 18, Figure 27 · p. 18
  • WEvade-B-Q achieves evasion rate 1 in the black-box setting, while existing methods are tuned to rates as close to 1 as possible for the perturbation comparison.Figure 28 reports ℓ2-norm and SSIM perturbations for HiDDeN on COCO; the perturbations use ℓ2-norm in place of ℓ∞-norm in Algorithm 3.Source: Figure 28 · p. 18
  • The algorithm takes a detector API, watermarked image, query budget, and early-stop threshold as inputs and returns a post-processed image, iteratively moving it toward the watermarked image.Its initialization iterates over the listed Q values.Source: C PROOF OF THEOREM 3 · p. 19

D PROOF OF THEOREM 4

  • The Theorem 4 proof invokes Equation 9, the triangle inequality, Definition 1, and the double-tail detector.The supplied passages identify these proof ingredients without giving the intervening derivation.Source: D PROOF OF THEOREM 4 · p. 19
Loading 2305.03807v5…