Research map / Adversarial robustness and security / Attacks on text and graphs
Leveraging Optimization for Adaptive Attacks on Image Watermarks
Read the paperCheck your idea against 108,967 papers
AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.
Proposes learnable adaptive attacks (adversarial noising and adversarial compression) that use differentiable surrogate watermark keys to optimize evasion of five no-box image watermarks for Stable Diffusion.
Problem
Robustness of no-box watermarks for image generators is evaluated with handcrafted, non-optimal attacks; there is no principled way to know whether an adaptive attack is optimal.
Approach
Frame adaptive attacks as an optimization problem by creating differentiable surrogate watermarking keys (GKeyGen, a trained ResNet-50 decoder) from a surrogate Stable Diffusion generator, then optimize either an L_inf adversarial perturbation or a fine-tuned pre-trained autoencoder (compression) against them.
Key results
- Adversarial compression reduces TPR@1%FPR to 0.8%-6.3% across DWT, DWT-SVD, WDM, and RivaGAN with a single compression and no visible FID/CLIP degradation.
- Adversarial noising at epsilon=2/255 evades TRW with 5.2% accuracy at LPIPS 3.2e-2.
- Optimizing attacks takes under 1 A100 GPU hour as stated in the abstract; adversarial noising takes under 1 second per sample and compressor tuning under 10 minutes.
Measured effects reported in the paper
| What was changed | Where | Measured | Effect |
|---|---|---|---|
| Apply adversarial noising with ε=2/255 | TRW watermarked Stable Diffusion-v2.0 · TRW | TPR@1%FPR: 5.2% | Helped |
| Apply optimized adversarial compression with r=1 | WDM watermarked Stable Diffusion-v2.0 · WDM | TPR@1%FPR: 2.0% | Helped |
| Apply optimized adversarial compression with r=1 | DWT watermarked Stable Diffusion-v2.0 · DWT | TPR@1%FPR: 0.8% | Helped |
| Apply optimized adversarial compression with r=1 | DWT-SVD watermarked Stable Diffusion-v2.0 · DWT-SVD | TPR@1%FPR: 1.9% | Helped |
| Apply optimized adversarial compression with r=1 | RivaGAN watermarked Stable Diffusion-v2.0 · RivaGAN | TPR@1%FPR: 6.3% | Helped |
| Add optimization of adversarial compression parameters (ablation) | Adversarial Compression across the surveyed watermark methods · TRW, WDM, DWT, DWT-SVD, and RivaGAN | watermark detection accuracy | Helped |
| Use double-tail instead of single-tail detection (ablation) | Adversarial Noising against DWT · DWT, ε=2/255 | TPR@1%FPR: 79.1% / 75.0% | Hurt |
| Use double-tail instead of single-tail detection (ablation) | Adversarial Noising against DWT-SVD · DWT-SVD, ε=6/255 | TPR@1%FPR: 0.0% / 23.3% | Hurt |
| Use double-tail instead of single-tail detection (ablation) | Adversarial Compression · WDM, DWT, DWT-SVD, and RivaGAN | TPR@1%FPR: 2.0% / 1.8%; 0.8% / 0.5%; 1.9% / 2.5%; 6.3% / 5.7% | No clear effect |
Surprising findings
- Using a single surrogate key suffices to evade detection, suggesting key randomization in these watermarks has little effect on robustness.
- Adversarial noising is ineffective against WDM and RivaGAN at small epsilon, while compression evades all methods.
Limitations
- Requires the watermarking algorithm and an open-source surrogate generator to replicate keys.
- Attacks evaluated only with a single surrogate pair (SD v1.1 surrogate, SD v2.0 defender) and only for Stable Diffusion; transfer to other models is untested.
- Code is not released publicly, reducing reproducibility.
Experimental setup
Datasets: LAION-5B MS-COCO-2017
Benchmarks: MS-COCO-2017
Metrics: TPR@1%FPR FID CLIP score LPIPS
Baselines: TRW WDM DWT DWT-SVD RivaGAN
Builds on: Tree-Ring Watermarks Stable Diffusion LPIPS DPM solver
Closest papers by meaning
- Optimizing Adaptive Attacks against Watermarks for Language Models (ICML 2025 · similarity 0.92)
- Robustness of AI-Image Detectors: Fundamental Limits and Practical Attacks (ICLR 2024 · similarity 0.88)
- Watermarks in the Sand: Impossibility of Strong Watermarking for Language Models (ICML 2024 · similarity 0.88)
- Can Simple Averaging Defeat Modern Watermarks? (NeurIPS 2024 · similarity 0.87)
- On the Robustness of Watermarking for Autoregressive Image Generation (NeurIPS 2026 · similarity 0.87)
- The Good, the Bad and the Ugly: Meta-Analysis of Watermarks, Transferable Attacks and Adversarial Defenses (NeurIPS 2025 · similarity 0.87)
Writing a paper in this area? scime draft is a free LaTeX editor with AI included, real-time co-authors and a check of your references and venue rules before you submit. It also imports OpenAI Prism projects.