深度水印安全性研究：对抗迁移性视角
Investigating Deep Watermark Security: An Adversarial Transferability Perspective
AI总结：
本文从对抗迁移性视角研究深度水印安全，提出ESS机制、ESMA攻击方法及BEM增强方法，显著提升定向迁移攻击成功率，并系统评估了深度水印在擦除与篡改风险下的脆弱性。
摘要：
生成式神经网络的兴起引发了对生成内容知识产权（IP）保护需求的增长。深度水印技术因其在知识产权保护中的灵活性而受到广泛关注。然而，对抗性可迁移攻击的激增给深度水印技术的安全性带来了前所未有的挑战，而这一领域目前缺乏系统性的研究。本研究通过引入两种有效的可迁移攻击者来填补这一空白，以评估深度水印在面对擦除和篡改风险时的脆弱性。具体而言，我们首先定义了局部样本密度的概念，并利用它推导出关于模型输出一致性的定理。在发现将样本扰动到目标类的高样本密度区域（HSDR）能够增强定向对抗迁移性之后，我们提出了简单样本选择（ESS）机制和简单样本匹配攻击（ESMA）方法。此外，我们提出了瓶颈增强混合（BEM）方法，该方法融合了信息瓶颈理论，以减少生成器对无关噪声的依赖。实验表明，ESMA和BEM-ESMA方法在定向迁移攻击的成功率上均有显著提升。我们进一步使用ESMA和BEM-ESMA作为度量手段，综合考虑模型架构和水印编码长度进行了全面评估，并获得了一些令人瞩目的发现。
英文摘要：
The rise of generative neural networks has triggered an increased demand for intellectual property (IP) protection in generated content. Deep watermarking techniques, recognized for their flexibility in IP protection, have garnered significant attention. However, the surge in adversarial transferable attacks poses unprecedented challenges to the security of deep watermarking techniques-an area currently lacking systematic investigation. This study fills this gap by introducing two effective transferable attackers to assess the vulnerability of deep watermarks against erasure and tampering risks. Specifically, we initially define the concept of local sample density, utilizing it to deduce theorems on the consistency of model outputs. Upon discovering that perturbing samples towards high sample density regions (HSDR) of the target class enhances targeted adversarial transferability, we propose the Easy Sample Selection (ESS) mechanism and the Easy Sample Matching Attack (ESMA) method. Additionally, we propose the Bottleneck Enhanced Mixup (BEM) that integrates information bottleneck theory to reduce the generator's dependence on irrelevant noise. Experiments show a significant enhancement in the success rate of targeted transfer attacks for both ESMA and BEM-ESMA methods. We further conduct a comprehensive evaluation using ESMA and BEM-ESMA as measurements, considering model architecture and watermark encoding length, and achieve some impressive findings.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
