Paper: Robustness of AI-Image Detectors: Fundamental Limits and Practical Attacks (ICLR-2024)

Reviewer comment (Writing):
Complexity of Theoretical Analysis: While the paper provides an in-depth theoretical analysis, the complexity of these analyses might pose challenges for some readers, especially those who are not familiar with diffusion models and the theoretical underpinnings of adversarial attacks. Certain sections of the paper may appear somewhat opaque to these readers. It would be beneficial if the authors could simplify the explanations or provide additional resources to aid understanding.

Author response:
In the new version of our draft, we have added a reference to [1] (in Section 3.1) which provides comprehensive definitions for diffusion models and the terms that are used in our paper. Most of the terms that we use in our work such as $x_0$, $x_t$, $\bar{\alpha}_t$ are consistent with this survey paper.

Reviewer comment (Writing):
Complexity of Theoretical Analysis: While the paper provides an in-depth theoretical analysis, the complexity of these analyses might pose challenges for some readers, especially those who are not familiar with diffusion models and the theoretical underpinnings of adversarial attacks. Certain sections of the paper may appear somewhat opaque to these readers. It would be beneficial if the authors could simplify the explanations or provide additional resources to aid understanding.

Author response:
In the new version of our draft, we have added a reference to [1] (in Section 3.1) which provides comprehensive definitions for diffusion models and the terms that are used in our paper. Most of the terms that we use in our work such as $x_0$, $x_t$, $\bar{\alpha}_t$ are consistent with this survey paper.

Reviewer comment (Experiments):
Problem Description: The experiments conducted in the article primarily utilize the ImageNet dataset, potentially limiting the generalizability of the results. Recommendation: In future work, conduct experiments using multiple datasets from various fields and sources to validate the effectiveness and stability of the method.

Author response:
We agree with the reviewer’s comment that including more datasets could support the generalizability of our work. Adding new datasets can be time-consuming, especially since some of the watermarking methods require training of their models on the target dataset. Nonetheless, it will be one of our priorities to include more datasets such as COCO and CIFAR in our work, hopefully for the final draft of the paper.

Reviewer comment (Theory):
Problem Description: The theoretical analysis presented in the article is quite complex, which may be challenging for all readers to comprehend. Recommendation: Provide more intuitive explanations and examples, and simplify some of the theoretical derivations to make them more accessible and easier to understand.

Author response:
To enhance the clarity of the theoretical parts of the paper, we have added more explanations to Sections 3 and 4, and the appendix. We added the formal definition of the terms used in Theorem 2 to the main text of Section 4. Additionally, we clarified the reason for the usage of denoising diffusion models in our theory, and how it can be replaced with other denoising techniques (Section 3.1, and Appendix B).

Reviewer comment (Evaluation):
The experimental results are missing a key element, specifically the PSNR, SSIM, or other image quality metrics comparing the diffusion-purified or adversarially attacked images with the original images. This result is crucial as adversaries aim to eliminate watermarks while preserving high-quality images simultaneously.

Author response:
Thank you for your positive feedback. We hope the following response can help address your concern.

> **Weakness 1:** The experimental results are missing a key element, specifically the PSNR, SSIM, or other image quality metric

We appreciate your valuable suggestion, which was an aspect we overlooked in our experiments. Below, you'll find the PSNR and SSIM values for images subjected to both DiffPure and adversarial attacks. In the case of the DiffPure attack, the output images with t=0.2 exhibit reasonable quality, while the attack significantly lowers the AUROC for imperceptible watermarking techniques, as shown in Figure 3 of the paper. As for the adversarial attack, the epsilon values employed in the paper align with standard perturbation budgets in the adversarial robustness literature. As indicated in the tables, these values result in images with reasonable quality. We have added these tables to the appendix of our paper.

[mean PSNR of images attacked with DiffPure w.r.t t]
| Method      | t=0.1 | t=0.2 | t=0.3 |
| ----------- | ---- | ---- | ---- | 
| WatermarkDM | 30.33 | 26.41 | 23.87|
| MBRS        | 29.96 | 26.23 | 23.76 |
| RivaGAN     | 29.77 | 26.10| 23.61|
| DwtDct      | 29.64| 26.03  | 23.70 |
| DwtDctSVD   | 29.69 | 26.08| 23.60|
| TreeRing    | 32.45 | 28.27 | 25.49 |
| StegaStamp  | 30.35 | 26.52| 24.08|

[mean SSIM of images attacked with DiffPure w.r.t t]
| Method      | t=0.1 | t=0.2 | t=0.3 |
| ----------- | ---- | ---- | ---- | 
| WatermarkDM | 0.86 | 0.75| 	0.66 |
| MBRS        | 0.83 | 0.73| 0.64|
| RivaGAN     | 0.83| 0.72 |0.63|
| DwtDct      | 0.83| 0.72 | 0.63|
| DwtDctSVD   | 0.83|0.72|0.63|
| TreeRing    | 0.92 | 0.86| 0.81|
| StegaStamp  | 0.84|0.73|0.64|

[mean PSNR of adversarially attacked images w.r.t epsilon]
| Method      | eps=4 | eps=8 | eps=12 |
| ----------- | ---- | ---- | ---- | 
| TreeRing    | 36.60 | 32.41 | 30.18|
| StegaStamp  | 36.11  |31.20|28.20|

[mean SSIM of adversarially attacked images w.r.t epsilon]
| Method      | eps=4 | eps=8 | eps=12 |
| ----------- | ---- | ---- | ---- | 
| TreeRing    | 0.96 | 0.90 |0.86|
| StegaStamp  | 0.95 |0.86|0.75|

Reviewer comment (Experiments):
The empirical studies for theorem 2 are unpractical. It is almost impossible to add noise to the interior feature maps directly in practical cases.

Author response:
Thank you for the comment. In Appendix F (Figure 19), we add new experiments (in purple text) where noise is added to the images. This result shows that adding small noises to the image space can cause high $\ell_2$ perturbations in the latent space. Also, note that the tradeoff we present in Figure 8 (Theorem 2) will be more significant as AI images become more realistic and the Wasserstein distance between real and fake distributions decreases. This means that it will become easier to affect the performance of image detectors by adding lower levels of noise to the images as generative image models evolve.

Reviewer comment (Experiments):
The experimental setup of section 4 is impractical. I suggest authors add noise to spatial images directly instead of interior feature maps.

Author response:
Thank you for the comment. In Appendix F (Figure 19), we add new experiments (in purple text) where noise is added to the images. This result shows that adding small noises to the image space can cause high $\ell_2$ perturbations in the latent space. Also, note that the tradeoff we present in Figure 8 (Theorem 2) will be more significant as AI images become more realistic and the Wasserstein distance between real and fake distributions decreases. This means that it will become easier to affect the performance of image detectors by adding lower levels of noise to the images as generative image models evolve.

Reviewer comment (Experiments):
The title of the paper is “AI-image detectors”. The authors only consider fake facial images in section 4. AI-generated facial detectors are only a small part of AI-image detectors. Therefore, more AI-image detectors for arbitrary contexts require consideration.

Author response:
Our theory in Section 4 is general and holds for any real and fake distributions. We consider an application of deepfakes and perform our experiments on facial images since they are popular in the research community. We take your feedback positively and are working on adding more experiments on a different dataset. We will update the manuscript if we finish our experiments before the discussion period ends. Otherwise, we will add these results to the final version of the paper.