Box-Free Model Watermarks are Prone to Black-Box Removal Attacks

Area of Science:

• Artificial Intelligence
• Computer Vision
• Cybersecurity

Background:

• Box-free model watermarking is crucial for protecting intellectual property in deep learning, especially for image processing.
• Previous research has focused on the effectiveness of these watermarking techniques.

Purpose of the Study:

• To systematically investigate the vulnerability of box-free model watermarking to removal attacks.
• To demonstrate the effectiveness of removal attacks under real-world black-box threat models.

Main Methods:

• Developed an extractor-gradient-guided (EGG) remover for specific extractor types.
• Leveraged adversarial attacks to create an EGG remover for unknown extractors.
• Designed a transferable remover using proxy models when the extractor is inaccessible.

Main Results:

• Proposed removers successfully eliminated watermarks while maintaining image quality.
• Demonstrated that the EGG remover can also replace existing watermarks.
• Attacks proved effective and generalizable across different scenarios.

Conclusions:

• Box-free model watermarking methods are susceptible to sophisticated removal attacks.
• Existing techniques require further research to enhance their robustness against adversarial removal.