Box-Free Model Watermarks are Prone to Black-Box Removal Attacks

Summary

Researchers show that box-free model watermarks, which protect deep learning image-processing models, can be removed even when the protected model and the watermark extractor are black boxes. They build three removers: an extractor-gradient-guided (EGG) remover for extractors using only ReLU activation, a gradient-estimating version for unknown extractors, and a transferable remover built on private proxy models for inaccessible extractors. The removers erase embedded watermarks while preserving processed image quality, and the EGG remover can also replace watermarks.

Related items

• InfoImage watermarking robustness under MLLM-guided semantic editing: Benchmark, defense, and diagnosisSimilar attack · Elsevier Security Journals
• LowYour Robot's Safety Functions Already Work. What If the Input Lies?Similar attack · VicOne Blog
• InfoSpeech Tokenizers are Vulnerable: Transferable Semantic Attack and Robust TokenizerSimilar attack · Arxiv (cs.CR + cs.CL + cs.LG)
• InfoAdversarial Retraining for Machine Learning-Based Man-in-the-Middle Attack Detection in Smart Grid Industrial Control SystemsSimilar attack · OpenAlex (peer-reviewed AI security)
• LowMeasuring Robustness and Efficiency in a Connectome-Constrained Fly Visual System Model: Linking an Adversarial and a Perceptual IllusionSimilar attack · Arxiv (cs.RO + cs.CV security)