Research map / Adversarial robustness and security / Attacks on text and graphs

The Good, the Bad and the Ugly: Meta-Analysis of Watermarks, Transferable Attacks and Adversarial Defenses

NeurIPS 2025 · Adversarial robustness and security › Attacks on text and graphs · approach: Neural network watermarking · 0 citations (OpenAlex)

Read the paperCheck your idea against 108,967 papers

AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.

Formalizes watermarks, adversarial defenses and transferable attacks as a verifier-prover protocol with bounded-circuit players, proves at least one of the three exists for any learnable task, and builds an FHE-based transferable attack.

Problem

The trade-off between backdoor-based watermarks and adversarial defenses for classification tasks, under computational resource bounds on attacker and defender, with no model-specific assumptions.

Approach

Models the watermark/defense/attack interaction as a zero-sum game over bounded-size circuits and shows via Nash equilibrium that one of three objects always exists; identifies transferable attacks (indistinguishable queries that fool all equally-resourced defenders) as a necessary third option, constructed using fully homomorphic encryption.

Key results

• Main theorem: for any learnable task, at least one of a watermark, an adversarial defense, or a transferable attack exists (formally, with some frequency over n).
• Constructs a cryptography-based learning task (lines on circle, FHE-augmented) with a transferable attack where attacker circuit size is about 1/epsilon versus Omega(1/epsilon^2) for the defender.
• Shows transferable attacks imply EFID pairs, hence a cryptographic primitive; bounded-VC tasks admit defenses against all attackers with poly(n/epsilon) defender size.

Surprising findings

• Transferable attacks, a counterintuitive third option, are necessary for the trade-off and exist under FHE.

Limitations

• Results are theoretical and in an idealized circuit-size model; no empirical validation on practical models.
• Main theorem holds only with some frequency over n rather than for all sufficiently large n.
• Transferable attack construction is for a specially designed cryptographic task, not natural learning tasks.

Experimental setup

Builds on: undetectable backdoors (Goldwasser et al.) randomized smoothing EFID pairs fully homomorphic encryption

Closest papers by meaning

• Leveraging Optimization for Adaptive Attacks on Image Watermarks (ICLR 2024 · similarity 0.87)
• Watermarks in the Sand: Impossibility of Strong Watermarking for Language Models (ICML 2024 · similarity 0.86)
• A Transfer Attack to Image Watermarks (ICLR 2025 · similarity 0.85)
• Watermark Stealing in Large Language Models (ICML 2024 · similarity 0.85)
• Black-Box Forgery Attacks on Semantic Watermarks for Diffusion Models (CVPR 2025 · similarity 0.85)
• Transferable Black-Box One-Shot Forging of Watermarks via Image Preference Models (NeurIPS 2025 · similarity 0.85)