人工智能生成的图像水印技术的脆弱性：检验其对视觉释义攻击的稳健性

The Brittleness of AI-Generated Image Watermarking Techniques: Examining Their Robustness Against Visual Paraphrasing Attacks

August 19, 2024

作者: Niyar R Barman, Krish Sharma, Ashhar Aziz, Shashwat Bajpai, Shwetangshu Biswas, Vasu Sharma, Vinija Jain, Aman Chadha, Amit Sheth, Amitava Das

cs.AI

摘要

文本到图像生成系统的快速发展，例如稳定扩散、Midjourney、Imagen和DALL-E等模型，引发了人们对其潜在滥用的担忧。作为回应，Meta和Google等公司加大了在由AI生成的图像上实施水印技术的力度，以遏制潜在误导视觉内容的传播。然而，在本文中，我们认为当前的图像水印方法脆弱且容易被通过视觉释义攻击规避。所提出的视觉释义器分为两步。首先，利用KOSMOS-2这一最新的最先进图像字幕系统为给定图像生成标题。其次，将原始图像和生成的标题传递给图像到图像扩散系统。在扩散管道的去噪步骤中，系统生成一个在文本标题指导下的视觉相似图像。生成的图像是一种视觉释义，不含任何水印。我们的实证研究结果表明，视觉释义攻击可以有效地从图像中去除水印。本文提供了一项批判性评估，从经验上揭示了现有水印技术对视觉释义攻击的脆弱性。虽然我们并未提出解决此问题的方案，但本文呼吁科学界优先发展更加健壮的水印技术。我们首创的视觉释义数据集及相关代码已公开提供。

English

The rapid advancement of text-to-image generation systems, exemplified by models like Stable Diffusion, Midjourney, Imagen, and DALL-E, has heightened concerns about their potential misuse. In response, companies like Meta and Google have intensified their efforts to implement watermarking techniques on AI-generated images to curb the circulation of potentially misleading visuals. However, in this paper, we argue that current image watermarking methods are fragile and susceptible to being circumvented through visual paraphrase attacks. The proposed visual paraphraser operates in two steps. First, it generates a caption for the given image using KOSMOS-2, one of the latest state-of-the-art image captioning systems. Second, it passes both the original image and the generated caption to an image-to-image diffusion system. During the denoising step of the diffusion pipeline, the system generates a visually similar image that is guided by the text caption. The resulting image is a visual paraphrase and is free of any watermarks. Our empirical findings demonstrate that visual paraphrase attacks can effectively remove watermarks from images. This paper provides a critical assessment, empirically revealing the vulnerability of existing watermarking techniques to visual paraphrase attacks. While we do not propose solutions to this issue, this paper serves as a call to action for the scientific community to prioritize the development of more robust watermarking techniques. Our first-of-its-kind visual paraphrase dataset and accompanying code are publicly available.