High-frequency Matters: An Overwriting Attack and defense for Image-processing Neural Network Watermarking

TL;DR

This paper introduces an overwriting attack targeting image-processing neural network watermarks, demonstrating its effectiveness, and proposes an adversarial training framework to enhance watermark robustness against such attacks.

Contribution

It presents a novel overwriting attack on neural network watermarks and develops an adversarial training method to defend against it, addressing overfitting issues in watermarking.

Findings

Overwriting attack achieves nearly 100% success rate.

Adversarial training improves watermark robustness.

Modified training reduces overfitting in watermarking models.

Abstract

In recent years, there has been significant advancement in the field of model watermarking techniques. However, the protection of image-processing neural networks remains a challenge, with only a limited number of methods being developed. The objective of these techniques is to embed a watermark in the output images of the target generative network, so that the watermark signal can be detected in the output of a surrogate model obtained through model extraction attacks. This promising technique, however, has certain limits. Analysis of the frequency domain reveals that the watermark signal is mainly concealed in the high-frequency components of the output. Thus, we propose an overwriting attack that involves forging another watermark in the output of the generative network. The experimental results demonstrate the efficacy of this attack in sabotaging existing watermarking schemes for image-processing networks, with an almost 100% success rate. To counter this attack, we devise an adversarial framework for the watermarking network. The framework incorporates a specially designed adversarial training step, where the watermarking network is trained to defend against the overwriting network, thereby enhancing its robustness. Additionally, we observe an overfitting phenomenon in the existing watermarking method, which can render it ineffective. To address this issue, we modify the training process to eliminate the overfitting problem.