High-Frequency Matters: Attack and Defense for Image-Processing Model Watermarking

Chen, H; Zhu, T; Liu, C; Yu, S; Zhou, W

High-Frequency Matters: Attack and Defense for Image-Processing Model Watermarking

Chen, H Zhu, T Liu, C Yu, S

Zhou, W

Permalink

Publisher:: Institute of Electrical and Electronics Engineers (IEEE)
Publication Type:: Journal Article
Citation:: IEEE Transactions on Services Computing, 2024, 17, (4), pp. 1565-1579
Issue Date:: 2024-01-01

Closed Access

	Filename	Description	Size
	1699917.pdf	Published version	13.58 MB	Adobe PDF	View/Open

Copyright Clearance Process

Recently Added
In Progress
Closed Access

This item is closed access and not available.

Full metadata record

Field	Value	Language
dc.contributor.author	Chen, H
dc.contributor.author	Zhu, T
dc.contributor.author	Liu, C
dc.contributor.author	Yu, S https://orcid.org/0000-0003-4485-6743
dc.contributor.author	Zhou, W
dc.date.accessioned	2024-08-21T05:30:24Z
dc.date.available	2024-08-21T05:30:24Z
dc.date.issued	2024-01-01
dc.identifier.citation	IEEE Transactions on Services Computing, 2024, 17, (4), pp. 1565-1579
dc.identifier.issn	2372-0204
dc.identifier.issn	1939-1374
dc.identifier.uri	http://hdl.handle.net/10453/180481
dc.description.abstract	In recent years, there has been significant advancement in the field of model watermarking techniques. However, the protection of image-processing neural networks remains a challenge, with only a limited number of methods being developed. The objective of these techniques is to embed a watermark in the output images of the target generative network, so that the watermark signal can be detected in the output of a surrogate model obtained through model extraction attacks. This promising technique, however, has certain limits. Analysis of the frequency domain reveals that the watermark signal is mainly concealed in the high-frequency components of the output. Thus, we propose an overwriting attack that involves forging another watermark in the output of the generative network. The experimental results demonstrate the efficacy of this attack in sabotaging existing watermarking schemes for image-processing networks with an almost 100% success rate. To counter this attack, we propose an adversarial framework for the watermarking network. The framework incorporates a specially-designed adversarial training step, where the watermarking network is trained to defend against the overwriting network, thereby enhancing its robustness. Additionally, we observe an overfitting phenomenon in the existing watermarking method, which can render it ineffective. To address this issue, we modify the training process to eliminate the overfitting problem.
dc.language	en
dc.publisher	Institute of Electrical and Electronics Engineers (IEEE)
dc.relation	http://purl.org/au-research/grants/arc/DP230100246
dc.relation.ispartof	IEEE Transactions on Services Computing
dc.relation.isbasedon	10.1109/TSC.2024.3349784
dc.rights	info:eu-repo/semantics/closedAccess
dc.subject	0803 Computer Software, 0805 Distributed Computing, 0806 Information Systems
dc.subject.classification	4606 Distributed computing and systems software
dc.subject.classification	4609 Information systems
dc.title	High-Frequency Matters: Attack and Defense for Image-Processing Model Watermarking
dc.type	Journal Article
utslib.citation.volume	17
utslib.for	0803 Computer Software
utslib.for	0805 Distributed Computing
utslib.for	0806 Information Systems
pubs.organisational-group	University of Technology Sydney
pubs.organisational-group	University of Technology Sydney/Faculty of Engineering and Information Technology
pubs.organisational-group	University of Technology Sydney/Strength - AAII - Australian Artificial Intelligence Institute
pubs.organisational-group	University of Technology Sydney/Faculty of Engineering and Information Technology/School of Computer Science
pubs.organisational-group	University of Technology Sydney/Strength - CCSP - Centre for Cyber Security and Privacy
pubs.organisational-group	University of Technology Sydney/All Manual Groups
pubs.organisational-group	University of Technology Sydney/All Manual Groups/Centre for Cyber Security and Privacy (CCSP)
utslib.copyright.status	closed_access	*
dc.date.updated	2024-08-21T05:30:10Z
pubs.issue	4
pubs.publication-status	Published
pubs.volume	17
utslib.citation.issue	4

Abstract:

In recent years, there has been significant advancement in the field of model watermarking techniques. However, the protection of image-processing neural networks remains a challenge, with only a limited number of methods being developed. The objective of these techniques is to embed a watermark in the output images of the target generative network, so that the watermark signal can be detected in the output of a surrogate model obtained through model extraction attacks. This promising technique, however, has certain limits. Analysis of the frequency domain reveals that the watermark signal is mainly concealed in the high-frequency components of the output. Thus, we propose an overwriting attack that involves forging another watermark in the output of the generative network. The experimental results demonstrate the efficacy of this attack in sabotaging existing watermarking schemes for image-processing networks with an almost 100% success rate. To counter this attack, we propose an adversarial framework for the watermarking network. The framework incorporates a specially-designed adversarial training step, where the watermarking network is trained to defend against the overwriting network, thereby enhancing its robustness. Additionally, we observe an overfitting phenomenon in the existing watermarking method, which can render it ineffective. To address this issue, we modify the training process to eliminate the overfitting problem.

Please use this identifier to cite or link to this item:

http://hdl.handle.net/10453/180481