Decoder Gradient Shields: A Family of Provable and High-Fidelity Methods Against Gradient-Based Box-Free Watermark Removal

TL;DR

This paper addresses the vulnerability of box-free watermarking decoders to gradient-based removal attacks by introducing Decoder Gradient Shields (DGSs): DGS-O (output), DGS-I (input), and DGS-L (layer). DGS-O offers a closed-form gradient reorientation using a positive definite matrix $P$, while DGS-I and DGS-L use orthogonal perturbations at the input and intermediate layers to disrupt gradient flow, all with provable performance and minimal impact on image quality. Through theoretical analysis and extensive experiments on deraining and text-to-image generation tasks, the authors demonstrate that the defense achieves near-certain protection against removal attempts and preserves fidelity metrics such as PSNR and MS-SSIM. The work provides a practical framework for deploying robust watermark verification in real-world generative systems with flexible defense options and quantified computational costs.

Abstract

Box-free model watermarking has gained significant attention in deep neural network (DNN) intellectual property protection due to its model-agnostic nature and its ability to flexibly manage high-entropy image outputs from generative models. Typically operating in a black-box manner, it employs an encoder-decoder framework for watermark embedding and extraction. While existing research has focused primarily on the encoders for the robustness to resist various attacks, the decoders have been largely overlooked, leading to attacks against the watermark. In this paper, we identify one such attack against the decoder, where query responses are utilized to obtain backpropagated gradients to train a watermark remover. To address this issue, we propose Decoder Gradient Shields (DGSs), a family of defense mechanisms, including DGS at the output (DGS-O), at the input (DGS-I), and in the layers (DGS-L) of the decoder, with a closed-form solution for DGS-O and provable performance for all DGS. Leveraging the joint design of reorienting and rescaling of the gradients from watermark channel gradient leaking queries, the proposed DGSs effectively prevent the watermark remover from achieving training convergence to the desired low-loss value, while preserving image quality of the decoder output. We demonstrate the effectiveness of our proposed DGSs in diverse application scenarios. Our experimental results on deraining and image generation tasks with the state-of-the-art box-free watermarking show that our DGSs achieve a defense success rate of 100% under all settings.

Figures (14)

• Figure 1: Flowchart of box-free model watermarking for image generative models, which is provided to users via a "Black-Box API" (query-based access). The text-to-image generation task is used as an example. Thin black arrows show the black-box querying flow (processing and watermarking), while the thick red arrow represents watermark extraction for a watermark-free image, and the thick brown arrow indicates watermark extraction for a watermarked image.
• Figure 2: Flowchart of gradient-based removal attack. The gradient backpropagated from $\mathbb{D}$ can be estimated by leveraging black-box adversarial attacks. However, to demonstrate the effectiveness of our proposed methods, we consider an attacker-friendly setting which assumes the attacker can directly obtain the gradient without estimation.
• Figure 3: Illustration of proposed orthogonality-based perturbation selection mechanism.
• Figure 4: Flowchart of the proposed DGSs in the black-box API of $\mathbb{D}$. The red arrows represent backpropagated gradients.
• Figure 5: Illustration of the three DGS-L variants applied to $\mathbb{D}$, where "S", "M", and "D" denote the shallow, middle, and deep layer implementations, respectively