Research map / Adversarial robustness and security / Black-box and transfer attacks
A Transfer Attack to Image Watermarks
Read the paperCheck your idea against 108,967 papers
AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.
Proposes a no-box transfer evasion attack on learning-based image watermark detectors by ensembling many surrogate watermarking decoders trained on a different dataset, with theoretical bounds on transferability.
Problem
Evading watermark-based AI-generated image detectors when the attacker has no access to the target encoder/decoder, detection API, watermark length, or training data (no-box setting).
Approach
Train multiple surrogate watermarking models (different architectures, watermark lengths, bootstrapped data subsets), choose inverse-decoded watermarks as targets, and solve a joint ensemble optimization (PGD with early stopping) for one perturbation that flips every surrogate's decoded watermark, which transfers to the target decoder; theoretical bounds on target bit accuracy are derived from sur
Key results
- With 100 surrogate models, the attack achieves over 85% evasion with average l_inf perturbation below 0.25 across target architectures and watermark lengths.
- The attack evades detection at 100% with 40 surrogate models and 0.09 perturbation for a CNN 30-bit target, versus 60 models and 0.14 for ResNet.
- Existing transfer attacks (WEvade-B-S, AdvEmb, AdvCls, MI-CWA, DiffPure) mostly achieve 0% evasion, while the proposed attack reaches over 77% across five target watermarking methods with 100 surrogate models.
Measured effects reported in the paper
| What was changed | Where | Measured | Effect |
|---|---|---|---|
| Use multiple surrogate watermarking models with ensemble optimization | Transfer attack against watermark detectors · Stable Diffusion and Midjourney | evasion rate: over 85% | Helped |
| Increase surrogate models from 40 to 100 for a ResNet target with 64-bit watermarks | Transfer attack · Stable Diffusion, ResNet, 64-bit watermark | evasion rate: 40 models and perturbation of 0.08 yield 85% evasion; 100 models and 0.15 perturbation are needed for 64-bit watermarks | Helped |
| Use transfer attack instead of common post-processing at the same evasion rate | Watermark evasion · Stable Diffusion and Midjourney | average perturbation | Helped |
| Use transfer attack instead of existing transfer attacks | Watermark evasion · Stable Diffusion, ResNet, varying watermark lengths | evasion rate: 0%; 10% | Helped |
| Transfer from HiDDeN and StegaStamp surrogates to other target watermarking methods | Transfer attack · Five target watermarking methods | evasion rate: over 77% | Helped |
| Use smaller sensitivity ε (ablation) | Transfer attack · Stable Diffusion, CNN, 30-bit watermark | number of surrogate models needed for a given evasion rate | Helped |
| Use very small sensitivity ε (e.g., 0.1) as the number of surrogate models increases (ablation) | Transfer attack · Stable Diffusion, CNN, 30-bit watermark | evasion rate | Mixed |
| Use ensemble optimization (EO) instead of post-aggregation (PA) (ablation) | Transfer attack · Stable Diffusion, CNN, 30-bit watermark | evasion rate | Helped |
| Use Inverse-Decode targets instead of Random-Different or Random-Same targets (ablation) | EO transfer attack · Stable Diffusion, CNN, 30-bit watermark | evasion rate: 100% | Helped |
| Use Inverse-Decode targets instead of Random-Different or Random-Same targets (ablation) | EO transfer attack · Stable Diffusion, CNN, 30-bit watermark | average perturbation | Helped |
Surprising findings
- Non-learning-based watermarks are easily removed by simple Gaussian noise, but learning-based watermarks resist it, so the study focuses on learning-based methods.
- Post-aggregation of per-surrogate white-box perturbations (PA variants) fails to evade detection, while ensemble optimization succeeds.
Limitations
- Attack effectiveness against a completely new target watermarking method entirely different from the surrogates is unclear.
- Attacking high-capacity watermarks may require more surrogate models, raising training cost.
- Inference time per image (about 178 s) exceeds most baselines.
Experimental setup
Datasets: Stable Diffusion generated images Midjourney generated images DALL-E 2 generated images
Benchmarks: Stable Diffusion image dataset Midjourney image dataset
Metrics: evasion rate average l_infinity perturbation average l2 perturbation SSIM bitwise accuracy
Baselines: WEvade-B-S AdvEmb-RN18 AdvCls-Real&WM AdvCls-Enc-WM1&WM2 MI-CWA DiffPure JPEG Gaussian noise Gaussian blur Brightness/Contrast
Builds on: HiDDeN StegaStamp Stable Signature white-box watermark removal attack projected gradient descent
Closest papers by meaning
- Robustness of AI-Image Detectors: Fundamental Limits and Practical Attacks (ICLR 2024 · similarity 0.89)
- Transferable Black-Box One-Shot Forging of Watermarks via Image Preference Models (NeurIPS 2025 · similarity 0.87)
- Invisible Image Watermarks Are Provably Removable Using Generative AI (NeurIPS 2024 · similarity 0.86)
- WMCopier: Forging Invisible Watermarks on Arbitrary Images (NeurIPS 2025 · similarity 0.86)
- Black-Box Forgery Attacks on Semantic Watermarks for Diffusion Models (CVPR 2025 · similarity 0.86)
- Leveraging Optimization for Adaptive Attacks on Image Watermarks (ICLR 2024 · similarity 0.86)
Writing a paper in this area? scime draft is a free LaTeX editor with AI included, real-time co-authors and a check of your references and venue rules before you submit. It also imports OpenAI Prism projects.