Large Language Models (LLMs) can be misused to spread unwanted content at scale. Content watermarking deters misuse by hiding messages in content, enabling its detection using a secret watermarking key. Robustness is a core security property, stating that evading detection requires (significant) degradation of the content's quality. Many LLM watermarking methods have been proposed, but robustness is tested only against non-adaptive attackers who lack knowledge of the watermarking method and can find only suboptimal attacks. We formulate watermark robustness as an objective function and use preference-based optimization to tune adaptive attacks against the specific watermarking method. Our evaluation shows that (i) adaptive attacks evade detection against all surveyed watermarks, (ii) training against any watermark succeeds in evading unseen watermarks, and (iii) optimization-based attacks are cost-effective. Our findings underscore the need to test robustness against adaptively tuned attacks. We release our adaptively optimized paraphrasers at https://github.com/nilslukas/ada-wm-evasion.
Blind PRNG Hijacking: An Undetectable Integrity-Preserving Attack Against LLM Watermarking
Fujian Provincial Key Laboratory of Automotive Electronics and Electric Drive（福建省汽车电子与电力驱动重点实验室）；School of Electronic, Electrical and Physics（电子、电气与物理学院）；Fujian University of Technology（福建理工大学）；School of Humanities（人文学院）；Institute of Applied Physics and Materials Engineering（应用物理与材料工程学院）；University of Macau（澳门大学）
Revealing Weaknesses in Text Watermarking Through Self-Information Rewrite Attacks
University of British Columbia（不列颠哥伦比亚大学）；Vector Institute for AI（向量人工智能研究所）；University of Cambridge（剑桥大学）；Canada CIFAR AI Chair（加拿大CIFAR人工智能主席）；NSERC CRC Chair（NSERC加拿大研究主席）
Watermark Overwriting Attack on StegaStamp algorithm
Moscow Institute of Physics and Technology（莫斯科物理技术学院）；Innopolis University（因诺波利斯大学）；Ivannikov Institute for System Programming of the Russian Academy of Sciences (ISP RAS)（俄罗斯科学院伊万尼科夫系统编程研究所）；Moscow State University Artificial Intelligence Institute（莫斯科国立大学人工智能研究所）；AIRI
本文提出一种针对StegaStamp算法的水印覆写攻击方法，可在极小质量损失下完全去除图像水印，并作为NeurIPS“Erasing the invisible”竞赛的一部分开发。
Neural Honeytrace: Plug&Play Watermarking Framework against Model Extraction Attacks
School of Cyberspace Security, Beijing University of Posts and Telecommunications（北京邮电大学网络安全学院）；Cyberspace Institute of Advanced Technology, Guangzhou University（广州大学网络空间技术研究院）；Huangpu Research School of Guangzhou University（广州大学黄埔研究学院）
In this paper, we analyze several recent schemes for watermarking network flows that are based on splitting the flow into timing intervals. We show that this approach creates time-dependent correlations that enable an attack that combines multiple watermarked flows. Such an attack can easily be mounted in nearly all applications of network flow watermarking, both in anonymous communication and stepping stone detection. The attack can be used to detect the presence of a watermark, recover the secret parameters, and remove the watermark from a flow. The attack can be effective even if different …
Large Language Model Watermark Stealing With Mixed Integer Programming
Griffith University（格里菲斯大学）；University of Technology, Sydney（悉尼科技大学）；Royal Melbourne Institute of Technology（皇家墨尔本理工大学）；Huazhong University of Science and Technology（华中科技大学）
LiBRA: Detection-Aware Image Watermark Removal via Bidirectional Latent Optimization
City University of Macau（澳门城市大学）；Xi’an Jiaotong University（西安交通大学）；University of Electronic Science and Technology of China（电子科技大学）；Xidian University（西安电子科技大学）
Secure and Efficient Watermarking for Latent Diffusion Models in Model Distribution Scenarios
Beijing Institute of Technology（北京理工大学）；School of Information Engineering, Minzu University of China（中央民族大学信息工程学院）；School of Computer Science, The University of Adelaide（阿德莱德大学计算机学院）
Watermarking algorithms needs properties of robustness and perceptibility. But these properties are affected by different -2 types of attacks performed on watermarked images. The goal of performing attacks is destroy the information of watermark hidden in the watermarked image. So every Algorithms should be previously tested by developers so that it would not affected by attacks.
In recent years, there has been significant advancement in the field of model watermarking techniques. However, the protection of image-processing neural networks remains a challenge, with only a limited number of methods being developed. The objective of these techniques is to embed a watermark in the output images of the target generative network, so that the watermark signal can be detected in the output of a surrogate model obtained through model extraction attacks. This promising technique, however, has certain limits. Analysis of the frequency domain reveals that the watermark signal is …
Backdoor-based watermarking schemes were proposed to protect the intellectual property of artificial intelligence models, especially deep neural networks, under the black-box setting. Compared with ordinary backdoors, backdoor-based watermarks need to digitally incorporate the owner's identity, which fact adds extra requirements to the trigger generation and verification programs. Moreover, these concerns produce additional security risks after the watermarking scheme has been published for as a forensics tool or the owner's evidence has been eavesdropped on. This paper proposes the capsulatio…
Deep Neural Network (DNN) watermarking is a method for provenance verification of DNN models. Watermarking should be robust against watermark removal attacks that derive a surrogate model that evades provenance verification. Many watermarking schemes that claim robustness have been proposed, but their robustness is only validated in isolation against a relatively small set of attacks. There is no systematic, empirical evaluation of these claims against a common, comprehensive set of removal attacks. This uncertainty about a watermarking scheme's robustness causes difficulty to trust their depl…
To ensure protection of the intellectual property rights of DNN models, watermarking techniques have been investigated to insert side-information into the models without seriously degrading the performance of original task. One of the threats for the DNN watermarking is the pruning attack such that less important neurons in the model are pruned to make it faster and more compact as well as to remove the watermark. In this study, we investigate a channel coding approach to resist the pruning attack. As the channel model is completely different from conventional models like digital images, it ha…
College of Computer Science, Chongqing University, China（重庆大学计算机学院）；School of Computer Science and Engineering, Nanyang Technological University, Singapore（南洋理工大学计算机科学与工程学院）；Institute for Network Sciences and Cyberspace, Tsinghua University, China（清华大学网络科学与网络空间研究院）；The Bradley Department of Electronic and Computer Engineering, Virginia Tech（弗吉尼亚理工大学布拉德利电子与计算机工程系）
Watermarking has become the tendency in protecting the intellectual property of DNN models. Recent works, from the adversary's perspective, attempted to subvert watermarking mechanisms by designing watermark removal attacks. However, these attacks mainly adopted sophisticated fine-tuning techniques, which have certain fatal drawbacks or unrealistic assumptions. In this paper, we propose a novel watermark removal attack from a different perspective. Instead of just fine-tuning the watermarked models, we design a simple yet powerful transformation algorithm by combining imperceptible pattern emb…
Machine learning is increasingly used in security-critical applications, such as autonomous driving, face recognition and malware detection. Most learning methods, however, have not been designed with security in mind and thus are vulnerable to different types of attacks. This problem has motivated the research field of adversarial machine learning that is concerned with attacking and defending learning methods. Concurrently, a different line of research has tackled a very similar problem: In digital watermarking information are embedded in a signal in the presence of an adversary. As a conseq…
Dynamic watermarking schemes can enhance the cyber attack detection capability of networked control systems (NCSs). This paper presents a linear event-triggered solution to conventional dynamic watermarking (CDW) schemes. Firstly, the limitations of CDW schemes for event-triggered state estimation based NCSs are investigated. Secondly, a new event-triggered dynamic watermarking (ETDW) scheme is designed by treating watermarking as symmetric key encryption, based on the limit convergence theorem in probability. Its security property against the generalized replay attacks (GRAs) is also discusse…
This paper analyzes a revised fragile watermarking scheme proposed by Botta et al. which was developed as a revision of the watermarking scheme previously proposed by Rawat et al. A new attack is presented that allows an attacker to apply a valid watermark on tampered images, therefore circumventing the protection that the watermarking scheme under study was supposed to offer. Furthermore, the presented attack has very low computational and memory requirements.
Trigger set-based watermarking schemes have gained emerging attention as they provide a means to prove ownership for deep neural network model owners. In this paper, we argue that state-of-the-art trigger set-based watermarking algorithms do not achieve their designed goal of proving ownership. We posit that this impaired capability stems from two common experimental flaws that the existing research practice has committed when evaluating the robustness of watermarking algorithms: (1) incomplete adversarial evaluation and (2) overlooked adaptive attacks. We conduct a comprehensive adversarial e…
Institute for Interdisciplinary Information Sciences, Tsinghua University（清华大学交叉信息研究院）；Tsinghua University（清华大学）
Optical character recognition (OCR) is widely applied in real applications serving as a key preprocessing tool. The adoption of deep neural network (DNN) in OCR results in the vulnerability against adversarial examples which are crafted to mislead the output of the threat model. Different from vanilla colorful images, images of printed text have clear backgrounds usually. However, adversarial examples generated by most of the existing adversarial attacks are unnatural and pollute the background severely. To address this issue, we propose a watermark attack method to produce natural distortion …
This paper presents an application of statistical machine learning to the field of watermarking. We propose a new attack model on additive spread-spectrum watermarking systems. The proposed attack is based on Bayesian statistics. We consider the scenario in which a watermark signal is repeatedly embedded in specific, possibly chosen based on a secret message bitstream, segments (signals) of the host data. The host signal can represent a patch of pixels from an image or a video frame. We propose a probabilistic model that infers the embedded message bitstream and watermark signal, directly from…
