Paper: Leveraging Optimization for Adaptive Attacks on Image Watermarks (ICLR-2024)

Reviewer comment (Theory):
The attack requires the knowledge of the watermarking algorithm.

Author response:
Knowledge of the watermarking algorithm may only sometimes be given in a real-world attack (as outlined in our limitations on page 9). Still, it remains a valuable tool for the provider to _test_ the robustness of a watermarking method. Robustness against adaptive attackers extends to robustness against non-adaptive attackers (as they have fewer capabilities). This forms our core argument for why studying a method’s robustness requires considering adaptive attacks. We will emphasize this argument in the revised paper.

Reviewer comment (Experiments):
The experiments comparison and discussion are weak.

Author response:
We will gladly expand the scope of discussion and add comparisons with advanced methods, but we kindly ask for clarification about the methods the reviewer refers to. To our knowledge, there are no strong, comparable attacks without access to the secret watermarking key, as evidenced by watermarking papers [A,B] that only evaluate against attacks such as JPEG compression and quantization. We would greatly appreciate it if the reviewer could point us to “more advanced methods” or detail what part of the discussion we should focus on more in-depth, and we would be happy to revise our paper.

Reviewer comment (Experiments):
The experiment section should expand the scope of discussion, compare with more advanced methods, and provide in-depth discussions.

Author response:
We will gladly expand the scope of discussion and add comparisons with advanced methods, but we kindly ask for clarification about the methods the reviewer refers to. To our knowledge, there are no strong, comparable attacks without access to the secret watermarking key, as evidenced by watermarking papers [A,B] that only evaluate against attacks such as JPEG compression and quantization. We would greatly appreciate it if the reviewer could point us to “more advanced methods” or detail what part of the discussion we should focus on more in-depth, and we would be happy to revise our paper.

Reviewer comment (Presentation):
ABSTRACT: The text should include more details to the proposed methodology, numerical results achieved, and comparison with other methods.

Author response:
We thank the reviewer for their suggestions and will revise the abstract and conclusion of the revised paper as requested.

Reviewer comment (Writing):
The abbreviations must appear at the very first place that the terminology is introduced and the way of introducing the terms must be consistent throughout the manuscript from abstract to conclusion.

Author response:
We apologize for any confusion if an abbreviation was used before defining it. We are happy to revise and clarify the paper if the reviewer could point us to the specific abbreviations that have caused confusion.

Reviewer comment (Writing):
The conclusions should be improved such that the authors add some analytical terms.

Author response:
We thank the reviewer for their suggestions and will revise the abstract and conclusion of the revised paper as requested.