A Transfer Attack to Image Watermarks
Authors: Yuepeng Hu
Zhengyuan Jiang
Moyang Guo
Neil Zhenqiang Gong
Venue: ICLR 2025 Poster (2025)
Keywords: Image Watermarking
Transfer Attack
AI-generated Image
Primary area: alignment, fairness, safety, privacy, and societal considerations

Abstract: Watermark has been widely deployed by industry to detect AI-generated images. The robustness of such watermark-based detector against evasion attacks in the white-box and black-box settings is well understood in the literature. However, the robustness in the no-box setting is much less understood. In this work, we propose a new transfer evasion attack to image watermark in the no-box setting. Our transfer attack adds a perturbation to a watermarked image to evade multiple surrogate watermarking models trained by the attacker itself, and the perturbed watermarked image also evades the target watermarking model.  Our major contribution is to show that, both theoretically and empirically, watermark-based AI-generated image detector based on existing watermarking methods is not robust to evasion attacks  even if the attacker does not have access to the watermarking model nor the detection API. Our code is available at: https://github.com/hifi-hyp/Watermark-Transfer-Attack.

Published as a conference paper at ICLR 2025
A TRANSFER ATTACK TO IMAGE WATERMARKS
Yuepeng Hu, Zhengyuan Jiang, Moyang Guo, Neil Zhenqiang Gong
Duke University {yuepeng. hu, zhengyuan. jiang, moyang. guo, neil. gong)oggeegeuueee.....
ABSTRACT
Watermark has been widely deployed by industry to detect Al Al-generated images. The robustness of such watermark-base detector against evasion attacks the white-box and black-box settings is well understood in the literature. However, the robustness in the no-box setting is much less understood. In this work, we propose transfer evasion attack to image watermark in the no-box setting. Our transfer attack adds a perturbation to a watermarked image to evade multiple surrogate watermarking models trained by the attacker itself, and the perturbed watermarked image also evades the target watermarking model. Our major con- tribution is to show that, both theoretically and empirically, watermark-based AI- generated image detector based on existing watermarking methods is not robust evasion attacks even if the attacker does not have access to the watermarking model nor the detection API. Our code is available at: hhtps://github..om//iii hyp/ hypp/Wtermarrk Santttrmmrrr-Tansee---eaeee TransferAAttcck
INTRODUCTION
Generative AI (GenAl) can create highly realistic images, raising concerns about online information
authenticity. Watermarking (Bi et al., 2007; /hhu et al.] [2018] Tancik et al. 2020: Zhang er al.
2020 Al-Haj] 2007 Abdelnabi & Fritz 2021 Kirchenbauer et al. 2023) was highlighted as key
technology for distinguishing Al-generated content in the White House's October 2023 Executive
Order on Al security. In this approach, a watermark is embedded in Al-generated images, which can be decoded to verify the image's origin. Watermarking is widely used, with examples like Google's SynthID for Imagen (Saharia et al. 2022), OpenAl's watermark for DALL-E (Ramesh et al. 2021 and Stable Diffusion's 's user-enabled watermarking (Rombach) 2022).
attacker can use evasion altacks (Jiang et al., 2023; Zhao al., 2024 Saberi et al. 2024 Lukas et al. 2024) to remove watermark from image and evade detection. This involves adding per- turbation so that the watermark- based detector falsely identifies the image as non-Al --------eerrredd... The robustness of such detectors against evasion attacks has been studied in both white-box (the attacker has access to the watermarking model) and black-box (the attacker can query the detection API) set- tings (Jiang et al.) (023). In white-box attacks, small perturbations evade detection while preserving image quality, while in black-box attacks, perturbations are found by querying the detection API multiple times.
However, robustness of watermark-based detection in the no-box setting (the attacker even lacks access to the detection API) is less understood. this setting, attackers may use common post- processing (c.g., JPEG compression) or transfer attacks (Jiang et al. 2023 An et al. 2024). Transfer attacks involve perturbing a watermarked image using surrogate models, which can be classifier- based or watermark-basen apply adversarial examples (Liu et al., 2017: Chen et al., 2024), while watermark-based attacks train a surrogate watermarking model for white-box attacks (Jiang et al. (023).. Both methods have limited success against advanced watermarking, leading to misleading conclusion in prior studies that watermarking is robust in the no-box setting.
Classifier-based attacks treat the detector as binary classifier and
Our work: In this work, we propose a new watermark- based transfer attack in the no-box setting to evade AI Al-generated image detection. Unlike classifier- based attacks (An et al. 2024), approach directly uses surrogate watermarking models, making more suited to watermark basedd detection. Unlike previous watermark-based attacks (Jiang et al. 2023), we employ multiple surrogate models

---

Published as a conference paper at ICLR 2025
Figure I: Watermarked images generated by Stable Diffusion (first row) and their perturbed versions in our transfer attack that successfully evade detection (second row). The target watermarking model uses ResNet architecture. Our transfer attack uses 100 surrogate watermarking models, each of which uses CNN architecture.
instead one. Specifically, an attacker trains multiple surrogate watermarking models with different architectures and watermark lengths on surrogate dataset, which may differ in distribution from the one used for the target watermarking model.
A key challenge for our attack is aggregating multiple surrogate watermarking models to find a small perturbation that evades the target watermarking model. We show that simple aggregation methods achieve suboptimal attack effectiveness. To address this, propose two-step approach. First, the attacker selects a target watermark for each surrogate model to guide the perturbation search, aiming make each model decode this target watermark from the perturbed image. For instance, one method flips each bit of the watermark decoded by a surrogate model and uses this as the target. If multiple surrogate models decode flipped watermarks, the target model is likely to do the same, thus evading detection.
In the second step, generate perturbation by aggregating multiple surrogate watermarking mod- els. A simple approach to apply a white-box attack (Jiang al. (023) on each model and its target watermark, then average the resulting perturbations. However, this method performs poorly, as ag- gregation compromises the perturbation patterns. To overcome this, we ensemble the models and formulate an optimization problem that finds a minimum perturbation while ensuring each surrogate model decodes its target watermark. Since this problem is hard to solve, we introduce strategies to reformulate and approximate solution.
We theoretically analyze the transferability of our attack. First, we quantify the correlation between the target and surrogate watermarking models. Using this correlation, we derive the probability that the target model's 's decoded watermark is flipped after adding our perturbation. From this, we further derive upper and lower bounds for the probability that the decoded watermark matches the ground truth. These bounds quantify the transferability of our attack.
empirically evaluate our transfer attack on image datasets from Stable Diffusion and Midjourney, using multiple watermarking methods (Zhu et al. 2018)) Tancik et al. 2020 Fernandez et al. [023] Jiang et al. 2024). Our attack, using dozens surrogate models, successfully evades watermark de- tectors while maintaining image quality (see examples in Figure D. This holds even when surrogate models differ from the target in algorithms, architectures, watermark lengths, and training datasets. Our attack also outperforms common post-processing, existing transfer attacks (Jiang et al.) 2023 An et al.) 2024), and the state-of-the- purification method (Nie et al. 2022), showing that existing image watermarks are broken even in the no-box setting. We note that the elfectiveness of our attack to completely new target watermarking method is unclear, which we discuss in Section 7
To summarize, our contributions are as follows:
We propose a transfer attack based on multiple surrogate watermarking models to watermark-bassel Al-generated image detector.
We theoretically analyze the effectiveness of attack.
2

---

Published as a conference paper at ICLR 2025
We empirically evaluate our attack and compare it with existing ones in different scenarios.
2 RELATED WORK
2.1 IMAGE WATERMARKS
Three components: An image watermarking method consists of three components: a watermark (a
bitstring), an encoder that embeds into an image, and a decoder that extracts it. In non-learning
based methods (Al-Haj 2007 Bi et al. 2007 Pereira & Pun 2000; Kang et al. 2010 Pramila
ct al. 2018). used for decades, the encoder and decoder are handcrafted but lack robustness to post- processing like JPEG compression or Gaussian noise Qiang al.
(023) (as confirmed in Section 7
In contrast, learning-bate -based methods (Zhu et al. 2018 Zhang et al. 2020 TTancik et al.) (020) use deep learning, with both the encoder and decoder trained end-to-end. The encoder combines water- mark and image features to generate a watermarked image, while the decoder retrieves the water- mark. Joint training minimizes visual differences while ensuring accurate decoding. Learning- -base methods, strengthened by adversarial training (Zhu et al. 2018). offer greater robustness, so we fo- cus on them.
Ad Adversaiial training: Adversarial training (addr et al. 2018 Goodfellow et al. 2015 is standard method to train robust classifiers and has been extended to train robust watermarking mod- els (Zhu et al. 2018). The key idea is to add a post-processing layer between the watermark encoder and decoder. The post-processing layer aims to mimic post post-processing that a watermarked image may undergo. Specifically, the post-processing layer post-processes watermarked image before sending it to the decoder. After jointly training the encoder and decoder using adversarial training, the decoder can still decode the watermark watermarked image even if undergoes some post- processing. Thus, we use adversarial training in our experiments to train encoders and decoders.
2.2 EVASION ATTACKS
White-box: Jiang et al. (2023) proposed white-box attack which assumes the attacker has access to the target watermark decoder. Given the target watermark decoder and a watermarked image, an attacker finds a small perturbation such that the watermark decoded from the perturbed image is close random watermark. In other words, the perturbation removes the watermark from the watermarked image and thus the perturbed image evades watermark- detection. Specifically, the attacker finds the perturbation by solving an optimization problem via gradient descent.
Black-box: In blx setting, an attacker has access to the API of a watermark- detector, which detects images as Al- -e-generated (watermarked) or non-Al- ----eeereee (non watermarked), A black-box attack (Jiang et al., 2023, Lukas et al. (024) uses the API to modify watermarked image to remove its watermark. Starting with an initially perturbed image detected as non-Al ---ennereed the attacker gradually reduces the perturbation by repeatedly querying the API. With enough queries, the attacker can find a minimally perturbed image that evades detection.
No-box: In this setting, an attacker even has no access the detection API. In such setting, com- mon post-processing or transfer attacks can be used to remove watermarks. Specifically, common post-procssiing refers image editing methods such as JPEG compression and Gaussian noise. Wa- termarks embedded by non-learning- based methods can be removed by common post-processing, but learning-baat based
based methods are more robust due adversarial training (Zhu al. 2018).
Existing transfer attacks rely on a single surrogate model (Jiang et al. 2023) or conventional classifier-based adversarial examples (An et al. 2024), but achieve limited success against learning- based watermarks (Jiang et al. 2023 An et al. 2024,, even if we leverage state-of-the-ard multiple surrogate classifiers based transfer adversarial examples (Chen et al. 2024). Note that compared to the existing watermark-basee transfer attack (Jiang al. 2023) that leverages only one surrogate watermarking model, our transfer attack leverages multiple surrogate watermarking models. One technical contribution of work is to develop methods to aggregate multiple surrogate water- marking models when perturbing a watermarked image. Another technical contribution is that we theoretically analyze the effectiveness of natermark-hasee transfer attacks.
3

---

The above is known double-tail detector @Jang et al. 2023). In single-tail detector, an image detected as Al-generated if (A()()), w) т. The double-tail detector more robust; if perturbed watermarked image evades the double-tail detector, it will evade the single-tail detector as Published as a conference paper at ICLR 2025
3 PROBLEM FORMULATION
3.1 WATERMARK-BASER DETECTION
A GenAl service provider trains a watermark encoder (target encoder) and decoder (target decoder, denoted 7') for Al-generated image detection. A watermark embedded into each image during generation and decoded from an image using T(x). The bitwise accuracy BA(w1, W2) measures the proportion of identical bits between two watermarks w1 and W2. Detection determines if an image is Al Al-generated based on the bitwise accuracy B (A) w) between the decoded watermark and the ground-truth watermark. Specifically, x flagged as Al-generated if B (T))), w) exceeds is set to ensure the false detection rate does not exceed a small value 7) (Jiang et al. 2023 (e.g., for a 30-bit watermark and 7) = 10 T 0.83).
a threshold falls below
well, but not vice versa. Thus, we focus on the double-tail detector in this work.
3.2 THREAT MODEL
Suppose an attacker uses GenAl service to produce watermarked image Tar- The attacker's goal is introduce minimal perturbation to watermarked image Tux aiming to evade watermark-basee detection while preserving image quality. Consequently, the attacker can engage illicit activities using this image, such as boosting disinformation and propaganda campaigns well as claiming ownership of the image.
Attacker's goal:
Attacker's knowledge: GenAl service provider's watermark-based detector includes a target encoder, decoder, ground-truth watermark w, and detection threshold т. no-box setting, the attacker has no access to any of these components, nor the architecture of the encoder/decoder, the length of w, or the dataset used for training. This threat model applies when the GenAl service keeps its detector private and limits API access to trusted customers.
Attacker's capability: We assume an attacker can add perturbation to an Al-generated, water- marked image. Furthermore, we assume that the attacker has sufficient computational resources to train multiple surrogate watermarking models, where each surrogate watermarking model includes surrogate encoder and surrogate decoder.
4 OUR TRANSFER ATTACK
4.1 OVERVIEW
We propose a transfer attack to evade watermark-based AI image detection by training multiple surrogate watermarking models. These models, trained independently different dataset than the target model, are used to generate perturbations for watermarked images. For a given image Tw generate perturbation 5 such that the watermark decoded by each surrogate model for zw + 8 differs significantly from the original watermark. The intuition that if multiple surrogate decoders produce different watermarks, the target decoder will likely do the same, evading detection. The same surrogate decoders are used for all images. Next, we detail the training of surrogate models and perturbation generation.
4.2 TRAIN SURROGATE WATERMARKING MODELS
Transfer attacks require surrogate watermarking models to generate perturbations for watermarked images. A key challenge is ensuring diversity among these models improve transferability. The attacker collects a surrogate dataset, potentially with a different distribution from the target model's dataset, and uses bootstrapping (Efron & Tibshirani, 1994) to promote diversity. Specifically, subsets are resampled from the dataset, each used to train one of the m surrogate models. Addition- ally, the attacker vary neural network architectures and watermark lengths across the models.
4

---

Published as a conference paper at ICLR 2025
4.3 FORMULATE AN OPTIMIZATION PROBLEM
detection, we generate a perturbation ó for a given watermarked image Tu based on the m surrogate decoders since the detection process only involves decoders. Specifi- cally, our goal is to add a perturbation å to the watermarked image Tw such that, for each surrogate decoder, the decoded watermark from the perturbed image Iw + å matches an attacker-chosen wa- termark, which we call target watermark. Our transfer attack faces two key challenges: 1) how to select target watermark for a surrogate decoder, and 2) how to generate perturbation based on the m target watermarks and surrogate decoders. We discuss how to address the two challenges in the following.
To evade watermark
Select a target watermark for a surrogate decoder: We use wp to denote the target watermark for the ith surrogate decoder, where 1,2, , We consider the following three approaches to select w.
m.
Random-Different (RD). This method involves randomly generating different target watermarks for the m surrogate decoders. For the ith surrogate decoder, each bit of w is sampled from {0. 1} uniformly at random. The intuition of this method that, if the m surrogate decoders decode random watermarks from the perturbed image, then the target decoder is also likely to decode a random watermark from the perturbed image. As a result, the bitwise accuracy between the watermark T(= + 6) decoded by the target decoder for the perturbed image and the ground-truth watermark w is expected to approach 0.5, thereby evading detection.
Random-Same (RS). This method randomly generates one random target watermark w for all m surrogate decoders, i.e., w w², Vi 1,2,- .... m.. The intuition is that it is more likely to find perturbation 8 such that the surrogate decoders decode the same target watermark from the perturbed image, and thus it is more likely for the target decoder to decode w from the perturbed image. Since w' is picked uniformly random, the bitwise accuracy between w and we is expected to approach 0.5 and detection is evaded.
Inverse-Decode (ID). Generating random watermarks for surrogate decoders poses challenge, as about 50% bits must be flipped during perturbation optimization, given that each bit of the target watermark is uniformly sampled from {0, 1}. Some bits may be resistant pixel changes, requiring large perturbations.
To address this, we propose using the inverse of the watermark decoded by each surrogate decoder as the target watermark. Let S; denote the ith surrogate decoder, which decodes a watermark from a watermarked image Far denoted as (zww) We use the inverse, S; (zw),, ), as the target watermark wi for S,. The intuition is that if the surrogate-decten decoodd watermark is reversed, the target decoder's s output T( + 5) will likely also be close to the inverse of T( making the bitwise accuracy between T(x,.. + 8) and w very small. We note that such bitwise accuracy may be even smaller than 1-7, which means that the double-tail detector can still detect the perturbed image as Al-generated, watermarked image. We mitigate this issue using early stopping, as discussed in Section 4.4
With the inverse watermark as target watermark, it may result in those bits that are less robust to pixel changes being flipped first during perturbation optimization process, which can lead to a smaller perturbation compared to random target watermark when the same portion of bits are flipped, as shown in our experiments.
Aggregate m surrogate decoders: Given target watermark w for the ith surrogate decoder, the attacker then finds a perturbation 5 for the watermarked image Ia by aggregating the m surrogate decoders. We consider two ways to aggregate the m surrogate decoders.
Post-Aggregate (PA). A simple approach is to apply an existing white-box attack to find a pertur- bation 6, for each surrogate decoder. For example, given a watermarked image Za.s the ith surrogate decoder S,, and target watermark wf. the attacker can use the white-box attack (Jiang et al. 2023) to obtain 8, This yields m perturbations { which are then aggregated into final perturbation 5 using method like mean or median. However, aggregation can disrupt effective patterns in the individual perturbations, limiting transferability to the target decoder, as shown in our experiments.
Ensemble-Optimizattn Optimization (EO). To address the challenge of PA, EO considers the m surrogate de- coders when optimizing the perturbation d. Specifically, EO aims to find a minimum perturbation such that the watermark ST + d) decoded by each surrogate decoder for the perturbed image
5

---

Published as a conference paper at ICLR 2025
Tw + 8 is the same its corresponding target watermark w/. Formally, we formulate optimiza- tion problem as follows:
min |00 s.t. (T + 6) wt, Vi 1,,,
EO finds a single perturbation that makes all m surrogate decoders produce their respective target watermarks for the perturbed image ww + 6. This unified perturbation improves transferability the target decoder, as demonstrated in our experiments. We use the fx- -nomm to measure perturbation size, but our method adapts other metries like or SSIM, shown in results.
4.4 SOLVE THE OPTIMIZATION PROBLEM
Solving the optimization problem in Equation gets the perturbation ó for the watermarked image Tmp- However, since the constraints the optimization problem are extremely strict, is difficult to solve the optimization problem. To address this challenge, we relax the constraints and reformulate the optimization problem as follows:
min |
s.t. 1(S + +). w/) < Vi 1,2, , m.
(2)
where I(:, denotes a metric to measure the distance between two watermarks. For instance, I(:;) is the square error in experiments. The reformulated optimization problem is still challenging to solve due to the high non-linearity of the relaxed constraints. To address this challenge, we further reformulate the optimization problem as follows:
min
(S +8),
8.1. |
rr
(3)
m
BA(S((EW w)) 1, m
where r is perturbation budget and (called sensitiviry) is used to ensure that the bitwise accu- racy between the watermark decoded by each surrogate decoder for the perturbed image and the corresponding target watermark is high enough produce an effective perturbation.
We use projected gradient descent (PGD) (Madry et al. 2018) to solve the optimization problem in Equation To control the strength of our transfer attack, we apply the second constraint as early stopping condition. Algorithm [ (Appendix) outlines the procedure for finding the perturbation ó. The algorithm initializes zero, computes gradients of the objective in Equation 3 and updates using gradient descent. If the norm of 8 exceeds it is projected back onto the -norm ball. The algorithm stops when set iteration limit or bitwise accuracy threshold reached.
THEORETICAL ANALYSIS
Given the watermarks decoded by the surrogate decoders for the perturbed image, derive both an upper bound and a lower bound for the probability that the watermark decoded by the target decoder for the perturbed image matches with the ground-truth watermark, which quantify the transferability of our transfer attack. Specifically, we derive the following theorem. Other details are shown Appendix B
Theorem 1. For any watermarked image x perturbation ó satisfying the constraints in Equation and watermarks decoded by m surrogate decoders for the perturbed image, the probability that the jth bit of the watermark decoded by matches the ground tound watermark w is bounded as follows:
mmxx(3 - -):
1 j S n,
(x + O)₂ = w/y S (Im + 8),5 Smm + +5);)
10,
n n<3 j $ nh-
lp 11, 1 j $ n, n < S Te.
Pr(T(xw + 8); = wiy S (zw + 8)),-.. Sm +8),) <
1,

---

Published as a conference paper at ICLR 2025
1.0
1.0
1.0
Exuaton Bate
Eoruzon Rate
0.8
0.8
0.6
6.6
0.0
Emudoon
0.4
6.4
0.4
0.2
0.2
0.2
0.01
0.01
0.01
0
60
60
100
40
60
100
20
40
100
# Sarrogolee Mudille
Suzmopale Moddels
of Surtogaate Mandelis
1.00
1.0
1.0
Stalu
Evoion Rale
0.8
Fonsion Rade
0.8-
Eovebo Mateo
0.8
0.6
8.6
0.6
0.4-
0.4
0.2
0.2
0.2
0.01
6.0
0.0
10
100
00
100
0
30
60
30
of Surrogate Models
Strtogate Models
# Surrogate Models
(a) 20
(b) 30 bits
(c) 64 bits
Figure 2: Evasion rate our transfer attack when the target model uses CNN (forst row) or ResNet (second row) architecture and different watermark lengths (the three columns). The surrogate models use CNN architecture and watermark length of 30 bits.
6 EXPERIMENTS
6.1 EXPERIMENTAL SETUP
Datasets: In our experiments, we utilize three publicly available datasets (Wang al., 2023 Turc Nemade 2022; Images] 2023) generated by Stable Diffusion, Midjourney, and DALL-E The first two datasets used to train and test the target watermarking models, while the last dataset is used to train the surrogate watermarking model. Each training set contains 10,000 images, and each testing contains 1,000 images. The details of the datasets are introduced in Appendix H
Surrogate watermarking models and watermark lengths: Unless otherwise mentioned, we use HiDDeN (Zhu al. 2018) and its CNN architecture with 30-bit watermark length to train sur- rogate watermarking models. This consistent setup serves two purposes: 1) it helps clearly assess our attack's transferability when the target and surrogate models have different architectures wa- termark lengths, and 2) it allows for better analysis of how the number of surrogate models affects transferability, without the confounding factors of varying architectures watermark lengths.
Target watermarking models and watermark lengths: For the target watermarking model, we use different choices of watermarking methods, architectures, and watermark lengths to analyze the transferabilitty of our transfer attack in different scenarios. Specifically, we consider HiDDeN (Zhu cct al. 2018), StegaStamp (Tancik et al., 2020), Stable Signature (Fernandez et al. 2023). Smoothed HiDDeN (Jiang et al.] (2224), and Smoothed StegaStamp (Jiang et al.) 2024) to train target water- marking models. The detailed settings of each watermarking method are shown in Appendix [
Common post-processing methods: We consider common post-processing methods. They are JPEG, Gaussian noise, Gaussian blur, and Brightness/Contrass. Details are introduced in Ap- pendix
Transfer attacks: In our experiments, we compare with 5 existing transfer attacks and state- of-the-art purification method for adversarial examples. They are WEvade-B-S (Jiang al. 2023)
AdvEmb-RN18 (An et al. 2024). AdvCls-Real& WM (An et al. 2024), AdvCIs-Enn Enc-----E---e &MT& WM2
MI-CWA (Chen et al. 2024). and DiffPure (Nie et al. 2022). Details are introduced in Appendix
We use two metrics: evasion rate and average perturbation. Evasion rate is the proportion of perturbed images that evade the target watermark detector. Average perturbation, measured by the -nomm, is averaged across 1,000 watermarked images in the test set. Following Jiang et al. (2023). with pixel values normalized from [0, 255] to [-1, 1]. we divide the perturbation by 2 to express
Evaluation metrics:
fraction of the full pixel range.
Parameter settings: We use adversarial training to train watermarking models since it enhances robustness. The detailed settings of parameters shown in Appendix L.

---

Published as a conference paper at ICLR 2025
Avnge F. Portuffation
0.25
Anmge Portutfattinn
0.25
Portufaarion
0.25
0.20
0.20
0.20
0.15
0.15
0.15
0..00
0.05
8..0
0.05
0.00
0.00
0.25
0.50
0.75
1.00
0.00
0.00
0.25
0.50
0.75
1:00
0.00
0.30
0.25
0.50
0.75
1.00
Dveston: Rate
Diaston Rate
Douston Rate
Aesragn 4. -.eturlttio
0.95
Averagn ta Peeturaation
625
4 Perturaation
0.25
0.20
0.20
0.20
0.15
6.15
0.15
20.10
20.13
0.05
0.05
0.05
0.00
0.00
0.00
0.00
0.75
0.50
0.75
1,00
0.00
0.25
0.50
0.75
1.00
0.50
0.95
0.50
0.75
1.00
Evesso: Bate
Eyuscon Rate
Eousion Rate
(a) 20 bits
(b) 30 bits
(c) 64 bits
Figure 3: Average perturbation of our transfer attack when the target model uses CNN (first row) or ResNet (second row) architecture and different watermark lengths (the three columns). The surro-
gate models use CNN architecture and watermark length of 30 bits.
Ansuge Dettureetion
Feigh
Like
Liu
0.5
0.6
0.5
0.4
Ansage 4g
30.4
0.2
0.2
0.
0.0
0.0
0.01
0.00
0.00
0.95
3.50
0.75
Evaston Bate
(a) 20 bits
(b) 30 bits
(c) 64 bits
Figure 4: Comparing the average perturbations of our transfer attack and common post-processing methods when they achieve the same evasion rate. The target model uses ResNet architecture and different watermark lengths (the three columns). Dataset is Stable Diffusion. Results for Midjourney are shown in Figure 7 in Appendix.
6.2 EXPERIMENTAL RESULTS
Our transfer attack is successful: Figure 2 and Figure showw the evasion rate and average pertur- bation of our attack, across different numbers of surrogate models, target model architectures, and watermark lengths. First, our attack successfully evades watermark- evasion rate over 85% with an average perturbation below 0.25 when using 100 surrogate models, regardless of target architecture or watermark length. Second, more complex target architectures require more surrogate models and higher perturbation. For example, 40 surrogate models and per- turbation of 0.09 achieve 100% evasion for a CNN with 30-bit watermarks, while 60 models and 0. 0.14 perturbation are needed for ResNet. Third, longer/shorter watermarks also increase the at- tack's complexity. For ResNet with 30-bit watermarks, 40 surrogate models and perturbation of 0.08 yield 85% evasion, while 100 models and 0.15 perturbation are needed for 64-bit watermarks.
and
detection, achieving an
Our transfer attack outperforms common post-processing: Figure compares the average per- turbations of common post-processing methods and our transfer attack when they achieve the same evasion rates for different target models. For each evasion rate achieved by our transfer attack, adjust the parameters of the post-processing methods to match it. We find that our attack intro- duces much smaller perturbations than post-processing methods for the same evasion rate. Note that Brightness/Contrasy only reaches up to 75% or 50% evasion for some models, so its curves are shorter the graphs. For a broader comparison, Figures g and [inn in Appendix show results using (2-norm and SSIM. Our attack consistently introduces smaller perturbations and maintains better visual quality than common post- post-processing, regardless of the metric used.
Our transfer attack outperforms existing ones: Figure 5a compares the evasion rates of existing methods and our transfer attack when the target model is ResNet with varying watermark lengths. Since AdvCls-Reaa Real-Ral&&W Wm and AdvCls-Enc- Tals--nn-WW. WM1 & WM2 achieve average perturbations around 0.1 regardless of the budget r, we introduce a variant of our method with r = 0.1 for comparison. For fairness, we constrain MI-CWA and DiffPure an average SSIM of 0.9, similar to our attack with
8

---

Published as a conference paper at ICLR 2025
Desion Rate
11.
1.00
1.0
Aneage Eo. Pettativiios
1.00
0.5
Eogoun Role
0.5
0.44
0,6
0.22
0.0
20 bets
30 bits
54 lite
02
0.0
0.1 Querly w0og
20
80
60)
90
100
60
100
of Stctogaat Modeds
5 oC Surrogite Modkhh
(a) Existing and ours
(b) Evasion rate
(c) 8o -nor perturbation
Figure 5: (a) Comparing evasion rates of existing and our transfer attacks. The target model is ResNet and uses watermarks with different lengths. Dataset is Stable Diffusion. Similar results for Midjourney are shown in Figure I0 in Appendix. (b) Evasion rates and (c) average -nomm perturbation of our transfer attacks to different target watermarking methods.
100 surrogate models, Other attacks have set to 0.25, We also report the evasion rate for each method across wide range of SSIM constraints in Figure 11
Appendix.
Our transfer attack significantly outperforms existing methods, which mostly achieve 0% evasion, except AdyCls-Enc- &MI& marks but requires access to the target encoder. MI-CWA and DiffPure show low evasion rates due to the limitations of classifier-based attacks and heavy image modification for watermark removal. In contrast, our transfer attack achieves much higher evasion rates while maintaining high image quality, with an average SSIM above 0.97 for r = 0.1 and above 0.92 for r = 0.25.
which reaches 10% on Stable Diffusion with 20-30 bit water-
Our transfer attack transfers to other target watermarking methods: Figures 56 and show the evasion rates and average -nom perturbations of our transfer attack across different target wa- termarking methods. To improve transferability, we use equal numbers of HiDDeN and StegaStamp as surrogate models. Our attack remains effective even when surrogate and target methods dif- fer, achieving over 77% evasion across all five target methods with 100 surrogate models. Despite Smoothed HiDDeN and Smoothed StegaStamp being certifiably robust, they are still vulnerable to our attack. While evasion rates slightly lower for Smoothed HiDDeN with 20 models and Smoothed StegaStamp with over 60 models, we still exceed 77% evasion with up to 100 models, as our perturbations exceed their certified bounds while preserving image quality.
Impact of sensitivity e: Figures 12a and 12b in Appendix show the evasion rate and average -nom perturbation for different sensitivity values (c) in our transfer attack on Stable Diffusion, with a CNN target model using 30-bit watermarks. Figures 13a and 13b in Appendix show results for f2-norm and SSIM. We observe that fewer surrogate models are needed for the same evasion rate when e is smaller. However, with very small (c.g.. 0.1), the evasion rate first increases but then decreases as more surrogate models are used, due to reduced bitwise accuracy in watermark decoding. Across different e values, the average perturbation (whether measured by -nomm, by- norm, or SSIM) remains nearly constant for a given evasion rate, reflecting the strong correlation between perturbation size and evasion success.
Different variants of our transfer attack: options. In the first step, we use RD, RS, or ID; in the second step, PA or EO is used. Variants are denoted by combining these symbols, e.g., RD-PA. When PA is used, "Mean" or "Median" indicates the aggregation rule, such as RD-PA-Mean. Figures 12c and [2d Appendix show evasion rates and -orm perturbations for different variants on Stable Diffusion, with CNN using 30- bit watermarks. Figures 13c and 13d in Appendix show f--norm and SSIM results. EO-based variants successfully evade detection, while PA-based variants do not, showing EO is more effective for surrogate decoder aggregation. Among EO variants, ID-BO outperforms RD-EO and RS-EO, achieving 100% evasion with fewer surrogate models, lower perturbations, and higher SSIM.
Our attack has two steps, each with multiple design
Theoretical vs. empirical results: Figures 6a and (hoshow the empirical bitwise accuracy between the watermark decoded by the target decoder and the ground truth, along with our theoretical upper and lower bounds on the Stable Diffusion dataset. To estimate these bounds, we measured unper- turbed similarity, transfer similarity, and attack strength using 1,000 test images. Using Theorem [ computed the probability for each bit pj. then averaged the bounds across all bits. We observe that the empirical results generally fall within our theoretical bounds, with a few exceptions due to the use of only 1, 1,000 images for estimation, leading minor inaccuracies.

---

Published as a conference paper at ICLR 2025
1.4
1/
And anesgg wieeeee Astupay
Aneage Biveee Artur
01.-
03.84
0.5
Ralc
0.5
3.5
0.0
TeccTac
0.4
0.4
0..4
Dopprted
Duperical
0.2
Ehemrtica kowe bonnd
Threcsbial lowse hound
0.2
Tharrtioal hoand
Thocetioal rpper loand
0.0
of Surrogate Modda
100
20
# Burrogate Moddl
0.00
0.05
0.10
Deciittion
0.15
0.50
Non-learming-baeet Figure 6: Comparing empirical bitwise accuracy and theoretical bounds of our transfer attack when
(a) CNN
(b) ResNet
the target model is (a) CNN and (b) ResNet. (c) Comparing evasion rates of learning-basee watermarking models and HiDDeN under Gaussian noise with varying standard deviations.
DISCUSSION AND LIMITATIONS
We focus on transfer attacks against learning- water- marking models because they are more robust than non-learning-based ones. For example, common post-srocessing like Gaussian noise can easily remove watermarks from non-learning-
Von-learning-basee watermarking:
mod- presents
els. but (carning-basel models resist such attacks (Jiang et al. 2023). Figure /6 pressents the evasion rates of Tree-Ring (Wen et al. 2024), RinglD (Ci al. 2025). Gaussian Shading (Yang et al.. 2024), and HiDDeN with ResNet under Gaussian noise. For the standard deviation larger than 0. 1, the non-learning- based methods exhibit significantly higher evasion rates, whereas the learning- -baeed method maintains an evasion rate close to zero. These results underscore the superior robustness of learning-based watermarking methods compared to the non-learning-basse ones.
Our attack can also applied to non-learning-basee based methods. Figure [5] in the Appendix shows that our attack achieves high evasion rates when the target watermarking method is DWT-DCT (AI-) Haj. 2007) while the surrogate models are trained under our default experimental settings. Unlike learning-based methods, DWT-DCT' is non-learning-bast based watermarking method used by Stable Diffusion. It employs the Discrete Wavelet Transform (DWT) to decompose an image into frequency sub-bands, applies the Discrete Cosine Transform (DCT) to blocks within selected sub-bands, and embeds the watermark by modifying specific frequency coefficients. The watermarked image is then reconstructed using inverse transforms. The result shows that our attack requires more surrogate models compared to learning-baset -based methods. This is because non-learning- based watermarking method is substantially different from learning-based and our attack needs more surrogate models to increase diversity to enhance transferability.
We acknowledge that the vietim may design a new watermarking method entirely different from those used by the attacker surrogates, and the effectiveness of our attack in such scenarios is unclear. We believe this can be an interesting future work to explore.
Computational cost: Our transfer attack trains surrogate watermarking models and optimizes per- turbations for watermarked images. Thus, the computational cost consists training time (to train surrogate models) and inference time (to optimize perturbation for image). Table in Appendix compares the computational costs of our attack with six baselines. Attacking high-capacity water- marks (Zhong et al.) (2200) may require more surrogate models, further increasing training cost-a practical limitation of our approach. However, training multiple surrogate models can be paral- lelized across GPUs, and this training is one-time process, which helps mitigate the limitation. We acknowledge that our inference time exceeds most baselines but remains acceptable with adequate computational resources.
CONCLUSION AND FUTURE WORK
In this work, we find that watermark- based detection of Al-generated images is not robust to transfer attacks in the no-box setting. Given watermarked image, an attacker can remove the watermark by adding a perturbation to it, where the perturbation can be found by ensembling multiple surro- gate watermarking models. Our results show that transfer attack based on surrogate watermarking models outperforms those based on surrogate classifiers that treat a watermark based detector as a conventional classifier. Moreover, leveraging surrogate watermarking models enables to perform a rigorous analysis on the transferability our attack. Interesting future work includes extending transfer attack to text and audio watermarks, as well designing more robust watermarks.
10

---

Published as a conference paper at ICLR 2025
9 ACKNOWLEDGMENT
We sincerely thank all the reviewers for their constructive feedback. This work was supported by NSF grants No. 2414406, 2131859, 2125977, 2112562, and 1937787, well as ARO grant No. 1911NF210012.
REFERENCES
Sahar Abdelnabi and Mario Fritz. Adversarial watermarking transformer: Towards tracing text provenance with data hiding. In IEFE Symposium Security and Privacy, 2021.
Al-Haj. Combined dwt-det digital image watermarking. Journal of computer science, 2007.
Bang An, Mucong Ding, Tahseen Rabbani, Aakriti Agrawal, Yuancheng Xu, Chenghao Deng, Sicheng Zhu, Abdirisak Mohamed, Yuxin Wen, Tom Goldstein, et al. Benchmarking the ro- bustness of image watermarks. arXiv preprint arXivv2401.08857 2024.
Ning Bi, Qiyu Sun, Daren Huang, Zhihua Yang, and Jiwu Huang. Robust image watermarking based multiband wavelets and empirical mode decomposition. IEEE Transactions Image Processing, 2007.
Huanran Chen, Yichi Zhang, Yinpeng Dong, and Jun Zhu. Rethinking model ensemble in transfer- based adversarial attacks. In International Conference on Learning Representations, 2024.
Hai Ci, Pei Yang, Yiren Song, and Mike Zheng Shou. Ringid: Rethinking tree-ring watermarking for enhanced multi-key identification. In European Conference Computer Vision, 2025.
Bradley Efron and Robert J Tibshirani. An introduction to the bootstrap. CRC press, 1994.
Pierre Fernandez, Guillaume Couairon, Hervé Jégou, Matthijs Douze, and Teddy Furon. The stable signature: Rooting watermarks in latent diffusion models. IEEE Conference on Computer Vision and Pattern Recognition, 2023.
Ian J Goodfellow, Jonathon Shlens, and Christian Szegedy. Explaining and harnessing adversarial examples. In International Conference on Learning Representations, 2015.
DALLE2 Images.
ftttps://Galle..ggal11
2023.
Zhengyuan Jiang, Jinghuai Zhang, and Neil Zhenqiang Gong. Evading watermark based detection of ai-generated content. In ACM Conference on Computer and Communications Security, 2023.
Zhengyuan Jiang, Moyang Guo, Yuepeng Hu, Jinyuan Jia, and Neil Zhenqiang Gong. Certifiably robust image watermark. In European Conference Computer Vision, 2024.
Xiangui Kang, Jiwu Huang, and Wenjun Zeng. Efficient general print-scanning resilient data hiding based uniform log-polar mapping. IEEE Transactions Information Forensics and Security, 2010.
John Kirchenbauer, Jonas Geiping, Yuxin Wen, Jonathan Katz, Ian Miers, and Tom Goldstein. A watermark for large language models. In International Conference on Machine Learning, 2023.
Yanpei Liu, Xinyun Chen, Chang Liu, and Dawn Song. Delving into transferable adversarial exam- ples and black-box attacks. In International Conference on Learning Representations, 2017.
Nils Lukas, Abdulrahman Diaa, Lucas Fenaux, and Florian Kerschbaum. Leveraging optimization for adaptive attacks on image watermarks. In International Conference on Leurning Representa- tions, 2024.
Aleksander
Madry, Aleksandar Makelov, Ludwig Schmidt, Dimitris Tsipras, and Adrian Vladu. Towards deep learning models resistant to adversarial attacks. In International Conference on Learning Representations, 2018.
11

---

Published as a conference paper at ICLR 2025
Weili Nie, Brandon Guo, Yujia Huang. Chaowei Xiao, Arash Vahdat, and Anima Anandkumar. Diffusion models for adversarial purification. In International Conference on Machine Learning, 2022.
S. Pereira and T. Pun. Robust template matching for affine resistant image watermarks. Transactions on Image Processing, 2000.
IEEE
Anu Pramila, Anja Keskinarkaus, and Tapio Seppänen. Increasing the capturing angle in print-cam robust watermarking. Journal of Systems and Software, 2018.
Aditya Ramesh, Mikhail Pavlov, Gabriel Goh, Scott Gray, Chelsea Voss, Alce Radford, Mark Chen, and Ilya Sutskever. Zero-shot text-to-image generation. In International Conference Machine Learning, 2021.
Robin Rombach. Stable diffusion watermark decoder,
/tter//.uuuoooot..rr///////aattt stable http:///.....aaaaaao.///aaaaaaaa otteee/sssssseeessssssssseaeeerr 2022.
http:/thhu..cmo/om////aaaaaaaa wwtermark.
Mehrdad Saberi, Vinu Sankar Sadasivan, Keivan Rezaei, Aounon Kumar, Atoosa Chegini, Wenxiao Wang, and Soheil Feizi Robustness of ai-image detectors: Fundamental limits and practical attacks. In International Conference on Learning Representations, 2024.
Chitwan Saharia, William Chan, Saurabh Saxena, Lala Li, Jay Whang, Emily Denton, Kamyar Ghasemipour, Raphael Gontijo Lopes, Bureu Karagol Ayan, Tim Salimans, et al. Photorealistic text-to-image diffusion models with deep language understanding. In Advances in Neural Infor- mation Processing Systems, 2022.
Matthew Tancik, Ben Mildenhall, and Ren Ng. Stegastamp: Invisible hyperlinks in physical pho- tographs. In IEEE Conference on Computer Vision and Pattern Recognition, 2020.
Iulia Turc and Gaurav Nemade. Midjourney user prompts & generated images (250k). https: 2022.
7/www. kaggle. 223mm/ds/3349//
Zijie J. Wang, Evan Montoya, David Munechika, Haoyang Yang, Benjamin Hoover, and Duen Horng Chau. DiffusionDB: A large-scale prompt gallery dataset for text-to-image gen- erative models. In Annual Meeting of the Association for Computational Linguistics, 2023.
Yuxin Wen, John Kirchenbauer, Jonas Geiping, and Tom Goldstein. Tree-rings watermarks: Invis- ible fingerprints for diffusion images. In Advances Neural Information Processing Systems, 2024.
Zijin Yang, Kai Zeng, Kejiang Chen, Han Fang, Weiming Zhang, and Nenghai Yu. Gaussian shad- ing: Provable performance-lossler image watermarking for diffusion models. In IEEE/CVF Conference on Computer Vision and Pattern Recognition, 2024.
Chaoning Zhang, Philipp Benz, Adil Karjauv, Geng Sun, and In So Kweon. Udh: Universal deep hiding for steganography, watermarking, and light field messaging, In Advances in Neural Infor- mation Processing Systems, 2020.
Xuandong Zhao, Kexun Zhang, Zihao Su, Saastha Vasan, Ilya Grishchenko, Christopher Kruegel, Giovanni Vigna, Yu-Xiang Wang, and Lei Li. Invisible image watermarks are provably removable using generative ai. In Advances in Neural Information Processing Systems, 2024.
Xin Zhong, Pei-Chi Huang, Spyridon Mastorakis, and Frank Shih. An automated and robust image watermarking scheme based deep neural networks. IEEE Transactions on Multimedia, 2020.
Jiren Zhu, Russell Kaplan, Justin Johnson, and Li Fei-Fei. Hidden: Hiding data with deep networks. In European Conference on Computer Vision, 2018.
12

---

Published as a conference paper at ICLR 2025
Table 1: The detailed settings of for different number of surrogate models.
# of Surrogate Models
5 10
20
30
40
60
80
100
ax
0.1
1
4
Computational cost comparison of existing attacks and our transfer attack on a single NVIDIA RTX-6000 GPU. ÅrNIS denotes the pre-training time of ResNet-18 ImageNet, and Apr denotes the training time of the unconditional diffusion model used by DiffPure. We note that training only needs be done once.
Table 2:
Method
Training Time (h)
Inference Time per Image (s)
AdyEmb-RN18
DRNIS
72.09
AdvCls-Real& WM
ARNIS + 0.11
77.04
AdvChs-Enc-WMI&WWW
ARNIS + 0.11
77.70
MI-CWA
ARNIS + 0.11
27.01
DiffPure
ADIT
8.96
WEvade-BB --S
17.06
187.03
Ours
6.50
177.97
Avenge & Penurtation
X0-0)
Apeege Pertrtattion
1.3
Average bg Pertutsation
1,0
0.5
0.8
Greene Like
0.5
Tright
Gevera Lik
0.6
0.9
0.6
50.4
0.2
0.0
0.3
0.0
0.00
0.50
1,00
0.00
0.25
0.75
1.00
0.25
0.25
1.00
Exusion
(a) 20 bits
(b) 30 bits
(c) 64 bits
Figure 7: Comparing the average perturbations of our transfer attack and common post-processing methods when they achieve the same evasion rate. The target model uses ResNet architecture and different watermark lengths (the three columns). Dataset is Midjourney.
A
ETHICS CONCERNS
Our proposed method has the potential to compromise the identity and authenticity of Al-generated images, raising ethical and societal concerns. Such misuse could erode trust digital media by en- abling unauthorized modifications misatrriutiions. To mitigate these risks, it is crucial to develop robust watermarking methods that can withstand our transfer attack. As discussed in Section 7 attack's effectiveness is unclear when the target watermarking method is entirely unknown and significantly different from the surrogate methods used by attackers. Therefore, designing novel watermarking techniques with fundamentally different mechanisms and maintaining their confiden- tiality could serve as an effective strategy to mitigate these risks.
B THEORETICAL ANALYSIS
derive both an upper bound and a lower bound of the probability because we consider double-tail detectors. Specifically, they enable to compute the upper bound and lower bound of the expected bitwise accuracy between the watermark decoded by the target decoder for the perturbed image and the ground-truth watermark. If such upper bound and lower bound of the expected bitwise accuracy fall between т and 1 т, the perturbed image produced by our transfer attack expected to evade the target watermark- based detector. All proofs are shown in Appendix.
13

---

Published as a conference paper at ICLR 2025
80
80
80
Ansagg f. P.rtturlattnn
L1 (Lanti side D1an
Averago Perturlutton Pettorlattoo
Brantic
Avenage f. Perttorlutio
Seanii cade
Daai
00
20
20-
20-
0.00
0.25
0,50
1.75
1.00
0.00
0.25
0.50
0.75
1.00
0.0
0.2
0.4
0.0
Dinsson Rate
Evesion Rate
Emnsion Rate
80
80
Avorago l. P.rturlattnn
Clanto adde
Averago Perturlates
Brantic cole
Avenago 6. Perturlatioo
Stranic cade
60
80
Dran
30
20
20
20-
200
0.00
0.25
0.50
1.75
1.00
0.00
0.25
0.50
0.75
1.00
0.50
3.25
01.50
0.75
1.00
Evasson Rate
Erasion Rate
Evissoon Rate
(a) 20 bits
(b) 30 bits
(c) 64 bits
Figure 8: Comparing the average forn perturbations of our transfer attack and common post- processing methods when they achieve the same evasion rate. The target model uses ResNet archi- tecture and different watermark lengths (the three columus).. First row: Stable Diffusion. Second row: Midjourney.
1.0
0.8
0.5
0.8
Aecuge 3SIM
Areeugo SSIM
Apecuue SSLM
0.5
0.4
0.4
0.4
Gaannia 1ik
Glaanaa Edu
0.0
0.3
0.0-
0.003
0.50
0.303
0.70
0.8
0.5
0.5
Avcrug 3SIM
Averugo SSIM
Joscuge SSLM
0.5-
0.6
0.4
0.4
0.4
Buanic 1ku
Gaaana 1au
Degittan
0.0
0.3
0.0-
0.00
0.50
0.00
0.75
1.50
0.25
0.77
1.00
(a) 20 bits
(b) 30 bits
(c) 64 bits
Figure 9: Comparing the average SSIM of our transfer attack and common post-processing methods when they achieve the same evasion rate. The target model uses ResNet architecture and different watermark lengths (the three columns). First row: Stable Diffusion. Second row: Midjourney.
B. NOTATIONS
We adopt T to denote the target decoder and {S:) to represent the m surrogate decoders. w denotes the ground-truth watermark and Tu denotes watermarked image embedded with w. denotes a perturbation that satisfies the constraints of the optimization problem in Equation 3 We use n, and n, to denote the watermark length of surrogate decoders and target decoder respectively, while define n min(n,, nc). T(-), and Sz(:), denote the jth bit of the watermarks decoded by T and S, for an image, respectively. Moreover, we consider inverse watermarks as the target watermarks in transfer attack.
14

---

Published as a conference paper at ICLR 2025
1.0
Evasson Rate
0.8
0.6
0.4
0.2
0.0
bits
30 bits
64 bits
MaioRRrb--NNA (r 0.25)
Wi (n 0.25)
Ours 1r-100 0.13
Ours (r (225)
Figure 10: Comparing the evasion rates of existing and our transfer attacks when the target model is ResNet and uses watermarks with different lengths. Dataset is Midjourney.
1.0
0.8
Evasion Rate
AdvElal RNLS
0.6
MI-CWA
0.4
DiEPum
Ours
0.2
0.0
1.00
0.90
0.80
0.70
0.60
SSIM Constraint
Figure 11: Comparing the evasion rates of existing and our transfer attacks under different SSIM constraints between the watermarked and perturbed images. The target model uses ResNet architec- ture and watermark length 30 bits. Dataset Stable Diffusion.
ELU0
Bleen Bex
1301
40
10
1031
3.25
0.00
200
40
010
0123
0.30
2.70
110
Sammata
Poiire
Kedble
(b) -nomm perturbation Figure 12: (a) Evasion rate and (b) average -orm perturbation of transfer attack when using different sensitivity e. (c) Evasion rate and (d) average for -oorm perturbation of different variants of transfer attack.
(a) Evasion rate
(c) Evasion rate
(d) norm perturbation
1,00
1,01
0:077
2.3
2.3
E5/00
0.
0100
1133
0.00
0.70
L00
1100
0.25
11.00
0.75
100
1130
0.25
0.10
0.75
110
0125
0000
(a) noomm perturbation
(b) SSIM
(c) noomm perturbation
(d) SSIM
Figure 13: (a, b) Average norm perturbations and average SSIM of our transfer attack with dif- ferent sensitivity The target model uses CNN architecture and watermark length of 30 bits. (c. d) Average fy-norm perturbations and average SSIM of different variants of our transfer attack. The target model uses CNN architecture and watermark length of 30 bits.
15

---

Published as a conference paper at ICLR 2025
1.0
0.9
Percentage
0.8
0.7
0.6
0.5
16
Index of Bit
Figure 14: Percentage of the pairs of surrogate watermarking models that pass the Chi-square test of independence with confidence of 0.95 each bit. We randomly sampled 100 pairs of surrogate wa- termarking models from the 100 surrogate models in our experiments. For each bit of the watermark and pair of surrogate models, level of 0.95 using the decoded watermarks from the 1,000 perturbed images. The y-axis in the graph shows the percentage of the 100 pairs of the surrogate models that passed the independence test for each bit. These results verify that our independence assumption in Assumption 2 roughly hold.
performed the Chi-square independence test with confidence
1.0
Statie Dilbedon
Miljearzay
0.8
Evasion Rate
0.6
0.4
0.2-
0.0
20
40
60
80
100
# of Surrogate Models
Figure 15: Evasion rate of our transfer attack when the target watermarking model is non-learning- based.
B.2 FORMAL DEFINITIONS
In this section, will introduce the details of our formal definitions. We formally define un- perturbed similarity, positive transferring similarity, negative transferring similarity, q-attacking strength, 3-accurate watermarking, Bit-level dependency, Independency, and Conditional indepen- dency. Specifically, unperturbed similarity measures the probability that the watermarks decoded by the target decoder and surrogate decoders identical for watermarked image Iw without perturbation, which is formally defined as follows:
Definition 1 (Unperturbed similarity). For any watermarked image Tw and satisfying the con- siraints of the optimization problem in Equation 3 the jth bit of the watermark decoded by T matches with the jth bit of the watermark decoded by S₃ for Fw with probability kiy, given that the jth bits of the watermarks for Zw + 8 and xw decoded by S, are inverse. Conversely, it occurs with probability Kl given that the jth bits of the watermarks for Rw + and zw decoded by St are identical. Formally, for 1,2, , and j 1,2, ,,, have:
Pr(T(xw)s S,(Dw); S + +8); 11-;=(1-)))) (-((xw))) Kigs Pr(T(ww)s (,(w))) S 5)₂ -(( Kgy-
(4)
16

---

Published as a conference paper at ICLR 2025
Algorithm 1 Find the Perturbation 8
Require: Watermarked image Fu, surrogate decoders {S (5.) target watermarks {w)
distance metric I, perturbation budget r, sensitivity c, learning rate a, and maximum number of iterations mar_iter.
Ensure: Perturbation 8
1: Initialize 8
2: for k = 1.2, ... mar iter do
3: g f- V8 1 -i=1 (z + 6), w!)
4: --0 a.g
5:
if [81811 No > r then
6:
ò + 8 T
7:
end
if
8:
if 1
DE 1= BA(S,(E + +0), w/) 2 1 - then
9: Return 8
10: end if
end for
12:
Return 5
Note that both kay and kl can be estimated in experiments. Positive transferring similarity measures the probability that the watermarks decoded by target decoder and surrogate decoders for a perturbed image Tue + are identical when the watermarks decoded by the surrogate decoders are flipped after adding the perturbation, which is defined as follows:
Definition (Positive transferring similarity). For any watermarked image In and 8 satisfying the constraints of the optimization problem in Equation 3 the jth bit of the watermark decoded by T matches with the jth bit of the watermark decoded by S for Iw + 6 with probability aıj. given that the jth bits of the watermarks decoded by T and St are identical for zw. and the jth bits of the watermarks for Tw + ō and Iw decoded by S; are inverse. Conversely, it occurs with probability d's given that the jth bits of the watermarks decoded by T and Si for Tw inverse, and the jth bits of the watermarks for Ie + 5 and I. decoded by Sy are also inverse. Formally, for and j 1,2,,-. n. we have the following:
fori- 1,2,...70 m
Pr(T(xw + +5j -S + +5) 1055170 T((w) S:(Im)j:
S1(Iw 8)5
(,(w))) =aij
(5)
Pr(T(xw + +8g ( + +8) [(Ew), = =1- - S,(xw)j,
S1 + 8)5 = - -S,(sw))) = =dg-
Both dy and d' can be estimated in experiments. Similarly, we use negative transferring similarity to measure the probability that the watermarks decoded by target decoder and surrogate decoders for perturbed image Tw + 8 are identical when the outputs of surrogate decoders remain unchanged after adding the perturbation, which defined as follows:
Definition 3 (Negative transferring similarity). For any watermarked image Iwe and 8 satisfying the constraints of the optimization problem in Equation 3 the jth bit of the watermark decoded by matches with the jth bit of the watermark decoded by St for I.. + 5 with probability big, given that the jth bits of the watermarks decoded by T and S; are inverse for Two and the jth bits of the watermarks for xw +8 and xa decoded by S, are identical. Conversely, it occurs with probability b/; given that the jth bits of the watermarks decoded by T and S, for Rw identical, and the jth bits of the watermarks for Iw + and aw decoded by St are also identical. Formally, for = 1,2, .. ...... m and j 1,2, ................................ n. have the following:
Pr( + 5)5 = S1(Iw + 8), T(Iw); = =1 (s
S1 + 8), S(( bij.
(6)
Pr(T + 5)₁ = =S,(r + 8)5 T(Iw); = (z(
S.(Iw + 6), = S((xw),) = bl.z.
17

---

Published as a conference paper at ICLR 2025
Both by and bi, can be estimated in experiments. To quantify the magnitude of our transfer attack, we formally define the q q-attacking strength which measures the probability that the watermarks for the perturbed image and the watermarked image decoded by surrogate decoders are inverse as follows:
Definition (q-attacking strength). For any watermarked image aug and 6 satisfying the construints of the optimization problem in Equation 3 the jth bit of the watermark decoded by St for the perturbed image is the inverse of the jth bit of the watermark decoded by for the watermarked
1,2, ng we have the image with probability qsj- Formally, for i 1,2,... ... , and following:
Pr(Stlww + td); = 1:,;=(1-,())))) -S((w)))) q6j-
Bj can also be estimated in experiments. To quantify the performance of the target watermarking model when no perturbations are added to watermarked images, we introduce the following defi- nition on 3-accurate watermarking: assume the bitwise accuracy between the watermark decoded by the target decoder for the watermarked image and the ground-truth watermark following Poisson binomial distribution. Specifically, we have the following assumption:
Definition (ß-accurate watermarking). For any watermarked image ww the bits of the watermark decoded by T are mutually independent and the probability that the jth bit of the decoded watermark matches with that of the ground-truth watermark w is Bg. where j S T4.
31, S2.82..... ,r, can be estimated in experiments. Next, we introduce three assumptions regarding the surrogate decoders and the target decoder. For bit-level dependency. it is assumed that each bit of the watermark decoded by the target decoder only depends on the corresponding bits of the watermarks decoded by the surrogate decoders. Formally, we have the assumption as follows:
Assumption (Bit-level dependency). For any watermarked image Fww and satisfying the con- straints of the optimization problem in Equation 3 each bit of the watermark decoded by T for the perturbed image only depends on the corresponding bits the the watermarks decoded by the surrogate decoders for the perturbed image. Formally, for 1,2,. ,,, have the following:
Pr( + 8)5 S (Z + 5),... ...... Sm Sm + 5)) Pr( + 8)5 Si + d) (mw + +8))).
(8)
Additionally, since all the surrogate decoders trained independently with different subsets of data, we further assume that the watermarks decoded by the surrogate decoders are independent and conditionally independent given the watermark decoded by the target decoder for the watermarked or perturbed image. We verify the independency assumption and the results are shown in Figure [4]
Assumption (Independency). For any watermarked image Iw and 8 satisfying the constraints of the optimization problem in Equation B the jth bits of the watermarks decoded by the m surrogate decoders for the perturbed image are independent. Formally, for j = 1,2, .... ass we have the following:
Pr(Si (Na + 8)j;".. Sm(Vw + 8)5)
(9)
= Pr(( + 0)z) Pr(Sm + 6)z).
Assumption 3 (Conditional independency). For any watermarked image Fwe and 8 satisfying the constraints of the optimization problem in Equation 3 the jth bits of the watermarks decoded by the m surrogate decoders for Iw + are independent when the jth bit of the watermark decoded by the target decoder for Iw or Iw + is given. Formally, for = 1, 1,2, ... n, we have:
Pr(Si(#w + ".., (m + +8g T(ww)))
= Pr(Si + +), [(xx),)
(r + 6), [T Vj.
(10)
Pr(S,(Iw + o)h, ... SSm (Iw + +5), T + 8)²) = Pr(S + 6)5 T( + +8);) ...
Pr(Sm + 8), T( + 8),). Vj.
18

---

Published as a conference paper at ICLR 2025
B.3 DERIVING (r +52 = -Txw)))))
We first derive the probability that the watermark decoded by the target decoder is flipped after adding the perturbation found by our transfer attack the watermark image, conditioned that the watermark decoded by a surrogate decoder is flipped or not after adding the perturbation. Formally, we have the following lemma:
Lemma 1. For any watermarked image Iw and 5 satisfying the constraints of the optimization problem in Equation 3 the jth bit of the watermark decoded by T for Iw + 5 is the inverse of the jth bit of the watermark decoded by T for with probability 0ijkiz + (1 - d.))(1
kig). given
that the jth bits of the watermarks for the Iw + 6 and wwo decoded by S are inverse. Conversely,
it occurs with probability (1 3 + bir(1 k.)) given that the jth bits of the watermarks for
Iw + å and Tw decoded by S, are identical. Formally, for = 2 1,, n, we have:
(rw + = 1- -T(ww) ( + =)² = 1 1-11 (xww))
Cij.
(11)
Pr(T(Tm +d); =1 -1-T(xxw) S: + 8); = (:(aw)))
= -4g
where Cig asyhis + (1 aly) (((1-ss)) -ks) and dgg = (1-b) My + bıg(1 Kgz)
Then, we derive the unconditional probability that the watermark decoded by the target decoder is flipped after adding the perturbation to the watermarked image as follows:
Theorem 2. For any watermarked image Iw and 8 satisfying the constraints of the optimization problem in Equation 3 the jth bit of the watermark decoded by 'T for the perturbed image is the inverse of the jth bit of the watermark decoded by T for the watermarked image with probability Cig9is + 112g 95)) Formally, for j 1,2, ,n, we have the following:
Pr( + t62 = ((xw);) =fj-
(12)
where e, = Cijii + + 915) Vi.
Then we derive the probability that the watermarks decoded by the surrogate decoders flipped when the watermark decoded by the target decoder is flipped after adding the perturbation as follows:
Lemma 2. For any watermarked image Iw and 8 satisfying the constraints of the optimization problem in Equation 3 the jth bit of the watermark decoded by S, for the perturbed image is the inverse of the jth bit of the watermark decoded by S₁ for the watermarked image with probability
C199, au90t2,(119)) (1-9))" given that the watermarks for the perturbed image and the watermarked image
decoded by T are inverse. Formally, for j = 2, ... n, we have the following:
Pr(S.(Iw + +8); - S((xw)s [(xw + 882 = -1- T(xw);)
Cjjii
(13)
Cijli + Cgg 44g)
Finally, we derive the probability that the watermark decoded by the target decoder is flipped after adding the perturbation to the watermarked image, given the watermarks decoded by the m surrogate decoders for the perturbed image. Formally, we have the following:
Theorem 3. For any watermarked image Iw and ó satisfying the constraints of the optimization problem in Equation 3 the jih bit of the watermark decoded by T for the perturbed image is the inverse of the jth bit of the watermark decoded by T for the watermarked inage with probability py. when the watermarks for the perturbed image decoded by the m surrogate decoders are given. Formally, for j 1,2, ,n, we have the following:
Pr(T[æw + +5) = = 1-1T(ax. 11-T(z)); S1(I + +6),,... ,S +8)s)
(14)
= =
dy where Pj min(es IlieM t. (1- IIi cu +c, [1s) 1). M51 (i Si( + 6), (z(w))). and M,2 (i S. + 8), S,(2w); M₁ (or M,2) is the set of surrogate decoders whose jth bits of the decoded watermarks flip (or not flip) after adding the perturbation to the watermarked image.
19

---

Published as a conference paper at ICLR 2025
B.4 DERIVING (r + +5g =wy)
The bitwise accuracy between the decoded watermark T(T + 6) and the ground-truth watermark is used to detect whether the perturbed image Zie + 6 is Al-generated. Therefore, given the watermarks decoded by the m surrogate decoders for the perturbed image zwo + 6, we derive an
upper bound and lower bound of the probability that the watermark decoded by the target decoder matches with the ground-trui watermark after adding the perturbation. Note that we consider 1 <
j S ny this section. Formally, based on the theorems in Section B.3 Section 5
we derive the Theorem in
Our theoretical analysis demonstrates that the probability of the jth bit of the watermark decoded by T for the perturbed image matching with the jth bit of the ground-truth watermark can be bounded, which can be used to compute the upper bound and lower bound of the expected bitwise accuracy between T( + 5) and w. If such upper bound and lower bound fall between and 1 T, the perturbed image is expected to evade the target watermark-baat -bsed detector.
C PROOF OF LEMMA I
Based on Definition
I
2 and 3 we have the followings:
Pr(T(sm + 8)j 1 - ((.w) ) ( + +0) (z(w)s)
= Pr(T(Tw +8), = 1- 1 - ([ww) = S:(ww)s
( + 8)2 = ()(w))
+ Pr((T( + 5)j = -1 T(tw)j ((Tw) = 1 - Si(
S, + 8)j = 1 (((ww)
= =Pr(T(Iw +8), = 1- - --T(xw) [[(ww] = =S((E)))
S +5), = (,(rw),)
x Pr(((TT)) = S((rw) (I + +0)5 = 1 - 5,( )i)
+ PP (Iw + ō)j 1 -1- T(ww); (T(ww)s = 1 (((W)s
Si(Ew + 8)5 = S((xw)))
XPr(T(Zw) = 1 S,(ww) ( + +0); =1 (,((Ew)
= Pr(TT(Iw +8), = [-((w)) [[[w) = =(((w)i
S1 +5) = S((ww),)
x Pr((T(Z)) = S((xw), S1 + 8), = - - (5:(ww)))
+ +0), T( (Twww)
(IIw)
51(2 +) =1 (((ww)))
(1-PPr((Ewu)
(((ww S + 8), 11 (x_(((
= Pr(TT +8), = 5,( + 0)j [(xw); = St(Iw)jj
S1 + 8)z 11 -(((w)))
x (P((T( = S((xw)) (T + +8) = 1 - (zw
+11 Pr + 6), S1 - + 8)5
T(xw); = 1- S1 Sm + 8)5 = 1 - -s((xw)s))
(1
S((ww) (( 8), (((())))))
aiyky + (1 - (k))
Cij.
Similarly, we have the following:
PT + +0) = 1 - T(Iw); )] S1( + +8); = Se((w)))
Pr + +); 1 - T(x (2ow); 5,(F
S, + +0); = S((ww)s) + (r(T (F + 6), = T(Iw)ss
T(sw)} =1 -5,(ww) ( + 5)5 = Si(ww))))
20

---

Published as a conference paper at ICLR 2025
Pr((T(Ew + +0j - T(xw); [T(w)) = (.(w))
Si(Tw + = S((ww)))
x Pr((T(uw] (;(ww) (1 +8) S1(
+ Pr(T(ww + +0, = -1- (xw)) [(xw); = Sz(Zw))
S + +5) (((ww)
x Pr([([u)] = - S((ww) S:(Zu + 8), -)((w)))
(1-Pr(T(Eeu) + +5) = =((w)) (xxw); S,(ww),
S + = S((ww)s))
x Pr(((Tw)] (;(ww) ( 5)j (((
+ Pr([((w + +0, = =1 ((w)) [(xw), = 1 S((ww)
S1 + 6), S(()w)s)
x (1 - (r(T(xu)} = (x(ww) (e + +5) = Si(xw)s))
= =11 - Pr + +0); = SI + +d) [(xw); (z
S + 6), = (s)))))
x Pr(T(sw)j (((w)) | ( 8)j Ss(
+ Pr(T + +0) = Si + 5)j ((xw); = - (i(w))
SI + +6), ((((ww))
x (1 - Pr(T(xx); = S;(xww Sa + 5)5 = S((rw)s))
= (1- - kyy) + bbs(1 kgy
= é1j
D PROOF OF THEOREM 2
Based on Lemma and Definition 4 we have the following:
Pr(T(ww + 6),
T (x));)
= Pr(((a + 6)5 = T(x i Si (I + 6) = 5,(dww)
Pr(T(I + ō)j
-T(w)) )i Se
+ + 1 Se(ww))
= Pr(T((r + 8)5
- -((ww) ( + +0) = S,(ww)
Pr(S,( + 8) (x(ww)
+ Pr + 8)j - T(rw)s Se(Tw + 8) = 1 - ()(
Pr(SS(I + +) 1 Sz(ww)
c1 4:5) + Ciglts
E
PROOF OF LEMMA 2
Pr(Si(nw + 001;=11 =1 1 [T + 0)5 = 1 T(xw)))
(r( + +0, = - (x ( 5)} = 1 ((xw)s)
Pr(T(aw + 6), T(
-Pr(T(x + +8); = 1 -((ww)) )J ( + 8)5 =1 11- -S((w)))
Pr(S + :); = - -S((1)))
Pr( 8)}
T(Fw)j)
Based on Lemma I and Theorem 2 we have the following:
(r( + 0)2 = 1 - T(xw) (. + 5)₁ = 1- (S((ww))
Pr(S, (Xmr + 8), = (((ww)))
x Pr(T (I +5) = 1 -T(xw))
21

---

Published as a conference paper at ICLR 2025
CjjRi
Gyjli + C2y -011-4)) 4ig)
F PROOF OF THEOREM 3
Pr(T(Ew + 8), = T(xw); ) [I + +6),... Sm + 8)5)
PPr(Si (Iw to)j.... S. (Ier 5)j
T(x + 6)5 = ( (r + 8)5 = 11-11 (T
X Pr(Si + :8j5
(Tw + 6)1)
Based on Assumption and 3 we have the following:
Pr(Si(Tw + 8) (m + 8)2 T(x + 8), = -T(xw))
Pr + +5,, (zxw)))
x Pr(Si + :8)j.... Sm + +0),)
Pr + 8)5 (( + {8) = T -(xxw)) )
... ...PrSmm + 8)j (Tr + +0); =1 T(x
X Pr(T(EE + +55 = 1 -T(Em)j)
(15)
Pr(SI + 8)z) Pr(Sm m (I 8)1)
- (z Given that M11 {i S1 + +8); =1-S; ) have the following according Lemma
( 6)5 [ + 6), = 1 [(xw);)
= (r(Si(Tw + 0)5 = 1 (xw) T( + 8)5 = -T(w))s)
Cjj9ij
Vi E Ms1.
(16)
Cjj9s + d, (1 9.))
Given that M,² (il (:(w + +8); ((( have:
Pr(Si(Iw + 8)5 T(r + d); = T (Im)a))
= 1 - Pr(S:(Iw + 8)5 = 1 1-S1-(ts (-S((ww)
T(x :8)
-{(xw)))
Gjjbi
Cifii + dy (1 - {is)
4g (1 - 9ig)
Vi E M,2.
(17)
Cújii + c4y( {tj)
Then Equation 15 can be reformulated as follows:
Pr(Si(m (N + 6), 7 (x + 8), (xxw)))
Pr(Sm + 0)5 T( + +5) ((xw)))
Pr(T(r, + +0) = -T(xw)
Pr(Si 8)z).... Pr(Sm (F + +8)5)
Pr + :81 = 1-T((xw)))
Pr(S,(ww + +5); ((w + +6); = - T(x
II M
Pr(Si(( + +0)j)
Pr(S, + 5)5 T(x + 8). 1 T(xw);)
II KEM22
Pr(S,(I,.. mlmm++0 +),,)
Then, based Definition Theorem 2 Equation 16 and Equation 17 have the following:
Pr(T(r.. 8); T(x))s)
22

---

Published as a conference paper at ICLR 2025
(r + +8)g T2w + +8) (zxw)s)
Pr(Si(Im + +6),)
K MM1
(r(S:( + +5)g (T + +5] = =1 -
(r(S + 8)z)
M32
Cij
ej
C3 + 2, Qij Mij
(, Qit)
II
Ciglif(1 9:5) + d. (1 9b9) )2
mmn(ee)
II
Cjj
Gj9y + 4, 9is)
iEM,
cjj
Cijli + dy - 9:5)) 1)
iEMyz
Pj
G PROOF OF THEOREM
When 1 15j S n, the conditional expectation of [T + +8) T(Iw)j) can be represented as:
Ex + 8); - T(xw)y) S1 0).. Sm (x + +8);)
= 0 x Pr(T(s + 8)j = (z
S1 5)j
Sm (Fee + 0)z)
+ 1 x ( + 0)j = ((xw)s
Si(x + +8)j.... (Ew + 6)z)
= Pr(T(s + 0)} = 1 - ((xw))
(1 + 8) ( 8)z)-
According to Theorem
we have:
Pr(T(ew + -)2 = =1 -1-T(w S1 + 6),, (m 8)5)
= Ps-
According to Assumption represented as:
when j S n, the conditional expectation of [T(x:)) - W/l can be
E([T(ww), wyl [zw + 8) Smm +
=0x Pr(T(zww; = w (I + :))..... Sm + 8)g)
+1x Pr(T(zw)j = Wi
S1 + 8);; ... Sm (x + -)1))
Pr((T(zw) = - w SI + 8)f Sm (Iw + 8)g)
Pr(T(ww)s 1 wj. S1 (w + 5) S (Iw + (815)
Pr(Si 8)
(n + 0)5)
Pr(Si(ww: + :")j,... (I + 0)5 T(Tw)) = - Wi))
Pr(Si(I,, + +0))r'.. (Iw 8)1z)
x Pr(T(Tum) = 1-
Pr(Si(zw + +8); T (T(ww) = 1 1-w))
Pr(S (I + 601;)
Pr(Sm (Nwr + 5)5 T ((xw); = wy)
Pr(Sm (Iw
w + 8),)
23

---

Published as a conference paper at ICLR 2025
Pr(T(Iw)} 1-
Since the flipping behavior of surrogate models irrelevant to Definition 5 lowing:
then we have the fol-
((T((w))) wyl 81 (1 + +)) Sm + +8)))
= Pr([(Tu)) = w,).
Based on Definition 5 we have:
E ((T(w wyl 81 (Iw + d)).... Sm td)s)
= 1 By-
Furthermore, the conditional expectation of [T 8)} wzl can be represented E( + 0), Wjl S (Iw + 8) Sm + 6)z)
= (r + 8)3 = wj S (2 + -.) , + 6);)
+1x x (r(T( + +6j = 1 wi
(z 8)3 ... Sm (In + 8)1)
(r + 8); = wj Si (I 8)3r (ww + 8)5).
(18)
Based on the triangle inequality, we have the following:
(x + 8), w51 S (T w + 6)z. (m 8);) S mini (f 6), T(sw)) + (T(r))) wyl
(1 + d)j; ... (1 + 8)5),
= min(1 - 33 + Pj. 1),
and the following:
E ( + 8), wil S (T + 6).. (m +
2 [ + 8), T(x )5 1T(xw); wyll
S (z + 8) .. Sm (I + 8),)
lp, + 83 1/.
Therefore, based on Equation
18 when j S n, we have the following:
Pr(T(zu, (T + 5), = wi S (I + ō) Sm 8)g)
= 1 - Pr(T(rx + 0), = 1 wy
(1 + 8) ... Sm + 8)g)
2 1 - min(1 - Bj + Pj. 1) - P; paar(3 0),
and the following:
Pr(T + +0; = w/ S1( + +0), Sm(2 + 8)8)
< P + + 1/.
If ne n, when n < S The, we have the following:
0 < Pr(T (2 + 8), wy ( + +8)j...- Sm + +))) S 1.
Therefore, we have the following:
Pr + +0); = wj
S1 (I. + 8) 1 n n n<j $ n4.
Sm(2w 8)3)
mar (3) p.. 0),
0,
Pr(T(zw + +5), = w
(1 + 6))."
Sm 8)z)
lpj + 3 1 1|,
1 < j < n
1,
n<3 j < nr.
24

---

Published as a conference paper at ICLR 2025
H DETAILS OF DATASETS
For the target watermarking models, we use two public datasets (Wang et al. 2023
Ture & Ne-
made 2022) generated by Stable Diffusion and Midjourney respectively. Following HiDDeN (Zhu et al. 2018), we randomly select 10,000 images from each dataset to train the target watermarking encoders and decoders. For testing, we randomly sample 1,000 images from the testing set of each dataset, embed the ground-trun watermark into each of them using target encoder, and then find the perturbation to each watermarked image using different methods. To train the surrogate water- marking models, we sample 10,000 images from another public dataset (Images) 2023) generated by DALLL-E 2, i.e., the surrogate dataset consists of these 10,000 images. The input image size of the watermarking models is 128 x 128 pixels.
I DETAILS OF TARGET WATERMARKING MODELS AND WATERMARK LENGTHS
For HiDDeN, we consider two architectures for the target watermarking model: CNN and ResNet. For the CNN architecture, the encoder consists of 4 convolutional blocks, while the decoder consists of 7 convolutional blocks. Each block integrates a Convolution layer, Batch Normalization, and ReLU activation. For the ResNet architecture, the encoder consists of 7 convolutional blocks and the decoder is the R8sNet-18.
For StegaStamp, we use model architecture introduced by Tancii et al. 2020). For Stable Signature, we use the public watermarking model provided by |eenandez et al. (2023) as the target watermark- ing model. Smoothed HiDDeN and Smoothed StegaStamp are certifiably robust against bounded adversarial perturbations. For them, we adopt the regression smoothing (Jiang et al., (022)) to obtain the smoothed versions of the corresponding HiDDeN and StegaStamp watermarking models.
Additionally, we also employ different watermark lengths for the target watermarking models. Specifically. evaluate lengths of 20 bits, 30 bits, and 64 bits. These variations include watermark lengths that are shorter than, equal to, and longer than those used by the surrogate watermarking models, offering thor- ough analysis of our transfer attack's 's performance across different watermark lengths in the target watermarking model.
transfer attack the target watermarking models with watermark
J DETAILS OF COMMON POST-PROCESSING METHODS
Specifically, we consider the following common post-processing methods.
JPEG. It is a commonly used compression method in digital imaging, which can reduce image file sizes while preserving reasonable level of image quality. The quality of images processed through JPEG is governed by a quality factor Q. As the quality factor decreases, detecting the watermark in the post-processed images becomes more challenging, although this also results in a lower image quality.
Gaussian noise.
This method involves adding statistical noise that follows Gaussian distribution with a zero mean and a standard deviation of ar, which effectively simulates various environmental noise effects encountered in real-world scenarios. larger o value leads to increased difficulty in watermark detection, but also results in lower image quality.
This method smooths the image by averaging pixel values with their neighbors. applies a Gaussian filter with kernel size of h x & to an image, characterized by a bell-shaped curve with a zero mean and a standard deviation a. larger a causes more pronounced blurring, which results in lower watermark detection rate and image quality. Following Jiang et al. (2023), we set and vary o.
Gaussian blur.
This method modifies the brightness and contrast of an image by adjusting pixel values throughout the image. Specifically, it operates by either increasing or decreasing these values to make the image brighter or darker. The process is regulated by two factors: brightness factor and contrast factor C. Formally, for each pixel value v, the method transforms it to Cu B. Following Jiang al. (022)), set B 0.2 and vary C.
Ferihhtnes/Coonraal
25

---

Published as a conference paper at ICLR 2025
K DETAILS OF TRANSFER ATTACKS
For the former 5 transfer attacks, WEvade-B-S is watermark-based, while the other four classifier-basse In particular, MI-CWA leverages the ttate-of-the-ar art multiple surrogate classifiers based transfer adversarial examples.
WEvade-B-S (Jing et al.) 2023). This method trains one surrogate watermarking model. wa- termarked image is perturbed such that the watermark decoded by the surrogate decoder for the perturbed image matches with a preset random watermark. In our experiments, we train the surro- gate watermarking model on 10,000 images generated by DALL-E 2. To give advantages this transfer attack, we assume the attacker knows the architecture of the target watermarking model and uses it for the surrogate watermarking model.
AdvEmb-Ree RN11 (An et al. 2024). This method uses a ResNet- 18 pretrained on ImageNet to gener- ate a feature embedding for a watermarked image. Then perturbs the image such that its embed- ding lies far from the one of the watermarked image.
WM (An et al. 2024). This method trains a surrogate classifier using watermarked and watermarrarree images. The watermarked images are generated by the target GenAl and are watermarked by the target watermarking model, and the -on-raaeraar images are drawn from distribution different from the one of the images generated by the target GenAl. A watermarked image is perturbed such that is misclassified by the surrogate classifier as a non-watermarked im- age. In our experiments, utilize images generated by DALL-E the non- watermarked images. More specifically, the training set for the surrogate classifier comprises 8,000 images generated by Stable Diffusion (or Midjourney) and watermarked by the target watermarking model, and 8, 8,000 non-watermarked images generated by DALL-E 2. The surrogate classifier is based on the ResNet- 18 architecture.
Fe--Ene-WM&&W22. This method is the same as AdyCls-Real& WM except for the training data used for the surrogate classifier. It assumes that the attacker has access the target water- marking encoder and can use it to embed any watermark into an image. The surrogate classifier is trained distinguish the images embedded with the ground-trute boound-tuuth watermark and those embedded with an attacker-chosen watermark. In our experiments, the training set for the surrogate classifier comprises 8,000 images generated by the target GenAl and watermarked by the target watermark- ing model with one watermark, and 8,000 images generated by DALL-E 2 and watermarked by the target watermarking model with another watermark, where both watermarks are randomly picked.
MI-CWA (Chen et al. 2024). Existing classifier-based transfer attacks (i.e., the above three) only leverage one surrogate classifier. We extend state-of-the-ar multiple surrogate classifiers based transfer adversarial examples (Chen et al.) 2024) to watermarks. Given the same training dataset as AdvCls-Real& WM, we train 100 surrogate classifiers, each of which has the ResNet-18 18 architec- ture. Given watermarked image, this transfer attack perturbs it such that it is misclassified by the surrogate classifiers as non-watermarked.
DiffPure Nie et al., 2022). This method uses diffusion model to purify adversarial examples. We extend it to remove watermark. Specifically, DiffPure first adds Gaussian noise gradually to turn a watermarked image into noised image. Then diffusion model is used predict the noise step by step to get the denoised image. We use its public code.
L DETAILS OF PARAMETER SETTINGS
Specifically, for common post-processing methods, we consider the following range of parameters
during adversarial training for target watermarking model: Q E [10, 19) for JPHG, a E [0. 0.1] for Gaussian noise, E [0, 2.0] for Gaussian blur, and C' [1,3] for Brightness/onnrast. For surrogate watermarking models, we adopt a smaller range of parameters for some common post- processing methods during adversarial training achieve weaker robustness than the target water- marking model as follows: Q E [50, 99) for JPEG, a E [0, 0.1] for Gaussian noise, o E 1.0) for Gaussian blur, and C [] for BrightnesssContrast..
By default, we set maximum number of iterations max iter = 5, 000, perturbation budget r = 0.25, sensitivity 0.2, and learning rate a 0.1 for transfer attack. Unless otherwise men-
26

---

Published as a conference paper at ICLR 2025
tioned, we use Inverse-Decode select target watermark for a surrogate decoder, and Ensemble- Optimization to find the perturbation. a is increased when the number of surrogate watermarking models increases in order satisfy the constraints of our optimization problem within 5, 000 itera- tions. The detailed settings for a for different number of surrogate models are shown in Table in Appendix. Moreover, we use fa-distance the distance metric I(:,,) for two watermarks.
For the detection threshold т, we set based on the watermark length of the target watermarking model. Specifically, we set be value such that the false positive detector is no larger than 10-4 when the double-tail detector is employed. Specifically, T is set to be 0.9, 0.83, and 0.73 for the target watermarking models with watermark lengths of 20 bits, 30 bits, and 64 bits, respectively.
of the watermark-based
27


Reviews:
[{"review_id": "EyrUBspbmR", "reviewer": "Reviewer_DtqA", "summary": "The paper proposes a transfer attack to (learned/learning-based) image watermarking that first trains a lot of surrogate watermarking models (encoders + decoders), then uses PGD to find a perturbation to the watermarked images that would change the extracted watermarks by the surrogate watermarking models.\n\nIt is argued that such approach requires smaller perturbations to break learning-based watermarking when being compared to common post-processing such as JPEG, Gaussian noise, Gaussian blur, and Brightness/Contrast; and it is more effective than existing transfer attacks.", "questions": "Please see Weaknesses for my primary concerns, which also include some of my suggestions/questions for the authors.", "limitations": "", "rating": 6, "confidence": 4, "soundness": 3, "presentation": 2, "contribution": 2, "strengths": "The robustness of image watermarking in no-box setting (i.e. with no access to watermarking models & with no access to detection API) is indeed a relatively overlooked area. Given that there are empirical ways to at least restrict the access to models/APIs, I consider this angle meaningful and worth investigating.\n\nThe presentation is clear enough overall and originality of this paper is not an issue.", "weaknesses": "My primary concerns regarding this paper are:\n1. **No analysis of the computational cost in comparison with existing transfer attacks, which should be discussed clearly**. I think while the proposed method definitely incur a much larger overhead compared to previous attacks, it could still be ok to highlight the risks, providing that this limitation is presented upfront in the paper. Some analysis + some empirical numbers of computation time (with the corresponding compute resources) could be helpful for illustration.\n\n2. **The comparison of the proposed attack with existing transfer attacks is somewhat inconclusive.**\nThis is because, as the authors must already know, there is a trade-off between evasion rate and the visibility/budget of the attacks (perturbation in L2/perturbation in Linf/SSIM/...). Thus a good comparison should at least compare the evasion rates with **all** baselines in representative budgets (if the other baselines work in such budgets). However, the comparison in the paper claims the proposed method is better than all others because it beats some baselines when r<= 0.1, and it beats MI-CWA and DiffPure assuming a SSIM>0.9. This is a rather misleading way of comparison, as some attacks will work better under certain (metrics of) budgets but not the others.\n\n3. **The effectiveness of the proposed method as a \"no-box\" attack remain unclear, specifically regarding the transferability to different watermarking methods.**\nWhile there are experiments involving a different target watermarking method from the surrogate ones, it is worth noting that these methods are somewhat similar (or as the authors called, they are learning-based watermarking). It is claimed that the proposed method also work for non-learning based methods (figure 13), but details regarding this set of experiments, especially what are the target watermarking methods, are missing. To my understanding, there is no rule preventing the victim using a watermarking scheme that is very different or even designed to be different from the ones used by the attacker as surrogates. This is not a deal breaker but such discussion seems to be missing.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "jBvEuAB9je", "reviewer": "Reviewer_k3og", "summary": "This paper proposed an evasion attack to interfere with the detection of watermarked images under the no-box setting, i.e. the attacker has no access to the watermark detector. They approach the objective through the transfer attack, where they train surrogate watermark models and find adversarial perturbation to fool the detection of local surrogate models. Both theoretical analysis and empirical evidence demonstrate that this transfer attack method can successfully undermine the detection capabilities of learning-based watermark systems across various watermarking scenarios.", "questions": "Please see the weaknesses.", "limitations": "", "rating": 6, "confidence": 3, "soundness": 3, "presentation": 4, "contribution": 2, "strengths": "1. This paper is well-written with clear motivation. The no-box setting is practical.\n2. The experiments and theoretical results support their claims and method design.\n3. The transfer results are effective against several learning-based watermarking systems.", "weaknesses": "1. While I acknowledge the authors have assumed that the attackers should have sufficient computational resources, the main concern of this paper is the computational cost. The costs associated with both surrogate models and perturbation discovery are large which prevents the practical usage of this method.  \n2. For the transfer attack to a specific architecture such as ResNet-18, did you use a similar architecture in your surrogate models, for instance, ResNet-X? Besides, have you considered attacks with totally different architectures, such as transformer-based watermark models?\n3. Another weakness of this paper is that the transfer attack primarily focuses on learning-based watermarks, neglecting non-learning-based watermark variants that may exhibit greater robustness than the baselines discussed here, such as variants of Tree-Ring [1][2], etc. Besides, can the proposed method attack the 0-bit watermark? \nThe cost of attacks escalates significantly with complex architectures a\n4. The attack cost is significantly increased with complex architectures and longer watermarks. This poses a hindrance to the practical implementation of transfer attacks involving high-capacity watermarks [3].\n\n[1] RingID: Rethinking Tree-Ring Watermarking for Enhanced Multi-Key Identification\n\n[2] Gaussian Shading: Provable Performance-Lossless Image Watermarking for Diffusion Models\n\n[3] A Robust Image Watermarking System Based on Deep Neural Networks", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "Nd0ZJpyPM1", "reviewer": "Reviewer_xUbX", "summary": "This paper demonstrates that watermark-based detection methods for AI-generated images are vulnerable to transfer attacks in a no-box setting. Specifically, an attacker can effectively remove the watermark from a given watermarked image by applying a perturbation, which can be identified through ensembling multiple surrogate watermarking models.", "questions": "See weakness", "limitations": "", "rating": 6, "confidence": 4, "soundness": 3, "presentation": 2, "contribution": 2, "strengths": "This paper presents a practical attack effective across multiple watermarking methods\nThe issue of watermarking the outputs of generative models is timely and interesting.", "weaknesses": "To ensure high image quality, the L infinity bound on perturbations should be kept low, as higher values (e.g., 0.2 as shown in Figures 3 and 4) can noticeably degrade image quality, reducing practicality. For a more realistic assessment, the paper should include comparisons using a set of small enough  L infinity bound (such as 0.03, 0.05) bounds to demonstrate the proposed method’s effectiveness under conditions that minimize visible impact.\nIf Section 5 is one of the paper’s main contributions, it would be better placed in the main text rather than in the appendix.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "gu9mkzzEAm", "reviewer": "Reviewer_F4Nf", "summary": "This paper develops an attack that evades a target image watermarking detector, without acquiring the access to this detector's model or API. The proposed method adds a perturbation trained to mislead multiple surrogate detector models, and hopes that this perturbation can transfer to the target detector and therefore succeed. The experiment results on various datasets demonstrate the effectiveness of the proposed method, which outperforms many existing attacks and post-processing methods.", "questions": "Please see the weakness section above.", "limitations": "", "rating": 8, "confidence": 4, "soundness": 4, "presentation": 3, "contribution": 3, "strengths": "1. The paper is well-written and easy to follow.\n2. This paper proposed an intuitive yet attractive method that seems work very well in the experimental studies. \n3.  The experimental studies are comprehensive.", "weaknesses": "**Major Concerns:**\n\n1. Theoretical contributions. While authors provide some theoretical analysis, I think the current results are not sufficient to be claimed as signficant. The reasons are as follows:\n(1) It is in doubt whether those independence assumptions will hold. As $\\delta$ is obtained by solving Eq. (3), which optimizes the chances that $m$ decoders will extract carefully designed watermarks from an image perturbed by $\\delta$, it is likely that coordinates of decoders' output is correlated. The authors may want to provide additional envidence to validate their assumptions.\n(2) The analysis only applies to inverse-decode. \n(3) The bound given by the theorems are not available in practice. Recall that this paper considers the setting where $T$ and its output is unknown to the attacker. In the meanwhile, the parameters including $a, b,\\beta, p$ involves the unknown target decoder $T$ and unknown data distribution.\n\n2. Empirical results. The empirical results are impressive, and it raises my question why it significantly outperforms SOTA methods? Could the author provide any justification and insight for the superior performance of the proposed method?\n\n\n**Minor Concerns:**\n\n1. Since the proposed method has to train a bunch of surrogate models, will it be computationally expensive? Also, every time this algorithm has to solve Eq. (3), which may also be expensive. The authors may want to add a table comparing the FLOPs and time used by different methods.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}]

Author rebuttal:

Decision: Accept (Poster)