High-frequency Matters: An Overwriting Attack and defense for Image-processing Neural Network Watermarking

by   Huajie Chen, et al.

In recent years, there has been significant advancement in the field of model watermarking techniques. However, the protection of image-processing neural networks remains a challenge, with only a limited number of methods being developed. The objective of these techniques is to embed a watermark in the output images of the target generative network, so that the watermark signal can be detected in the output of a surrogate model obtained through model extraction attacks. This promising technique, however, has certain limits. Analysis of the frequency domain reveals that the watermark signal is mainly concealed in the high-frequency components of the output. Thus, we propose an overwriting attack that involves forging another watermark in the output of the generative network. The experimental results demonstrate the efficacy of this attack in sabotaging existing watermarking schemes for image-processing networks, with an almost 100 an adversarial framework for the watermarking network. The framework incorporates a specially designed adversarial training step, where the watermarking network is trained to defend against the overwriting network, thereby enhancing its robustness. Additionally, we observe an overfitting phenomenon in the existing watermarking method, which can render it ineffective. To address this issue, we modify the training process to eliminate the overfitting problem.


page 1

page 4

page 7

page 8

page 9

page 10

page 11

page 12


Generative Model Watermarking Suppressing High-Frequency Artifacts

Protecting deep neural networks (DNNs) against intellectual property (IP...

Phase-shifted Adversarial Training

Adversarial training has been considered an imperative component for saf...

Bandlimiting Neural Networks Against Adversarial Attacks

In this paper, we study the adversarial attack and defence problem in de...

A Dual Stealthy Backdoor: From Both Spatial and Frequency Perspectives

Backdoor attacks pose serious security threats to deep neural networks (...

Frequency Disentangled Residual Network

Residual networks (ResNets) have been utilized for various computer visi...

Camera Model Anonymisation with Augmented cGANs

The model of camera that was used to capture a particular photographic i...

Exploring Structure Consistency for Deep Model Watermarking

The intellectual property (IP) of Deep neural networks (DNNs) can be eas...

Please sign up or login with your details

Forgot password? Click here to reset