Evading watermark-based detection of AI-generated content
Evading Watermark based Detection of AI-Generated Content
Translation in progress — untranslated text is omitted.
A paper published at ACM CCS 2023 proposes the WEvade attack, which adds small perturbations imperceptible to the human eye to watermarked AI-generated images so that they are misjudged as not AI-generated, thereby evading watermark-based detection while maintaining visual quality. The method covers two threat models, white-box and black-box; the white-box variant WEvade-W-II brings the bit accuracy of decoding the watermark close to 0.5 and can bypass both the single-tailed detector and the two-tailed detector proposed by the authors, while the black-box variant WEvade-B-Q extends HopSkipJump to watermark detectors, and the paper states that the attacker needs only dozens of queries to escape the target detector. The paper derives theoretical bounds on the evasion rate of each variant and validates them on the non-learned watermarks used by HiDDeN, UDH and Stable Diffusion, using the COCO, ImageNet and CC datasets; to reach a similar evasion rate, WEvade requires far smaller perturbations than existing post-processing methods such as JPEG compression and Gaussian blur.
- Watermarks are used to detect AI-generated content, but the robustness of learned watermarks to common post-processing has only been evaluated in scenarios such as JPEG and Gaussian blur, and their robustness to adversarial post-processing has not been explored.
- Proposes WEvade: in the white-box setting, optimizes the perturbation so that the decoded watermark approaches a random target watermark (bit accuracy about 0.5); in the black-box setting, extends HopSkipJump with JPEG initialization and early stopping to query the target detector; and proposes a double-tail detector.
- On COCO/ImageNet/CC with HiDDeN and UDH as targets: WEvade-W-II's escape rate is close to the theoretical lower bound and its perturbation is far smaller than methods such as JPEG; WEvade-B-Q's escape rate is always 1; against the Stable Diffusion detector, both JPEG and WEvade-B-Q can escape.
- The authors point out that the ℓp norm and SSIM are only approximate measures of visual quality, and that existing watermarks lack provable robustness guarantees; the experiments cover only image watermarks and three datasets, and text watermarks are discussed only as a future direction.
The paper presents theoretical and experimental results for two types of evasion attacks, white-box and black-box, which deployments relying on watermark detection of AI-generated images can use to assess their own robustness.
Related papers
- Semantic-aware Adversarial Fine-tuning for CLIPDefensesarXiv