A Transfer Attack to Image Watermarks
Image Watermarking;Transfer Attack;AI-generated Image
Yes
No ethics review needed.
Please see Weaknesses for my primary concerns, which also include some of my suggestions/questions for the authors.
The robustness of image watermarking in no-box setting (i.e. with no access to watermarking models & with no access to detection API) is indeed a relatively overlooked area. Given that there are empirical ways to at least restrict the access to models/APIs, I consider this angle meaningful and worth investigating.

The presentation is clear enough overall and originality of this paper is not an issue.
The paper proposes a transfer attack to (learned/learning-based) image watermarking that first trains a lot of surrogate watermarking models (encoders + decoders), then uses PGD to find a perturbation to the watermarked images that would change the extracted watermarks by the surrogate watermarking models.

It is argued that such approach requires smaller perturbations to break learning-based watermarking when being compared to common post-processing such as JPEG, Gaussian noise, Gaussian blur, and Brightness/Contrast; and it is more effective than existing transfer attacks.
My primary concerns regarding this paper are:
1. **No analysis of the computational cost in comparison with existing transfer attacks, which should be discussed clearly**. I think while the proposed method definitely incur a much larger overhead compared to previous attacks, it could still be ok to highlight the risks, providing that this limitation is presented upfront in the paper. Some analysis + some empirical numbers of computation time (with the corresponding compute resources) could be helpful for illustration.

2. **The comparison of the proposed attack with existing transfer attacks is somewhat inconclusive.**
This is because, as the authors must already know, there is a trade-off between evasion rate and the visibility/budget of the attacks (perturbation in L2/perturbation in Linf/SSIM/...). Thus a good comparison should at least compare the evasion rates with **all** baselines in representative budgets (if the other baselines work in such budgets). However, the comparison in the paper claims the proposed method is better than all others because it beats some baselines when r<= 0.1, and it beats MI-CWA and DiffPure assuming a SSIM>0.9. This is a rather misleading way of comparison, as some attacks will work better under certain (metrics of) budgets but not the others.

3. **The effectiveness of the proposed method as a "no-box" attack remain unclear, specifically regarding the transferability to different watermarking methods.**
While there are experiments involving a different target watermarking method from the surrogate ones, it is worth noting that these methods are somewhat similar (or as the authors called, they are learning-based watermarking). It is claimed that the proposed method also work for non-learning based methods (figure 13), but details regarding this set of experiments, especially what are the target watermarking methods, are missing. To my understanding, there is no rule preventing the victim using a watermarking scheme that is very different or even designed to be different from the ones used by the attacker as surrogates. This is not a deal breaker but such discussion seems to be missing.
Yes
No ethics review needed.
Please see the weaknesses.
1. This paper is well-written with clear motivation. The no-box setting is practical.
2. The experiments and theoretical results support their claims and method design.
3. The transfer results are effective against several learning-based watermarking systems.
This paper proposed an evasion attack to interfere with the detection of watermarked images under the no-box setting, i.e. the attacker has no access to the watermark detector. They approach the objective through the transfer attack, where they train surrogate watermark models and find adversarial perturbation to fool the detection of local surrogate models. Both theoretical analysis and empirical evidence demonstrate that this transfer attack method can successfully undermine the detection capabilities of learning-based watermark systems across various watermarking scenarios.
1. While I acknowledge the authors have assumed that the attackers should have sufficient computational resources, the main concern of this paper is the computational cost. The costs associated with both surrogate models and perturbation discovery are large which prevents the practical usage of this method.  
2. For the transfer attack to a specific architecture such as ResNet-18, did you use a similar architecture in your surrogate models, for instance, ResNet-X? Besides, have you considered attacks with totally different architectures, such as transformer-based watermark models?
3. Another weakness of this paper is that the transfer attack primarily focuses on learning-based watermarks, neglecting non-learning-based watermark variants that may exhibit greater robustness than the baselines discussed here, such as variants of Tree-Ring [1][2], etc. Besides, can the proposed method attack the 0-bit watermark? 
The cost of attacks escalates significantly with complex architectures a
4. The attack cost is significantly increased with complex architectures and longer watermarks. This poses a hindrance to the practical implementation of transfer attacks involving high-capacity watermarks [3].

[1] RingID: Rethinking Tree-Ring Watermarking for Enhanced Multi-Key Identification

[2] Gaussian Shading: Provable Performance-Lossless Image Watermarking for Diffusion Models

[3] A Robust Image Watermarking System Based on Deep Neural Networks
Yes
No ethics review needed.
See weakness
This paper presents a practical attack effective across multiple watermarking methods
The issue of watermarking the outputs of generative models is timely and interesting.
This paper demonstrates that watermark-based detection methods for AI-generated images are vulnerable to transfer attacks in a no-box setting. Specifically, an attacker can effectively remove the watermark from a given watermarked image by applying a perturbation, which can be identified through ensembling multiple surrogate watermarking models.
To ensure high image quality, the L infinity bound on perturbations should be kept low, as higher values (e.g., 0.2 as shown in Figures 3 and 4) can noticeably degrade image quality, reducing practicality. For a more realistic assessment, the paper should include comparisons using a set of small enough  L infinity bound (such as 0.03, 0.05) bounds to demonstrate the proposed method’s effectiveness under conditions that minimize visible impact.
If Section 5 is one of the paper’s main contributions, it would be better placed in the main text rather than in the appendix.
Yes
The proposed method might be used to compromise the identity and authenticity of AI-generated images. Therefore, a discussion of potential negative societal influence and possible mitigation approaches is suggested to be included.
Yes, Privacy, security and safety Yes, Legal compliance (e.g., GDPR, copyright, terms of use)
Please see the weakness section above.
1. The paper is well-written and easy to follow.
2. This paper proposed an intuitive yet attractive method that seems work very well in the experimental studies. 
3.  The experimental studies are comprehensive.
This paper develops an attack that evades a target image watermarking detector, without acquiring the access to this detector's model or API. The proposed method adds a perturbation trained to mislead multiple surrogate detector models, and hopes that this perturbation can transfer to the target detector and therefore succeed. The experiment results on various datasets demonstrate the effectiveness of the proposed method, which outperforms many existing attacks and post-processing methods.
**Major Concerns:**

1. Theoretical contributions. While authors provide some theoretical analysis, I think the current results are not sufficient to be claimed as signficant. The reasons are as follows:
(1) It is in doubt whether those independence assumptions will hold. As $\delta$ is obtained by solving Eq. (3), which optimizes the chances that $m$ decoders will extract carefully designed watermarks from an image perturbed by $\delta$, it is likely that coordinates of decoders' output is correlated. The authors may want to provide additional envidence to validate their assumptions.
(2) The analysis only applies to inverse-decode. 
(3) The bound given by the theorems are not available in practice. Recall that this paper considers the setting where $T$ and its output is unknown to the attacker. In the meanwhile, the parameters including $a, b,\beta, p$ involves the unknown target decoder $T$ and unknown data distribution.

2. Empirical results. The empirical results are impressive, and it raises my question why it significantly outperforms SOTA methods? Could the author provide any justification and insight for the superior performance of the proposed method?


**Minor Concerns:**

1. Since the proposed method has to train a bunch of surrogate models, will it be computationally expensive? Also, every time this algorithm has to solve Eq. (3), which may also be expensive. The authors may want to add a table comparing the FLOPs and time used by different methods.
@inproceedings{
anonymous2024a,
title={A Transfer Attack to Image Watermarks},
author={Anonymous},
booktitle={Submitted to The Thirteenth International Conference on Learning Representations},
year={2024},
url={https://openreview.net/forum?id=UchRjcf4z7},
note={under review}
}
Watermark has been widely deployed by industry to detect AI-generated images. The robustness of such watermark-based detector against evasion attacks in the white-box and black-box settings is well understood in the literature. However, the robustness in the no-box setting is much less understood. In this work, we propose a new transfer evasion attack to image watermark in the no-box setting. Our transfer attack adds a perturbation to a watermarked image to evade multiple surrogate watermarking models trained by the attacker itself, and the perturbed watermarked image also evades the target watermarking model.  Our major contribution is to show that, both theoretically and empirically,  watermark-based AI-generated image detector is not robust to evasion attacks  even if the attacker does not have access to the watermarking model nor the detection API.
I certify that there is no URL (e.g., github page) that could be used to find authors’ identity.
I acknowledge that I and all co-authors of this work have read and commit to adhering to the ICLR Code of Ethics.
Image Watermarking Transfer Attack AI-generated Image
I certify that there is no acknowledgement section in this submission for double blind review.
/pdf/a561e3ba1438e277ef57b52d9e268de5e665c21b.pdf
alignment, fairness, safety, privacy, and societal considerations
I understand the reciprocal reviewing requirement as described on https://iclr.cc/Conferences/2025/CallForPapers. If none of the authors are registered as a reviewer, it may result in a desk rejection at the discretion of the program chairs. To request an exception, please complete this form at https://forms.gle/Huojr6VjkFxiQsUp6.
I certify that this submission complies with the submission instructions as described on https://iclr.cc/Conferences/2025/AuthorGuide.
A Transfer Attack to Image Watermarks
ICLR 2025 Conference Submission
ICLR.cc/2025/Conference/Submission