Pith. sign in

REVIEW 3 major objections 5 minor 54 references

The Efficacy of Transfer-based No-box Attacks on Image Watermarking: A Pragmatic Analysis

T0 review · 3 major / 5 minor · reviewed 2026-08-11 · deepseek-v4-flash

Challenge this review Re-run · record.json Download PDF Read on arXiv ↗ Review JSON

Pith's one-line read The paper claims that optimization-based transfer attacks on image watermarks succeed only under unrealistic assumptions, and that a one-surrogate, optimization-free attack is comparable or better in 11 of 12 configurations.

desk verdict A useful empirical check on a published attack with a cheap baseline, but the headline negative result is tested against a narrower version of the original attack than the paper implies. read the letter →

arxiv 2412.02576 v1 pith:TV4XQMIP submitted 2024-12-03 cs.CR

Qilong Wu , Varun Chandrasekaran This is my paper · ORCID
classification cs.CR
keywords imagewatermarkingno-boxattacktransferevasionratesurrogatemodeloptimization-freeHiDDeNdiffusionpurification
verification ladder T0 review T1 audit T2 compute T3 formal

The pith

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

The reading

This paper argues that optimization-based transfer attacks on image watermarks—attacks that train surrogate watermarking models and optimize a perturbation—look effective only when the surrogate models closely match the victim model's architecture and training setup and when the attacker can afford many surrogates. Once those assumptions are relaxed to a realistic no-box setting, the paper measures a maximum evasion rate of 21.1%. It then proposes Optimization-Free Transfer (OFT), which decodes the watermark with one surrogate, flips the decoded bits, re-encodes that flipped message onto the image, and uses the difference as the perturbation. Under an $\ell_\infty$ budget of 0.25 with configurations mostly aligned, OFT is better or comparable to the optimization-based attack in 11 of 12 configurations while being thousands of times faster. If correct, this shifts the practical question from how to optimize transfer attacks to whether optimization has any real advantage over a simple baseline in the no-box setting.

What carries the argument

The central object is the Optimization-Free Transfer (OFT) attack, together with the transfer assumption it tests. OFT takes a watermarked image $x_{wm}$, decodes it with a surrogate decoder to get $s_i$, flips all bits to $\bar{s}_i$, and re-encodes that flipped message with the same surrogate encoder: $\varepsilon_i = \mathrm{Enc}_i(\bar{s}_i, x_{wm}) - x_{wm}$. Perturbations from multiple surrogates are aggregated by mean or median and clamped to the $\ell_\infty$ budget. This isolates the paper's core comparison: optimization is removed entirely, so any remaining transfer must come from surrogate–victim alignment rather than from the optimization procedure.

What would settle it

Run the original transfer attack from [20] with the mixed surrogate pool it used (HiDDeN and StegaStamp together) against unaligned targets such as RivaGAN or MBRS under the same $\ell_\infty = 0.25$ budget; an evasion rate above 21.1% would contradict the paper's ceiling for relaxed assumptions.

Watch

Extended reading notes

Core claim

The central claim is that the success of prior optimization-based transfer attacks depends on two impractical assumptions: alignment between the surrogate and victim watermarking configurations, and large compute for training many surrogates. The paper reports that when the victim method differs from the surrogate method, evasion drops to at most 21.1%, and the only successful configuration is the control where target and surrogate use the same watermarking method. When alignment mostly holds, a single-surrogate, optimization-free attack the authors call OFT—flip the decoded secret, re-encode it as a perturbation, and add it to the image—matches or beats the 50-surrogate optimized attack in 11 of 12 configurations under $\ell_\infty \le 0.25$, losing only narrowly in one 20-bit ResNet setting. OFT also runs in under one second on 1,000 images versus roughly 2,500 seconds for the 50-surrogate optimized attack, and compares favorably to diffusion-purification regeneration baselines.

Load-bearing premise

The negative result assumes that testing the transfer attack with only HiDDeN surrogate models is enough to judge the attack, even though the original attack's cross-method experiment mixed HiDDeN and StegaStamp surrogates.

Editorial extensions

If this is right

  • If the paper is right, transfer-based no-box attacks in the literature overstate the practical threat: under unaligned configurations, evasion is capped at 21.1% at $\ell_\infty=0.25$.
  • OFT becomes the relevant cheap baseline: one surrogate, sub-second runtime, and it beats or ties the 50-surrogate optimization attack in 11 of 12 aligned configurations.
  • Relaxing compute alone (using OFT) preserves attack success, while relaxing alignment alone kills the optimization attack; alignment, not optimization, is the crucial enabler.
  • Watermarking deployments that hide their architecture and training configuration gain substantial practical protection against transfer-based evasion.

Reading between the lines

Editorial extensions of the paper, not claims the author makes directly.

  • The paper does not test a mixed-architecture surrogate pool; rerunning the original attack with HiDDeN and StegaStamp surrogates together could move the 21.1% ceiling.
  • OFT can be read as a cheap alignment probe: if a single surrogate evades, the surrogate family is close to the victim; if not, expensive optimization is unlikely to recover transfer.
  • Applying OFT across watermark families beyond HiDDeN, or combining it with a light regeneration step, would test whether the transfer signal is architectural or data-driven.
Share X Bluesky LinkedIn Reddit HN

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, and a circularity audit.

Referee Report

3 major / 5 minor

Summary. The paper studies transfer-based no-box evasion attacks against learning-based image watermarking. It argues that a prior optimization-based attack (Hu et al., 2024) relies on impractical assumptions: the attacker must align surrogate and victim architectures and training configurations, and must train many surrogate models. The authors propose an optimization-free transfer (OFT) attack that uses one surrogate and simply adds the watermark of the flipped decoded secret. They report that relaxing the alignment assumption causes Hu et al.'s attack to fail (evasion rate at most 21.1%), and that in the aligned setting OFT matches or outperforms Hu et al.'s attack in 11 of 12 configurations under the same l_infinity budget. The paper releases code for all experiments.

Significance. If the findings hold, the paper provides a useful reality check on the practicality of transfer-based no-box attacks and introduces a cheap, effective baseline for the aligned setting. Clear strengths are the code release and the systematic variation of surrogate counts and configurations. However, the headline negative result is tested only with a restricted surrogate pool, the aligned comparison uses retuned target models, and no statistical tests are reported despite acknowledged checkpoint variance. The significance is therefore conditional on addressing these gaps.

major comments (3)
  1. [§6.2] The principal negative claim—that relaxing the alignment assumption yields evasion rates of at most 21.1%—is supported only by experiments in which the surrogate pool consists exclusively of HiDDeN models. The paper itself notes in §6.2 that Hu et al.'s cross-method evaluation included both HiDDeN and StegaStamp surrogates. Because a no-box attacker who does not know the victim method can still assemble a diverse public surrogate pool, the current experiment tests a strictly weaker version of the original attack. The authors should either replicate Hu et al.'s multi-architecture pool (or a comparable diverse pool) or explicitly restrict the conclusion to HiDDeN-only surrogates. As written, the abstract's 'at most 21.1%' claim is not supported for the original attack as proposed.
  2. [§5.1.1] The comparison between Hu et al.'s attack and OFT in §6.3 is performed on target models that were re-trained with hyperparameters tuned by the authors. Footnote 5 reports a grid search over encoder and decoder loss weights because the authors found that the hyperparameters from Hu et al. do not reach a reasonable bit accuracy for CNN architectures. This retuning changes the target models relative to those in Hu et al.'s original evaluation, and the paper does not demonstrate that the retuning is neutral between the two attacks. The authors should evaluate on the original target checkpoints as well, or show that the relative ranking is unchanged under both sets of hyperparameters.
  3. [§7.1] The paper acknowledges in §7.1 that 'the variance over different checkpoints is not ignorable,' yet Figures 3 and 4 report only means and ranges, and no significance tests are provided for the central '11 out of 12' claim. Given the explicit statement about non-negligible variance, the claim that OFT is superior or comparable in 11 of 12 configurations could be within checkpoint noise. The authors should report confidence intervals or perform paired statistical tests across checkpoints for each configuration, so that the reader can assess the robustness of the headline comparison.
minor comments (5)
  1. [Abstract and §6.2] The specific '21.1%' maximum evasion rate for unaligned configurations does not appear in the main text or in a table; please report the exact maximum in §6.2 or in a table so the abstract's number can be verified.
  2. [§6.3] The paper compares against 'the best configuration (k = 50)' of Hu et al., but Appendix C.3 notes that k = 40 can be worse than k = 30 (e.g., for ℓ = 64 CNN on MidJourney). The authors should confirm that k = 50 is indeed the best per configuration, or use the per-configuration maximum over k.
  3. [Throughout] There are several typos and minor presentation issues: 'wheras' in Table 2 caption, 'MidJouruney' in Appendix A.1, 'the attack has no knowledge' in the Introduction should be 'the attacker,' and the use of 'BA' for both bit-wise accuracy and bit accuracy in equations should be made consistent.
  4. [§3.3] The reference to 'Figure 6 of their draft 1' is not a stable citation; please cite the arXiv version of Hu et al. with its identifier.
  5. [§7.2] The discussion of why OFT cannot be applied to generator-embedded watermarks is very brief; one concrete example (e.g., Stable Signature) would help the reader understand the scope of the proposed attack.

Circularity Check

0 steps flagged · score 0.0 of 10

No circularity: the paper's central claims rest on fresh experiments against external baselines (Hu et al. and DiffPure), not on its own definitions or a self-citation chain.

full rationale

The paper is an empirical evaluation and contains no derivation chain that reduces to its own inputs. OFT is a new, simple heuristic (decode, flip, re-encode, aggregate, clamp) whose effectiveness is established by direct comparison with Hu et al.'s published transfer attack and with DiffPure under the same epsilon-infinity budget; OFT's parameters (mean/median aggregation, clamping to r) are not fitted to the targets, so the 'OFT beats optimization' claim is not a fitted input renamed as a prediction. The alignment-relaxation result in Sec. 6.2 is likewise an experimental finding, not a definitional equivalence: the paper runs Hu et al.'s own code with HiDDeN surrogates against HiDDeN, StegaStamp, RivaGAN, and MBRS targets, and reports failure for the unaligned cases. The strongest caveat is the paper's own acknowledged mismatch in Sec. 6.2 that Hu et al.'s analogous cross-method experiment included both HiDDeN and StegaStamp in the surrogate pool, meaning the negative result may not generalize to the original attack as designed; this is a validity/scope limitation about experimental coverage, not circularity, because the conclusion is not equivalent to its inputs by construction and a diverse surrogate pool could in principle falsify the paper's claim. No load-bearing self-citation exists: Hu et al. [20] is a different research group's prior work cited as an external baseline, the DiffPure baseline is also external, and no uniqueness theorem or forced-choice argument is imported from the authors' own prior work. The paper's limitations section candidly states that OFT is heuristic with no evasion guarantee and that checkpoint variance is not small, which further supports that the contributions are empirical and falsifiable rather than circular. Overall, the derivation chain is self-contained against external benchmarks, so the appropriate verdict is no significant circularity.

Assumptions & free parameters 2 free parameters · 3 assumptions · 0 invented entities

The paper's central empirical claims do not rest on a fitted mathematical derivation; the main burden is on experimental configuration choices. We count the perturbation budget and the grid-selected target-model hyperparameters as the parameters on which the results depend. The axioms are standard threat-model and framework assumptions.

free parameters (2)
  • l_infinity perturbation budget r = 0.25
    Set by hand as the attack budget for all methods; the main comparison under the same budget depends on this choice, but it is a threat-model constraint rather than a fitted parameter.
  • Target HiDDeN CNN training hyperparameters (encoder loss weight, decoder loss weight) = 0.7, 4
    Chosen by grid search in Section 5.1.1 and Appendix C.2 because Hu et al.'s provided hyperparameters did not reach reasonable bit-wise accuracy. This affects the target models against which Hu et al.'s attack is evaluated.
assumptions (3)
  • domain assumption No-box attacker has no knowledge of the victim watermarking method and cannot query the detector.
    Stated in Section 3 as the threat model for all experiments; this is a standard assumption from prior work, not introduced ad hoc.
  • domain assumption Watermarking methods can be represented by the encoder-decoder-detector framework with bit-wise accuracy detection.
    Introduced in Section 2.1 and used to define surrogates and targets. This excludes non-learning and generator-specific methods, which the paper acknowledges in Section 7.2.
  • domain assumption Using surrogate models trained on the same dataset and architecture as the target is a valid instantiation of 'mostly aligned' configurations.
    Section 5.1 and Appendix E assume that alignment of dataset, architecture, secret length (as close as possible), and noise type is sufficient for the transfer setting being studied.

how reviews work

0 comments
Cite this review

Pith. "Pith review of The Efficacy of Transfer-based No-box Attacks on Image Watermarking: A Pragmatic Analysis." pith.science (2026). https://pith.science/paper/TV4XQMIP

@misc{pith2026241202576,
  author       = {Pith},
  title        = {Pith review of: The Efficacy of Transfer-based No-box Attacks on Image Watermarking: A Pragmatic Analysis},
  year         = {2026},
  howpublished = {\url{https://pith.science/paper/TV4XQMIP}},
  note         = {Machine review of arXiv:2412.02576}
}
abstract

Watermarking approaches are widely used to identify if images being circulated are authentic or AI-generated. Determining the robustness of image watermarking methods in the ``no-box'' setting, where the attacker is assumed to have no knowledge about the watermarking model, is an interesting problem. Our main finding is that evading the no-box setting is challenging: the success of optimization-based transfer attacks (involving training surrogate models) proposed in prior work~\cite{hu2024transfer} depends on impractical assumptions, including (i) aligning the architecture and training configurations of both the victim and attacker's surrogate watermarking models, as well as (ii) a large number of surrogate models with potentially large computational requirements. Relaxing these assumptions i.e., moving to a more pragmatic threat model results in a failed attack, with an evasion rate at most $21.1\%$. We show that when the configuration is mostly aligned, a simple non-optimization attack we propose, OFT, with one single surrogate model can already exceed the success of optimization-based efforts. Under the same $\ell_\infty$ norm perturbation budget of $0.25$, prior work~\citet{hu2024transfer} is comparable to or worse than OFT in $11$ out of $12$ configurations and has a limited advantage on the remaining one. The code used for all our experiments is available at \url{https://github.com/Ardor-Wu/transfer}.

Figures

Figures reproduced from arXiv: 2412.02576 by the authors.

Figure 1
Figure 1. Watermarked images generated by Stable Diffusion and their perturbed versions in different attacks that successfully evade [PITH_FULL_IMAGE:figures/full_fig_p001_1.png] view at source ↗
Figure 2
Figure 2. Evaluation of Hu et al. [20]’s attack to different watermarking methods. The only successful attack is when the target model’s method matches the surrogate models’ method (HiDDeN). We compare the evasion rate when evaluating the transfer attack [20] on different target models: HiDDeN, StegaStamp, RivaGAN, MBRS. As the surrogate models are HiDDeN models, HiDDeN is the contrast group. Results are shown in Fig. 2a. Obs… view at source ↗
Figure 3
Figure 3. Evasion rate comparing Hu et al. [20] and OFT (k = 1): Observe that OFT is superior most often! Bit-wise accuracy, reported in [PITH_FULL_IMAGE:figures/full_fig_p009_3.png] view at source ↗
Figures from the paper (11 more)
Figure 4
Figure 4. Figure 4: Bit-wise accuracy comparing Hu et al. [20] and OFT (k = 1): Observe that OFT is superior most often! [PITH_FULL_IMAGE:figures/full_fig_p010_4.png]
Figure 5
Figure 5. Figure 5: Evasion rate comparing Hu et al. [20] and OFT (k = 1) on MidJourney: Observe that OFT is superior most often, consistent with DiffusionDB results [PITH_FULL_IMAGE:figures/full_fig_p018_5.png]
Figure 6
Figure 6. Figure 6: BA comparing Hu et al. [20] and OFT (k = 1) on MidJourney: Observe that OFT is superior most often, consistent with DiffusionDB results [PITH_FULL_IMAGE:figures/full_fig_p018_6.png]
Figure 7
Figure 7. Figure 7: ℓ∞ comparing Hu et al. [20] and OFT (k = 1) on MidJourney: Normalization (Clamp) ensures the noise is always within budget and significantly reduces ℓ∞ [PITH_FULL_IMAGE:figures/full_fig_p019_7.png]
Figure 8
Figure 8. Figure 8: SSIM comparing Hu et al. [20] and OFT (k = 1) on MidJourney: Hu et al. [20] has better SSIM but larger k harms SSIM in general; Normalization (Clamp) hardly helps improve SSIM [PITH_FULL_IMAGE:figures/full_fig_p019_8.png]
Figure 9
Figure 9. Figure 9: LPIPS comparing Hu et al. [20] and OFT (k = 1) on MidJourney: Hu et al. [20] has better LPIPS but larger k harms LPIPS in general; Normalization (Clamp) hardly helps improve LPIPS [PITH_FULL_IMAGE:figures/full_fig_p020_9.png]
Figure 10
Figure 10. Figure 10: ℓ∞ comparing Hu et al. [20] and OFT (k = 1) on DiffusionDB: Normalization (Clamp) ensures the noise is always within budget and significantly reduces ℓ∞, consistent with MidJourney results. SSIM results on DiffusionDB are shown in [PITH_FULL_IMAGE:figures/full_fig_p0…
Figure 11
Figure 11. Figure 11: SSIM comparing Hu et al. [20] and OFT (k = 1) on DiffusionDB: Hu et al. [20] has better SSIM but larger k harms SSIM in general; Normalization (Clamp) hardly helps improving SSIM. Results are consistent with MidJourney. LPIPS results on DiffusionDB are shown in [PITH…
Figure 12
Figure 12. Figure 12: LPIPS comparing Hu et al. [20] and OFT (k = 1) on DiffusionDB: Hu et al. [20] has better LPIPS but larger k harms LPIPS in general; Normalization (Clamp) hardly helps improving LPIPS. Results are consistent with MidJourney. C.5. Additional Results for § 6.2 Perceptibi…
Figure 13
Figure 13. Figure 13: The aligned MBRS is shown as MBRS (64 bits), whose configuration is detailed in Appendix A.2 and the alignment is discussed in Appendix E. The unaligned MBRS results are consistent with that of the partially aligned version, i.e., no successful transfer, showing that …
Figure 14
Figure 14. Figure 14: Evaluation of OFT (k = 1) attack to different watermarking methods. The only successful attack is when the target model’s method matches the surrogate models’ method (HiDDeN). While consistent with Hu et al. [20] in §6.2 in general, OFT is relatively more effective. E…

Discussion (0). Continue with ORCID to comment.

Reference graph

Works this paper leans on

54 extracted references · 34 canonical work pages

  1. [1]

    Ntire 2017 challenge on single image super-resolution: Dataset and study

    Eirikur Agustsson and Radu Timofte. Ntire 2017 challenge on single image super-resolution: Dataset and study. In Proceedings of the IEEE conference on computer vision and pattern recognition workshops, pages 126–135, 2017. 15

    work page 2017

  2. [2]

    Introducing stable diffusion 3.5

    Stability AI. Introducing stable diffusion 3.5. 2024. Accessed November 15, 2024. 2

    work page 2024

  3. [3]

    Combined dwt-dct digital image watermarking

    Ali Al-Haj. Combined dwt-dct digital image watermarking. Journal of computer science, 3(9):740–746, 2007. 11

    work page 2007

  4. [4]

    Box-free model watermarks are prone to black-box removal attacks

    Haonan An, Guang Hua, Zhiping Lin, and Yuguang Fang. Box-free model watermarks are prone to black-box removal attacks. arXiv preprint arXiv:2405.09863, 2024. 2, 3, 4, 16, 17

    arXiv 2024

  5. [5]

    real attackers don’t compute gradients

    Giovanni Apruzzese, Hyrum S Anderson, Savino Dambra, David Freeman, Fabio Pierazzi, and Kevin Roundy. “real attackers don’t compute gradients”: bridging the gap between adversarial ml research and practice. In 2023 IEEE Conference on Secure and Trustworthy Machine Learning (SaTML), pages 339–364. IEEE, 2023. 5

    work page 2023

  6. [6]

    Meissonic: Revitalizing masked generative transformers for efficient high-resolution text-to-image synthesis

    Jinbin Bai, Tian Ye, Wei Chow, Enxin Song, Qing-Guo Chen, Xiangtai Li, Zhen Dong, Lei Zhu, and Shuicheng Yan. Meissonic: Revitalizing masked generative transformers for efficient high-resolution text-to-image synthesis. arXiv preprint arXiv:2410.08261,

    arXiv

  7. [7]

    Make-a-scene: Scene-based text-to- image generation

    Yogesh Balaji, Kiran Mani, Tal Shacham, Armand Joulin, Marcus Rohrbach, and Devi Parikh. Make-a-scene: Scene-based text-to- image generation. arXiv preprint arXiv:2203.13131, 2022. 1

    arXiv 2022

  8. [8]

    Industrial practitioners’ mental models of adversarial machine learning

    Lukas Bieringer, Kathrin Grosse, Michael Backes, Battista Biggio, and Katharina Krombholz. Industrial practitioners’ mental models of adversarial machine learning. In Eighteenth Symposium on Usable Privacy and Security (SOUPS 2022), pages 97–116, 2022. 5

    work page 2022

Show all 54 references
  1. [9]

    Ai and the rise of fake images

    Russell Brandom. Ai and the rise of fake images. The Atlantic, 2024. Accessed: 2024-11-14. 1

    2024

  2. [10]

    Openai’s watermarking tool for chatgpt text generation remains unreleased

    Dell Cameron. Openai’s watermarking tool for chatgpt text generation remains unreleased. https://www.theverge.com/ 2024/8/4/24213268/openai-chatgpt-text-watermark-cheat-detection-tool , 2024. Accessed: 2024-11-

    2024

  3. [11]

    Hopskipjumpattack: A query-efficient decision-based attack

    Jianbo Chen, Michael I Jordan, and Martin J Wainwright. Hopskipjumpattack: A query-efficient decision-based attack. In 2020 ieee symposium on security and privacy (sp), pages 1277–1294. IEEE, 2020. 2, 3, 16

    2020

  4. [12]

    Synthid: Identifying ai-generated content

    DeepMind. Synthid: Identifying ai-generated content. https://deepmind.google/technologies/synthid/ , 2023. Accessed: 2024-11-14. 5

    2023

  5. [13]

    Imagenet: A large-scale hierarchical image database

    Jia Deng, Wei Dong, Richard Socher, Li-Jia Li, Kai Li, and Li Fei-Fei. Imagenet: A large-scale hierarchical image database. In 2009 IEEE conference on computer vision and pattern recognition, pages 248–255. Ieee, 2009. 14, 17

    2009

  6. [14]

    The stable signature: Rooting watermarks in latent diffusion models

    Pierre Fernandez, Guillaume Couairon, Herv ´e J´egou, Matthijs Douze, and Teddy Furon. The stable signature: Rooting watermarks in latent diffusion models. In Proceedings of the IEEE/CVF International Conference on Computer Vision, pages 22466–22477, 2023. 8, 11, 17

    2023

  7. [15]

    Imagen: Text-to-image diffusion models

    Brain Team Google Research. Imagen: Text-to-image diffusion models. 2022. Accessed November 15, 2024. 2

    2022

  8. [16]

    Towards more practical threat models in artificial intelli- gence security

    Kathrin Grosse, Lukas Bieringer, Tarek R Besold, and Alexandre M Alahi. Towards more practical threat models in artificial intelli- gence security. In 33rd USENIX Security Symposium (USENIX Security 24), pages 4891–4908, 2024. 2, 5

    2024

  9. [17]

    Delving deep into rectifiers: Surpassing human-level performance on imagenet classification

    Kaiming He, Xiangyu Zhang, Shaoqing Ren, and Jian Sun. Delving deep into rectifiers: Surpassing human-level performance on imagenet classification. In Proceedings of the IEEE international conference on computer vision, pages 1026–1034, 2015. 16

    2015

  10. [18]

    Deep residual learning for image recognition

    Kaiming He, Xiangyu Zhang, Shaoqing Ren, and Jian Sun. Deep residual learning for image recognition. In Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition (CVPR), pages 770–778, 2016. 7

    2016

  11. [19]

    Squeeze-and-excitation networks

    Jie Hu, Li Shen, and Gang Sun. Squeeze-and-excitation networks. In Proceedings of the IEEE conference on computer vision and pattern recognition, pages 7132–7141, 2018. 14

    2018

  12. [20]

    A transfer attack to image watermarks

    Yuepeng Hu, Zhengyuan Jiang, Moyang Guo, and Neil Gong. A transfer attack to image watermarks. arXiv preprint arXiv:2403.15365, 2024. 1, 2, 4, 5, 6, 7, 8, 9, 10, 11, 14, 17, 18, 19, 20, 21, 22, 23

    2024 arXiv

  13. [21]

    Huiskes and Michael S

    Mark J. Huiskes and Michael S. Lew. The mir flickr retrieval evaluation. In MIR ’08: Proceedings of the 2008 ACM International Conference on Multimedia Information Retrieval, New York, NY , USA, 2008. ACM. 3

    2008

  14. [22]

    The mir flickr retrieval evaluation

    Mark J Huiskes and Michael S Lew. The mir flickr retrieval evaluation. In Proceedings of the 1st ACM international conference on Multimedia information retrieval, pages 39–43, 2008. 16

    2008

  15. [23]

    D. Images. Dall·e 2 gallery, 2023. Accessed: 2024-11-13. 3, 14, 23

    2023

  16. [24]

    Mbrs: Enhancing robustness of dnn-based watermarking by mini-batch of real and simulated jpeg compression

    Zhaoyang Jia, Han Fang, and Weiming Zhang. Mbrs: Enhancing robustness of dnn-based watermarking by mini-batch of real and simulated jpeg compression. In Proceedings of the 29th ACM international conference on multimedia, pages 41–49, 2021. 1, 2, 3, 14

    2021

  17. [25]

    Evading watermark based detection of ai-generated content

    Zhengyuan Jiang, Jinghuai Zhang, and Neil Zhenqiang Gong. Evading watermark based detection of ai-generated content. In Proceedings of the 2023 ACM SIGSAC Conference on Computer and Communications Security, pages 1168–1181, 2023. 2, 3, 16

    2023

  18. [26]

    Certifiably robust image watermark

    Zhengyuan Jiang, Moyang Guo, Yuepeng Hu, Jinyuan Jia, and Neil Zhenqiang Gong. Certifiably robust image watermark. arXiv preprint arXiv:2407.04086, 2024. 1, 8

    2024 arXiv

  19. [27]

    Unmarker: A universal attack on defensive watermarking

    Andre Kassis and Urs Hengartner. Unmarker: A universal attack on defensive watermarking. arXiv preprint arXiv:2405.08363 ,

    arXiv

  20. [28]

    Microsoft coco: Common objects in context

    Tsung-Yi Lin, Michael Maire, Serge Belongie, James Hays, Pietro Perona, Deva Ramanan, Piotr Doll ´ar, and C Lawrence Zitnick. Microsoft coco: Common objects in context. In Computer Vision–ECCV 2014: 13th European Conference, Zurich, Switzerland, September 6-12, 2014, Proceedin...

    2014

  21. [29]

    Image watermarks are removable using controllable regeneration from clean noise

    Yepeng Liu, Yiren Song, Hai Ci, Yu Zhang, Haofan Wang, Mike Zheng Shou, and Yuheng Bu. Image watermarks are removable using controllable regeneration from clean noise. arXiv preprint arXiv:2410.05470, 2024. 2, 4

    2024 arXiv

  22. [30]

    Leveraging optimization for adaptive attacks on image watermarks

    Nils Lukas, Abdulrahman Diaa, Lucas Fenaux, and Florian Kerschbaum. Leveraging optimization for adaptive attacks on image watermarks. arXiv preprint arXiv:2309.16952, 2023. 2, 3, 16

    2023 arXiv

  23. [31]

    Actions in context

    Marcin Marszalek, Ivan Laptev, and Cordelia Schmid. Actions in context. In 2009 IEEE Conference on Computer Vision and Pattern Recognition, pages 2929–2936. IEEE, 2009. 3, 15

    2009

  24. [32]

    Midjourney: High-quality ai image generation, 2022

    Midjourney. Midjourney: High-quality ai image generation, 2022. Midjourney Documentation. 1, 17

    2022

  25. [33]

    Security} is not my field, {I’m} a stats {guy

    Jaron Mink, Harjot Kaur, Juliane Schm ¨user, Sascha Fahl, and Yasemin Acar. {“Security} is not my field, {I’m} a stats {guy”}: A qualitative root cause analysis of barriers to adversarial machine learning defenses in industry. In 32nd USENIX Security Symposium (USENIX Security...

    2023

  26. [34]

    Diffusion models for adversarial purification

    Weili Nie, Brandon Guo, Yujia Huang, Chaowei Xiao, Arash Vahdat, and Anima Anandkumar. Diffusion models for adversarial purification. arXiv preprint arXiv:2205.07460, 2022. 2, 4

    2022 arXiv

  27. [35]

    Dall·e 2

    OpenAI. Dall·e 2. 2022. Accessed November 15, 2024. 2

    2022

  28. [36]

    Zero-shot text-to-image generation

    Aditya Ramesh, Mikhail Pavlov, Gabriel Goh, Scott Gray, Chelsea V oss, Alec Radford, Mark Chen, and Ilya Sutskever. Zero-shot text-to-image generation. arXiv preprint arXiv:2102.12092, 2021. 1

    2021 arXiv

  29. [37]

    High-resolution image synthesis with latent diffusion models

    Robin Rombach, Andreas Blattmann, Dominik Lorenz, Patrick Esser, and Bj¨orn Ommer. High-resolution image synthesis with latent diffusion models. arXiv preprint arXiv:2112.10752, 2022. 1

    2022 arXiv

  30. [38]

    Ro- bustness of ai-image detectors: Fundamental limits and practical attacks

    Mehrdad Saberi, Vinu Sankar Sadasivan, Keivan Rezaei, Aounon Kumar, Atoosa Chegini, Wenxiao Wang, and Soheil Feizi. Ro- bustness of ai-image detectors: Fundamental limits and practical attacks. arXiv preprint arXiv:2310.00076, 2023. 1, 2, 3, 4, 6, 8, 9, 10

    arXiv

  31. [40]

    Imagen: Photorealistic text-to-image diffusion models with improved sampling

    Chitwan Saharia, William Chan, Saurabh Saxena, Lala Li, Jay Whang, Emily Denton, and Tim Salimans. Imagen: Photorealistic text-to-image diffusion models with improved sampling. arXiv preprint arXiv:2205.11487, 2022. 1

    2022 arXiv

  32. [41]

    Shawn Shan, Jenna Cryan, Emily Wenger, Haitao Zheng, Rana Hanocka, and Ben Y . Zhao. Glaze: Protecting artists from style mimicry by text-to-image models. In 32nd USENIX Security Symposium (USENIX Security 23), 2023. 1

    2023

  33. [42]

    Digital image watermarking for copyright protection

    Yasuhito Tanaka, Koichi Matsui, and Shigeo Matsui. Digital image watermarking for copyright protection. In Proceedings of the International Conference on Intellectual Property Rights in the Information Age, 1990. 1

    1990

  34. [43]

    Stegastamp: Invisible hyperlinks in physical photographs

    Matthew Tancik, Ben Mildenhall, and Ren Ng. Stegastamp: Invisible hyperlinks in physical photographs. In Proceedings of the IEEE/CVF conference on computer vision and pattern recognition, pages 2117–2126, 2020. 1, 2, 3, 15

    2020

  35. [44]

    Midjourney user prompts & generated images (250k), 2022

    Iulia Turc and Gaurav Nemade. Midjourney user prompts & generated images (250k), 2022. 3, 6, 9, 14

    2022

  36. [45]

    Diffusiondb: A large- scale prompt gallery dataset for text-to-image generative models

    Zijie J Wang, Evan Montoya, David Munechika, Haoyang Yang, Benjamin Hoover, and Duen Horng Chau. Diffusiondb: A large- scale prompt gallery dataset for text-to-image generative models. arXiv preprint arXiv:2210.14896, 2022. 3, 6, 9, 14, 17

    2022 arXiv

  37. [46]

    Tree-ring watermarks: Fingerprints for diffusion images that are invisible and robust

    Yuxin Wen, John Kirchenbauer, Jonas Geiping, and Tom Goldstein. Tree-ring watermarks: Fingerprints for diffusion images that are invisible and robust. arXiv preprint arXiv:2305.20030, 2023. 17

    2023 arXiv

  38. [47]

    Steganalysis on digital watermarking: Is your defense truly impervious? arXiv preprint arXiv:2406.09026, 2024

    Pei Yang, Hai Ci, Yiren Song, and Mike Zheng Shou. Steganalysis on digital watermarking: Is your defense truly impervious? arXiv preprint arXiv:2406.09026, 2024. 17

    2024 arXiv

  39. [48]

    Bisenet: Bilateral segmentation network for real-time semantic segmentation

    Changqian Yu, Jingbo Wang, Chao Peng, Changxin Gao, Gang Yu, and Nong Sang. Bisenet: Bilateral segmentation network for real-time semantic segmentation. In Proceedings of the European conference on computer vision (ECCV), pages 325–341, 2018. 15

    2018

  40. [49]

    Robust invisible video watermarking with attention

    Kevin Alex Zhang, Lei Xu, Alfredo Cuesta-Infante, and Kalyan Veeramachaneni. Robust invisible video watermarking with attention. arXiv preprint arXiv:1909.01285, 2019. 1, 2, 3, 15

    1909 arXiv

  41. [50]

    The unreasonable effectiveness of deep features as a perceptual metric

    Richard Zhang, Phillip Isola, Alexei A Efros, Eli Shechtman, and Oliver Wang. The unreasonable effectiveness of deep features as a perceptual metric. In Proceedings of the IEEE conference on computer vision and pattern recognition, pages 586–595, 2018. 7

    2018

  42. [51]

    Invisible image watermarks are provably removable using generative ai

    Xuandong Zhao, Kexun Zhang, Zihao Su, Saastha Vasan, Ilya Grishchenko, Christopher Kruegel, Giovanni Vigna, Yu-Xiang Wang, and Lei Li. Invisible image watermarks are provably removable using generative ai. arXiv preprint arXiv:2306.01953, 2023. 2, 4

    2023 arXiv

  43. [52]

    A recipe for watermarking diffusion models

    Yunqing Zhao, Tianyu Pang, Chao Du, Xiao Yang, Ngai-Man Cheung, and Min Lin. A recipe for watermarking diffusion models. arXiv preprint arXiv:2303.10137, 2023. 2

    2023 arXiv

  44. [53]

    Hidden: hiding data with deep networks

    J Zhu. Hidden: hiding data with deep networks. arXiv preprint arXiv:1807.09937, 2018. 1, 2, 3, 14 Appendix A. Details: Watermarking Methods Different watermarking methods architectures can be very different. Here we list their architecture details for their imple- mentations. ...

    2018 arXiv

  45. [54]

    ℓ∞, defined as: ∥xa − xwm∥∞, where xa, xwm ∈ [−1, 1]128×128

  46. [55]

    SSIM score between attacked image and victim watermarked image, SSIM (xa, xwm) C.2. 64 bit CNN Architecture HiDDeN Hyper-parameter Tuning As mentioned in § 5.1.1, we perform grid search on encoder loss weight in {0.7, 0.35, 0.175, 0.0875} and decoder loss weight in {1, 2, 4, 8...

Pith tools

Reviewed August 11, 2026 · model on record in the stance chip above.