PaperlayerView exact revision on arXiv

Source-linked AI summary

Invisible Image Watermarks Are Provably Removable Using Generative AI

Xuandong Zhao, Kexun Zhang, Zihao Su, Saastha Vasan, Ilya Grishchenko, Christopher Kruegel, Giovanni Vigna, Yu-Xiang Wang, Lei Li

arXiv:2306.01953v3cs.CRcs.AIcs.CV

TL;DR

Invisible watermarks are intended to protect image provenance but may be removable by attacks that preserve visual quality. This paper proposes regeneration attacks that noise image representations and reconstruct them with denoising or generative models, then proves and empirically demonstrates their effectiveness against pixel-level invisible watermarks. The results motivate semantically similar watermarks as an alternative defense.

  • Problem

    The paper investigates whether invisible watermarks have fundamental robustness limits against attacks that preserve image quality.

  • Method

    The paper combines representation-space noise injection with reconstruction using denoising algorithms or generative models, supported by formal analysis and experiments.

  • Results

    Across four invisible watermarking schemes, regeneration attacks outperform five baselines on watermark removal and image quality; for RivaGAN, they remove 98% while maintaining PSNR above 30.

  • Takeaways & Limitations

    Pixel-level invisible watermarks are vulnerable to regeneration attacks, motivating a shift toward visible but semantically similar watermarking alternatives.

  • Takeaways & Limitations

    Semantic watermarks offer a potential defense and have shown resilience, but they are not a perfect solution because the watermark becomes somewhat visible.

Abstract

from arXiv · show

Invisible watermarks safeguard images' copyrights by embedding hidden messages only detectable by owners. They also prevent people from misusing images, especially those generated by AI models. We propose a family of regeneration attacks to remove these invisible watermarks. The proposed attack method first adds random noise to an image to destroy the watermark and then reconstructs the image. This approach is flexible and can be instantiated with many existing image-denoising algorithms and pre-trained generative models such as diffusion models. Through formal proofs and extensive empirical evaluations, we demonstrate that pixel-level invisible watermarks are vulnerable to this regeneration attack. Our results reveal that, across four different pixel-level watermarking schemes, the proposed method consistently achieves superior performance compared to existing attack techniques, with lower detection rates and higher image quality. However, watermarks that keep the image semantically similar can be an alternative defense against our attacks. Our finding underscores the need for a shift in research/industry emphasis from invisible watermarks to semantic-preserving watermarks. Code is available at https://github.com/XuandongZhao/WatermarkAttacker

1 Introduction

The paper asks whether invisible watermarks can remain robust against quality-preserving attacks and proposes regeneration attacks that noise image representations before reconstructing them. Theory and experiments show that pixel-level invisible watermarks can be removed while retaining image quality, whereas semantically similar watermarks offer a possible alternative.

  • The paper asks whether invisible watermarks are necessarily non-robust and whether invisibility trades off with resilience to quality-preserving attacks.
  • The proposed regeneration attack combines destructive corruption in an image representation with constructive reconstruction using denoisers or generative models.It adds Gaussian noise to a latent representation and reconstructs the image with a regeneration algorithm.
  • The attack is theoretically guaranteed to remove certain pixel-level invisible watermarks so that no detection algorithm can detect them, while preserving quality comparable to the unwatermarked image.
  • 98% of RivaGAN watermarks were removed while maintaining PSNR above 30 relative to the original images.The experiments covered four widely used invisible watermarking schemes and compared the attack with five baselines.
  • The paper explores visible but semantically similar watermarks as an alternative defense because they can be more resilient to the proposed attacks.Tree-Ring is identified as one semantic watermark that showed resilience, although it is not a perfect solution.

2 Related Work and Background

Prior work includes destructive and constructive watermark-removal attacks, while this paper frames removal through watermark detection and an adversary that lacks access to the watermarking scheme or detector.

  • Invisible watermarking developed from hand-crafted spatial and frequency-domain methods into learned techniques for hiding information imperceptibly.
  • Deep generative models provide latent representations and denoising-based purification mechanisms that motivate their use for invisible-watermark removal.
  • Watermark detection distinguishes watermarked and unwatermarked image distributions and can make false-positive or false-negative errors.
  • The threat model gives the adversary only watermarked images, arbitrary side information and computation, but no watermarking details or detector queries.
  • The adversary seeks to make detection ineffective while keeping the output image comparable in quality to the non-watermarked original.
  • For a 32-bit watermark, detection requires at least 23 correctly extracted bits under the stated p-value threshold.

3 The Proposed Regeneration Attack

The regeneration attack injects noise into an image embedding and reconstructs the image through a denoising or generative model. Its embedding and regeneration components can vary across identities, denoisers, VAEs, and diffusion models.

  • The attack first maps a watermarked image to an embedding, adds Gaussian noise, and reconstructs the image from the corrupted representation.
  • The algorithm maps xw to latent space, samples Gaussian noise, denoises the noisy latent, decodes it, and returns a reconstructed image.
  • The embedding function can be an identity map or a deep generative model, while the regeneration function can be a traditional denoiser or a diffusion model.Different choices may change empirical results but do not affect the theoretical guarantee.
  • VAEs can instantiate the attack because their encoder samples a noisy latent representation and their decoder reconstructs the image.Their built-in encoding noise means extra noise injection is unnecessary.
  • Diffusion models serve as regeneration functions because they learn to estimate clean samples from randomly noised ones.Their forward process adds noise and their backward process denoises it.
  • In the diffusion instantiation, the watermarked image is encoded to z0, noised to timestep t*, reconstructed as ẑ0, and decoded to x̂.

4 Theoretical Analysis

The analysis gives regeneration attacks provable guarantees for removing certain pixel-level invisible watermarks while preserving image quality. It characterizes detection difficulty through error trade-offs and extends utility guarantees across denoising and generative models.

  • Certified removal: Theoretical guarantees show regeneration attacks can remove certain invisible watermarks while retaining high image quality.The proofs cover a broad family of attacks and are stated for pixel-level watermarks bounded in ℓ2-distance.
  • Certified removal: f-Certified-Watermark-Free requires every detector’s Type II error to exceed a function of its Type I error.This formalizes certified removal as making watermark detection fundamentally difficult.
  • Detection trade-off: After regeneration, detection is as hard as distinguishing samples from N(0, 1) and N(Lx,w∆/σ, 1).The trade-off function bounds how simultaneously low the detector’s Type I and Type II errors can be.
  • Utility guarantees: If a generative model denoises a noisy unwatermarked image successfully, the corresponding attack also produces a similarly high-quality watermarked-image reconstruction.This extension applies even when worst-case guarantees for modern deep models are unavailable.
  • Attack framework: The attack adds Gaussian noise in an embedding space and reconstructs the image with a denoising or generative algorithm.The framework can use traditional denoisers, VAEs, diffusion models, or other regeneration algorithms.

5 Evaluation

The evaluation tests regeneration attacks on real and AI-generated images across four pixel-level watermarking methods. Regeneration methods generally combine high watermark-removal effectiveness with better image quality than baseline attacks, although StegaStamp requires more noise.

  • Experimental setup: The evaluation uses 500 MS-COCO photographs and 500 Stable Diffusion-v2.1 images.The generated set includes both photorealistic and artistic styles.
  • Experimental setup: Four pixel-level watermarking methods are evaluated: DwtDctSvd, RivaGAN, StegaStamp, and SSL watermark.The methods span traditional signal-processing and deep-learning approaches.
  • Results: Regeneration attacks occupy the strongest quality-detectability region by achieving lower TPR@FPR=0.01 and higher SSIM or PSNR than other attacks.In the plots, stronger attackers lie toward the lower-right corner.
  • Results: Regeneration attacks achieve over 99% removal rates for DwtDctSvd, RivaGAN, and SSL watermarking.The reported attacks are VAE-Bmshj2018, VAE-Cheng2020, and Diffusion.
  • Results: StegaStamp is the most robust evaluated scheme, with effective removal requiring the diffusion attack at substantial noise levels.Higher noise improves removal but creates a trade-off with image quality.
  • Potential defense: Semantic watermarks are presented as a potential defense because the attacks target pixel-level invisible watermarks.Tree-Ring is cited as an example that has shown resilience against these attacks.

6 Conclusion

The paper proposes regeneration attacks that combine destructive and constructive approaches to remove invisible watermarks. Theory and experiments show vulnerability in pixel-level invisible watermarks, motivating semantically similar alternatives.

  • Regeneration attacks combine destructive and constructive attacks to remove invisible watermarks.
  • Theoretical analysis proves that some invisible watermarks can become undetectable by any detection algorithm after attack.
  • Experiments show the proposed attack performs well empirically across the evaluated invisible watermarking methods.
  • The authors explore visible but semantically similar watermarks as an alternative defense.

A Additional Discussion in FAQ style

The discussion identifies assumptions and design choices affecting certified watermark freeness. It also considers alternative randomized perturbations and classical removal methods as directions for improving the quality–certification trade-off.

  • A fixed Certified Watermark Freeness level requires a uniform upper bound on the local Lipschitz parameter L_x,w independent of x and w.
  • For identity, low-pass, and other bounded-operator-norm linear embeddings, the discussion gives conditions that bound or reduce L_x,w.
  • Uniform bounds for neural embeddings may be too conservative; adversarially aligned watermark perturbations could make some neural-embedding attacks less resilient.
  • Classical quantization attacks offer practical trade-offs but generally lack provable Certified Watermark Freeness guarantees.
  • Laplace noise and other randomized perturbation mechanisms are proposed as future directions for studying certified removal and regenerated-image utility.

B.1 Invisible Watermarking Methods

The paper reviews traditional, neural, and generative invisible-watermarking methods together with destructive and constructive attacks used to evaluate watermark robustness. It also contrasts the proposed method with recent generative attacks.

  • Invisible Watermarking Methods: The evaluated watermarking methods span traditional signal processing and deep learning, including schemes used by Stable Diffusion.
  • Invisible Watermarking Methods: DwtDctSvd combines DWT, DCT, and SVD to embed watermarks in color images and is the default watermark used by Stable Diffusion.
  • Invisible Watermarking Methods: RivaGAN uses adversarial networks with an encoder and decoder to provide robust image watermarking.
  • Invisible Watermarking Methods: StegaStamp uses adversarial training and a spatial transformer network to resist noise, cropping, and minor geometric changes.
  • Existing Attacking Methods: Attacks are categorized as destructive, which corrupt images, or constructive, which use processing techniques to restore unwatermarked images.
  • Existing Attacking Methods: The proposed method removes watermarks from high-resolution images, provides theoretical justification, and does not assume knowledge of the watermarking algorithm.

C.1 Certified Watermark Removal

Certified watermark removal formalizes when no detector can reliably distinguish attacked watermarked images from corresponding originals. The theory connects this guarantee to randomized embedding-space noise, watermark compression, and the local Lipschitz parameter.

  • Certified Watermark Removal: Certified watermark removal requires that no detection algorithm can distinguish an attacked watermarked image from its corresponding original.
  • Certified Watermark Removal: The f-CWF definition lower-bounds a detector’s Type II error as a function of its Type I error.
  • Certified Watermark Removal: L_x,w measures how much an embedding compresses the watermark added to a particular clean image.
  • Certified Watermark Removal: The randomized algorithm A(ϕ(·) + N(0, σ^2I_d)) produces a reconstructed image satisfying an f-CWF guarantee under the local Lipschitz assumption.
  • Certified Watermark Removal: The trade-off interpretation compares detection after regeneration with distinguishing samples from Gaussian distributions separated by L_x,wΔ/σ.
  • Certified Watermark Removal: Pixel quantization and low-pass filtering can reduce watermark differences, while deep-learning embeddings preserve natural-image structure and compress watermark perturbations.
  • Certified Watermark Removal: The guarantees are specific to ℓ2-distance, although the general idea may extend to other distance functions.

C.2 Utility Guarantees

The utility analysis shows that regeneration quality on watermarked images follows denoising quality on corresponding unwatermarked images, with only a slight increase in failure probability. This extends from black-box generative models to denoisers with theoretical guarantees.

  • A general extension lemma transfers high-probability denoising quality from noisy unwatermarked images to their watermarked counterparts, with a slightly larger failure probability.The result applies to black-box generative models and image-generation or denoising algorithms.
  • When σ is proportional to Lx,w∆, the same exponential tail can hold for denoising the watermarked image if unwatermarked denoising error depends logarithmically on 1/δ.
  • The extension result makes no assumption about the watermark perturbation or the image-generation algorithm used.This broadens the utility guarantee beyond a particular watermark design or reconstruction method.
  • For denoisers with theoretical guarantees, the attack obtains provable utility bounds, including vanishing mean squared error as the image dimension grows.The passage gives TV-denoising as an example of such an algorithm.
  • For modern deep-learning denoisers and generators, empirical denoising quality on an unwatermarked image should also hold on its watermarked counterpart.The theorem can be applied separately to each image even when worst-case guarantees are intractable.

D Proofs of Technical Results

The technical results establish indistinguishability after randomized regeneration and connect it to utility preservation. The paper then identifies semantic watermarking as a defense that relaxes pixel-level invisibility, with Tree-Ring as an example.

  • Proof strategy: The proof models the watermark and original as inputs to a Gaussian mechanism and uses post-processing to preserve the resulting tradeoff after regeneration.The tradeoff is analyzed through indistinguishability and post-processing arguments.
  • Proof strategy: The Gaussian testing problem reduces to distinguishing along the one-dimensional direction between the two embedded representations.Translation and scaling preserve the tradeoff function, enabling the reduction from isotropic multivariate Gaussians.
  • Proof strategy: The utility proof applies indistinguishability to the event that the regenerated image is far from the original unwatermarked image.This yields the corresponding quality guarantee for the regenerated output.
  • Defense implication: Semantic watermarks relax ℓ2 invisibility, allowing larger image changes while retaining similar content; Tree-Ring is presented as an example.Unlike pixel-based watermarks, Tree-Ring changes the image visibly while preserving its semantic content.
  • Defense implication: Tree-Ring embeds a structured Fourier-space pattern in the diffusion model’s initial noise and detects it by inverting the diffusion process.The method influences the full sampling process rather than applying a post-hoc image modification.

E.2 Defense Experiments

The defense experiments evaluate Tree-Ring on generated images using text prompts and find strong robustness against the tested attacks. That robustness is accompanied by larger pixel- and latent-space differences from the original images.

  • Experimental setup: Tree-Ring watermarked images are evaluated using captions or user prompts because the method embeds watermarks during diffusion generation.The selected attacks, including the proposed regeneration attack, are applied to the resulting images.
  • Results: Tree-Ring watermarks show exceptional robustness against all tested attacks.The experiments use the same MS-COCO and SDP datasets as earlier experiments.
  • Results: Tree-Ring images are significantly more different from the originals in both pixel space and latent space.Figure 14 reports the corresponding ℓ2 distances.
  • Implication: The experiments identify semantic watermarking as a potential alternative whose robustness comes at the price of more visible differences.
Loading 2306.01953v3…