Abstract:In light of recent advancements in generative AI models, it has become essential to distinguish genuine content from AI-generated one to prevent the malicious usage of fake materials as authentic ones and vice versa. Various techniques have been introduced for identifying AI-generated images, with watermarking emerging as a promising approach. In this paper, we analyze the robustness of various AI-image detectors including watermarking and classifier-based deepfake detectors. For watermarking methods that introduce subtle image perturbations (i.e., low perturbation budget methods), we reveal a fundamental trade-off between the evasion error rate (i.e., the fraction of watermarked images detected as non-watermarked ones) and the spoofing error rate (i.e., the fraction of non-watermarked images detected as watermarked ones) upon an application of diffusion purification attack. To validate our theoretical findings, we also provide empirical evidence demonstrating that diffusion purification effectively removes low perturbation budget watermarks by applying minimal changes to images. The diffusion purification attack is ineffective for high perturbation watermarking methods where notable changes are applied to images. In this case, we develop a model substitution adversarial attack that can successfully remove watermarks. Moreover, we show that watermarking methods are vulnerable to spoofing attacks where the attacker aims to have real images identified as watermarked ones, damaging the reputation of the developers. In particular, with black-box access to the watermarking method, a watermarked noise image can be generated and added to real images, causing them to be incorrectly classified as watermarked. Finally, we extend our theory to characterize a fundamental trade-off between the robustness and reliability of classifier-based deep fake detectors and demonstrate it through experiments.

On Visible Adversarial Perturbations & Digital Watermarking

Adversarial Watermarking for Face Recognition

Poster: Detecting Adversarial Examples Hidden under Watermark Perturbation via Usable Information Theory

Elevating Defenses: Bridging Adversarial Training and Watermarking for Model Resilience

Watermark Vaccine: Adversarial Attacks to Prevent Watermark Removal

Attacking Optical Character Recognition (OCR) Systems with Adversarial Watermarks

Adversarial watermark: A robust and reliable watermark against removal

Black-Box Forgery Attacks on Semantic Watermarks for Diffusion Models

Evaluation of Security of ML-based Watermarking: Copy and Removal Attacks

The Good, the Bad and the Ugly: Watermarks, Transferable Attacks and Adversarial Defenses

Invisible Image Watermarks Are Provably Removable Using Generative AI

Generating Image Adversarial Examples by Embedding Digital Watermarks

On Evaluating The Performance of Watermarked Machine-Generated Texts Under Adversarial Attacks

Invisible Perturbations: Physical Adversarial Examples Exploiting the Rolling Shutter Effect

Watermark-embedded Adversarial Examples for Copyright Protection against Diffusion Models

Watermark Smoothing Attacks against Language Models

Improved Image Wasserstein Attacks and Defenses

A Transfer Attack to Image Watermarks

On the Weaknesses of Backdoor-based Model Watermarking: An Information-theoretic Perspective

Adversarial Attacks on Leakage Detectors in Water Distribution Networks

Robustness of AI-Image Detectors: Fundamental Limits and Practical Attacks