Box-Free Model Watermarks are Prone to Black-Box Removal Attacks

Researchers found that box-free model watermarking (a technique to protect ownership of AI models by embedding hidden marks), which is used for image processing tasks, can be defeated through black-box removal attacks (attacks where the attacker cannot see inside the protected model). The study describes three methods attackers could use to strip watermarks from protected models while keeping the images looking good, showing that current watermarking approaches are vulnerable.