Peccavi：面向AI生成图像的无失真视觉改写攻击安全水印技术

Peccavi: Visual Paraphrase Attack Safe and Distortion Free Image Watermarking Technique for AI-Generated Images

June 28, 2025

作者: Shreyas Dixit, Ashhar Aziz, Shashwat Bajpai, Vasu Sharma, Aman Chadha, Vinija Jain, Amitava Das

cs.AI

摘要

欧盟执法机构的一份报告预测，到2026年，高达90%的在线内容可能由合成生成，这一趋势引发了政策制定者的担忧。他们警告称，“生成式AI可能成为政治虚假信息的倍增器。生成文本、图像、视频和音频的综合效应，可能超越任何单一模态的影响力。”对此，加利福尼亚州的AB 3211法案要求对AI生成的图像、视频和音频进行水印标记。然而，人们仍担忧隐形水印技术易受篡改，以及恶意行为者可能完全绕过这些水印。特别是新引入的视觉转述攻击，生成式AI驱动的去水印攻击已展现出完全去除水印的能力，导致原始图像的转述。本文介绍了PECCAVI，首个能抵御视觉转述攻击且无失真的图像水印技术。在视觉转述攻击中，图像被修改的同时保留了其核心语义区域，称为非融化点（NMPs）。PECCAVI策略性地将水印嵌入这些NMPs中，并采用多通道频域水印技术。它还引入了噪声打磨，以对抗旨在定位NMPs以破坏嵌入水印的反向工程努力，从而增强耐久性。PECCAVI与模型无关。所有相关资源和代码将开源。

English

A report by the European Union Law Enforcement Agency predicts that by 2026, up to 90 percent of online content could be synthetically generated, raising concerns among policymakers, who cautioned that "Generative AI could act as a force multiplier for political disinformation. The combined effect of generative text, images, videos, and audio may surpass the influence of any single modality." In response, California's Bill AB 3211 mandates the watermarking of AI-generated images, videos, and audio. However, concerns remain regarding the vulnerability of invisible watermarking techniques to tampering and the potential for malicious actors to bypass them entirely. Generative AI-powered de-watermarking attacks, especially the newly introduced visual paraphrase attack, have shown an ability to fully remove watermarks, resulting in a paraphrase of the original image. This paper introduces PECCAVI, the first visual paraphrase attack-safe and distortion-free image watermarking technique. In visual paraphrase attacks, an image is altered while preserving its core semantic regions, termed Non-Melting Points (NMPs). PECCAVI strategically embeds watermarks within these NMPs and employs multi-channel frequency domain watermarking. It also incorporates noisy burnishing to counter reverse-engineering efforts aimed at locating NMPs to disrupt the embedded watermark, thereby enhancing durability. PECCAVI is model-agnostic. All relevant resources and codes will be open-sourced.