DiffWA: Diffusion Models for Watermark Attack

TL;DR

This paper introduces DiffWA, a diffusion-based watermark attack method that effectively removes watermarks from images while preserving visual quality, outperforming traditional approaches in both watermark removal and image fidelity.

Contribution

We propose a novel diffusion model guided by distance metrics for watermark removal, achieving high-quality unwatermarked images and effective watermark disruption.

Findings

Watermark removal increases bit error rate above 0.4.

Attacked images maintain PSNR > 31 and SSIM > 0.97.

Method outperforms existing watermark attack techniques.

Abstract

With the rapid development of deep neural networks(DNNs), many robust blind watermarking algorithms and frameworks have been proposed and achieved good results. At present, the watermark attack algorithm can not compete with the watermark addition algorithm. And many watermark attack algorithms only care about interfering with the normal extraction of the watermark, and the watermark attack will cause great visual loss to the image. To this end, we propose DiffWA, a conditional diffusion model with distance guidance for watermark attack, which can restore the image while removing the embedded watermark. The core of our method is training an image-to-image conditional diffusion model on unwatermarked images and guiding the conditional model using a distance guidance when sampling so that the model will generate unwatermarked images which is similar to original images. We conducted experiments on CIFAR-10 using our proposed models. The results shows that the model can remove the watermark with good effect and make the bit error rate of watermark extraction higher than 0.4. At the same time, the attacked image will maintain good visual effect with PSNR more than 31 and SSIM more than 0.97 compared with the original image.