The Brittleness of AI-Generated Image Watermarking Techniques: Examining Their Robustness Against Visual Paraphrasing Attacks

TL;DR

This work investigates the brittleness of state-of-the-art AI-generated image watermarking against visual paraphrase attacks. It introduces a two-step visual paraphraser using KOSMOS-2 captioning and image-to-image diffusion to produce paraphrased, watermark-free images and benchmarks multiple watermarking methods across three datasets. The results show broad vulnerability among static and learning-based watermarks, with Gaussian Shading and Tree Ring offering relatively stronger resilience, and it provides a public dataset and code to benchmark robustness. The findings highlight the urgent need for more robust watermarking techniques and encourage ongoing research, while addressing ethical considerations surrounding potential misuse.

Abstract

The rapid advancement of text-to-image generation systems, exemplified by models like Stable Diffusion, Midjourney, Imagen, and DALL-E, has heightened concerns about their potential misuse. In response, companies like Meta and Google have intensified their efforts to implement watermarking techniques on AI-generated images to curb the circulation of potentially misleading visuals. However, in this paper, we argue that current image watermarking methods are fragile and susceptible to being circumvented through visual paraphrase attacks. The proposed visual paraphraser operates in two steps. First, it generates a caption for the given image using KOSMOS-2, one of the latest state-of-the-art image captioning systems. Second, it passes both the original image and the generated caption to an image-to-image diffusion system. During the denoising step of the diffusion pipeline, the system generates a visually similar image that is guided by the text caption. The resulting image is a visual paraphrase and is free of any watermarks. Our empirical findings demonstrate that visual paraphrase attacks can effectively remove watermarks from images. This paper provides a critical assessment, empirically revealing the vulnerability of existing watermarking techniques to visual paraphrase attacks. While we do not propose solutions to this issue, this paper serves as a call to action for the scientific community to prioritize the development of more robust watermarking techniques. Our first-of-its-kind visual paraphrase dataset and accompanying code are publicly available.

Figures (10)

• Figure 1: The proposed visual paraphraser operates in two steps. First, it generates a caption for the given image using KOSMOS-2 peng2023kosmos2. Second, it passes both the original image and the generated caption to an image-to-image diffusion system. During the denoising step of the diffusion pipeline, the system generates a visually similar image that is guided by the text caption. The resulting image is a visual paraphrase and is free of any watermarks.
• Figure 2: Meta recently announced their strategies fbLabelingAIGenerated to combat AI-generated misinformation, including a proposal to place visible markers on images. However, we argue that these visible markers are easily detectable and can be removed or altered using image inpainting techniques zeng2020highresolutionimageinpaintingiterative, which involve reconstructing missing regions in an image. In Image (a), the original image from Meta's blog is shown, while Images (b), (c), and (d) demonstrate how image inpainting can generate different versions of the image with the markers effectively removed or replaced. Therefore, visible markers cannot be considered a reliable countermeasure in the era of generative AI.
• Figure 3: Watermarking techniques are generally classified into two categories: (i) static (i.e., non-learning) watermarking methods and (ii) learning-based (dynamic) watermarking methods. Static watermarking includes both invisible and visible types, while learning-based techniques represent the state-of-the-art. Although static watermarking techniques are mostly outdated and seldom used, we selected the latest method, DwtDctSVD dctdw, for comparison. Other static methods are discussed solely for literature review purposes. Learning-based watermarking techniques are more modern, and we tested all the listed methods against visual paraphrase attacks.
• Figure 4: Impact of paraphrasing strength ($s$) and guidance scale ($gs$) on Visual Paraphrasing: A higher strength $s$ allows for greater deviation from the original image, while a lower strength preserves more of the original details. The guidance scale $gs$ controls adherence to the text prompt, with higher values enforcing closer alignment to the prompt and lower values permitting more creative variations.
• Figure 5: This figure shows the variation of CMMD jayasumana2024rethinking and detectability of visual paraphrases with respect to strength and guidance scale. represents the optimal $s$ and $gs$ value for the particular technique. The images were watermarked using Tree Ring Watermarking wen2023treering and Stable Signature fernandez2023stable.