Search papers, labs, and topics across Lattice.
The paper introduces AdvMark, a two-stage fine-tuning framework for robust image watermarking that decouples defense strategies against adversarial, distortion, and regeneration attacks. AdvMark first fine-tunes the encoder with a tailored adversarial training paradigm, conditionally updating the decoder to improve robustness against adversarial attacks while preserving clean accuracy. The second stage tackles distortion and regeneration attacks through constrained image optimization, balancing deviation from cover and previously encoded images with a quality-aware early-stopping mechanism to maintain visual quality and adversarial robustness.
Image watermarks can now withstand a barrage of adversarial, distortion, and regeneration attacks, thanks to a decoupled training strategy that boosts robustness by up to 46% without sacrificing image quality.
Deep learning-based image watermarking, while robust against conventional distortions, remains vulnerable to advanced adversarial and regeneration attacks. Conventional countermeasures, which jointly optimize the encoder and decoder via a noise layer, face 2 inevitable challenges: (1) decrease of clean accuracy due to decoder adversarial training and (2) limited robustness due to simultaneous training of all three advanced attacks. To overcome these issues, we propose AdvMark, a novel two-stage fine-tuning framework that decouples the defense strategies. In stage 1, we address adversarial vulnerability via a tailored adversarial training paradigm that primarily fine-tunes the encoder while only conditionally updating the decoder. This approach learns to move the image into a non-attackable region, rather than modifying the decision boundary, thus preserving clean accuracy. In stage 2, we tackle distortion and regeneration attacks via direct image optimization. To preserve the adversarial robustness gained in stage 1, we formulate a principled, constrained image loss with theoretical guarantees, which balances the deviation from cover and previous encoded images. We also propose a quality-aware early-stop to further guarantee the lower bound of visual quality. Extensive experiments demonstrate AdvMark outperforms with the highest image quality and comprehensive robustness, i.e. up to 29\%, 33\% and 46\% accuracy improvement for distortion, regeneration and adversarial attacks, respectively.
Tsinghua AI