Research map / Adversarial robustness and security / Attacks on text and graphs

Decoder Gradient Shield: Provable and High-Fidelity Prevention of Gradient-Based Box-Free Watermark Removal

CVPR 2025 · Adversarial robustness and security › Attacks on text and graphs · approach: Neural network watermarking · 1 citations (OpenAlex)

Read the paperCheck your idea against 108,967 papers

AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.

Proposes Decoder Gradient Shield, a closed-form gradient-reorienting output perturbation in the watermark decoder API that prevents gradient-based box-free watermark removal training on image-to-image models.

Problem

Box-free watermark decoders jointly trained with encoders can be exploited via black-box gradient access to train a watermark removal network, stripping copyright marks from image-to-image model outputs.

Approach

Reorient and rescale the gradient of watermarked queries by returning a perturbed decoder output Z* = -PZ + (P+I)W (with P positive definite, small eigenvalues) whenever the output is detected as a watermark, so the attacker's removal loss cannot converge while output fidelity is retained.

Key results

• Without defense, the gradient-based removal attack drives the removal loss to near zero (about 1e-8 for deraining and 1e-14 for style transfer), while with DGS none of the attacker's loss functions decrease meaningfully.
• DGS retains decoder output fidelity and, under JPEG compression at 10% quality and lattice attack with step 2, the watermark success rate remains 1.00 for both tasks.
• DGS runs in about 1.65e-4 s (deraining) and 8.45e-5 s (style transfer) per query on a single RTX5000.

Measured effects reported in the paper

Surprising findings

• Gradient sign flipping by the attacker is partially compensated by DGS only when eigenvalues of P are small (about 1e-7 to 1e-6 or smaller); larger eigenvalues let the attacker still learn removal.
• Under 0 dB Gaussian noise the success rate for style transfer drops to 58%, showing robustness limits.

Limitations

• Attacker can potentially recover the hidden true output Z from observed Z* if W and P are estimated, and the paper notes this remains a weakness.
• Gradient sign flipping still partially learnable unless eigenvalues of P are very small.
• Evaluated only on grayscale 256x256 images with two tasks and one watermarking model.

Experimental setup

Datasets: PASCAL VOC

Benchmarks: PASCAL VOC (image deraining and style transfer)

Metrics: PSNR MS-SSIM success rate of defense (SR) removal loss convergence

Baselines: no defense (gradient-based removal attack) gradient sign flipping attack lattice attack JPEG compression Gaussian noise addition

Builds on: box-free watermarking (Yu et al. post-hoc watermarking) prediction poisoning gradient redirection gradient-based black-box attacks

Closest papers by meaning

• Lightweight-Mark: Rethinking Deep Learning-Based Watermarking (ICML 2025 · similarity 0.89)
• END^2: Robust Dual-Decoder Watermarking Framework Against Non-Differentiable Distortions (AAAI 2025 · similarity 0.89)
• RAW: A Robust and Agile Plug-and-Play Watermark Framework for AI-Generated Images with Provable Guarantees (NeurIPS 2024 · similarity 0.87)
• Transferable Black-Box One-Shot Forging of Watermarks via Image Preference Models (NeurIPS 2025 · similarity 0.86)
• Robustness of AI-Image Detectors: Fundamental Limits and Practical Attacks (ICLR 2024 · similarity 0.86)
• Invisible Image Watermarks Are Provably Removable Using Generative AI (NeurIPS 2024 · similarity 0.86)