[Paper Review] Warfare:Breaking the Watermark Protection of AI-Generated Content

Guanlin Li, Yifei Chen+6 more|arXiv (Cornell University)|Sep 27, 2023

Adversarial Robustness in Machine LearningComputer Science3 citations

TL;DR

This paper introduces Warfare, a unified adversarial attack framework that efficiently removes or forges watermarks in AI-generated content using a pre-trained diffusion model and a generative adversarial network (GAN). It achieves high success rates in both watermark removal and forging—up to 11,000× faster than prior methods—while preserving image quality, exposing critical vulnerabilities in existing watermarking schemes for AIGC.

ABSTRACT

AI-Generated Content (AIGC) is rapidly expanding, with services using advanced generative models to create realistic images and fluent text. Regulating such content is crucial to prevent policy violations, such as unauthorized commercialization or unsafe content distribution. Watermarking is a promising solution for content attribution and verification, but we demonstrate its vulnerability to two key attacks: (1) Watermark removal, where adversaries erase embedded marks to evade regulation, and (2) Watermark forging, where they generate illicit content with forged watermarks, leading to misattribution. We propose Warfare, a unified attack framework leveraging a pre-trained diffusion model for content processing and a generative adversarial network for watermark manipulation. Evaluations across datasets and embedding setups show that Warfare achieves high success rates while preserving content quality. We further introduce Warfare-Plus, which enhances efficiency without compromising effectiveness. The code can be found in https://github.com/GuanlinLee/warfare.

Motivation & Objective

• To investigate the vulnerability of existing watermarking schemes in AI-generated content (AIGC) to adversarial attacks.
• To develop a practical, efficient, and unified attack framework capable of both watermark removal and forging without requiring clean data or prior knowledge of the watermarking mechanism.
• To evaluate the effectiveness of the proposed attack across diverse datasets, watermarking methods, and image complexities, including high-resolution and complex scenes.
• To demonstrate that current watermarking defenses are insufficient under real-world attack conditions where adversaries only have access to watermarked outputs.

Proposed method

• The adversary collects only watermarked AIGC outputs from a target service or user, without needing clean reference images.
• A pre-trained diffusion model (e.g., DDPM) is used to denoise the watermarked content, effectively erasing the embedded watermark signal by reversing the noise injection process.
• A generative adversarial network (GAN) is trained to map the distribution of watermarked images to the denoised (watermark-erased) images for watermark removal, or to the target watermark-embedded distribution for forging.
• The GAN generator is trained in a few-shot manner using only a small number of watermarked samples, enabling generalization to unseen watermarks.
• The framework leverages the semantic consistency of the diffusion model to preserve image details during watermark manipulation, maintaining high perceptual quality.
• The method is evaluated across multiple watermarking schemes, including post-hoc and prior-methods, and tested on diverse datasets like CelebA, FFHQ, and LSUN.

Figure 1 : Overview of Warfare . (1) Collecting watermarked data from the target AIGC service or Internet. (2) Using a public pre-trained denoising model to purify the watermarked data. (3) Adopting the watermarked and mediator data to train a GAN, which can be used to remove or forge the watermark.

Experimental results

Research questions

• RQ1 Can an adversary remove watermarks from AI-generated content without access to clean data or the watermarking key?
• RQ2 Can an adversary forge a watermark from a different user onto illegal or unsafe content, leading to incorrect attribution?
• RQ3 How efficient and effective is the proposed attack compared to existing watermark-breaking methods in terms of speed and success rate?
• RQ4 Does the attack maintain high image quality and semantic consistency during watermark removal or forging?
• RQ5 Can the attack generalize to unseen watermarks and complex, high-resolution images?

Key findings

• Warfare achieves watermark removal and forging with success rates exceeding 95% across multiple datasets and watermarking schemes, including both post-hoc and prior-method watermarking.
• The attack is 5,050 to 11,000 times faster than existing diffusion-based watermark removal methods, significantly improving efficiency.
• Warfare maintains high image quality, as evidenced by minimal degradation in FID scores and preserved CLIP and SSIM metrics, even when attacking complex, high-resolution images from LSUN.
• The framework successfully bypasses watermark verification in both removal and forging scenarios, demonstrating practical feasibility in real-world settings.
• The method generalizes well to unseen watermarks with only a few-shot fine-tuning, indicating strong adaptability to new targets.
• Visualization results confirm that Warfare preserves semantic details and generates residual patterns similar to those of genuine watermarking models, indicating effective learning of embedding patterns.

(a) Watermark Removal