Decoder Gradient Shield: Provable and High-Fidelity Prevention of Gradient-Based Box-Free Watermark Removal

TL;DR

This paper introduces the Decoder Gradient Shield (DGS), a novel defense mechanism that provably prevents gradient-based watermark removal in box-free watermarking, maintaining image quality and enhancing intellectual property protection.

Contribution

We propose DGS, a new protection layer that defends against gradient-based watermark removal attacks in box-free watermarking models, with a closed-form solution and proven effectiveness.

Findings

DGS effectively prevents watermark removal training.

Maintains high image quality despite protection.

Proven theoretical and experimental robustness.

Abstract

The intellectual property of deep image-to-image models can be protected by the so-called box-free watermarking. It uses an encoder and a decoder, respectively, to embed into and extract from the model's output images invisible copyright marks. Prior works have improved watermark robustness, focusing on the design of better watermark encoders. In this paper, we reveal an overlooked vulnerability of the unprotected watermark decoder which is jointly trained with the encoder and can be exploited to train a watermark removal network. To defend against such an attack, we propose the decoder gradient shield (DGS) as a protection layer in the decoder API to prevent gradient-based watermark removal with a closed-form solution. The fundamental idea is inspired by the classical adversarial attack, but is utilized for the first time as a defensive mechanism in the box-free model watermarking. We then demonstrate that DGS can reorient and rescale the gradient directions of watermarked queries and stop the watermark remover's training loss from converging to the level without DGS, while retaining decoder output image quality. Experimental results verify the effectiveness of proposed method. Code of paper will be made available upon acceptance.