Title: Invisible Image Watermarks Are Provably Removable Using Generative AI
Venue: NeurIPS 2024
Accepted: yes
Keywords: Image Watermark

AI Safety
Abstract: Invisible watermarks safeguard images' copyrights by embedding hidden messages only detectable by owners. They also prevent people from misusing images, especially those generated by AI models.
We propose a family of regeneration attacks to remove these invisible watermarks. 
The proposed attack method first adds random noise to an image to destroy the watermark and then reconstructs the image. 
This approach is flexible and can be instantiated with many existing image-denoising algorithms and pre-trained generative models such as diffusion models. Through formal proofs and extensive empirical evaluations, we demonstrate that pixel-level invisible watermarks are vulnerable to this regeneration attack.
Our results reveal that, across four different pixel-level watermarking schemes, the proposed method consistently achieves superior performance compared to existing attack techniques, with lower detection rates and higher image quality.
However, watermarks that keep the image semantically similar can be an alternative defense against our attacks.
Our finding underscores the need for a shift in research/industry emphasis from invisible watermarks to semantic-preserving watermarks. Code is available at https://github.com/XuandongZhao/WatermarkAttacker

Invisible Image Watermarks Are Provably Removable Using Generative AI

Abstract

Invisible watermarks safeguard images' copyrights by embedding hidden messages only detectable by owners. They also prevent people from misusing images, especially those generated by AI models. We propose a family of regeneration attacks to remove these invisible watermarks. The proposed attack method first adds random noise to an image to destroy the watermark and then reconstructs the image. This approach is flexible and can be instantiated with many existing imagedenoising algorithms and pre-trained generative models such as diffusion models. Through formal proofs and extensive empirical evaluations, we demonstrate that pixel-level invisible watermarks are vulnerable to this regeneration attack. Our results reveal that, across four different pixel-level watermarking schemes, the proposed method consistently achieves superior performance compared to existing attack techniques, with lower detection rates and higher image quality. However, watermarks that keep the image semantically similar can be an alternative defense against our attacks. Our finding underscores the need for a shift in research/industry emphasis from invisible watermarks to semantic-preserving watermarks. Code is available at https://github.com/XuandongZhao/WatermarkAttacker .

1 Introduction

Generative models like DALL-E [45], Imagen [50], and Stable Diffusion [47] can produce images that are often visually indistinguishable from those created by human photographers and artists, potentially leading to misunderstandings and false beliefs due to their visual similarity. To address this, government leaders [30, 26, 29] advocate for the responsible use of AI, emphasizing the importance of identifying AI-generated content. In response, leading AI companies such as Google [20], Microsoft [61], and OpenAI [4] have pledged to incorporate watermarks into their AI-generated images. Invisible watermarks [62, 17, 9] are preferred as they preserve image quality and are less likely to be removed by laypersons. However, abusers are aware of these watermarks and may attempt to remove them, making it crucial for invisible watermarks to be robust against evasion attacks.

Existing attacks can be categorized into two types. The first is destructive , where the watermark is removed by corrupting the image. Typical destructive attacks include modifying the brightness, JPEG compression, and adding Gaussian noise. These approaches are effective at removing watermarks, but

Detected

Add

Watermark

No watermark

Attacker removes

the watermark

Watermark

Detector

Noise

Embedding

Undetected

Noisy Embedding

Regenerate

又

they result in significant quality loss. The second type of attack is constructive , where the watermark is treated as some noise on the original image and removed by purifying the image. Constructive attacks include image-denoising techniques like Gaussian blur [25], BM3D [11], and learning-based approaches [65]. However, they cannot remove resilient watermarks easily. To counter these attacks, learning-based watermarking methods [67, 66, 15] were proposed to explicitly train against the known attacks to be robust. But how about other attacks? What is the end of this cat-and-mouse game? In this paper, we ask a more fundamental question:

Is an invisible watermark necessarily non-robust?

To be more precise, is there a fundamental trade-off between the invisibility of a watermark and its resilience to any attack that preserves the image quality to a certain-level?

To address this question, we propose a regeneration attack that leverages the strengths of both destructive and constructive approaches. The pipeline of the attack is given in Figure 1. Our attack first corrupts the image by adding Gaussian noise to its latent representation. Then, we reconstruct the image from the noisy embedding using a generative model. The proposed regeneration attack is flexible in that it can be instantiated with various regeneration algorithms, including traditional denoisers and deep generative models such as diffusion models [23]. Ironically, the recent advances in generative models that created the desperate need for invisible watermarks are also making watermark removal easier when integrated into the proposed regeneration attack.

Surprisingly, we prove that the proposed attack guarantees the removal of certain invisible watermarks such that no detection algorithm could work. In other words, our attack is provably effective in removing any watermarks that perturb the image within a limited range of ℓ 2 -distance, regardless of whether they have been proposed or have not yet been invented. We also show that our attack maintains image quality comparable to the unwatermarked original.

To validate our theory, we conduct extensive experiments on four widely used invisible watermarks [41, 67, 53, 15]. Our proposed attack method significantly outperforms five baseline methods in terms of both image quality and watermark removal. For the resilient watermark scheme RivaGAN, our regeneration attacks successfully remove 98% of the invisible watermarks while maintaining a PSNR above 30 compared to the original images. With the empirical results and the theoretical guarantee, we claim that pixel-level invisible image watermarks are vulnerable to our regeneration attacks.

Given the vulnerability of invisible watermarks, we explore another option: semantic watermarks. Semantic watermarks do not limit the perturbation to be within an ℓ 2 -distance. As long as the watermarked image looks similar and contains similar content, it is considered suitable for use. One instance of such semantic watermarks is Tree-Ring [60], which has shown resilience against our attacks. While not a perfect solution, as the watermark becomes somewhat 'visible', semantic watermarking offers a potential path forward for protecting the proper use of AI-generated images when invisible watermarks are provably ineffective.

Our contributions can be summarized as follows:

We propose a family of regeneration attacks for image watermark removal that can be instantiated with many existing denoising algorithms and generative models.

We prove that the proposed attack is guaranteed to remove certain pixel-based invisible watermarks and that the regenerated images are close to the original unwatermarked image.

We evaluate the proposed attack on various invisible watermarks to demonstrate their vulnerability and its effectiveness compared with strong baselines.

We explore other possibilities to embed watermarks in a visible yet semantically similar way. Empirical results indicate that this approach works better under our attack and is worth investigating as an alternative.

2 Related Work and Background

2.1 Related Work

Image watermarking and steganography. Steganography and invisible watermarking are key techniques in information hiding, serving diverse purposes such as copyright protection, privacypreserved communication, and content provenance. Early works in this area employ hand-crafted methods, such as Least Significant Bit (LSB) embedding [62], which subtly hides data in the lowest order bits of each pixel in an image. Over time, numerous techniques have been developed to imperceptibly embed secrets in the spatial [17] and frequency [24, 44] domains of an image. Additionally, the emergence of deep learning has contributed significantly to this field. Deep learning methods offer improved robustness against noise while maintaining the quality of the generated image. SteganoGAN [66] uses generative adversarial networks (GAN) for steganography and perceptual image optimization. RivaGAN [67], further improves GAN-based watermarking by leveraging attention mechanisms. SSL watermarking [15], trained with self-supervision, enhances watermark features through data augmentation. Stable Signature [14] fine-tunes the decoder of Latent Diffusion Models to add the watermark. Tree-Ring [60] proposes a semantic watermark, which watermarks generative diffusion models using minimal shifts of their output distribution. This work focuses on the removal of invisible watermarks, as opposed to visible watermarks, for several reasons. Visible watermarks are straightforward for potential adversaries to visually identify and locate within an image. Additionally, removal techniques for visible watermarks are already extensively studied in prior work such as [35, 21, 10]. In contrast, invisible watermarks do not have explicit visual cues that reveal their presence or location. Developing removal techniques for imperceptible embedded watermarks presents unique challenges.

Deep generative models. The high-dimensional nature of images poses unique challenges to generative modeling. In response to these challenges, several types of deep generative models have been developed, including Variational Auto-Encoders (VAEs) [56, 55], Generative Adversarial Networks (GANs) [18], flow-based generative models [46], and diffusion models [23, 47]. These models leverage deep latent representations to generate high-quality synthetic images and approximate the true data distribution. One particularly interesting use of generative models is for data purification, i.e., removing the adversarial noise from a data sample. The purification is similar to watermark removal except that purification is a defense strategy while watermark removal is an attack. The diffusion-based approach in [43] is similar to an instance of our regeneration attack, but the usage is different in our paper and our theoretical guarantee of watermark removal is stronger. In this paper, we aim to demonstrate the capability of these deep generative models in removing invisible watermarks from images by utilizing the latent representations obtained through the encoding and decoding processes.

2.2 Problem Setup

This section defines invisible watermarks and the properties of an algorithm for their detection. It then discusses the threat model for the removal of invisible watermarks.

Definition 2.1 (Invisible watermark) . Let x ∈ X be the original image and x w = Watermark ( x, aux ) be the watermarked image for a watermarking scheme that is a function of x and any auxiliary information aux , e.g., a secret key. We say that the watermark is ∆ -invisible on a clean image x w.r.t. a 'distance' function dist : X × X → R + if dist ( x, x w ) ≤ ∆ .

Definition 2.2 (Watermark detection) . A watermark detection algorithm Detect : X × aux →{ 0 , 1 } determines whether an image ˜ x ∈ X is watermarked with the auxiliary information (secret key) being aux . Detect may make two types of mistakes, false positives (classifying an unwatermarked image as watermarked) and false negatives (classifying a watermarked image as unwatermarked). ˜ x could be drawn from either the null distribution P 0 or watermarked distribution P 1 . We define Type I error (or false positive rate) ϵ 1 := Pr x ∼ P 0 [ Detect ( x ) = 1] and Type II error (or false negative rate) ϵ 2 := Pr x ∼ P 1 [ Detect ( x ) = 0] .

A watermarking scheme is typically designed such that P 1 is different from P 0 so the corresponding (carefully designed) detection algorithm can distinguish them almost perfectly, that is, to ensure ϵ 1 and ϵ 2 are nearly 0 . An attack on a watermarking scheme aims at post-processing a possibly watermarked image which changes both P 0 and P 1 with the hope of increasing Type I and Type II error at the same time, hence evading the detection.

We consider the following threat model for removing invisible watermarks from images:

Adversary's capabilities. We assume that an adversary only has access to the watermarked images. The watermarking scheme Watermark , the auxiliary information aux , and the detection algorithm Detect are unknown to the adversary. The adversary can make modifications to these already watermarked images it has access to using arbitrary side information and computational resources, but it cannot rely on any specific property of the watermarking process and it cannot query Detect .

Adversary's objective. The primary objective of an adversary is to render the watermark detection algorithm ineffective. Specifically, the adversary aims to produce an image ˜ x from the watermarked image x w which causes the Detect algorithm to always have a high Type I error (false positive rate) or a high Type II error (false negative rate). Simultaneously, the output image ˜ x should maintain comparable quality to the original, non-watermarked image. The adversary's objective will be formally defined later.

2.3 Invisible Watermark Detection

Watermarking methods implant k -bit secret information into images. The detection algorithm Detect uses an extractor for this hidden data, applying a statistical test to ascertain if the extracted message matches the secret. This test evaluates the number of matching bits M ( m,m ′ ) between the extracted m ′ and original m ∈ { 0 , 1 } k messages. A watermark is detected if M ( m,m ′ ) ≥ τ for a predefined threshold τ [63, 38]. Formally, we distinguish whether an image x was watermarked ( H 1 ) or not ( H 0 ). Assuming under null hypothesis H 0 that the extracted bits behave like independent Bernoulli variables with a 0.5 probability, M ( m,m ′ ) follows a binomial distribution B ( k, 0 . 5) . The false positive rate ( ϵ 1 ) corresponds to the probability that M ( m,m ′ ) exceeds τ . This has a closed form using the regularized incomplete beta function I x ( a ; b ) :

Decision threshold. We consider a watermark to be detected, if we can reject the null hypothesis H 0 with a p -value less than 0 . 01 . In practice, for a k = 32 -bit watermark, we require at least 23 bits to be extracted correctly in order to confirm the presence of a watermark. This provides a reasonable balance between detecting real watermarks and avoiding false positives.

3 The Proposed Regeneration Attack

Our attack method first destructs a watermarked image by adding noise to its representation, and then reconstructs it from the noised representation.

Specifically, given an embedding function ϕ : R n → R d , a regeneration function A : R d → R n , and a noise level σ , the attack algorithm takes a watermarked image x w ∈ R n and returns

Algorithm 1 Regeneration Attack Instance: Removing invisible watermarks with a diffusion model input The watermarked image x w , a time step t ∗ determining the level of noise added. output A reconstructed clean image ˆ x .

1: z 0 ← ϕ ( x w ) // map the watermarked image x w to latent space

2: ϵ ∼ N (0 , I d ) // sample a random normal Gaussian noise

3: z t ∗ ← √ α ( t ∗ ) z 0 + √ 1 -α ( t ∗ ) ϵ // add noise to the latent, noise level determined by t ∗

4: ˆ z 0 ← solve ( z t ∗ , t ∗ , s, f, g ) // denoise the noised latent to reconstruct a clean latent

5: ˆ x ← θ (ˆ z 0 ) // map the reconstructed latent back to a watermark-free image

6: return ˆ x

The first step of the algorithm is destructive . It maps the watermarked image x w to an embedding ϕ ( x w ) (which is a possibly different representation of the image), and adds i.i.d. Gaussian noise. The explicit noise shows the destructive nature of the first step. The second step of the algorithm is constructive . The corrupted image representation ϕ ( x w ) + N (0 , σ 2 I d ) is passed through a regeneration function A to reconstruct the original clean image.

There are various different choices for ϕ and A that can instantiate our attack. ϕ can be as simple as identity map, or as complicated as deep generative models including variational autoencoders [31]. A can be traditional denoising algorithms from image processing and recent AI models such as diffusion [23]. The choice of ϕ and A may change the empirical results, but it does not affect the theoretical guarantee. In the following sections, we introduce three combinations of ϕ and A to instantiate the attack. Among the three, the diffusion instantiation is the most complicated and we describe it with pseudocode in Algorithm 1.

3.1 Attack Instance 1: Identity Embedding with Denoising Reconstruction

Set ϕ to be identity map, then A can be any image denoising algorithm, e.g., BM3D [11], TVdenoising [48], bilateral filtering [54], DnCNNs [65], or a learned natural image manifold [6, 11, 65, 64]. A particular example of interest is a 'denoising autoencoder' [57], which takes ϕ to be identity, adds noise to the image deliberately, and then denoises by attempting to reconstruct the image. Observe that for 'denoising autoencoder' we do not need to add additional noise.

3.2 Attack Instance 2: VAE Embedding and Reconstruction

The regeneration attack in Equation 1 can be instantiated with a variational autoencoder (V AE). A VAE [31] consists of an encoder q ϕ ( z | x ) that maps a sample x to the latent space z and a decoder p θ ( x | z ) that maps a latent z back to the data space x . Both the encoder and decoder are parameterized with neural networks. VAEs are trained with a reconstruction loss that measures the distance from the reconstructed sample to the original sample and a prior matching loss that restricts the latent to follow a pre-defined prior distribution.

Instead of mapping x directly to z , the encoder maps it to the mean µ ( x ) and variance σ ( x ) of a Gaussian distribution and samples from it. Therefore, VAE already adds noise during the encoding stage (though its variance depends on the sample x , which is not exactly the same as defined in Equation 1), so there is no need to add extra noise. Note that this is similar to the situation of denoising autoencoders described in Section 3.1, as the denoising autoencoder is a trivial case of VAE where µ ( x ) is identity.

3.3 Attack Instance 3: Diffusion Embedding and Reconstruction

The regeneration attack can also be instantiated with diffusion models. Diffusion models [23] define a generative process that learns to sample from an unknown true distribution p ( z 0 ) . This process is learned by estimating original samples from randomly noised ones. In other words, diffusion models are trained to denoise, which makes them candidates for the regeneration function A in the proposed attack. The embedding function ϕ can either be identity [23] or a latent embedding [47], depending on the space where diffusion is trained.

For diffusion models, the process of adding noise to a clean sample is known as the forward process . Likewise, the process of denoising a noisy sample is known as the backward process .

The forward process is defined by the following stochastic differential equation (SDE): dz = f ( z, t ) dt + g ( t ) dw (2) , where t ∈ [0 , 1] , z ∈ R d , w ( t ) ∈ R d is a standard Wiener process, and f, g are real-valued functions. The backward process can then be described with its reverse SDE: d ˆ z = [ f (ˆ z, t ) -g ( t ) 2 ∇ ˆ z log p t (ˆ z ) ] dt + g ( t ) d ¯ w (3) , where ˆ w is a reverse Wiener process. Diffusion models parameterize ∇ ˆ z log p t (ˆ z ) with a neural network s ( z, t ) . By substituting s ( z, t ) into Equation 3, the backward SDE becomes known and solvable using numerical solvers [34, 36], ˆ z 0 = solve ( z t , t, s, f, g ) .

Among many ways to define f and g in Equation 2, variance preserving SDE (VP-SDE) is commonly used [23, 47]. Under this setting, the conditional distribution of the noised sample is the following Gaussian [51]: p ( z t | z 0 ) = N ( √ α ( t ) z 0 , 1 -α ( t )) (4) , where α ( t ) a pre-defined noise schedule. The variance of the original distribution p ( z 0 ) is preserved at any step.

As defined in Algorithm 1, our algorithm removes the watermark from the watermarked image x w using diffusion models. x w is first mapped to the latent representation z 0 , which is then noised to the time step t ∗ . A latent diffusion model is then used to reconstruct the latent ˆ z 0 , which is mapped back to an image ˆ x .

Similar to denoising autoencoders, in either diffusion or V AEs, the noise-injection is integral to the algorithms themselves, and no additional noise-injection is needed.

4 Theoretical Analysis

We show in this section that the broad family of regeneration attacks as defined in Equation 1 enjoy provable guarantees on their ability to remove invisible watermarks while retaining the high quality of the original image. Our proofs are deferred to Appendix D. More discussion on the implications and interpretation of our theoretical analysis can be found in Appendix C.

4.1 Certified Watermark Removal

How do we quantify the ability of an attack algorithm to remove watermarks? We argue that if after the attack, no algorithm is able to distinguish whether the result is coming from a watermarked image or the corresponding original image without the watermark, then we consider the watermark certifiably removed. More formally:

Definition 4.1 ( f -Certified-Watermark-Free) . We say that a watermark removal attack is f -CertifiedWatermark-Free (or f -CWF) against a watermark scheme for a non-increasing function f : [0 , 1] → [0 , 1] , if for any detection algorithm Detect : X × aux →{ 0 , 1 } , the Type II error (false negative rate) ϵ 2 of Detect obeys that ϵ 2 ≥ f ( ϵ 1 ) for all Type I error 0 ≤ ϵ 1 ≤ 1 .

Let us also define a parameter to quantify the effect of the embedding function ϕ .

Definition 4.2 (Local Watermark-Specific Lipschitz property) . We say that an embedding function ϕ : X → R d satisfies L x,w -Local Watermark-Specific Lipschitz property if for a watermark scheme w that generates x w with x ,

The parameter L x,w measures how much the embedding compresses the watermark added on a particular clean image x . If ϕ is identity, then L x,w ≡ 1 . If ϕ is a projection matrix to a linear subspace then 0 ≤ L x,w ≤ 1 depending on the magnitude of the component of x w -x in this subspace. For a neural image embedding ϕ , the exact value of L x,w is unknown but given each x w and x it can be computed and estimated efficiently. We defer more discussion to the Appendix A.

Theorem 4.3. For a ∆ -invisible watermarking scheme with respect to ℓ 2 -distance. Assume the embedding function ϕ of the diffusion model is L x,w -Locally Lipschitz. The randomized algorithm A ( ϕ ( · ) + N (0 , σ 2 I d )) produces a reconstructed image ˆ x which satisfies f -CWF with

where Φ is the Cumulative Density Function function of the standard normal distribution.

0.0

0.2

0.4

0.6

0.8

1.0

Type I error

0.0

0.2

0.4

0.6

0.8

1.0

Type II error

Impossibility Region

=1.16

Indistinguishable

Diffusion attack

The proof, deferred to Appendix D, leverages an interesting connection to a modern treatment of differential privacy [13] known as the Gaussian differential privacy [12]. The work of [12] itself is a refinement and generalization of the pioneering work of [59] and [28] which established a tradeoff-function view.

4.2 Utility Guarantees

In this section, we prove that the regenerated image ˆ x is close to the original (unwatermarked) image x 0 . This is challenging because the denoising algorithm only gets access to the noisy version of the watermarked image. Interestingly, we can obtain a general extension lemma showing that for any black-box generative model that can successfully denoise a noisy yet unwatermarked image with high probability, the same result also applies to the watermarked counterpart, except that the failure probability is slightly larger.

Theorem 4.4. Let x 0 be an image with n pixels and ϕ : R n → R d be an embedding function. Let A be an image generation / denoising algorithm such that with probability at least 1 -δ , ∥A ( ϕ ( x 0 ) + N (0 , σ 2 I d )) -x 0 ∥ ≤ ξ x 0 ,σ,δ . Then for any ∆ -invisible watermarking scheme that produces x w from a clean image x 0 , then ˆ x = A ( ϕ ( x w ) + N (0 , σ 2 I d )) satisfies that

with a probability at least 1 -˜ δ , where ˜ δ = min v ∈ R { δ · e v +Φ ( ˜ ∆ 2 σ -vσ ˜ ∆ ) -e v Φ ( -˜ ∆ 2 σ -vσ ˜ ∆ )} in which Φ denotes the standard normal CDF and ˜ ∆ := L x 0 ,w ∆ .

The theorem says that if a generative model is able to denoise a noisy version of the original image, then the corresponding watermark-removal attack using this generative model provably produces an image with similar quality.

Corollary 4.5. The expression for ˜ δ above can be (conservatively) simplified to ˜ δ ≤ e L 2 x,w ∆ 2 σ 2 · δ 1 / 2 .

For example if σ ≍ L x,w ∆ , then this is saying that if ξ x 0 ,σ,δ depends logarithmically on 1 /δ , the same exponential tail holds for denoising the watermarked image.

The above result is powerful in that it makes no assumption about what perturbation the watermarking schemes could inject and which image generation algorithm we use. We give a few examples below.

For denoising algorithms with theoretical guarantees, e.g., TV-denoising [27, Theorem 2], our results imply provable guarantees on the utility for the watermark removal attack of the form, 'w.h.p., 1 n ∥ ˆ x -x 0 ∥ 2 = ˜ O ( σ TV 2 d ( x 0 ) n ) ', i.e., vanishing mean square error (MSE) as n gets bigger.

Original Image DwtDctSvd WM

Brightness

JPEG

VAE attack

Diffusion attack

CKSTO

STO

ASTO

For modern deep learning-based image denoising and generation algorithms where worst-case guarantees are usually intractable, Theorem 4.4 is still applicable for each image separately. That is to say, as long as their empirical denoising quality is good on an unwatermarked image, the quality should also be good on its watermarked counterpart.

5 Evaluation

Datasets. We evaluate our attack on two types of images: real photos and AI-generated images. For real photos, we use 500 randomly selected images from the MS-COCO dataset [33]. For AIgenerated images, we employ the Stable Diffusion-v2.1 model 2 from Stable Diffusion [47], a state-of-the-art generative model capable of producing high-fidelity images. Using prompts from the Stable Diffusion Prompt (SDP) dataset 3 , we generate 500 images encompassing both photorealistic and artistic styles. This diverse selection allows for a comprehensive evaluation of our attack on invisible watermarks. All experiments are conducted on Nvidia A6000 GPUs.

Watermark settings. We evaluate four publicly available pixel-level watermarking methods: DwtDctSvd [41], RivaGAN [67], StegaStamp [53], and SSL watermark [15]. These methods represent a variety of approaches, ranging from traditional signal processing to recent deep learning techniques, as introduced in Section 2.1. To account for watermarks of different lengths, we use k = 32 bits for DwtDctSvd, RivaGAN, and SSL watermark, and k = 96 bits for StegaStamp. For watermark detection, we set the decision threshold to reject the null hypothesis with p < 0 . 01 , requiring the detection of 23 out of 32 bits or 59 out of 96 bits, respectively, for the corresponding methods, as described in Section 2.3. For watermark extraction, we use the publicly available code for each method with default inference and fine-tuning parameters specified in their papers.

Attack baselines. To thoroughly evaluate the robustness of our proposed watermarking method, we test it against a diverse set of baseline attacks representing common image perturbations. We select both geometric/quality distortions and noise manipulations that could potentially interfere with embedded watermarks. Specifically, the baseline attack set includes: brightness adjustments with enhancement factors of [2, 4, 6, 8, 12], contrast adjustments with enhancement factors of [2, 3, 4, 5, 6, 7], JPEG compression at quality levels [10, 20, 30, 40, 50, 60], Gaussian noise addition with a

10

20

30

40

PSNR

0.0

0.2

0.4

0.6

0.8

1.0

TPR@FPR=0.01

DctDwtSvd watermarking

10

20

30

40

PSNR

0.0

0.2

0.4

0.6

0.8

1.0

TPR@FPR=0.01

RivaGAN watermarking

10

20

30

40

PSNR

0.0

0.2

0.4

0.6

0.8

1.0

TPR@FPR=0.01

SSL watermarking

10

20

30

40

PSNR

0.0

0.2

0.4

0.6

0.8

1.0

TPR@FPR=0.01

StegaStamp watermarking

0.2

0.4

0.6

0.8

1.0

SSIM

0.0

0.2

0.4

0.6

0.8

1.0

TPR@FPR=0.01

DctDwtSvd watermarking

0.2

0.4

0.6

0.8

1.0

SSIM

0.0

0.2

0.4

0.6

0.8

1.0

TPR@FPR=0.01

RivaGAN watermarking

0.2

0.4

0.6

0.8

1.0

SSIM

0.0

0.2

0.4

0.6

0.8

1.0

TPR@FPR=0.01

SSL watermarking

0.2

0.4

0.6

0.8

1.0

SSIM

0.0

0.2

0.4

0.6

0.8

1.0

TPR@FPR=0.01

StegaStamp watermarking

Diffusion model

VAE-Cheng2020

VAE-Bmshj2018

JPEG

Brightness

Contrast

mean of 0 and standard deviations of [5, 10, 15, 20, 25, 30], and Gaussian blur with radii of [2, 4, 6, 8, 10, 12]. Further details are provided in Appendix B.

Proposed attacks. For regeneration attacks using variational autoencoders, we evaluate two pre-trained image compression models from the CompressAI library [5]: Bmshj2018 [3] and Cheng2020 [7]. Compression factors are set to [1, 2, 3, 4, 5, 6], where lower factors correspond to more heavily degraded images. For diffusion model attacks, we use the Stable Diffusion-v2.1 model. The number of noise steps is set to [10, 30, 50, 100, 150, 200] (with σ = [0.10, 0.17, 0.23, 0.34, 0.46, 0.57]), and we employ pseudo numerical methods for diffusion models (PNDMs) [34] to generate samples. By adjusting the compression factors and noise steps, we achieve varying levels of perturbation for regeneration attacks.

Evaluation metrics. We evaluate the quality of attacked and watermarked images compared to the original cover image using two common metrics: Peak Signal-to-Noise Ratio (PSNR) defined as PSNR( x, x ′ ) = -10 · log 10 ( MSE ( x, x ′ )) , for images x, x ′ ∈ [0 , 1] c × h × w , and Structural Similarity Index (SSIM) [58] which measures perceptual similarity. To evaluate the diversity and quality of watermarked images, we use Fréchet Inception Distance (FID) [22] between the distributions of watermarked and unwatermarked images. To evaluate the robustness of the watermark, we compute the True Positive Rate (TPR) at a fixed False Positive Rate (FPR), specifically TPR@FPR=0.01. The detection threshold corresponding to FPR=0.01 is set according to each watermark's default configuration: correctly decoding 23/32, 59/96, and 32/48 bits for the respective watermarking methods, as described in the watermark settings.

5.1 Results and Analysis

This section presents detailed results and analysis of the regeneration attack experiments on different watermarking methods. Some attacking examples are shown in Figure 3.

DwtDctSvd

RivaGAN

SSL

StegaStamp

0

25

50

75

100

125

150

2 dis in Image

0

1

2

3

4

2 dis in Latent

Image

Latent

Watermarking performance without attacks. Table 1 summarizes the watermarked image quality and detection rates for images watermarked by the four methods without any attacks. Each method-DwtDctSvd, RivaGAN, SSL, and StegaStamp-successfully embeds and retrieves messages from the images. These methods are post-processing techniques, adding watermarks to existing images. Among them, SSL achieves the highest PSNR and SSIM values, indicating superior perceptual quality and minimal visual distortion compared to the original images. DwtDctSvd achieves the lowest FID scores, suggesting the watermarked images maintain fidelity similar to clean images. In contrast, StegaStamp exhibits a noticeable drop in quality, with the lowest PSNR and highest FID scores. As illustrated in Figure 6, StegaStamp introduced noticeable blurring artifacts.

Watermark removal effectiveness and image quality reservation. Figure 4 and 7 present the quality-detectability tradeoff results from applying various regeneration attacks to remove watermarks. The VAE and diffusion model-based attacks (VAE-Bmshj2018, VAE-Cheng2020, Diffusion) consistently achieve over 99% removal rates for the DctDwtSvd, RivaGAN, and SSL watermarking methods, demonstrating their high effectiveness. In contrast, StegaStamp exhibits the highest robustness, with effective removal only achieved by the diffusion model with substantial noise. This resilience is partially attributed to StegaStamp's lower visual quality and higher perturbation levels (as indicated in Table 1, Figure 6 and Figure 5). Yet, increasing the noise level in diffusion models reduces StegaStamp's resistance. As demonstrated in Figure 4 and 7, higher noise levels improve the removal rate on StegaStamp, aligning with the theory that larger perturbations necessitate more noise for effective removal. This also aligns with the trade-off of lower image quality at higher noise levels. Overall, the consistently high removal rates across various watermarking schemes demonstrate the effectiveness of regeneration attacks for watermark removal. In terms of image quality preservation, the regeneration attacks generally maintain high quality, as indicated by PSNR and SSIM metrics. VAE models yield higher PSNR and SSIM scores, suggesting superior perceptual quality from a GAN-based perspective. However, qualitative inspection of example images in Figure 3 reveals the VAE outputs exhibit some blurring compared to the diffusion outputs. Since PSNR and SSIM are known to be insensitive to blurring artifacts [42, 58], we conclude that the choice of using regeneration with diffusion models should be guided by the specific requirements of each application.

Potential defense. Although we show that the proposed attack is guaranteed to remove any pixelbased invisible watermarks, it is not impossible to detect AI-generated images. Semantic watermarks offer a viable detection method, with further details and results discussed in Appendix E.

6 Conclusion

We proposed a regeneration attack on invisible watermarks that combines destructive and constructive attacks. Our theoretical analysis proved that the proposed regeneration attack is able to remove certain invisible watermarks from images and make the watermark undetectable by any detection algorithm. We showed with extensive experiments that the proposed attack performed well empirically. The proofs and experiments revealed the vulnerability of invisible watermarks. Given this vulnerability, we explored an alternative defense that uses visible but semantically similar watermarks. Our findings on the vulnerability of invisible watermarks underscore the need for shifting the research/industry emphasis from invisible watermarks to their alternatives.

References

Bang An, Mucong Ding, Tahseen Rabbani, Aakriti Agrawal, Yuancheng Xu, Chenghao Deng, Sicheng Zhu, Abdirisak Mohamed, Yuxin Wen, Tom Goldstein, et al. Benchmarking the robustness of image watermarks. arXiv preprint arXiv:2401.08573 , 2024.

Borja Balle and Yu-Xiang Wang. Improving the gaussian mechanism for differential privacy: Analytical calibration and optimal denoising. In International Conference on Machine Learning , pages 394-403. PMLR, 2018.

Johannes Ballé, David Minnen, Saurabh Singh, Sung Jin Hwang, and Nick Johnston. Variational image compression with a scale hyperprior. arXiv preprint arXiv:1802.01436 , 2018.

Diane Bartz and Krystal Hu. Openai, google, others pledge to watermark ai content for safety, white house says, Jul 2023.

Jean Bégaint, Fabien Racapé, Simon Feltman, and Akshay Pushparaja. Compressai: a pytorch library and evaluation platform for end-to-end compression research. arXiv preprint arXiv:2011.03029 , 2020.

Antoni Buades, Bartomeu Coll, and J-M Morel. A non-local algorithm for image denoising. In 2005 IEEE computer society conference on computer vision and pattern recognition (CVPR'05) , volume 2, pages 60-65. Ieee, 2005.

Zhengxue Cheng, Heming Sun, Masaru Takeuchi, and Jiro Katto. Learned image compression with discretized gaussian mixture likelihoods and attention modules. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition , pages 7939-7948, 2020.

Ingemar Cox, Matthew Miller, Jeffrey Bloom, Jessica Fridrich, and Ton Kalker. Digital watermarking and steganography . Morgan kaufmann, 2007.

Ingemar J Cox and Matt L Miller. The first 50 years of electronic watermarking. EURASIP Journal on Advances in Signal Processing , 2002:1-7, 2002.

Xiaodong Cun and Chi-Man Pun. Split then refine: stacked attention-guided resunets for blind single image visible watermark removal. In Proceedings of the AAAI conference on artificial intelligence , 2021.

Kostadin Dabov, Alessandro Foi, Vladimir Katkovnik, and Karen Egiazarian. Image denoising by sparse 3-d transform-domain collaborative filtering. IEEE Transactions on image processing , 16(8):2080-2095, 2007.

Jinshuo Dong, Aaron Roth, and Weijie J Su. Gaussian differential privacy. Journal of the Royal Statistical Society Series B: Statistical Methodology , 84(1):3-37, 2022.

Cynthia Dwork, Frank McSherry, Kobbi Nissim, and Adam Smith. Calibrating noise to sensitivity in private data analysis. In Theory of Cryptography: Third Theory of Cryptography Conference, TCC 2006, New York, NY, USA, March 4-7, 2006. Proceedings 3 , pages 265-284. Springer, 2006.

Pierre Fernandez, Guillaume Couairon, Hervé Jégou, Matthijs Douze, and Teddy Furon. The stable signature: Rooting watermarks in latent diffusion models. arXiv preprint arXiv:2303.15435 , 2023.

Pierre Fernandez, Alexandre Sablayrolles, Teddy Furon, Herv'e J'egou, and Matthijs Douze. Watermarking images in self-supervised latent spaces. ICASSP 2022 - 2022 IEEE International Conference on Acoustics, Speech and Signal Processing (ICASSP) , pages 3054-3058, 2021.

Teddy Furon and Patrick Bas. Broken arrows. EURASIP Journal on Information Security , 2008:1-13, 2008.

Kazem Ghazanfari, Shahrokh Ghaemmaghami, and Saeed R Khosravi. Lsb++: An improvement to lsb+ steganography. In TENCON 2011-2011 IEEE Region 10 Conference , pages 364-368. IEEE, 2011.

Ian Goodfellow, Jean Pouget-Abadie, Mehdi Mirza, Bing Xu, David Warde-Farley, Sherjil Ozair, Aaron Courville, and Yoshua Bengio. Generative adversarial networks. Communications of the ACM , 63(11):139-144, 2020.

Ian J Goodfellow, Jonathon Shlens, and Christian Szegedy. Explaining and harnessing adversarial examples. arXiv preprint arXiv:1412.6572 , 2014.

Google. Google keynote (google i/o 23). Google blog , 2023.

Amir Hertz, Sharon Fogel, Rana Hanocka, Raja Giryes, and Daniel Cohen-Or. Blind visual motif removal from a single image. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition , pages 6858-6867, 2019.

Martin Heusel, Hubert Ramsauer, Thomas Unterthiner, Bernhard Nessler, and Sepp Hochreiter. Gans trained by a two time-scale update rule converge to a local nash equilibrium. Advances in neural information processing systems , 30, 2017.

Jonathan Ho, Ajay Jain, and Pieter Abbeel. Denoising diffusion probabilistic models. Advances in Neural Information Processing Systems , 33:6840-6851, 2020.

Vojtˇ ech Holub and Jessica Fridrich. Designing steganographic distortion using directional filters. In 2012 IEEE International workshop on information forensics and security (WIFS) , pages 234-239. IEEE, 2012.

Osama Hosam. Attacking image watermarking and steganography-a survey. International Journal of Information Technology and Computer Science , 11(3):23-37, 2019.

The White House. President biden issues executive order on safe, secure, and trustworthy artificial intelligence, 2023.

Jan-Christian Hütter and Philippe Rigollet. Optimal rates for total variation denoising. In Conference on Learning Theory , pages 1115-1146. PMLR, 2016.

Peter Kairouz, Sewoong Oh, and Pramod Viswanath. The composition theorem for differential privacy. In International conference on machine learning , pages 1376-1385. PMLR, 2015.

Makena Kelly. Chuck schumer calls on congress to pick up the pace on ai regulation, Jun 2023.

Makena Kelly. White house rolls out plan to promote ethical ai, May 2023.

Diederik P Kingma and Max Welling. Auto-encoding variational bayes. arXiv preprint arXiv:1312.6114 , 2013.

Xinyu Li. Diffwa: Diffusion models for watermark attack. ArXiv , abs/2306.12790, 2023.

Tsung-Yi Lin, Michael Maire, Serge Belongie, James Hays, Pietro Perona, Deva Ramanan, Piotr Dollár, and C Lawrence Zitnick. Microsoft coco: Common objects in context. In Computer Vision-ECCV 2014: 13th European Conference, Zurich, Switzerland, September 6-12, 2014, Proceedings, Part V 13 , pages 740-755. Springer, 2014.

Luping Liu, Yi Ren, Zhijie Lin, and Zhou Zhao. Pseudo numerical methods for diffusion models on manifolds. In International Conference on Learning Representations , 2021.

Yang Liu, Zhen Zhu, and Xiang Bai. Wdnet: Watermark-decomposition network for visible watermark removal. In Proceedings of the IEEE/CVF Winter Conference on Applications of Computer Vision , pages 3685-3693, 2021.

Cheng Lu, Yuhao Zhou, Fan Bao, Jianfei Chen, Chongxuan Li, and Jun Zhu. Dpm-solver: A fast ode solver for diffusion probabilistic model sampling in around 10 steps. Advances in Neural Information Processing Systems , 35:5775-5787, 2022.

Nils Lukas, Abdulrahman Diaa, Lucas Fenaux, and Florian Kerschbaum. Leveraging optimization for adaptive attacks on image watermarks. ArXiv , abs/2309.16952, 2023.

Nils Lukas and Florian Kerschbaum. Ptw: Pivotal tuning watermarking for pre-trained image generators. arXiv preprint arXiv:2304.07361 , 2023.

Matthew L Miller, Ingemar J Cox, and Jeffrey A Bloom. Informed embedding: exploiting image and detector information during watermark insertion. In Proceedings 2000 International Conference on Image Processing (Cat. No. 00CH37101) , volume 3, pages 1-4. IEEE, 2000.

Ilya Mironov. Rényi differential privacy. In IEEE computer security foundations symposium (CSF) , pages 263-275. IEEE, 2017.

KA Navas, Mathews Cheriyan Ajay, M Lekshmi, Tampy S Archana, and M Sasikumar. Dwtdct-svd based watermarking. In 2008 3rd International Conference on Communication Systems Software and Middleware and Workshops (COMSWARE'08) , pages 271-274. IEEE, 2008.

Peter Ndajah, Hisakazu Kikuchi, Masahiro Yukawa, Hidenori Watanabe, and Shogo Muramatsu. Ssim image quality metric for denoised images. In Proc. 3rd WSEAS Int. Conf. on Visualization, Imaging and Simulation , pages 53-58, 2010.

Weili Nie, Brandon Guo, Yujia Huang, Chaowei Xiao, Arash Vahdat, and Animashree Anandkumar. Diffusion models for adversarial purification. In International Conference on Machine Learning , pages 16805-16827. PMLR, 2022.

Tomáš Pevn` y, Tomáš Filler, and Patrick Bas. Using high-dimensional image models to perform highly undetectable steganography. In Information Hiding: 12th International Conference, IH 2010, Calgary, AB, Canada, June 28-30, 2010, Revised Selected Papers 12 , pages 161-177. Springer, 2010.

Aditya Ramesh, Prafulla Dhariwal, Alex Nichol, Casey Chu, and Mark Chen. Hierarchical text-conditional image generation with clip latents. arXiv preprint arXiv:2204.06125 , 2022.

Danilo Rezende and Shakir Mohamed. Variational inference with normalizing flows. In International conference on machine learning , pages 1530-1538. PMLR, 2015.

Robin Rombach, Andreas Blattmann, Dominik Lorenz, Patrick Esser, and Björn Ommer. Highresolution image synthesis with latent diffusion models. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition , pages 10684-10695, 2022.

Leonid I Rudin, Stanley Osher, and Emad Fatemi. Nonlinear total variation based noise removal algorithms. Physica D: nonlinear phenomena , 60(1-4):259-268, 1992.

Mehrdad Saberi, Vinu Sankar Sadasivan, Keivan Rezaei, Aounon Kumar, Atoosa Malemir Chegini, Wenxiao Wang, and Soheil Feizi. Robustness of ai-image detectors: Fundamental limits and practical attacks. ArXiv , abs/2310.00076, 2023.

Chitwan Saharia, William Chan, Saurabh Saxena, Lala Li, Jay Whang, Emily L Denton, Kamyar Ghasemipour, Raphael Gontijo Lopes, Burcu Karagol Ayan, Tim Salimans, et al. Photorealistic text-to-image diffusion models with deep language understanding. Advances in Neural Information Processing Systems , 35:36479-36494, 2022.

Yang Song, Jascha Sohl-Dickstein, Diederik P Kingma, Abhishek Kumar, Stefano Ermon, and Ben Poole. Score-based generative modeling through stochastic differential equations. In International Conference on Learning Representations , 2020.

Christian Szegedy, Wojciech Zaremba, Ilya Sutskever, Joan Bruna, Dumitru Erhan, Ian Goodfellow, and Rob Fergus. Intriguing properties of neural networks. arXiv preprint arXiv:1312.6199 , 2013.

Matthew Tancik, Ben Mildenhall, and Ren Ng. Stegastamp: Invisible hyperlinks in physical photographs. In Proceedings of the IEEE/CVF conference on computer vision and pattern recognition , pages 2117-2126, 2020.

Carlo Tomasi and Roberto Manduchi. Bilateral filtering for gray and color images. In Sixth international conference on computer vision (IEEE Cat. No. 98CH36271) , pages 839-846. IEEE, 1998.

Aaron Van Den Oord, Oriol Vinyals, et al. Neural discrete representation learning. Advances in neural information processing systems , 30, 2017.

Pascal Vincent, Hugo Larochelle, Yoshua Bengio, and Pierre-Antoine Manzagol. Extracting and composing robust features with denoising autoencoders. In Proceedings of the 25th international conference on Machine learning , pages 1096-1103, 2008.

Pascal Vincent, Hugo Larochelle, Isabelle Lajoie, Yoshua Bengio, Pierre-Antoine Manzagol, and Léon Bottou. Stacked denoising autoencoders: Learning useful representations in a deep network with a local denoising criterion. Journal of machine learning research , 11(12), 2010.

Zhou Wang, A.C. Bovik, H.R. Sheikh, and E.P. Simoncelli. Image quality assessment: from error visibility to structural similarity. IEEE Transactions on Image Processing , 13(4):600-612, 2004.

Larry Wasserman and Shuheng Zhou. A statistical framework for differential privacy. Journal of the American Statistical Association , 105(489):375-389, 2010.

Yuxin Wen, John Kirchenbauer, Jonas Geiping, and Tom Goldstein. Tree-ring watermarks: Fingerprints for diffusion images that are invisible and robust. arXiv preprint arXiv:2305.20030 , 2023.

Kyle Wiggers. Microsoft pledges to watermark ai-generated images and videos. TechCrunch blog , 2023.

Raymond B Wolfgang and Edward J Delp. A watermark for digital images. In Proceedings of 3rd IEEE International Conference on Image Processing , volume 3, pages 219-222. IEEE, 1996.

Ning Yu, Vladislav Skripniuk, Sahar Abdelnabi, and Mario Fritz. Artificial fingerprinting for generative models: Rooting deepfake attribution in training data. In Proceedings of the IEEE/CVF International conference on computer vision , pages 14448-14457, 2021.

Kai Zhang, Yawei Li, Wangmeng Zuo, Lei Zhang, Luc Van Gool, and Radu Timofte. Plug-andplay image restoration with deep denoiser prior. IEEE Transactions on Pattern Analysis and Machine Intelligence , 44(10):6360-6376, 2021.

Kai Zhang, Wangmeng Zuo, Yunjin Chen, Deyu Meng, and Lei Zhang. Beyond a gaussian denoiser: Residual learning of deep cnn for image denoising. IEEE transactions on image processing , 26(7):3142-3155, 2017.

Kevin Alex Zhang, Alfredo Cuesta-Infante, Lei Xu, and Kalyan Veeramachaneni. Steganogan: High capacity image steganography with gans. arXiv preprint arXiv:1901.03892 , 2019.

Kevin Alex Zhang, Lei Xu, Alfredo Cuesta-Infante, and Kalyan Veeramachaneni. Robust invisible video watermarking with attention. ArXiv , abs/1909.01285, 2019.

A Additional Discussion in FAQ style

How do we control a certain degree of Certified Watermark Freeness apriori? We note that our guarantee in Theorem 4.3 depends on the specific watermark injected on specific image instance through the unknown local Lipschitz parameter L x,w . Specifying a fixed CWF level requires us to have a uniform upper bound of L x,w independent to x and w . To give two concrete examples, when the embedding ϕ is chosen trivial to be the identity map, then we can take L x,w ≤ 1 . When ϕ is a lower pass filtering, e.g., Fourier transform than removing all high-frequency components except the top k dimension, then we can bound L x,w ≤ √ k/n where n is the number of pixels. More generally, any linear transformation with bounded operator norm works.

Is there a uniform bound for neural embedding ϕ such as those from VAE and diffusion models? We believe there is, but these bounds might be too conservative to use in practice. In particular, they might be ≫ 1 due to the widely observed adversarial examples [52, 19]. If the injected watermarks are carefully designed such that the injected perturbation is aligned with an adversarial perturbation, then the resulting watermarked images will be more resilient to our attacks that leverage the neural embeddings. They will not be more resilient to our attacks that do not use neural embeddings though. In practice, we found that in all existing watermarks, neural embeddings result in substantially smaller distortions to the original images while suppressing L x,w substantially (Figure 5).

Other ways of achieving CWF without adding Gaussian noise. Research from the golden age of digital watermarking [39, 9, 16, 8] has proposed methods such as quantization for removing watermarks that provide similar tradeoffs in practice to the watermarks that we experimented with in this paper. However, these methods, in general, do not come with provable CWF guarantees. It is critical that the watermark removal attack is randomized to enjoy similar properties to what we have in Theorem 4.3. That said, the classical removal attacks can be used in constructing better embedding function ϕ which may help reducing the local Lipschitz parameter and, thus, improving the tradeoff between certified removal and utility of the regenerated image. Besides Gaussian noise, we can also add Laplace noise and other well-known perturbation mechanisms from the differential privacy and cryptography research community. Thoroughly investigating the impact of the choice of noise (and randomized quantization approaches) is an interesting direction of future research.

B Additional Method Details

B.1 Invisible Watermarking Methods

In this section, we review several well-established invisible watermarking schemes that are evaluated in our experiments (Section 5). These approaches cover a range of methods, including traditional signal processing techniques and more recent deep learning methods. They include the default watermarking schemes employed by the widely used Stable Diffusion models [47]. We show some invisible watermarking examples in Figure 6.

DwtDctSvd watermarking. The DwtDctSvd watermarking method [41] combines Discrete Wavelet Transform (DWT), Discrete Cosine Transform (DCT), and Singular Value Decomposition (SVD) to embed watermarks in color images. First, the RGB color space of the cover image is converted to YUV. DWT is then applied to the Y channel, and DCT divides it into blocks. SVD is performed on each block. Finally, the watermark is embedded into the blocks. DwtDctSvd is the default watermark used by Stable Diffusion.

RivaGAN watermarking. RivaGAN [67] presents a robust image watermarking method using GANs. It employs two adversarial networks to assess watermarked image quality and remove watermarks. An encoder embeds the watermark, while a decoder extracts it. By combining these, RivaGAN offers superior performance and robustness. RivaGAN is another watermark used by Stable Diffusion.

StegaStamp watermarking. StegaStamp [53] is a robust CNN-based watermarking method. It uses differentiable image perturbations during training to improve noise resistance. Additionally, it incorporates a spatial transformer network to resist minor perspective and geometric changes like cropping. This adversarial training and spatial transformer enable StegaStamp to withstand various attacks.

Original Image

DwtDctSvd WM

RivaGAN WM

SSL WM

StegaStamp WM

SSL watermarking. SSL watermarking [15] utilizes pre-trained neural networks' latent spaces to encode watermarks. Networks pretrained with self-supervised learning (SSL) extract effective features for watermarking. The method embeds watermarks through backpropagation and data augmentation, then detects and decodes them from the watermarked image or its features.

B.2 Existing Attacking Methods

In this section, we review common attacking methods that aim to degrade or remove invisible watermarks in images. These methods are widely used to measure the robustness of watermarking algorithms against removal or tampering [67, 53, 15, 14, 60]. The attacking methods can be categorized into destructive attacks, where the watermark is considered part of the image and actively removed by corrupting the image, and constructive attacks, where image processing techniques like denoising are used to obscure the watermark.

Destructive attacks intentionally corrupt the image to degrade or remove the embedded watermark. Common destructive attack techniques include:

Brightness/Contrast adjustment. This attack adjusts the brightness and contrast parameters of the image globally. Adjusting the brightness/contrast makes the watermark harder to detect.

JPEG compression. JPEG is a common lossy image compression technique. It has a quality factor parameter that controls the amount of compression. A lower quality factor leads to more loss of fine details and a higher chance of degrading the watermark.

Gaussian noise. This attack adds random Gaussian noise to each pixel of the watermarked image. The variance of the Gaussian noise distribution controls the strength of the noise. A higher variance leads to more degradation of the watermark signal.

10

20

30

40

PSNR

0.0

0.2

0.4

0.6

0.8

1.0

TPR@FPR=0.01

DctDwtSvd watermarking

10

20

30

40

PSNR

0.0

0.2

0.4

0.6

0.8

1.0

TPR@FPR=0.01

RivaGAN watermarking

10

20

30

40

PSNR

0.0

0.2

0.4

0.6

0.8

1.0

TPR@FPR=0.01

SSL watermarking

10

20

30

40

PSNR

0.0

0.2

0.4

0.6

0.8

1.0

TPR@FPR=0.01

StegaStamp watermarking

0.2

0.4

0.6

0.8

1.0

SSIM

0.0

0.2

0.4

0.6

0.8

1.0

TPR@FPR=0.01

DctDwtSvd watermarking

0.2

0.4

0.6

0.8

1.0

SSIM

0.0

0.2

0.4

0.6

0.8

1.0

TPR@FPR=0.01

RivaGAN watermarking

0.2

0.4

0.6

0.8

1.0

SSIM

0.0

0.2

0.4

0.6

0.8

1.0

TPR@FPR=0.01

SSL watermarking

0.2

0.4

0.6

0.8

1.0

SSIM

0.0

0.2

0.4

0.6

0.8

1.0

TPR@FPR=0.01

StegaStamp watermarking

Diffusion model

VAE-Cheng2020

VAE-Bmshj2018

JPEG

Brightness

Contrast

Constructive attacks aim to remove the watermark by improving image quality and restoring the original unwatermarked image. Examples include:

Gaussian blur. Blurring the image by convolving it with a Gaussian kernel smoothens the watermark signal and makes it less detectable. The kernel size and standard deviation parameter control the level of blurring.

Other recent attacking methods [32, 49, 37, 1] aim to remove invisible image watermarks using generative models. Concurrent to our work, [32] use propose DiffWA, a conditional diffusion model with distance guidance for watermark removal. However, DiffWA only works for low-resolution images and lacks theoretical guarantees. [49] train a substitute classifier and conduct projected gradient descent (PGD) attacks on it to deceive black-box watermark detectors. However, their approach requires multiple queries to the target generator. [37] propose an adaptive attack that locally replicates secret watermarking keys by creating differentiable surrogate keys used to optimize the attack parameters. However, they assume the attacker knows the watermarking method, which is a stronger assumption than ours. Our method removes invisible watermarks from high-resolution images, provides theoretical justifications, and does not assume knowledge of the watermarking algorithm.

C Remarks on Our Theoretical Guarantee

In this section, we discuss more about the theoretical guarantees in Section 4. For the readers' convenience, we first restate the definitions and theorems and then discuss their implications and interpretation. The proofs can be found in Appendix D.

C.1 Certified Watermark Removal

How do we quantify the ability of an attack algorithm to remove watermarks? We argue that if after the attack, no algorithm is able to distinguish whether the result is coming from a watermarked image or the corresponding original image without the watermark, then we consider the watermark certifiably removed. More formally:

Definition C.1 ( f -Certified-Watermark-Free) . We say that a watermark removal attack is f -CertifiedWatermark-Free (or f -CWF) against a watermark scheme for a non-increasing function f : [0 , 1] → [0 , 1] , if for any detection algorithm Detect : X × aux →{ 0 , 1 } , the Type II error (false negative rate) ϵ 2 of Detect obeys that ϵ 2 ≥ f ( ϵ 1 ) for all Type I error 0 ≤ ϵ 1 ≤ 1 .

Original Image DwtDctSvd WM

Brightness

JPEG

VAE attack

Diffusion attack

Let us also define a parameter to quantify the effect of the embedding function ϕ .

Definition C.2 (Local Watermark-Specific Lipschitz property) . We say that an embedding function ϕ : X → R d satisfies L x,w -Local Watermark-Specific Lipschitz property if for a watermark scheme w that generates x w with x ,

The parameter L x,w measures how much the embedding compresses the watermark added on a particular clean image x . If ϕ is identity, then L x,w ≡ 1 . If ϕ is a projection matrix to a linear subspace then 0 ≤ L x,w ≤ 1 depending on the magnitude of the component of x w -x in this subspace. For a neural image embedding ϕ , the exact value of L x,w is unknown but given each x w and x it can be computed efficiently.

Theorem C.3. For a ∆ -invisible watermarking scheme with respect to ℓ 2 -distance. Assume the embedding function ϕ of the diffusion model is L x,w -Locally Lipschitz. The randomized algorithm A ( ϕ ( · ) + N (0 , σ 2 I d )) produces a reconstructed image ˆ x which satisfies f -CWF with

where Φ is the Cumulative Density Function function of the standard normal distribution.

Figure 2 illustrates what the tradeoff function looks like. The result says that after the regeneration attack, it is impossible for any detection algorithm to correctly detect the watermark with high confidence. In addition, it shows that such detection is as hard as telling the origin of a single sample Y from either of the two Gaussian distributions N (0 , 1) and N ( L x,w ∆ /σ, 1) .

Original Image

RivaGAN WM

Brightness

JPEG

VAE attack

Diffusion attack

Original Image StegaStamp WM

Brightness

JPEG

VAE attack

Diffusion attack

Original Image

SSL WM

Brightness

JPEG

VAE attack

Diffusion attack

0.0

0.2

0.4

0.6

0.8

1.0

Type I error

0.0

0.2

0.4

0.6

0.8

1.0

Type II error

Impossibility Region

=0.57

Indistinguishable

Diffusion attack

The proof in Section D leverages an interesting connection to a modern treatment of differential privacy [13] known as the Gaussian differential privacy [12]. The work of [12] itself is a refinement and generalization of the pioneering work of [59] and [28] which established a tradeoff-function view.

Discussion. Let us instantiate the algorithm with a latent diffusion model by choosing σ = √ (1 -α ( t ∗ )) /α ( t ∗ ) (see Algorithm 1) and discuss the parameter choices.

Remark C.4 (Two trivial cases) . Observe that when α ( t ∗ ) = 0 , the result of the reconstruction does not depend on the input x w , thus there is no information about the watermark in ˆ x (0) , i.e., the trade-off function is f ( ϵ 1 ) = 1 -ϵ 2 -perfectly watermark-free, however, the information about x (through x w ) is also lost. When α ( t ∗ ) = 1 , the attack trivially returns ˆ x (0) = x w , which does not change the performance of the original watermark detection algorithm at all (and it could be perfect, i.e., ϵ 1 = ϵ 2 = 0 ).

Remark C.5 (Choice of t ∗ ) . In practice, the best choice t ∗ is in between the two trivial cases, i.e., one should choose it such that L x,w ∆ √ α ( t ∗ ) / (1 -α ( t ∗ )) is a small constant. The smaller the constant, the more thoroughly the watermark is removed. The larger the constant, the higher the fidelity of the regenerated image w.r.t. x w (thus x 0 too).

Remark C.6 (VAE) . Strictly speaking, Theorem 4.3 does not directly apply to VAE because the noise added on the latent embedding depends on the input data. So if it chooses σ ( x 0 ) = 1 and

σ ( x w ) = 0 , then it is easy to distinguish between the two distributions. We can still provide provable guarantees for VAE if either the input image is artificially perturbed (so V AE becomes a denoising algorithm) or the latent space is artificially perturbed after getting the embedding vector. When σ ( x ) itself could be stable, more advanced techniques from differential privacy such as Smooth Sensitivity or Propose-Test-Release can be used to provide certified removal guarantees for the V AE attack. In practice, we find that the V AE attack is very effective in removing watermarks as is without adding additional noise.

Remark C.7 (The role of embedding function ϕ ) . Readers may wonder why having an embedding function ϕ is helpful for removing watermarks. We give three illustrative examples.

Pixel quantization. This ϕ is effective against classical Least Significant Bit (LSB) watermarks. By removing the lower-significance bits ϕ ( x ) = ϕ ( x w ) thus L x,w = 0 .

Low-pass filtering. By choosing ϕ to be a low-pass filter, one can effectively remove or attenuate watermarks injected in the high-frequency spectrum of the Fourier domain, hence resulting in a L x,w ≪ 1 for these watermarks.

Deep-learning-based image embedding. Modern deep-learning-based image models effectively encode a 'natural image manifold,' which allows a natural image x to pass through while making the added artificial watermark ϵ smaller. To be more concrete, consider ϕ to be a linear projection to a d -dimensional 'natural image subspace'. For a natural image x and watermarked image x w = x + ε , we have ϕ ( x w ) = ϕ ( x ) + ϕ ( ε ) = x + ϕ ( ε ) . If ε ∼ N (0 , σ 2 w I n ) then E [ ∥ ϕ ( ε ) ∥ 2 ] = dσ 2 w ≪ nσ 2 w = E [ ∥ ε ∥ 2 ] . This projection compresses the magnitude of the watermark substantially while preserving the signal , thereby boosting the effect of the noise added in the embedding space in obfuscating the differences between watermarked and unwatermarked images.

Finally, we note that while Theorem 4.3 and 4.4 are specific to ℓ 2 -distance, the general idea applies to other distance functions (e.g., ℓ 1 distance). ℓ 2 -distance is natural for the Gaussian noise natively introduced by diffusion and VAE-based regeneration attacks.

C.2 Utility Guarantees

In this section, we prove that the regenerated image ˆ x is close to the original (unwatermarked) image x 0 . This is challenging because the denoising algorithm only gets access to the noisy version of the watermarked image.

Interestingly, we can obtain a general extension lemma showing that for any black-box generative model that can successfully denoise a noisy yet unwatermarked image with high probability, the same result also applies to the watermarked counterpart, except that the failure probability is slightly larger.

Theorem C.8. Let x 0 be an image with n pixels and ϕ : R n → R d be an embedding function. Let A be an image generation / denoising algorithm such that with probability at least 1 -δ , ∥A ( ϕ ( x 0 ) + N (0 , σ 2 I d )) -x 0 ∥ ≤ ξ x 0 ,σ,δ . Then for any ∆ -invisible watermarking scheme that produces x w from a clean image x 0 , then ˆ x = A ( ϕ ( x w ) + N (0 , σ 2 I d )) satisfies that

with a probability at least 1 -˜ δ where

in which Φ denotes the standard normal CDF and ˜ ∆ := L x 0 ,w ∆ .

The theorem says that if a generative model is able to denoise a noisy version of the original image, then the corresponding watermark-removal attack using this generative model provably produces an image with similar quality.

Corollary C.9. The expression for ˜ δ above can be (conservatively) simplified to

For example, if σ ≍ L x,w ∆ , then this is saying that if ξ x 0 ,σ,δ depends logarithmically on 1 /δ , the same exponential tail holds for denoising the watermarked image.

The above result is powerful in that it makes no assumption about what perturbation the watermarking schemes could inject and which image generation algorithm we use. We give a few examples below.

For denoising algorithms with theoretical guarantees, e.g., TV-denoising [27, Theorem 2], our results imply provable guarantees on the utility for the watermark removal attack of the form, 'w.h.p., 1 n ∥ ˆ x -x 0 ∥ 2 = ˜ O ( σ TV 2 d ( x 0 ) n ) ', i.e., vanishing mean square error (MSE) as n gets bigger.

For modern deep learning-based image denoising and generation algorithms where worst-case guarantees are usually intractable, Theorem 4.4 is still applicable for each image separately. That is to say, as long as their empirical denoising quality is good on an unwatermarked image, the quality should also be good on its watermarked counterpart.

D Proofs of Technical Results

Proof of Theorem 4.3. By the conditions on the invisible watermark and the local Lipschitz assumption on ϕ , we get that

This can be viewed as the ℓ 2 -local-sensitivity of ϕ at x 0 in the language of differential privacy literature.

The two candidate distributions are N ( ϕ ( x 0 ) , σ 2 I ) and N ( ϕ ( x w ) , σ 2 I ) . Let T ( P, Q ) : [0 , 1] → [0 , 1] be the tradeoff function for distinguishing between distributions P and Q as in Definition 2.1 of [12]. The tradeoff function outputs the Type II error of the likelihood ratio test of the two point hypotheses as a function of the Type I error. By the Neyman-Pearson lemma, the likelihood ratio test is uniform most powerful, thus the tradeoff function provides a lower bound of any test in distinguishing P and Q .

First notice that translation and scaling by any non-zero constant (a non-zero linear transformation) does not change the tradeoff function, thus

Next, observe that the likelihood ratio of the two multivariate isotropic normal distributions remains the same when we collapse it to the 1-dimension along the vector ϕ ( x 0 ) -ϕ ( x w ) , i.e.,

Lemma 2.9 of [12] states that for any post-processing function h ,

which is known to information theorists as the information processing inequality of the Hockey-Stick divergence.

Consider a particular randomized post-processing function h that first adds N (0 , v ) then divides √ 1 + v .

To see the last identity, observe that we can choose v > 0 such that L x 0 ,w ∆ σ 2 ( √ 1+ v ) = ∥ ϕ ( x w ) -ϕ ( x 0 ) ∥ σ 2 , thanks to the local Lipschitz assumption. To put things together, we get

The left hand side is the tradeoff function of two univariate Gaussian with variance 1 , by Equation (6) of [12], the tradeoff function can be written as Φ ( Φ -1 (1 -α ) -L x 0 ,w ∆ σ 2 ) where Φ is the cumulative density function of the standard Gaussian distribution.

Finally, by applying the the postprocessing property (6) again by instantiating h to be the re-generation procedure, we get that the regenerated image ˆ x also satisfies the same tradeoff function as stated above.

Proof of Theorem 4.4. The key idea is to use the definition of indistinguishability (differential privacy, but for a fixed pair of neighbors, rather than for all neighbors). So we say two input x, x ′ are ( v, w ) -indistinguishable using the output of a mechanism M if for any event S ,

and the same also true when x, x ′ are swapped. In our case, we have already shown that (from the proof of Theorem 4.3) for any post-processing algorithm A , x 0 and x w are indistinguishable using ˆ x in the trade-off function sense. [2] obtained a 'dual' characterization which says that the same Gaussian mechanism satisfies ( v, w ) -indistinguishability with

for all v ∈ R . By instantiating the event S to be that ∥ ˆ x -x 0 ∥ > ξ x 0 ,σ,δ , then we get

This completes the proof.

Proof of Corollary 4.5. The w,v 'privacy profile' implies a Renyi-divergence bound (one can also get that directly from the Renyi-DP of gaussian mechanism) which implies (by Proposition 10 of [40]) that

The stated result is obtained by setting u = 2 .

E Defense with Semantic Watermarks

In this section, we discuss possible defenses that are resilient to the proposed attack, and although Theorem 4.3 has guaranteed that no detection algorithm will be able to detect the watermark after our attack, the guarantee is based on the invisibility with respect to ℓ 2 distance. Therefore, by relaxing that invisibility constraint and thus making the watermark more visible, we may be able to prevent the watermark from being removed. One less-harmful way to loosen the invisibility constraint is with semantic watermarks. As shown in Figure 13, pixel-based watermarks such as DwtDctSvd keep the image almost intact, while semantic watermarks change the image significantly but retain its content.

E.1 Tree-Ring Watermarks

Tree-Ring Watermarking [60] is a new technique that robustly fingerprints diffusion model outputs in a way that is semantically hidden in the image space. An image with a Tree-Ring watermark does not look the same as the image, but it is semantically similar (in Figure 13, both the original and the semantically watermarked image contain an astronaut riding a horse in Zion National Park). Unlike existing methods that perform post-hoc modifications to images after sampling, Tree-Ring Watermarking subtly influences the entire sampling process, resulting in a model fingerprint. The watermark embeds a pattern into the initial noise vector used for sampling. These patterns are structured in Fourier space so that they are invariant to convolutions, crops, dilations, flips, and rotations. After image generation, the watermark signal is detected by inverting the diffusion process to retrieve the noise vector, which is then checked for the embedded signal. [60] demonstrated that Tree-Ring Watermarking can be easily applied to arbitrary diffusion models, including textconditioned Stable Diffusion, as a plug-in with negligible loss in FID.

E.2 Defense Experiments

To evaluate Tree-Ring as an alternative watermark, we use the same datasets from the previous experiments in Section 5 - MS-COCO and SDP. However, since Tree-Ring adds watermarks during the generation process of diffusion, it cannot directly operate on AI-generated images. Instead, it needs textual inputs that describe the content of the images. We use captions from MS-COCO and the user prompts of SDP datasets as the input prompts. The selected set of attacks (including our proposed attack) is applied to the Tree-Ring watermarked images.

As shown in Table 2, Tree-Ring watermarks show exceptional robustness against all the attacks tested. However, such robustness does not come for free. We depict the ℓ 2 -distances between original images and watermarked ones in Figure 14. Images with Tree-Ring watermarks are significantly more different from the original images in both the pixel space and the latent space. These results indicate that Tree-Ring, as an instance of semantic watermarks, shows the potential to be an alternative solution to the image watermarking problem. However, as our theory predicts, the robustness comes at the price of more visible differences.

DwtDctSvd

RivaGAN

SSL

StegaStamp

Tree-Ring

0

50

100

150

200

250

300

2 dis in Image

0

10

20

30

40

2 dis in Latent

Image

Latent

NeurIPS Paper Checklist

1. Claims

Question: Do the main claims made in the abstract and introduction accurately reflect the paper's contributions and scope?

Answer: [Yes]

Justification: Our major claim is that pixel-level invisible watermarks are vulnerable to our proposed attack. It's clearly stated in our abstract and introduction.

Guidelines:

The answer NA means that the abstract and introduction do not include the claims made in the paper.

The abstract and/or introduction should clearly state the claims made, including the contributions made in the paper and important assumptions and limitations. A No or NA answer to this question will not be perceived well by the reviewers.

The claims made should match theoretical and experimental results, and reflect how much the results can be expected to generalize to other settings.

It is fine to include aspirational goals as motivation as long as it is clear that these goals are not attained by the paper.

2. Limitations

Question: Does the paper discuss the limitations of the work performed by the authors?

Answer: [Yes]

Justification: We have pointed out one class of watermarks that can resist our attacks semantic-preserving ones. We have evaluated our method on these watermarks and discussed them in detail in Appendix F.

Guidelines:

The answer NA means that the paper has no limitation while the answer No means that the paper has limitations, but those are not discussed in the paper.

The authors are encouraged to create a separate "Limitations" section in their paper.

The paper should point out any strong assumptions and how robust the results are to violations of these assumptions (e.g., independence assumptions, noiseless settings, model well-specification, asymptotic approximations only holding locally). The authors should reflect on how these assumptions might be violated in practice and what the implications would be.

The authors should reflect on the scope of the claims made, e.g., if the approach was only tested on a few datasets or with a few runs. In general, empirical results often depend on implicit assumptions, which should be articulated.

The authors should reflect on the factors that influence the performance of the approach. For example, a facial recognition algorithm may perform poorly when image resolution is low or images are taken in low lighting. Or a speech-to-text system might not be used reliably to provide closed captions for online lectures because it fails to handle technical jargon.

The authors should discuss the computational efficiency of the proposed algorithms and how they scale with dataset size.

If applicable, the authors should discuss possible limitations of their approach to address problems of privacy and fairness.

While the authors might fear that complete honesty about limitations might be used by reviewers as grounds for rejection, a worse outcome might be that reviewers discover limitations that aren't acknowledged in the paper. The authors should use their best judgment and recognize that individual actions in favor of transparency play an important role in developing norms that preserve the integrity of the community. Reviewers will be specifically instructed to not penalize honesty concerning limitations.

3. Theory Assumptions and Proofs

Question: For each theoretical result, does the paper provide the full set of assumptions and a complete (and correct) proof?

Answer: [Yes]

Justification: Our theoretical results are in Section 4, with our assumptions in Section 4.1. Our proofs can be found in Appendix D. We have also discussed the implications and interpretation of our theoretical analysis in AppendixC.

Guidelines:

The answer NA means that the paper does not include theoretical results.

All the theorems, formulas, and proofs in the paper should be numbered and crossreferenced.

All assumptions should be clearly stated or referenced in the statement of any theorems.

The proofs can either appear in the main paper or the supplemental material, but if they appear in the supplemental material, the authors are encouraged to provide a short proof sketch to provide intuition.

Inversely, any informal proof provided in the core of the paper should be complemented by formal proofs provided in appendix or supplemental material.

Theorems and Lemmas that the proof relies upon should be properly referenced.

4. Experimental Result Reproducibility

Question: Does the paper fully disclose all the information needed to reproduce the main experimental results of the paper to the extent that it affects the main claims and/or conclusions of the paper (regardless of whether the code and data are provided or not)?

Answer: [Yes]

Justification: Our experiment setting is detailed in Section 5. We have also provided our implementation in the submitted supplementary material.

Guidelines:

The answer NA means that the paper does not include experiments.

If the paper includes experiments, a No answer to this question will not be perceived well by the reviewers: Making the paper reproducible is important, regardless of whether the code and data are provided or not.

If the contribution is a dataset and/or model, the authors should describe the steps taken to make their results reproducible or verifiable.

Depending on the contribution, reproducibility can be accomplished in various ways. For example, if the contribution is a novel architecture, describing the architecture fully might suffice, or if the contribution is a specific model and empirical evaluation, it may be necessary to either make it possible for others to replicate the model with the same dataset, or provide access to the model. In general. releasing code and data is often one good way to accomplish this, but reproducibility can also be provided via detailed instructions for how to replicate the results, access to a hosted model (e.g., in the case of a large language model), releasing of a model checkpoint, or other means that are appropriate to the research performed.

While NeurIPS does not require releasing code, the conference does require all submissions to provide some reasonable avenue for reproducibility, which may depend on the nature of the contribution. For example

(a) If the contribution is primarily a new algorithm, the paper should make it clear how to reproduce that algorithm.

(b) If the contribution is primarily a new model architecture, the paper should describe the architecture clearly and fully.

(c) If the contribution is a new model (e.g., a large language model), then there should either be a way to access this model for reproducing the results or a way to reproduce the model (e.g., with an open-source dataset or instructions for how to construct the dataset).

(d) We recognize that reproducibility may be tricky in some cases, in which case authors are welcome to describe the particular way they provide for reproducibility. In the case of closed-source models, it may be that access to the model is limited in some way (e.g., to registered users), but it should be possible for other researchers to have some path to reproducing or verifying the results.

5. Open access to data and code

Question: Does the paper provide open access to the data and code, with sufficient instructions to faithfully reproduce the main experimental results, as described in supplemental material?

Answer: [Yes]

Justification: Our code is provided in the supplementary material. We use openly accessible data in our experiments.

Guidelines:

The answer NA means that paper does not include experiments requiring code.

Please see the NeurIPS code and data submission guidelines ( https://nips.cc/ public/guides/CodeSubmissionPolicy ) for more details.

While we encourage the release of code and data, we understand that this might not be possible, so 'No' is an acceptable answer. Papers cannot be rejected simply for not including code, unless this is central to the contribution (e.g., for a new open-source benchmark).

The instructions should contain the exact command and environment needed to run to reproduce the results. See the NeurIPS code and data submission guidelines ( https: //nips.cc/public/guides/CodeSubmissionPolicy ) for more details.

The authors should provide instructions on data access and preparation, including how to access the raw data, preprocessed data, intermediate data, and generated data, etc.

The authors should provide scripts to reproduce all experimental results for the new proposed method and baselines. If only a subset of experiments are reproducible, they should state which ones are omitted from the script and why.

At submission time, to preserve anonymity, the authors should release anonymized versions (if applicable).

Providing as much information as possible in supplemental material (appended to the paper) is recommended, but including URLs to data and code is permitted.

6. Experimental Setting/Details

Question: Does the paper specify all the training and test details (e.g., data splits, hyperparameters, how they were chosen, type of optimizer, etc.) necessary to understand the results?

Answer: [Yes]

Justification: We have specified the details in Section 5 for readers to understand the results.

Guidelines:

The answer NA means that the paper does not include experiments.

The experimental setting should be presented in the core of the paper to a level of detail that is necessary to appreciate the results and make sense of them.

The full details can be provided either with the code, in appendix, or as supplemental material.

7. Experiment Statistical Significance

Question: Does the paper report error bars suitably and correctly defined or other appropriate information about the statistical significance of the experiments?

Answer: [No]

Justification: Although we haven't reported error bars, the effectiveness of our proposed attack is much better than the existing baselines.

Guidelines:

The answer NA means that the paper does not include experiments.

The authors should answer "Yes" if the results are accompanied by error bars, confidence intervals, or statistical significance tests, at least for the experiments that support the main claims of the paper.

The factors of variability that the error bars are capturing should be clearly stated (for example, train/test split, initialization, random drawing of some parameter, or overall run with given experimental conditions).

The method for calculating the error bars should be explained (closed form formula, call to a library function, bootstrap, etc.)

The assumptions made should be given (e.g., Normally distributed errors).

It should be clear whether the error bar is the standard deviation or the standard error of the mean.

It is OK to report 1-sigma error bars, but one should state it. The authors should preferably report a 2-sigma error bar than state that they have a 96% CI, if the hypothesis of Normality of errors is not verified.

For asymmetric distributions, the authors should be careful not to show in tables or figures symmetric error bars that would yield results that are out of range (e.g. negative error rates).

If error bars are reported in tables or plots, The authors should explain in the text how they were calculated and reference the corresponding figures or tables in the text.

8. Experiments Compute Resources

Question: For each experiment, does the paper provide sufficient information on the computer resources (type of compute workers, memory, time of execution) needed to reproduce the experiments?

Answer: [Yes]

Justification: We discussed the compute resources we used in Section 5.

Guidelines:

The answer NA means that the paper does not include experiments.

The paper should indicate the type of compute workers CPU or GPU, internal cluster, or cloud provider, including relevant memory and storage.

The paper should provide the amount of compute required for each of the individual experimental runs as well as estimate the total compute.

The paper should disclose whether the full research project required more compute than the experiments reported in the paper (e.g., preliminary or failed experiments that didn't make it into the paper).

9. Code Of Ethics

Question: Does the research conducted in the paper conform, in every respect, with the NeurIPS Code of Ethics https://neurips.cc/public/EthicsGuidelines ?

Answer: [Yes]

Justification: Yes it does.

Guidelines:

The answer NA means that the authors have not reviewed the NeurIPS Code of Ethics.

If the authors answer No, they should explain the special circumstances that require a deviation from the Code of Ethics.

The authors should make sure to preserve anonymity (e.g., if there is a special consideration due to laws or regulations in their jurisdiction).

10. Broader Impacts

Question: Does the paper discuss both potential positive societal impacts and negative societal impacts of the work performed?

Answer: [Yes]

Justification: We have discussed the societal impacts in our abstract, introduction, conclusion, and Appendix F.

Guidelines:

The answer NA means that there is no societal impact of the work performed.

If the authors answer NA or No, they should explain why their work has no societal impact or why the paper does not address societal impact.

Examples of negative societal impacts include potential malicious or unintended uses (e.g., disinformation, generating fake profiles, surveillance), fairness considerations (e.g., deployment of technologies that could make decisions that unfairly impact specific groups), privacy considerations, and security considerations.

The conference expects that many papers will be foundational research and not tied to particular applications, let alone deployments. However, if there is a direct path to any negative applications, the authors should point it out. For example, it is legitimate to point out that an improvement in the quality of generative models could be used to generate deepfakes for disinformation. On the other hand, it is not needed to point out that a generic algorithm for optimizing neural networks could enable people to train models that generate Deepfakes faster.

The authors should consider possible harms that could arise when the technology is being used as intended and functioning correctly, harms that could arise when the technology is being used as intended but gives incorrect results, and harms following from (intentional or unintentional) misuse of the technology.

If there are negative societal impacts, the authors could also discuss possible mitigation strategies (e.g., gated release of models, providing defenses in addition to attacks, mechanisms for monitoring misuse, mechanisms to monitor how a system learns from feedback over time, improving the efficiency and accessibility of ML).

11. Safeguards

Question: Does the paper describe safeguards that have been put in place for responsible release of data or models that have a high risk for misuse (e.g., pretrained language models, image generators, or scraped datasets)?

Answer: [NA]

Justification: We do not release any models or data.

Guidelines:

The answer NA means that the paper poses no such risks.

Released models that have a high risk for misuse or dual-use should be released with necessary safeguards to allow for controlled use of the model, for example by requiring that users adhere to usage guidelines or restrictions to access the model or implementing safety filters.

Datasets that have been scraped from the Internet could pose safety risks. The authors should describe how they avoided releasing unsafe images.

We recognize that providing effective safeguards is challenging, and many papers do not require this, but we encourage authors to take this into account and make a best faith effort.

12. Licenses for existing assets

Question: Are the creators or original owners of assets (e.g., code, data, models), used in the paper, properly credited and are the license and terms of use explicitly mentioned and properly respected?

Answer: [Yes]

Justification: We have properly cited the dataset we use, MS-COCO in our paper.

Guidelines:

The answer NA means that the paper does not use existing assets.

The authors should cite the original paper that produced the code package or dataset.

The authors should state which version of the asset is used and, if possible, include a URL.

The name of the license (e.g., CC-BY 4.0) should be included for each asset.

For scraped data from a particular source (e.g., website), the copyright and terms of service of that source should be provided.

If assets are released, the license, copyright information, and terms of use in the package should be provided. For popular datasets, paperswithcode.com/datasets has curated licenses for some datasets. Their licensing guide can help determine the license of a dataset.

For existing datasets that are re-packaged, both the original license and the license of the derived asset (if it has changed) should be provided.

If this information is not available online, the authors are encouraged to reach out to the asset's creators.

13. New Assets

Question: Are new assets introduced in the paper well documented and is the documentation provided alongside the assets?

Answer: [Yes]

Justification: The code provided in our supplementary material is well documented.

Guidelines:

The answer NA means that the paper does not release new assets.

Researchers should communicate the details of the dataset/code/model as part of their submissions via structured templates. This includes details about training, license, limitations, etc.

The paper should discuss whether and how consent was obtained from people whose asset is used.

At submission time, remember to anonymize your assets (if applicable). You can either create an anonymized URL or include an anonymized zip file.

14. Crowdsourcing and Research with Human Subjects

Question: For crowdsourcing experiments and research with human subjects, does the paper include the full text of instructions given to participants and screenshots, if applicable, as well as details about compensation (if any)?

Answer: [NA]

Justification: The paper does not involve human subjects.

Guidelines:

The answer NA means that the paper does not involve crowdsourcing nor research with human subjects.

Including this information in the supplemental material is fine, but if the main contribution of the paper involves human subjects, then as much detail as possible should be included in the main paper.

According to the NeurIPS Code of Ethics, workers involved in data collection, curation, or other labor should be paid at least the minimum wage in the country of the data collector.

15. Institutional Review Board (IRB) Approvals or Equivalent for Research with Human Subjects

Question: Does the paper describe potential risks incurred by study participants, whether such risks were disclosed to the subjects, and whether Institutional Review Board (IRB) approvals (or an equivalent approval/review based on the requirements of your country or institution) were obtained?

Answer: [NA]

Justification: The paper does not involve human subjects.

Guidelines:

The answer NA means that the paper does not involve crowdsourcing nor research with human subjects.

Depending on the country in which research is conducted, IRB approval (or equivalent) may be required for any human subjects research. If you obtained IRB approval, you should clearly state this in the paper.

We recognize that the procedures for this may vary significantly between institutions and locations, and we expect authors to adhere to the NeurIPS Code of Ethics and the guidelines for their institution.

For initial submissions, do not include any information that would break anonymity (if applicable), such as the institution conducting the review.

Peer reviews:
comments: SUMMARY:
This paper investigates the resilience of invisible watermarks embedded in images against removal attacks. The authors propose a new class of attacks, called regeneration attacks, which combine adding random noise to the image and then reconstructing the image using generative models. The study demonstrates that these attacks can effectively remove invisible watermarks, including the resilient RivaGAN, while maintaining image quality.

STRENGTHS:
Introduces a new Image Watermarks attack leveraging generative models, providing a fresh perspective on watermark removal.

Offers formal proofs to demonstrate the effectiveness of the proposed attacks.

Provides extensive empirical results showing the success of the attacks across different watermarking methods.

The writing is clear and well-organized.

WEAKNESSES:
While invisible watermarks are highly vulnerable, semantic watermarks are less affected by the proposed attacks.

QUESTIONS:
N/A

LIMITATIONS:
N/A
TITLE: Official Review
SOUNDNESS_CORRECTNESS: 4
DATE: 2024-06-23

{"IS_META_REVIEW": false, "comments": "SUMMARY:\nThe main idea proposed in this paper is that regenerating images using other (pretrained) generative AI (e.g., vae, diffusion models) can provably remove any invisible watermarks embedded in a given image. Accompanying this, the paper can be divided into the following parts: (1) intro of the proposed regeneration methods; (2) proof of the removal guarantee (by any regeneration methods falls into the definition of this paper, not limited to vae or diffusion; and (3) empirical experiments to support their claim \"the regeneration methods is effective, especially using defussion models.\"\n\nSTRENGTHS:\nThe idea proposed in this work original.\nThe paper is clearly written. The use of math does not create burden in readability but helps to understand the main idea.\n\nWEAKNESSES:\nThe weakness is listed below in order, from major to minor:\n\nWeakness 1 (Major): Experiment settings and evaluation are not rigorous.\n\nThe key experiment and result to support the authors claim of the effectiveness of their method will be those that can show the “strength” of their proposed attacks, but the current evaluation experiment is poorly designed. Reporting the watermark detection acc. (as in Table 2) using a fixed attack point (e.g., JPEG 50, or the selected VAE’s, etc., where they all have tunable parameters) cannot faithfully show the strength. This make the PSNR value reported in Table 2 meaningless. Instead, if there is a tradeoff between the image quality and the watermark detectability expected, the authors should report the maximal PSNR (the best image quality) for each attack method when the same detection ability (e.g., fail the watermark detection) of the decoder is achieved (e.g., with the same bitwise acc.) by tuning the hyperparameters of the attack methods (e.g., the JPEG quality factor, the compression index of the selected VAE model used in this paper, the noise level of the diffusion regeneration as Fig. 5, etc.). In this regard, the attack method with the best image quality can be argued as the strongest reasonably. Alternatively, the authors may consider profiling the quality and detectability tradeoff as proposed in [1]. The current evaluation experiment is not sufficient to support the claim made in line 71-73.\n\nWeakness 2 (Major): Conclusion with insufficient support.\n\nIn line 13-14 “Our findings underscores … to semantic-preserving watermarks” is not convincing. For example, let’s say we want to prevent misusing generated images. In Fig 6., the authors visualize the StegaStamp watermark, where there are obvious abnormal patterns embedded into the image (in another word, they are not `invisible’ and humans can tell these images are suspicious). I would suspect that the attacked images of StegaStamp after applying the methods proposed by the authors will still have visible artifacts that are enough to raise human caution and suspect they are not original images—so it may be reasonable to argue that StegaStamp can successfully prevent image misuse and do not need a shift as the authors claimed. My suspicions are raised by the following results presented by the authors: (i) The visualizations of the attack methods proposed by the authors (e.g., Diffusion Attack in Fig 3. And 7.) are on DwtDctSVD watermarks and they already contain visible artifacts; (ii) corresponding PSNR values in Table 2 for DwtDctSVD is higher than StegaStamp; whereas in Fig 5., the PSNR of diffusion regeneration on StegaStamp is low. So, I would imagine that the attacked images of StegaStamp will have more visible artifacts but the author did not include any visualization of this. Thus, I consider the current conclusion an overclaim without persuasive argument and suggest the authors provide more evidence to support their claim.\n\nWeakness 3 (Minor) --- inaccurate statements.\n\nIn line 1-3 “Invisible watermark safeguards images’ copyrights … prevent people from misusing images … ”.  These are largely believed to be only possible applications that people are thinking of how to use invisible watermarks, but not affirmative conclusions.\nLine 4 “ The proposed attack method first adds random noise to an image…”. According to Eq. 1, the proposed methods add noise to the latent feature of the image (attack instance 2 & 3), not the image itself.\n\n\n[1] An, Bang, et al. \"WAVES: Benchmarking the Robustness of Image Watermarks.\" Forty-first International Conference on Machine Learning.\n\nQUESTIONS:\n1. Similar to Fig. 2, can you also provide (1) watermarks other than DwtDctSVD and (2) curves that are achieved by other regeneration attacks (e.g., VAE, denoising autoencoder)? Current illustration is insufficient to support the claim in the caption “indicating the success of our attack and the validity of the theoretical bound”.\n\n2. As the authors repeatedly claim the superior attack performance of their proposed method, the visualization w.r.t only DwtDctSVD is not sufficient, as DwtDctSVD appears to be the least robust watermark among all the selected watermarks in this paper (see Table 2). Can you provide complete set of attack visualization of all methods on different watermarks considered in this paper? This will also help to clarify \"Weakness 2\" stated above.\n\n3. As the authors proposed denoising reconstruction (attack instance 1), I think it is necessary to include DiffPure as a baseline attack in the experiment and discuss its performance. This has been applied as a watermark attack method in a published paper [2].\n\n[2] Saberi, Mehrdad, et al. \"Robustness of AI-Image Detectors: Fundamental Limits and Practical Attacks.\" The Twelfth International Conference on Learning Representations. 2023.\n\nLIMITATIONS:\nN/A. The work does not have potential negative impact that needs to be explicitly discussed.", "TITLE": "Official Review", "RECOMMENDATION": 7, "REVIEWER_CONFIDENCE": 5, "SOUNDNESS_CORRECTNESS": 3, "DATE": "2024-06-24"}

{"IS_META_REVIEW": false, "comments": "SUMMARY:\nThis paper proposes regeneration attacks, which adds destructive Gaussian noise to the latent representation of the watermarked image, and then reconstructs the corrupted latent to reconstruct the original clean image. The paper provides theoretical guarantee that shows the trade-off function between the Type I error and the Type II error after the attack, in addition to the theorem that shows the ability of the regeneration attack's capability to produce images with similar quality as the generative model that reconstructs the corrupted latent. The paper also introduces a potential defense mechanism that can survive the regeneration attack.\n\nSTRENGTHS:\nThe paper is well-written and easy to read. The presentation is clear and the empirical result is thorough and informative. Besides empirical results, the author also provides theoretical guarantees on the claim. Besides proposing the regeneration attack, the author also provides a potential defense mechanism that sheds light on future watermarking research under the proposed attack.\n\nWEAKNESSES:\nThe proposed method relies on the upper bound $L \\geq L_{x,w}$ to effectively calibrate $\\sigma$, which is slightly unrealistic considering the embedding function $\\phi$ and original image $x$ is unknown to the attacker, even though a uniform upper bound may exist, this could potentially affect the attack performance or image quality since the attacker normally has no access to the decoding scheme thus unable to verify the performance of the attack while maintaining the image quality.\n\nQUESTIONS:\nMajor concerns are already addressed in Appendix A, so here are some minor questions that may be slightly out of the scope. \n1. For in-processing watermarking, semantic watermarking is a great alternative for preserving visual quality as well as robustness to regeneration attacks. However, for post-hoc watermarking, changing the semantic content leads to unsatisfactory results. How do you envision balancing the robustness of semantic watermarks with their increased visibility in practical applications? Are there any strategies you are exploring to minimize the visual impact while maintaining robustness under regeneration attacks?\n2. The Stegastamp method seems to be able to withstand the proposed attack due to a relatively high l2 distance in both pixel and latent space. Figure 5 shows that with greater noise levels, StegaStamp fails to withstand the regeneration attacks, but the reduced PSNR and SSIM indicate significant degradation in image quality. Since StegaStamp's image quality is already low, enforcing regeneration attacks that further degrade image quality seems unrealistic in real-world scenarios. Given that PSNR and SSIM are pixel-level metrics, such degradation is expected after multiple perturbations in the semantic space. I wonder if the semantically meaningful content is still preserved after regeneration attacks capable of breaking StegaStamp. Specifically, a visualization for Figure 5 or an LPIPS curve might be helpful for understanding the preservation of semantic content.\n\n-------------------Post rebuttal Edit------------------------\n\nI appreciate the author for the comments. My questions has been well addressed. I have increased my rating accordingly.\n\nLIMITATIONS:\npotential negative societal impact has not been addressed but the author does provide potential defense mechanisms for the proposed attack method.", "TITLE": "Official Review", "RECOMMENDATION": 7, "REVIEWER_CONFIDENCE": 3, "SOUNDNESS_CORRECTNESS": 3, "DATE": "2024-07-13"}