提出无需了解水印算法的伪造方法，可隐蔽植入任意图像水印。
WMCopier: Forging Invisible Image Watermarks on Arbitrary Images
- 用无条件扩散模型建模目标水印分布，通过浅层反演嵌入水印。
- 在不破坏图像质量前提下，成功欺骗开源与闭源水印系统。
- 适用于研究水印安全性的研究人员，也警示生成式AI内容溯源风险。
隐形图像水印对于保障生成式AI内容的来源可追溯性至关重要。尽管生成式AI服务商正越来越多地集成隐形水印系统，但这些方案对伪造攻击的鲁棒性仍缺乏充分评估。这十分关键，因为将可追踪水印伪造到非法内容上会导致错误归因，可能损害未责任相关生成式AI服务提供商的声誉和法律地位。本文提出WMCopier，一种无需事先知晓或访问目标水印算法即可实施的有效水印伪造攻击。该方法首先利用无条件扩散模型建模目标水印分布，再通过浅层反演过程将水印无缝嵌入非水印图像中，并引入迭代优化流程以平衡图像保真度与伪造效率。实验结果表明，WMCopier能有效欺骗开源及闭源水印系统（如Amazon系统），成功率显著高于现有方法。此外，我们还评估了伪造样本的鲁棒性，并讨论了潜在防御策略。
原文摘要 · Abstract (English)
Invisible Image Watermarking is crucial for ensuring content provenance and accountability in generative AI. While Gen-AI providers are increasingly integrating invisible watermarking systems, the robustness of these schemes against forgery attacks remains poorly characterized. This is critical, as forging traceable watermarks onto illicit content leads to false attribution, potentially harming the reputation and legal standing of Gen-AI service providers who are not responsible for the content. In this work, we propose WMCopier, an effective watermark forgery attack that operates without requiring any prior knowledge of or access to the target watermarking algorithm. Our approach first models the target watermark distribution using an unconditional diffusion model, and then seamlessly embeds the target watermark into a non-watermarked image via a shallow inversion process. We also incorporate an iterative optimization procedure that refines the reconstructed image to further trade off the fidelity and forgery efficiency. Experimental results demonstrate that WMCopier effectively deceives both open-source and closed-source watermark systems (e.g., Amazon's system), achieving a significantly higher success rate than existing methods. Additionally, we evaluate the robustness of forged samples and discuss the potential defenses against our attack.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。