人工智慧生成的影像浮水印技術的脆弱性：檢驗其對視覺改寫攻擊的強健性

The Brittleness of AI-Generated Image Watermarking Techniques: Examining Their Robustness Against Visual Paraphrasing Attacks

August 19, 2024

作者: Niyar R Barman, Krish Sharma, Ashhar Aziz, Shashwat Bajpai, Shwetangshu Biswas, Vasu Sharma, Vinija Jain, Aman Chadha, Amit Sheth, Amitava Das

cs.AI

摘要

文字轉圖像生成系統的快速發展，例如Stable Diffusion、Midjourney、Imagen和DALL-E等模型，加劇了人們對其潛在濫用的擔憂。為應對此，Meta和Google等公司加大了實施數字水印技術於AI生成圖像上，以遏制潛在誤導視覺內容的流通。然而，在本文中，我們認為當前的圖像水印方法脆弱且容易通過視覺改寫攻擊來規避。所提出的視覺改寫器分為兩個步驟。首先，利用KOSMOS-2這一最新的頂尖圖像字幕系統為給定圖像生成標題。其次，將原始圖像和生成的標題傳遞給圖像對圖像擴散系統。在擴散管道的去噪步驟中，系統生成一個在文本標題引導下的視覺上相似的圖像。結果得到的圖像是一個視覺改寫，並且不含任何水印。我們的實證研究結果表明，視覺改寫攻擊可以有效地從圖像中刪除水印。本文提供了對現有水印技術對視覺改寫攻擊的脆弱性進行實證評估。雖然我們並未提出解決方案，但本文呼籲科學界優先開發更強大的水印技術。我們首創的視覺改寫數據集及相應代碼已公開提供。

English

The rapid advancement of text-to-image generation systems, exemplified by models like Stable Diffusion, Midjourney, Imagen, and DALL-E, has heightened concerns about their potential misuse. In response, companies like Meta and Google have intensified their efforts to implement watermarking techniques on AI-generated images to curb the circulation of potentially misleading visuals. However, in this paper, we argue that current image watermarking methods are fragile and susceptible to being circumvented through visual paraphrase attacks. The proposed visual paraphraser operates in two steps. First, it generates a caption for the given image using KOSMOS-2, one of the latest state-of-the-art image captioning systems. Second, it passes both the original image and the generated caption to an image-to-image diffusion system. During the denoising step of the diffusion pipeline, the system generates a visually similar image that is guided by the text caption. The resulting image is a visual paraphrase and is free of any watermarks. Our empirical findings demonstrate that visual paraphrase attacks can effectively remove watermarks from images. This paper provides a critical assessment, empirically revealing the vulnerability of existing watermarking techniques to visual paraphrase attacks. While we do not propose solutions to this issue, this paper serves as a call to action for the scientific community to prioritize the development of more robust watermarking techniques. Our first-of-its-kind visual paraphrase dataset and accompanying code are publicly available.