mlsanityData to 7 Oct 2026

Box-Free Model Watermarks Are Prone to Black-Box Removal Attacks

arXiv 2405.09863 ↗First posted 16 May 2024cs.CV cs.AIcited by 6

On the map: LLM safety and security → Watermarking generated content and models

Abstract (arXiv)

Box-free model watermarking is an emerging technique to safeguard the intellectual property of deep learning models, particularly those for low-level image processing tasks. Existing works have verified and improved its effectiveness in several aspects. However, in this paper, we reveal that box-free model watermarking is prone to removal attacks, even under the real-world threat model such that the protected model and the watermark extractor are in black boxes. Under this setting, we carry out three studies. 1) We develop an extractor-gradient-guided (EGG) remover and show its effectiveness when the extractor uses ReLU activation only. 2) More generally, for an unknown extractor, we leverage adversarial attacks and design the EGG remover based on the estimated gradients. 3) Under the most stringent condition that the extractor is inaccessible, we design a transferable remover based on a set of private proxy models. In all cases, the proposed removers can successfully remove embedded watermarks while preserving the quality of the processed images, and we also demonstrate that the EGG remover can even replace the watermarks. Extensive experimental results verify the effectiveness and generalizability of the proposed attacks, revealing the vulnerabilities of the existing box-free methods and calling for further research.

Key facts. Cited by 6 papers in the map (data through 7 Oct 2026). Placed in Watermarking generated content and models, one of 12 directions in LLM safety and security. Builds on 29 of its 59 references that are in the map. First posted on arXiv 16 May 2024.

Builds on

29 of 59 references.

Closest ancestors · 3

Same direction, newest first

  1. 2023Invisible Image Watermarks Are Provably Removable Using Generative AI2 Jun
  2. 2023Evading Watermark based Detection of AI-Generated Content5 May
  3. 2021Deep Model Intellectual Property Protection via Deep Watermarking8 Mar

Other references · 26

  1. 2015Deep Residual Learning for Image Recognitioncited by 51,809
  2. 2018BERT: Pre-training of Deep Bidirectional Transformers for Language Understandingcited by 40,204
  3. 2020Language Models are Few-Shot Learnerscited by 32,199
  4. 2020An Image is Worth 16x16 Words: Transformers for Image Recognition at Scalecited by 29,915
  5. 2015U-Net: Convolutional Networks for Biomedical Image Segmentationcited by 19,604
  6. 2016Image-to-Image Translation with Conditional Adversarial Networkscited by 4,510
  7. 2016Perceptual Losses for Real-Time Style Transfer and Super-Resolutioncited by 2,678
  8. 2017ZOO: Zeroth Order Optimization based Black-box Attacks to Deep Neural Networks without Training Substitute Modelscited by 656
  9. 2018Turning Your Weakness Into a Strength: Watermarking Deep Neural Networks by Backdooringcited by 334
  10. 2020A Comprehensive Survey of Neural Architecture Search: Challenges and Solutionscited by 253
  11. 2017Embedding Watermarks into Deep Neural Networkscited by 227
  12. 2020Artificial Fingerprinting for Generative Models: Rooting Deepfake Attribution in Training Datacited by 200
14 more
  1. 2017Adversarial Frontier Stitching for Remote Neural Network Watermarkingcited by 110
  2. 2020Responsible Disclosure of Generative Models Using Scalable Fingerprintingcited by 90
  3. 2021A survey of deep neural network watermarking techniquescited by 69
  4. 2021SoK: How Robust is Image Classification Deep Neural Network Watermarking? (Extended Version)cited by 67
  5. 2017A Generic Deep Architecture for Single Image Reflection Removal and Image Smoothingcited by 60
  6. 2020Model Watermarking for Image Processing Networkscited by 49
  7. 2019Robust Watermarking of Neural Network with Exponential Weightingcited by 48
  8. 2022Query-Efficient Black-box Adversarial Attacks Guided by a Transfer-based Priorcited by 38
  9. 2020Spread-Transform Dither Modulation Watermarking of Deep Neural Networkcited by 23
  10. 2020Fine-tuning Is Not Enough: A Simple yet Effective Watermark Removal Attack for DNN Modelscited by 18
  11. 2023What can Discriminator do? Towards Box-free Ownership Verification of Generative Adversarial Networkcited by 10
  12. 2023Erase and Repair: An Efficient Box-Free Removal Attack on High-Capacity Deep Hidingcited by 6
  13. 2024Perceptive self-supervised learning network for noisy image watermark removalcited by 3
  14. 2024A self-supervised CNN for image watermark removalcited by 3

Built on by

Cited by year (2026 to 7 Oct)

Citing papers per year: 2024: 1; 2025: 2; 2026: 3.

6 papers.

  1. 2025GCP: Guarded Collaborative Perception with Spatial-Temporal Aware Malicious Agent Detectioncited by 8
  2. 2025Towards Reliable Forgetting: A Survey on Machine Unlearning Verificationcited by 8
  3. 2026Learning Mutual View Information Graph for Adaptive Adversarial Collaborative Perceptioncited by 3
  4. 2026Decoder Gradient Shields: A Family of Provable and High-Fidelity Methods Against Gradient-Based Box-Free Watermark Removalcited by 1
  5. 2024Your Semantic-Independent Watermark is Fragile: A Semantic Perturbation Attack against EaaS Watermarkcited by 0
  6. 2026Correlation-Aware and Gaussianity-Preserving Robust Latent Angular Watermarking for Diffusion Modelscited by 0