Neural Watermarking: Lack of a Secret Key is still Lack of Security
Résumé
Neural watermarking has been on the rise as a simple tool for marking generated multimedia content in a robust way. This simplicity, however, comes at a cost. While it is easy to enforce robustness in a training loss through various data augmentations, it is currently unknown how to include the security aspect of watermarking. Consequently, these black-box schemes are easily breakable by targeted attacks. In this work, we show how to remove a watermark from a recently proposed WAM [16] image watermarking model. Consistent with Kerckhoffs's principle, we show that the absence of a secret key, combined with the requirement for robustness, creates an exploitable weakness. This manifests as near-periodic patterns in one principal color component of the image. We show that these patterns can be accurately estimated even from a single image, and erased by manipulating a single component of the image in its Fourier representation. Furthermore, we demonstrate that the same watermark can be manually injected, yielding noticeably higher image fidelity than when using WAM for watermarking. The code used in this work will be made available upon acceptance of the paper.
| Origine | Fichiers produits par l'(les) auteur(s) |
|---|---|
| Licence |