This paper presents an application of statistical machine learning to the field of watermarking. We propose a new attack model on additive spread-spectrum watermarking systems. The proposed attack is based on Bayesian statistics. We consider the scenario in which a watermark signal is repeatedly embedded in specific, possibly chosen based on a secret message bitstream, segments (signals) of the host data. The host signal can represent a patch of pixels from an image or a video frame. We propose a probabilistic model that infers the embedded message bitstream and watermark signal, directly from the watermarked data, without access to the decoder. We develop an efficient Markov chain Monte Carlo sampler for updating the model parameters from their conjugate full conditional posteriors. We also provide a variational Bayesian solution, which further increases the convergence speed of the algorithm. Experiments with synthetic and real image signals demonstrate that the attack model is able to correctly infer a large part of the message bitstream and obtain a very accurate estimate of the watermark signal.
Watermarking algorithms needs properties of robustness and perceptibility. But these properties are affected by different -2 types of attacks performed on watermarked images. The goal of performing attacks is destroy the information of watermark hidden in the watermarked image. So every Algorithms should be previously tested by developers so that it would not affected by attacks.
Deep Neural Network (DNN) watermarking is a method for provenance verification of DNN models. Watermarking should be robust against watermark removal attacks that derive a surrogate model that evades provenance verification. Many watermarking schemes that claim robustness have been proposed, but their robustness is only validated in isolation against a relatively small set of attacks. There is no systematic, empirical evaluation of these claims against a common, comprehensive set of removal attacks. This uncertainty about a watermarking scheme's robustness causes difficulty to trust their depl…
To ensure protection of the intellectual property rights of DNN models, watermarking techniques have been investigated to insert side-information into the models without seriously degrading the performance of original task. One of the threats for the DNN watermarking is the pruning attack such that less important neurons in the model are pruned to make it faster and more compact as well as to remove the watermark. In this study, we investigate a channel coding approach to resist the pruning attack. As the channel model is completely different from conventional models like digital images, it ha…
Machine learning is increasingly used in security-critical applications, such as autonomous driving, face recognition and malware detection. Most learning methods, however, have not been designed with security in mind and thus are vulnerable to different types of attacks. This problem has motivated the research field of adversarial machine learning that is concerned with attacking and defending learning methods. Concurrently, a different line of research has tackled a very similar problem: In digital watermarking information are embedded in a signal in the presence of an adversary. As a conseq…
This paper analyzes a revised fragile watermarking scheme proposed by Botta et al. which was developed as a revision of the watermarking scheme previously proposed by Rawat et al. A new attack is presented that allows an attacker to apply a valid watermark on tampered images, therefore circumventing the protection that the watermarking scheme under study was supposed to offer. Furthermore, the presented attack has very low computational and memory requirements.
Trigger set-based watermarking schemes have gained emerging attention as they provide a means to prove ownership for deep neural network model owners. In this paper, we argue that state-of-the-art trigger set-based watermarking algorithms do not achieve their designed goal of proving ownership. We posit that this impaired capability stems from two common experimental flaws that the existing research practice has committed when evaluating the robustness of watermarking algorithms: (1) incomplete adversarial evaluation and (2) overlooked adaptive attacks. We conduct a comprehensive adversarial e…
College of Computer Science, Chongqing University, China（重庆大学计算机学院）；School of Computer Science and Engineering, Nanyang Technological University, Singapore（南洋理工大学计算机科学与工程学院）；Institute for Network Sciences and Cyberspace, Tsinghua University, China（清华大学网络科学与网络空间研究院）；The Bradley Department of Electronic and Computer Engineering, Virginia Tech（弗吉尼亚理工大学布拉德利电子与计算机工程系）
Watermarking has become the tendency in protecting the intellectual property of DNN models. Recent works, from the adversary's perspective, attempted to subvert watermarking mechanisms by designing watermark removal attacks. However, these attacks mainly adopted sophisticated fine-tuning techniques, which have certain fatal drawbacks or unrealistic assumptions. In this paper, we propose a novel watermark removal attack from a different perspective. Instead of just fine-tuning the watermarked models, we design a simple yet powerful transformation algorithm by combining imperceptible pattern emb…
With the increasing application value of machine learning, the intellectual property (IP) rights of deep neural networks (DNN) are getting more and more attention. With our analysis, most of the existing DNN watermarking methods can resist fine-tuning and pruning attack, but distillation attack. To address these problem, we propose a new DNN watermarking framework, Unified Soft-label Perturbation (USP), having a detector paired with the model to be watermarked, and Customized Soft-label Perturbation (CSP), embedding watermark via adding perturbation into the model output probability distributi…
The rise of machine learning as a service and model sharing platforms has raised the need of traitor-tracing the models and proof of authorship. Watermarking technique is the main component of existing methods for protecting copyright of models. In this paper, we show that distillation, a widely used transformation technique, is a quite effective attack to remove watermark embedded by existing algorithms. The fragility is due to the fact that distillation does not retain the watermark embedded in the model that is redundant and independent to the main learning task. We design ingrain in respon…
State Key Laboratory of Mathematical Sciences, Academy of Mathematics and Systems Science, Chinese Academy of Sciences（数学科学国家重点实验室，数学与系统科学研究院，中国科学院）；University of Chinese Academy of Sciences（中国科学院大学）；Institute of AI for Industries, Nanjing, China（产业人工智能研究院，南京，中国）
In this paper, we analyze several recent schemes for watermarking network flows that are based on splitting the flow into timing intervals. We show that this approach creates time-dependent correlations that enable an attack that combines multiple watermarked flows. Such an attack can easily be mounted in nearly all applications of network flow watermarking, both in anonymous communication and stepping stone detection. The attack can be used to detect the presence of a watermark, recover the secret parameters, and remove the watermark from a flow. The attack can be effective even if different …
Institute for Interdisciplinary Information Sciences, Tsinghua University（清华大学交叉信息研究院）；Tsinghua University（清华大学）
Optical character recognition (OCR) is widely applied in real applications serving as a key preprocessing tool. The adoption of deep neural network (DNN) in OCR results in the vulnerability against adversarial examples which are crafted to mislead the output of the threat model. Different from vanilla colorful images, images of printed text have clear backgrounds usually. However, adversarial examples generated by most of the existing adversarial attacks are unnatural and pollute the background severely. To address this issue, we propose a watermark attack method to produce natural distortion …
Recent research has demonstrated that adding some imperceptible perturbations to original images can fool deep learning models. However, the current adversarial perturbations are usually shown in the form of noises, and thus have no practical meaning. Image watermark is a technique widely used for copyright protection. We can regard image watermark as a king of meaningful noises and adding it to the original image will not affect people's understanding of the image content, and will not arouse people's suspicion. Therefore, it will be interesting to generate adversarial examples using watermar…
Delft University of Technology（代尔夫特理工大学）；Radboud University（拉德堡德大学）
Graph Neural Networks (GNNs) have achieved promising performance in various real-world applications. Building a powerful GNN model is not a trivial task, as it requires a large amount of training data, powerful computing resources, and human expertise in fine-tuning the model. Moreover, with the development of adversarial attacks, e.g., model stealing attacks, GNNs raise challenges to model authentication. To avoid copyright infringement on GNNs, verifying the ownership of the GNN models is necessary. This paper presents a watermarking framework for GNNs for both graph and node classification …
Obtaining the state of the art performance of deep learning models imposes a high cost to model generators, due to the tedious data preparation and the substantial processing requirements. To protect the model from unauthorized re-distribution, watermarking approaches have been introduced in the past couple of years. We investigate the robustness and reliability of state-of-the-art deep neural network watermarking schemes. We focus on backdoor-based watermarking and propose two -- a black-box and a white-box -- attacks that remove the watermark. Our black-box attack steals the model and remove…
The main theme of this application is to provide an algorithm color image watermark to manage the attacks such as rotation, scaling and translation. In the existing watermarking algorithms, those exploited robust features are more or less related to the pixel position, so they cannot be more robust against the attacks. In order to solve this problem this application focus on certain parameters rather than the pixel position for watermarking. Two statistical features such as the histogram shape and the mean of Gaussian filtered low-frequency component of images are taken for this proposed appli…
Revealing Weaknesses in Text Watermarking Through Self-Information Rewrite Attacks
University of British Columbia（不列颠哥伦比亚大学）；Vector Institute for AI（向量人工智能研究所）；University of Cambridge（剑桥大学）；Canada CIFAR AI Chair（加拿大CIFAR人工智能主席）；NSERC CRC Chair（NSERC加拿大研究主席）
With the explosive growth of internet technology, easy transfer of digital multimedia is feasible. However, this kind of convenience with which authorized users can access information, turns out to be a mixed blessing due to information piracy. The emerging field of Digital Rights Management (DRM) systems addresses issues related to the intellectual property rights of digital content. In this paper, an object-oriented (OO) DRM system, called "Imaging System with Watermarking and Attack Resilience" (ISWAR), is presented that generates and authenticates color images with embedded mechanisms for …
The recent advent in the field of multimedia proposed a many facilities in transport, transmission and manipulation of data. Along with this advancement of facilities there are larger threats in authentication of data, its licensed use and protection against illegal use of data. A lot of digital image watermarking techniques have been designed and implemented to stop the illegal use of the digital multimedia images. This paper compares the robustness of three different watermarking schemes against brightness and rotation attacks. The robustness of the watermarked images has been verified on th…
MEA-Defender: A Robust Watermark against Model Extraction Attack
Institute of Information Engineering, Chinese Academy of Sciences（中国科学院信息工程研究所）；School of Cyber Security, University of Chinese Academy of Sciences（中国科学院大学网络空间安全学院）；Department of Computer Science, Metropolitan College, Boston University（波士顿大学大都会学院计算机科学系）
Tsinghua University（清华大学）；University of Southern California（南加州大学）
Deep neural networks (DNNs) significantly improved the accuracy of optical character recognition (OCR) and inspired many important applications. Unfortunately, OCRs also inherit the vulnerabilities of DNNs under adversarial examples. Different from colorful vanilla images, text images usually have clear backgrounds. Adversarial examples generated by most existing adversarial attacks are unnatural and pollute the background severely. To address this issue, we propose the Fast Adversarial Watermark Attack (FAWA) against sequence-based OCR models in the white-box manner. By disguising the perturb…
In recent years, there has been significant advancement in the field of model watermarking techniques. However, the protection of image-processing neural networks remains a challenge, with only a limited number of methods being developed. The objective of these techniques is to embed a watermark in the output images of the target generative network, so that the watermark signal can be detected in the output of a surrogate model obtained through model extraction attacks. This promising technique, however, has certain limits. Analysis of the frequency domain reveals that the watermark signal is …
As an efficient watermark attack method, geometric distortions destroy the synchronization between watermark encoder and decoder. And the local geometric distortion is a famous challenge in the watermark field. Although a lot of geometric distortions resilient watermarking schemes have been proposed, few of them perform well against local geometric distortion like random bending attack (RBA). To address this problem, this paper proposes a novel watermark synchronization process and the corresponding watermarking scheme. In our scheme, the watermark bits are represented by random patterns. The …
In order to protect the intellectual property (IP) of deep neural networks (DNNs), many existing DNN watermarking techniques either embed watermarks directly into the DNN parameters or insert backdoor watermarks by fine-tuning the DNN parameters, which, however, cannot resist against various attack methods that remove watermarks by altering DNN parameters. In this paper, we bypass such attacks by introducing a structural watermarking scheme that utilizes channel pruning to embed the watermark into the host DNN architecture instead of crafting the DNN parameters. To be specific, during watermar…
Backdoor-based watermarking schemes were proposed to protect the intellectual property of artificial intelligence models, especially deep neural networks, under the black-box setting. Compared with ordinary backdoors, backdoor-based watermarks need to digitally incorporate the owner's identity, which fact adds extra requirements to the trigger generation and verification programs. Moreover, these concerns produce additional security risks after the watermarking scheme has been published for as a forensics tool or the owner's evidence has been eavesdropped on. This paper proposes the capsulatio…
Training deep neural networks from scratch could be computationally expensive and requires a lot of training data. Recent work has explored different watermarking techniques to protect the pre-trained deep neural networks from potential copyright infringements. However, these techniques could be vulnerable to watermark removal attacks. In this work, we propose REFIT, a unified watermark removal framework based on fine-tuning, which does not rely on the knowledge of the watermarks, and is effective against a wide range of watermarking schemes. In particular, we conduct a comprehensive study of …
Deep neural networks have had enormous impact on various domains of computer science, considerably outperforming previous state of the art machine learning techniques. To achieve this performance, neural networks need large quantities of data and huge computational resources, which heavily increases their construction costs. The increased cost of building a good deep neural network model gives rise to a need for protecting this investment from potential copyright infringements. Legitimate owners of a machine learning model want to be able to reliably track and detect a malicious adversary that…
Dynamic watermarking schemes can enhance the cyber attack detection capability of networked control systems (NCSs). This paper presents a linear event-triggered solution to conventional dynamic watermarking (CDW) schemes. Firstly, the limitations of CDW schemes for event-triggered state estimation based NCSs are investigated. Secondly, a new event-triggered dynamic watermarking (ETDW) scheme is designed by treating watermarking as symmetric key encryption, based on the limit convergence theorem in probability. Its security property against the generalized replay attacks (GRAs) is also discusse…
SemBind: Binding Diffusion Watermarks to Semantics Against Black-Box Forgery Attacks
School of Cyber Science and Technology, University of Science and Technology of China, Anhui, China（中国科学技术大学网络安全学院）；Anhui Province Key Laboratory of Digital Security, Anhui, China（安徽省数字安全重点实验室）
Tsinghua University（清华大学）；CISPA Helmholtz Center for Information Security（CISPA亥姆霍兹信息安全中心）
Self-supervised learning is an emerging machine learning paradigm. Compared to supervised learning which leverages high-quality labeled datasets, self-supervised learning relies on unlabeled datasets to pre-train powerful encoders which can then be treated as feature extractors for various downstream tasks. The huge amount of data and computational resources consumption makes the encoders themselves become the valuable intellectual property of the model owner. Recent research has shown that the machine learning model's copyright is threatened by model stealing attacks, which aim to train a sur…
Watermark Overwriting Attack on StegaStamp algorithm
Moscow Institute of Physics and Technology（莫斯科物理技术学院）；Innopolis University（因诺波利斯大学）；Ivannikov Institute for System Programming of the Russian Academy of Sciences (ISP RAS)（俄罗斯科学院伊万尼科夫系统编程研究所）；Moscow State University Artificial Intelligence Institute（莫斯科国立大学人工智能研究所）；AIRI
本文提出一种针对StegaStamp算法的水印覆写攻击方法，可在极小质量损失下完全去除图像水印，并作为NeurIPS“Erasing the invisible”竞赛的一部分开发。
Energy efficient watermarking preserves the watermark energy after linear attack as much as possible. We consider in this letter non-stationary signal models and derive conditions for energy efficient watermarking under random vector model without WSS assumption. We find that the covariance matrix of the energy efficient watermark should be proportional to host covariance matrix to best resist the optimal linear removal attacks. In WSS process our result reduces to the well known power spectrum condition. Intuitive geometric interpretation of the results are also discussed which in turn also p…
Vulnerability of watermarking schemes against intense signal processing attacks is generally a major concern, particularly when there are techniques to reproduce an acceptable copy of the original signal with no chance for detecting the watermark. In this paper, we propose a two-layer, data partitioning (DP) based, image in image watermarking method in the DCT domain to improve the watermark detection performance. Truncated singular value decomposition, binary wavelet decomposition and spatial scalability idea in H.264/SVC are analyzed and employed as partitioning methods. It is shown that the…
