mlsanityData to 7 Oct 2026

Watermark Vaccine: Adversarial Attacks to Prevent Watermark Removal

arXiv 2207.08178 ↗First posted 17 Jul 2022cs.CVcited by 18

Not on the map. Why?

Abstract (arXiv)

As a common security tool, visible watermarking has been widely applied to protect copyrights of digital images. However, recent works have shown that visible watermarks can be removed by DNNs without damaging their host images. Such watermark-removal techniques pose a great threat to the ownership of images. Inspired by the vulnerability of DNNs on adversarial perturbations, we propose a novel defence mechanism by adversarial machine learning for good. From the perspective of the adversary, blind watermark-removal networks can be posed as our target models; then we actually optimize an imperceptible adversarial perturbation on the host images to proactively attack against watermark-removal networks, dubbed Watermark Vaccine. Specifically, two types of vaccines are proposed. Disrupting Watermark Vaccine (DWV) induces to ruin the host image along with watermark after passing through watermark-removal networks. In contrast, Inerasable Watermark Vaccine (IWV) works in another fashion of trying to keep the watermark not removed and still noticeable. Extensive experiments demonstrate the effectiveness of our DWV/IWV in preventing watermark removal, especially on various watermark removal networks.

Key facts. Cited by 18 papers in the map (data through 7 Oct 2026). Builds on 39 of its 57 references that are in the map. First posted on arXiv 17 Jul 2022.

Builds on

39 of 57 references.

References · 39

  1. 2015Deep Residual Learning for Image Recognitioncited by 51,809
  2. 2014Explaining and Harnessing Adversarial Examplescited by 7,287
  3. 2017Towards Deep Learning Models Resistant to Adversarial Attackscited by 6,326
  4. 2013Intriguing properties of neural networkscited by 5,114
  5. 2016Towards Evaluating the Robustness of Neural Networkscited by 2,976
  6. 2016Pyramid Scene Parsing Networkcited by 2,472
  7. 2016Adversarial examples in the physical worldcited by 1,762
  8. 2019Certified Adversarial Robustness via Randomized Smoothingcited by 1,324
  9. 2016Practical Black-Box Attacks against Machine Learningcited by 893
  10. 2016Universal adversarial perturbationscited by 774
  11. 2017ZOO: Zeroth Order Optimization based Black-box Attacks to Deep Neural Networks without Training Substitute Modelscited by 656
  12. 2018Improving Transferability of Adversarial Examples with Input Diversitycited by 591
27 more
  1. 2018Threat of Adversarial Attacks on Deep Learning in Computer Vision: A Surveycited by 459
  2. 2019Evading Defenses to Transferable Adversarial Examples by Translation-Invariant Attackscited by 440
  3. 2016Transferability in Machine Learning: from Phenomena to Black-Box Attacks using Adversarial Samplescited by 439
  4. 2019Nesterov Accelerated Gradient and Scale Invariance for Adversarial Attackscited by 352
  5. 2017Adversarial Examples: Attacks and Defenses for Deep Learningcited by 350
  6. 2018Adversarial Risk and the Dangers of Evaluating Against Weak Attackscited by 221
  7. 2018"Double-DIP": Unsupervised Image Decomposition via Coupled Deep-Image-Priorscited by 114
  8. 2018Feature Distillation: DNN-Oriented JPEG Compression Against Adversarial Examplescited by 98
  9. 2022LAS-AT: Adversarial Training with Learnable Attack Strategycited by 94
  10. 2017Universal Adversarial Perturbations Against Semantic Image Segmentationcited by 92
  11. 2018Universal Adversarial Trainingcited by 85
  12. 2020Disrupting Deepfakes: Adversarial Attacks Against Conditional Image Translation Networks and Facial Manipulation Systemscited by 65
  13. 2017Adversarial examples for generative modelscited by 58
  14. 2020Adv-watermark: A Novel Watermark Perturbation for Adversarial Examplescited by 56
  15. 2021Boosting Fast Adversarial Training with Learnable Adversarial Initializationcited by 40
  16. 2020WDNet: Watermark-Decomposition Network for Visible Watermark Removalcited by 37
  17. 2018Ask, Acquire, and Attack: Data-free UAP Generation using Class Impressionscited by 31
  18. 2020Defending against GAN-based Deepfake Attacks via Transformation-aware Adversarial Facescited by 21
  19. 2020Split then Refine: Stacked Attention-guided ResUNets for Blind Single Image Visible Watermark Removalcited by 20
  20. 2016Adversarial Images for Variational Autoencoderscited by 19
  21. 2019Blind Visual Motif Removal from a Single Imagecited by 18
  22. 2021MagDR: Mask-guided Detection and Reconstruction for Defending Deepfakescited by 17
  23. 2021Visible Watermark Removal via Self-calibrated Localization and Background Refinementcited by 14
  24. 2019Towards Photo-Realistic Visible Watermark Removal with Conditional Generative Adversarial Networkscited by 10
  25. 2021Markpainting: Adversarial Machine Learning meets Inpaintingcited by 9
  26. 2020OGAN: Disrupting Deepfakes with an Adversarial Attack that Survives Trainingcited by 8
  27. 2020Protecting Against Image Translation Deepfakes by Leaking Universal Perturbations from Black-Box Neural Networkscited by 7

Built on by

Cited by year

Citing papers per year: 2022: 2; 2023: 6; 2024: 5; 2025: 5.

18 papers.

Sort:

By area:

  1. 2024Inducing High Energy-Latency of Large Vision-Language Models with Verbose Imagescited by 69
  2. 2023TrustMark: Universal Watermarking for Arbitrary Resolution Imagescited by 50
  3. 2023Backdoor Defense via Adaptively Splitting Poisoned Datasetcited by 43
  4. 2023Personalization as a Shortcut for Few-Shot Backdoor Attack against Text-to-Image Diffusion Modelscited by 42
  5. 2022Untargeted Backdoor Attack against Object Detectioncited by 28
  6. 2023Does Few-shot Learning Suffer from Backdoor Attacks?cited by 19
  7. 2025Rethinking Data Protection in the (Generative) Artificial Intelligence Eracited by 17
  8. 2024Which Model Generated This Image? A Model-Agnostic Approach for Origin Attributioncited by 15
  9. 2024Are Watermarks Bugs for Deepfake Detectors? Rethinking Proactive Forensicscited by 12
  10. 2022Backdoor Defense via Suppressing Model Shortcutscited by 10
  11. 2023Fast Propagation is Better: Accelerating Single-Step Adversarial Training via Sampling Subnetworkscited by 8
  12. 2024Perceptive self-supervised learning network for noisy image watermark removalcited by 3
6 more
  1. 2025GeoShield: Safeguarding Geolocation Privacy from Vision-Language Models via Adversarial Perturbationscited by 3
  2. 2023Preventing Unauthorized AI Over-Analysis by Medical Image Adversarial Watermarkingcited by 1
  3. 2025PersGuard: Preventing Malicious Personalization in Text-to-Image Diffusion Models via Model Backdoorscited by 1
  4. 2024Hallucination Detection in Virtually-Stained Histology: A Latent Space Baselinecited by 0
  5. 2025Beyond Invisibility: Learning Robust Visible Watermarks for Stronger Copyright Protectioncited by 0
  6. 2025Exploring Adversarial Watermarking in Transformer-Based Models: Transferability and Robustness Against Defense Mechanism for Medical Imagescited by 0