发表机构
University of Science and Technology of China; National University of Singapore（中国科学技术大学; 新加坡国立大学）
机构由 AI 辅助整理，请以论文原文为准。AI 中文总结
针对单图像盲水印去除的实用性与针对性矛盾，提出ProxyEraseAgent框架，利用公开解码器作为代理，通过响应排名引导异构去除操作搜索，在11种水印系统上实现94.8%的攻击成功率。
AI 中文摘要
不可见图像水印去除已受到越来越多的关注。尽管取得了实质性进展，现有攻击方法在实用性和针对性之间存在矛盾：利用检测器输出、解码器响应或配对图像的攻击可针对水印决策边界定制，但需要现实场景中很少能获得的信息；相反，基于压缩、几何失真或重构的攻击可从单张含水印图像轻松部署，但在很大程度上仍属于开环攻击——它们应用通用变换，而不知道图像是否正走向水印失效。因此，单图像盲水印去除的关键挑战不仅在于如何变换图像，还在于如何在不访问隐藏解码器的情况下获得有用的去除方向。为弥合这一差距，我们提出ProxyEraseAgent，一种通过代理解码器响应恢复攻击针对性的智能体驱动框架。公开可用的水印方案提供了候选解码器的自然知识库，其中一些对给定的未知图像具有信息价值。我们的见解是，对查询图像产生强校准响应的解码器可能与隐藏目标机制共享附近的解码边界。ProxyEraseAgent按校准响应强度对这些解码器进行排名，并使用排名最高的解码器作为代理边界估计器。它们的响应随后在感知质量约束下引导对异构去除操作（例如几何失真、JPEG压缩、图像重构和梯度扰动）的渐进搜索。在11种水印系统上进行的实验表明，ProxyEraseAgent达到了94.8%的攻击成功率，证明了响应引导的代理检索和反馈驱动的顺序规划在盲水印去除中的有效性。
英文摘要
Invisible image watermark removal has received growing attention. Despite substantial progress, existing attacks face a tension between practicality and specificity. Attacks exploiting detector outputs, decoder responses, or paired images can be tailored to the watermark decision boundary, but require information rarely available in realistic scenarios. Conversely, attacks based on compression, geometric distortion, or reconstruction are easily deployed from a single watermarked image, but remain largely open-loop: they apply generic transformations without knowing if the image is moving toward watermark failure. Thus, the key challenge in single-image blind watermark removal is not merely how to transform the image, but how to obtain a useful removal direction without accessing the hidden decoder. To bridge this gap, we propose ProxyEraseAgent, an agent-driven framework recovering attack specificity through proxy decoder responses. Publicly available watermarking schemes provide a natural knowledge base of candidate decoders, where some are informative for a given unknown image. Our insight is that a decoder producing a strong calibrated response to the query image likely shares a nearby decoding boundary with the hidden target mechanism. ProxyEraseAgent ranks these decoders by calibrated response strength and uses the top ones as proxy boundary estimators. Their responses then guide a progressive search over heterogeneous removal operations (e.g., geometric distortion, JPEG compression, image reconstruction, and gradient perturbation) under perceptual-quality constraints. Experiments across 11 watermarking systems show ProxyEraseAgent achieves a 94.8% attack success rate, demonstrating the effectiveness of response-guided proxy retrieval and feedback-driven sequential planning for blind watermark removal.
