Investigating Deep Watermark Security: An Adversarial Transferability Perspective
Not on the map. Why?
Abstract (arXiv)
The rise of generative neural networks has triggered an increased demand for intellectual property (IP) protection in generated content. Deep watermarking techniques, recognized for their flexibility in IP protection, have garnered significant attention. However, the surge in adversarial transferable attacks poses unprecedented challenges to the security of deep watermarking techniques-an area currently lacking systematic investigation. This study fills this gap by introducing two effective transferable attackers to assess the vulnerability of deep watermarks against erasure and tampering risks. Specifically, we initially define the concept of local sample density, utilizing it to deduce theorems on the consistency of model outputs. Upon discovering that perturbing samples towards high sample density regions (HSDR) of the target class enhances targeted adversarial transferability, we propose the Easy Sample Selection (ESS) mechanism and the Easy Sample Matching Attack (ESMA) method. Additionally, we propose the Bottleneck Enhanced Mixup (BEM) that integrates information bottleneck theory to reduce the generator's dependence on irrelevant noise. Experiments show a significant enhancement in the success rate of targeted transfer attacks for both ESMA and BEM-ESMA methods. We further conduct a comprehensive evaluation using ESMA and BEM-ESMA as measurements, considering model architecture and watermark encoding length, and achieve some impressive findings.
Key facts. Cited by 3 papers in the map (data through 7 Oct 2026). Builds on 56 of its 73 references that are in the map. First posted on arXiv 26 Feb 2024.
Builds on
56 of 73 references.
References · 56
- 2015Deep Residual Learning for Image Recognitioncited by 51,809
- 2020An Image is Worth 16x16 Words: Transformers for Image Recognition at Scalecited by 29,915
- 2021High-Resolution Image Synthesis with Latent Diffusion Modelscited by 18,694
- 2023GPT-4 Technical Reportcited by 18,132
- 2014Microsoft COCO: Common Objects in Contextcited by 17,498
- 2014Very Deep Convolutional Networks for Large-Scale Image Recognitioncited by 15,267
- 2014Explaining and Harnessing Adversarial Examplescited by 7,287
- 2016Densely Connected Convolutional Networkscited by 6,691
- 2022Hierarchical Text-Conditional Image Generation with CLIP Latentscited by 6,539
- 2017Towards Deep Learning Models Resistant to Adversarial Attackscited by 6,326
- 2015Rethinking the Inception Architecture for Computer Visioncited by 5,451
- 2017mixup: Beyond Empirical Risk Minimizationcited by 5,155
38 more
- 2016Towards Evaluating the Robustness of Neural Networkscited by 2,976
- 2015Fast R-CNNcited by 2,930
- 2015Learning Deep Features for Discriminative Localizationcited by 2,430
- 2016Inception-v4, Inception-ResNet and the Impact of Residual Connections on Learningcited by 1,509
- 2016Practical Black-Box Attacks against Machine Learningcited by 893
- 2015Deep Learning and the Information Bottleneck Principlecited by 793
- 2018A Convergence Theory for Deep Learning via Over-Parameterizationcited by 784
- 2017One pixel attack for fooling deep neural networkscited by 579
- 2016Training Region-based Object Detectors with Online Hard Example Miningcited by 577
- 2018Gradient Descent Finds Global Minima of Deep Neural Networkscited by 572
- 2016Linear Convergence of Gradient and Proximal-Gradient Methods Under the Polyak-Lojasiewicz Conditioncited by 526
- 2018Black-box Adversarial Attacks with Limited Queries and Informationcited by 499
- 2019Evading Defenses to Transferable Adversarial Examples by Translation-Invariant Attackscited by 440
- 2018HiDDeN: Hiding Data With Deep Networkscited by 384
- 2019Nesterov Accelerated Gradient and Scale Invariance for Adversarial Attackscited by 352
- 2017Certifying Some Distributional Robustness with Principled Adversarial Trainingcited by 333
- 2023The Stable Signature: Rooting Watermarks in Latent Diffusion Modelscited by 289
- 2017Embedding Watermarks into Deep Neural Networkscited by 227
- 2017Generative Adversarial Perturbationscited by 153
- 2019Solving a Class of Non-Convex Min-Max Games Using Iterative First Order Methodscited by 148
- 2024PIXART-δ: Fast and Controllable Image Generation with Latent Consistency Modelscited by 139
- 2022Frequency Domain Model Augmentation for Adversarial Attackcited by 128
- 2021On the Convergence and Robustness of Adversarial Trainingcited by 127
- 2018Gradient Harmonized Single-stage Detectorcited by 114
- 2021MBRS : Enhancing Robustness of DNN-based Watermarking by Mini-Batch of Real and Simulated JPEG Compressioncited by 108
- 2019Cross-Domain Transferability of Adversarial Perturbationscited by 92
- 2020On Success and Simplicity: A Second Look at Transferable Targeted Attackscited by 89
- 2022Boosting the Transferability of Adversarial Attacks with Reverse Adversarial Perturbationcited by 67
- 2021On Generating Transferable Targeted Perturbationscited by 65
- 2022Towards Blind Watermarking: Combining Invertible and Non-invertible Mechanismscited by 61
- 2020Perturbing Across the Feature Hierarchy to Improve Standard and Strict Blackbox Attack Transferabilitycited by 57
- 2018ReDMark: Framework for Residual Diffusion Watermarking on Deep Networkscited by 55
- 2017NAG: Network for Adversary Generationcited by 51
- 2020Transferable Perturbations of Deep Feature Distributionscited by 51
- 2020Model Watermarking for Image Processing Networkscited by 49
- 2021Deep Model Intellectual Property Protection via Deep Watermarkingcited by 47
- 2017A-Fast-RCNN: Hard Positive Generation via Adversary for Object Detectioncited by 43
- 2022Supervised GAN Watermarking for Intellectual Property Protectioncited by 39
50 most cited of 56 All 56 (JSON)
Built on by
Citing papers per year: 2024: 3.
3 papers.