# High-frequency Matters: An Overwriting Attack and defense for Image-
processing Neural Network Watermarking

Huajie Chen, Tianqing Zhu*, Chi Liu, Shui Yu, and Wanlei Zhou *Tianqing Zhu is
the corresponding author.Huajie Chen, Tianqing Zhu, Chi Liu, and Shui Yu are
with the Centre for Cyber Security and Privacy and the School of Computer
Science, University of Technology Sydney, Sydney, NSW 2007, Australia (e-mail:
<EMAIL_ADDRESS><EMAIL_ADDRESS><EMAIL_ADDRESS>shui.yu@uts.edu.au;).Wanlei Zhou is with the
Institute of Data Science, City University of Macau, Macao SAR, China (e-mail:
wlzhou@cityu.edu.mo).

###### Abstract

In recent years, there has been significant advancement in the field of model
watermarking techniques. However, the protection of image-processing neural
networks remains a challenge, with only a limited number of methods being
developed. The objective of these techniques is to embed a watermark in the
output images of the target generative network, so that the watermark signal
can be detected in the output of a surrogate model obtained through model
extraction attacks. This promising technique, however, has certain limits.
Analysis of the frequency domain reveals that the watermark signal is mainly
concealed in the high-frequency components of the output. Thus, we propose an
overwriting attack that involves forging another watermark in the output of
the generative network. The experimental results demonstrate the efficacy of
this attack in sabotaging existing watermarking schemes for image-processing
networks with an almost 100% success rate. To counter this attack, we propose
an adversarial framework for the watermarking network. The framework
incorporates a specially-designed adversarial training step, where the
watermarking network is trained to defend against the overwriting network,
thereby enhancing its robustness. Additionally, we observe an overfitting
phenomenon in the existing watermarking method, which can render it
ineffective. To address this issue, we modify the training process to
eliminate the overfitting problem.

###### Index Terms:

Model Watermarking, Deep Steganography, Attack and defense, Image Processing.

##  I Introduction

Training a high-performing deep learning model is incredibly costly, which
consumes a massive amount of computational resources along with electricity,
human resources, etc. In fact, training such models is so time-consuming and
expensive, that stealing a model is comparatively much simpler and cheaper.
Beyond directly copying an original model and simply claiming its ownership,
there are several genres of deep learning model theft. These include model
fine-tuning [1, 2, 3], model pruning[4, 5, 6], and knowledge distillation. In
the face of this many potential threats, model owners have sought ways to
protect their intellectual properties, and one such method is model
watermarking. Model watermarking is a brand-new technique that embeds a
traceable digital watermark into a deep learning model. As such, it offers a
promising way to model copyright protection.

The first attempt at model watermarking was made in 2017 by Yusuke Uchida et
al. [7], who proposed a method of embedding a watermark into a deep learning
model. The watermark was designed to verify ownership of the model given
white-box access. Since then, several exemplary works [8, 9, 10] have emerged
to provide better protection for deep learning models in different scenarios
up to today, where even black-box attacks can be effectively prevented.

Figure 1: Attack workflow: The adversary sends the input image to the
watermarked image-processing model to derive the watermarked output. If it
trains a surrogate model directly with the input image and the watermarked
output, the surrogate model will contain the watermark information. By
overwriting the watermarked output, it removes the watermark in the output set
and forges its own watermark inside the overwritten output. Finally, a
watermark-free surrogate model can be trained. Figure 2: Defense workflow:
After embedding the watermark, an overwriting network performs an overwriting
attack that yields an overwritten image that is then fed to the retrieval
network. The retrieval network is then required to retrieve a valid recovered
watermark from the overwritten image. Together, these networks form the
defense network.

However, most model watermarking approaches are designed to protect
classification models; methods that work for image-processing models are few
and far between. In short, an image-processing model takes images as its input
and outputs modified images, which is quite unlike a classification model that
takes in images and simply outputs the digits of a category. In 2020, Zhang et
al. [11] proposed a framework to watermark image-processing neural networks,
which, to the best of our knowledge, was the first work in image-processing
model watermarking. Essentially, Zhang’s work combines model watermarking with
deep steganography so as to forcibly embed watermark information in the
outputs of the released models. Deep steganography is a technique that uses
deep learning models to hide a secret image completely within a cover image,
such that it is invisible to the naked human eye. The image containing the
embedded secret image is called the container image. By releasing a set of
processed images containing a hidden watermark, any attacker intending to
steal the model is compelled to train their own watermarked model.
Subsequently, Quan et al. [12] devised another image-processing model
watermarking scheme that takes a backdoor watermarking approach. Briefly, the
watermarked model functions normally when it receives normal input images.
When it receives a noise trigger input, it outputs a pre-defined watermark to
validate ownership. Even though recent studies show that steganography plays
an essential role in the protection of images, this type of approach might
still vulnerable to attacks.

In fact, our study shows that current watermarking methods for image-
processing models are not adequately robust. For example, we find that, due to
the properties of deep steganography, watermarking with image-processing
models is vulnerable to changes in the frequency domain, especially the high-
frequency domain. To outline what we mean, we devise an overwriting attack
method that shows how existing image-processing model watermarking methods,
and even deep steganography itself can be nullified. Having designed the
attack, we also designed a defense against it that promises to guarantee the
safety of deep learning models. The defense method mitigates the overwriting
attack through a new adversarial training framework that combines a
watermarking method with the overwriting attack.

The general workflow of the attack is described in Figure 1. Here, a released
image-processing deep learning model is watermarked such that every image it
outputs contains an invisible watermark. If an attacker tries to train a
surrogate model via knowledge distillation, the surrogate model will carry the
watermark information automatically. However, in our attack, we train an
overwriting network that overwrites the embedded watermark in the output from
the watermarked model. A surrogate model is also trained with the overwritten
output and the input image sets. Thus, the watermark is nullified, for the
original watermark can no longer be retrieved from the output of the surrogate
model.

To effectively counter the overwriting attack, we propose an adversarial
training framework that deliberately incorporates an overwriting network to
enhance the robustness of the watermarking network. Figure 2 demonstrates.
Briefly, an overwriting network is trained along with a watermarking network,
which together form a defense network. There is an adversarial training
process, where the overwriting network tries to overwrite the watermark in the
container image so that the retrieval network in the watermarking network
cannot retrieve a valid recovered watermark from it. In contrast, the
watermarking network tries to retrieve a valid recovered watermark even if the
container image has been overwritten. This competitive process significantly
boosts the robustness of the watermarking network.

Overall, our contributions are as follows:

  1. i)

Through frequency analysis, we have unraveled where a secret image signal is
embedded in a container image. Accordingly, we devised a possible attack to
nullify the currently existing image-processing model watermarking methods.

  2. ii)

We devised a corresponding defense method based on adversarial training that
counters the proposed attack method with a new adversarial training framework
to protect the image-processing network.

  3. iii)

We discovered an overfitting problem with the current watermarking method for
protecting image-processing models that will nullify the protection, and fixed
it by modifying the training process.

The rest of this paper is organized as follows. In section II, we demonstrate
the preliminaries by listing the notations used in the context and
illustrating the background and related works. We then describe our proposed
method in detail in Section III. Our experiment processes and results are
presented in Section IV, and they are analyzed and discussed in Section V.
Lastly, we draw a conclusion about this work in Section VI.

##  II Preliminary

TABLE I: Notations Notation | Definition
---|---
$\mathcal{U}$ |  The overwriting network.
$\mathcal{O}$ |  The defense network.
$\mathcal{E}$ |  An embedding network that embeds a secret image into a cover image to yield a container image.
$\mathcal{R}$ |  A retrieval network that retrieves a recovered secret image from a container image.
$\mathcal{D}$ |  A discriminator network that identifies whether or not a given image contains hidden content.
$\mathcal{E}_{\mathcal{U}}$ |  The overwriting embedding network.
$\mathcal{R}_{\mathcal{U}}$ |  The overwriting retrieval network.
$H$ |  The original and watermark-free image-processing model.
$H^{\prime}$ |  A surrogate model mimicking $H$, but trained on a watermarked dataset.
$H_{0}$ |  A surrogate model mimicking $H$, but trained on a watermark-free dataset.
$A$ |  A set of images for the image-processing network to process.
$B$ |  A set of processed images originating from $A$.
$B^{\prime}$ |  A set of watermarked and processed images, originating from $B$.
$B^{\prime\prime}$ |  A set of noisy output images from, originating from $B$.
$B_{\mathcal{U}}$ |  A set of watermarked and processed images, but having suffered from the overwriting attack.
$B_{0}$ |  A set of processed images from a surrogate model that is not trained on the watermarked dataset.
$C/c$ |  A set of cover images/a cover image for concealing secrets.
$C^{\prime}/c^{\prime}$ |  A set of container images/a container image where secrets are hidden inside.
$S/s$ |  A set of secret images/a secret image to hide.
$S^{\prime}/s^{\prime}$ |  A set of recovered secret images/a recovered secret image.
$w$ |  A watermark.
$w^{\prime}$ |  A recovered watermark.
$w_{0}$ |  A pure black null image.
$c^{\prime}$ |  A container image that contains a watermark.
$x$ |  An arbitrary image that is the same size as $c^{\prime}$
$x^{\prime}$ |  A recovered image originating from $x$.
$\epsilon$ |  A tolerable error range of a recovered secret image.
$\mathcal{L}$ |  A loss function.
$\lambda$ |  A weight parameter for a regularizer in the loss function.

###  II-A Watermarking & Deep Learning

Watermarking is a powerful method for object authentication and ownership
validation. It has established strong ties with deep learning in recent times.
To provide a comprehensive overview of these interactions, we have categorized
them into two main categories: model watermarking and image watermarking using
deep learning. For the reader’s convenience, a list of all the notations used
in the subsequent sections can be found in Table I.

####  II-A1 Model watermarking

The existing techniques for model watermarking can be classified into three
categories: model weight watermarking, backdoor watermarking, and active
watermarking.

In model weight watermarking, as described in [7], the watermark is embedded
into the model’s weight parameters during the training process. To retrieve
the watermark, one needs complete access to the model’s internal structure,
which is often not feasible in real-world scenarios. Furthermore, these
methods are not highly resilient against attacks such as model pruning, fine-
tuning, and knowledge distillation.

Backdoor watermarking, as discussed in [9], involves the deliberate alteration
of a portion of the training data to create an overfitted model. This portion
is referred to as the trigger dataset and can be used to validate the
ownership of a suspect model. If the majority of the trigger data result in
the suspect model producing the watermark labels, the model’s ownership can be
confirmed with just black-box access. Compared to model weight watermarking,
this method is more robust against the previously mentioned attacks.

On the other hand, active watermarking methods aim to prevent model theft
proactively. For instance, Tang et al. [13] proposed a method that requires
the user to enter a valid serial number before using the desired model. This
model is a student model derived from a teacher model and functions correctly
only with a valid serial number. Although this approach is proactive in nature
and protects the model, a malicious entity can still crack the serial number
generator and propagate the stolen model.

####  II-A2 Image watermarking via deep learning

Image watermarking methods that leverage deep learning can be further
categorized into auto-encoder image watermarking and generative adversarial
network image watermarking.

Auto-encoder image watermarking, first introduced by Baluja in [14], involves
the use of an embedding network and a retrieval network. The embedding network
embeds a watermark or secret image into a cover image to produce a container
image that is visually similar to the cover image. The retrieval network then
retrieves the watermark from the container image with a tolerable error range.
While these methods achieve high perceptual quality, they are susceptible to
steganalysis, a detection attack that identifies hidden content in an image.
Additionally, the container images generated by these methods lack robustness
against distortions and malicious attacks that can result in damage or removal
of the hidden content.

Generative adversarial network image watermarking is similar to auto-encoder
image watermarking, but with the addition of a discriminator in the framework.
During adversarial training, the discriminator is trained to detect hidden
content in any image, while the embedding network is tasked with deceiving the
discriminator with the container images it generates. This enhances the
covertness of the container images against steganalysis. However, they remain
vulnerable to distortions during transmission and malicious attacks, such as
JPEG compression and overwriting attacks.

###  II-B Related Work

Figure 3: Framework of the Watermarking Network: Starting from the very left,
the embedding network is trained to embed a watermark into a processed image
set so as to yield a watermarked image set. An adversary trains a surrogate
model with a set of raw images and the watermarked image set, and thus the
surrogate model carries the watermark information. Every time when the
surrogate model yields a set of noisy output, the retrieval network is able to
retrieve a recovered watermark from the noisy output to validate the model’s
ownership.

Watermarking is a powerful method for safeguarding intellectual property and
preventing copyright infringement in various domains, including image
protection [15], audio [16] and video files [17]. By embedding unique and
imperceptible marks within the intellectual property, the watermark serves as
evidence of ownership and can be used in legal proceedings to defend against
infringement claims. Despite having a long history of use, watermarking is a
relatively new application in the realm of deep learning models.

In 2017, Uchida et al. [7] introduced a novel method for embedding a watermark
into the weight parameters of a model, which was considered to be the first
attempt at using watermarking techniques for the protection of intellectual
property in neural networks. Despite its pioneering efforts, the method’s
validity in proving ownership required complete access to the parameters, or
white-box access, which made it not practical for real-world scenarios.
Furthermore, its robustness to different types of attacks was subject to
improvement.

Rouhani et al. [8] then proposed a watermarking framework that provides
protection against fine-tuning, pruning, and overwriting of watermarks in both
white-box and black-box scenarios. This approach was more robust to attacks,
however, it was not capable of preventing knowledge distillation attacks.
Szyller et al. [9] then introduced an approach that was capable of countering
all types of attacks, including knowledge distillation, by making a portion of
the output from the watermarked model deliberately false. This strategy forces
the surrogate model to include the watermark information by overfitting the
falsified labels, thus representing a trade-off between robustness and
accuracy.

It is worth noting that all of these methods, including the one proposed by
Szyller et al., work in a passive manner to defend against attacks, as the
watermarks only serve to prove ownership after a copyright violation has
already occurred, rather than preventing the violation from happening in the
first place. Furthermore, these methods, along with most other model
watermarking methods, are designed for classification models, with only a
limited number of watermarking methods available for image-processing models.

In 2020, Zhang et al. proposed a watermarking method for image-processing deep
learning models [11]. This method is the first of its kind and incorporates
the concept of deep steganography, which is the technique of hiding
information in such a way that it is not detected. The method fuses
imperceptible image watermarking with model watermarking, making it effective
against black-box knowledge distillation attacks. The technique of
steganography has a long history, dating back centuries, and has been utilized
in different domains. Baluja first introduced the use of a deep learning model
for image steganography in 2017 [14]. The method involves hiding one image
within another image in such a way that it is not visible to the naked eye.

Several advancements have been made in the field of deep steganography since
then, with Wu et al. designing a framework to perform end-to-end deep
steganography [18] and Zhang et al. developing a framework to hide an
arbitrary image within another image [19]. In [20], an image watermarking
method was merged with the image-generative network, using deep steganography
to prevent the model from being misused.

However, as deep steganography evolves, so do the attacks. Traditional attacks
on steganography include image resizing, cropping, distortion, and
compression, as illustrated in Hosam’s work [21]. Additionally, deep learning
has been utilized to perform these attacks, as seen in Boroumand et al.’s work
[22], where a deep convolution neural network (DCNN) framework was proposed to
perform deep steganalysis. Corley et al. [23] designed a framework based on a
generative adversarial network (GAN) with significant performance that is
capable of purging secret images hidden in container images. Thus, similar to
the battles between attacks and defenses in model watermarking, intense
battles also exist in image watermarking through deep steganography.

##  III Method – Attack and defense

Figure 4: Framework of the Overwriting Network: The overwriting network is
trained to embed an arbitrary image, or, a watermark, into a container image
so as to yield a overwritten image. The overwriting also contains a retrieval
network that is able to retrieve the recovered image, whereas the retrieval
network in the watermarking network can only retrieve a null image from the
overwritten image.

###  III-A Attack Analysis

In the current watermarking method for image-processing neural networks, deep
steganography is seamlessly integrated with model watermarking. The
watermarking process is composed of two key components, an embedding network
$\mathcal{E}$ and a retrieval network $\mathcal{R}$. As illustrated in Figure
3, the watermarking process begins by training $\mathcal{E}$ and $\mathcal{R}$
on a set of processed images, $B$, and a watermark image, $w$. The embedding
network $\mathcal{E}$ then embeds the watermark image $w$ into each image
$b_{i}$ in the set $B$ to produce a watermarked image set, $B^{\prime}$. This
process is denoted as

$\displaystyle B^{\prime}=\mathcal{E}(B,w).$ (1)

In the event of the presence of an adversary, they will only have access to
the unprocessed image set $A$, and the watermarked processed image set
$B^{\prime}$. The adversary can then train a surrogate model, denoted as
$H^{\prime}$, using $A$ and $B^{\prime}$, such that the model learns to
produce processed images with watermarks similar to those in $B^{\prime}$.
Finally, the retrieval network $\mathcal{R}$ should be capable of retrieving a
recovered watermark $w^{\prime}$ from both the original watermarked image set
$B^{\prime}$ and the noisy output set $B^{\prime\prime}$ produced by the
surrogate model $H^{\prime}$, denoted as

$\displaystyle w^{\prime}=\mathcal{R}(b^{\prime}),\text{ s.t.
}w^{\prime}=w+\epsilon,\textit{ iff }b^{\prime}\in B^{\prime}\cup
B^{\prime\prime},$ (2)

where $\epsilon$ represents a tolerable error range. Meanwhile, if
$\mathcal{R}$ receives a watermark-free image $x$ as input, $\mathcal{R}$ will
yield a null image $w_{0}$ that is purely dark, denoted as

$\displaystyle w_{0}=\mathcal{R}(x),\forall\ x\not\in B^{\prime}\cup
B^{\prime\prime}.$ (3)

However, deep steganography is vulnerable to perturbations in the frequency
domain, as highlighted in the work of Zhang et al. [24]. This motivates us to
explore an overwriting attack on the watermarked image set $B^{\prime}$. The
objective of the attack is to generate an overwritten image set
$B_{\mathcal{U}}$ such that the retrieval network $\mathcal{R}$ is unable to
retrieve a valid watermark from $B_{\mathcal{U}}$ or from the outputs of a
surrogate model $H^{\prime}$ trained on $B_{\mathcal{U}}$. The objective of
this attack is denoted as

$\displaystyle\forall\ b_{u}\in B_{\mathcal{U}}\cup
B^{\prime\prime},\mathcal{R}(b_{u})\neq w+\epsilon.$ (4)

In other words, the goal here is to purge the signal of the watermark inside
the container images so that the surrogate model trained on them does not
contain the watermark’s information. Thus, the watermarking method is
nullified.

Conversely, to counter the overwriting attack, we need a watermarking network
that is sufficiently robust so as to be able to retrieve a valid recovered
watermark $w^{\prime}$ under such an attack. The objective of the defense is
denoted as

$\displaystyle\exists\ \mathcal{R},w^{\prime}=\mathcal{R}(b_{u}),\text{ s.t.
}w^{\prime}=w+\epsilon,\forall\ b_{u}\in B_{\mathcal{U}}\cup
B^{\prime\prime}.$ (5)

This objective requires the watermarking method to completely withstand the
overwriting attack.

###  III-B The Attack Network

####  III-B1 The overwriting attack

##### Overview

As depicted in Figure 4, the overwriting attack aims at the output image set
$B^{\prime}$, which contains the watermark. A deep steganographic model
$\mathcal{U}$ is trained, which consists of an embedding function
$\mathcal{E}_{\mathcal{U}}$ and a retrieval function
$\mathcal{R}_{\mathcal{U}}$. As illustrated in Algorithm 1, this model is
capable of embedding an arbitrary image into another arbitrary image so as to
perform an overwriting attack on the given container image set
$B^{\prime\prime}$. The result is a set of overwritten container images
$B_{\mathcal{U}}$, where $w^{\prime}$ cannot be validly retrieved.

Algorithm 1 Train the Overwriting Network

while $\mathcal{L}_{\mathcal{U}}$ not converged do

$c_{\mathcal{U}}\leftarrow\mathcal{E}_{\mathcal{U}}(x,c^{\prime})$
$\triangleright$ Overwrite

$x^{\prime}\leftarrow\mathcal{R}_{\mathcal{U}}(c_{\mathcal{U}})$
$\triangleright$ Retrieve

$\mathcal{L}_{\mathcal{U}}\leftarrow\mathcal{L}^{\mathcal{U}}_{\mathcal{E}}(c^{\prime},c_{\mathcal{U}})+\mathcal{L}^{\mathcal{U}}_{\mathcal{R}}(c_{\mathcal{U}},x^{\prime})$
$\triangleright$ Get loss

$\mathcal{L}_{\mathcal{U}}$.back_propagation() $\triangleright$ Backwards

end while

This attack is denoted as

$\displaystyle\mathcal{E}_{\mathcal{U}}(B^{\prime})=B_{\mathcal{U}},\
\text{s.t.}\ \mathcal{R}(B_{\mathcal{U}})\not=w+\epsilon.$ (6)

Since the watermark information in $B_{\mathcal{U}}$ is lost, an attacker can
train a surrogate model $\mathcal{H}_{\mathcal{U}}$ with $A$ and
$B_{\mathcal{U}}$, which is either watermark-free, or it contains a self-made
watermark $w_{\mathcal{U}}$.

##### Loss Functions.

The loss function for training $\mathcal{U}$ is defined as

$\displaystyle\mathcal{L}_{\mathcal{U}}=\mathcal{L}_{\mathcal{E}}^{\mathcal{U}}+\mathcal{L}_{\mathcal{R}}^{\mathcal{U}},$
(7)

where $\mathcal{L}_{\mathcal{E}}^{\mathcal{U}}$ and
$\mathcal{L}_{\mathcal{R}}^{\mathcal{U}}$ respectively denote the embedding
loss and the retrieval loss of $\mathcal{U}$.

$\mathcal{L}_{\mathcal{E}}^{\mathcal{U}}$ is further decomposed into

$\displaystyle\mathcal{L}_{\mathcal{E}}^{\mathcal{U}}=\lambda_{mse}l_{mse}+\lambda_{vgg}l_{vgg}+\lambda_{freq}l_{freq},$
(8)

where the $\lambda$s are weight parameters.

$l_{bs}$ is the $L2$ loss between the cover images $C$ and container images
$C^{\prime}$, defined as

$\displaystyle l_{mse}=\sum_{c_{i}\in C,c_{i}^{\prime}\in
C^{\prime}}\frac{1}{N_{c}}\|c_{i}-c_{i}^{\prime}\|^{2},$ (9)

where $N_{c}$ is the total number of pixels.

$l_{vgg}$ denotes the perceptual loss between $C$ and $C^{\prime}$, defined as

$\displaystyle l_{vgg}=\sum_{c_{i}\in C,c_{i}^{\prime}\in
C^{\prime}}\frac{1}{N_{f}}\|VGG_{k}(c_{i})-VGG_{k}(c_{i}^{\prime})\|^{2},$
(10)

where $N_{f}$ and $VGG_{k}$ respectively denote the total number of feature
neurons and the features extracted at layer $k$.

$l_{freq}$ is the frequency loss [25] between $C$ and $C^{\prime}$ for
controlling consistency in the frequency domain, defined as

$\displaystyle l_{freq}=\sum_{c_{i}\in C,c_{i}^{\prime}\in
C^{\prime}}\frac{1}{N_{p}}\mathcal{F}(c_{i},c_{i}^{\prime}),$ (11)

where $\mathcal{F}$ and $N_{p}$ are the focal frequency loss function and the
total number of image pairs.

$\mathcal{L}_{\mathcal{R}_{\mathcal{U}}}$ is also further decomposed into

$\displaystyle\mathcal{L}_{\mathcal{R}}^{\mathcal{U}}=\lambda_{mse}l_{mse}+\lambda_{vgg}l_{vgg}+\lambda_{freq}l_{freq},$
(12)

where the terms therein are identical to those in
$\mathcal{L}_{\mathcal{E}_{\mathcal{U}}}$ but applied to image pairs
$(s_{i},s_{i}^{\prime})$ from the secret images $S$ and the retrieved secret
images $S^{\prime}$.

###  III-C The defense Network

Figure 5: Framework of the Defense Network: The initial training stage is
critical for the success of the proposed method, as it involves the concurrent
training of both the watermarking and overwriting networks. The retrieval
network must be able to extract a valid watermark from the overwritten images
generated by the overwriting embedding network. During the adversarial
training stage, the retrieval network is further refined through exposure to
both watermarked images and watermark-free images. If the retrieval network
encounters a watermarked image, it should produce a valid recovered watermark.
Conversely, when it encounters a watermark-free image, it should output a null
image.

####  III-C1 Overview

To counter the threat of the attack network, we devised an adversarial
training framework, i.e., the defense network $\mathcal{O}$, that includes
both the watermarking framework $f_{wm}$ and $\mathcal{U}$, and where $f_{wm}$
and $\mathcal{U}$ are each configured as a two-party-mini-max game. In short,
we set up an adversarial training scheme by training $f_{wm}$ along with
$\mathcal{U}$ according to the following settings in Figure 5:

As demonstrated in Algorithm 2, the embedding network $\mathcal{E}$ in
$f_{wm}$ is initially trained to embed $w$ into $B$ to get $B^{\prime}$. A
discriminator network $\mathcal{D}$ then determines whether $B^{\prime}$
contains a watermark so as to make $\mathcal{E}$ to hide the watermark more
covertly. Meanwhile, the overwriting embedding network
$\mathcal{E}_{\mathcal{U}}$ is trained to embed an arbitrary image into
another arbitrary image so as to perform an overwriting attack. $B^{\prime}$
is then fed to $\mathcal{E}_{\mathcal{U}}$ along with an arbitrary image set
$S$ of the same size of $B^{\prime}$ to yield an overwritten image set
$B_{\mathcal{U}}$. Lastly, $B^{\prime}$ and $B_{\mathcal{U}}$ are passed to
the retrieval network $\mathcal{R}$ in $f_{wm}$ to retrieve $w^{\prime}$, and
$\mathcal{R}$ is required to produce a null image $w_{0}$ when it receives
watermark-free images from $A$ and $B$.

Algorithm 2 The Defense Network - Initial Training Stage

while $\mathcal{L}$ not converged do

$B^{\prime}\leftarrow\mathcal{E}(w,B)$ $\triangleright$ Embed

$B_{\mathcal{U}}\leftarrow\mathcal{E}_{\mathcal{U}}(w_{\mathcal{U}},B^{\prime})$
$\triangleright$ Overwrite

$w_{0}\leftarrow\mathcal{R}(A;B)$ $\triangleright$ Null retrieval

$w^{\prime}\leftarrow\mathcal{R}(B^{\prime};B_{\mathcal{U}})$ $\triangleright$
Ret. watermark

$\mathcal{L}\leftarrow\mathcal{L}_{\mathcal{U}}(A,B,B^{\prime},B_{\mathcal{U}},w,w_{\mathcal{U}},w_{0},w^{\prime})$
$\triangleright$ Get Loss

$\mathcal{L}\leftarrow\mathcal{L}+\mathcal{L}_{\mathcal{O}}(A,B,B^{\prime},B_{\mathcal{U}},w,w_{\mathcal{U}},w_{0},w^{\prime})$

$\mathcal{L}$.back() $\triangleright$ Backwards

end while

At the adversarial training stage, as illustrated in Algorithm 3, only
$\mathcal{R}$ is trained for better robustness. On top of the previous
training settings, $\mathcal{R}$ is further forced to retrieve a watermark
from the noisy output $B^{\prime\prime}$ generated by the surrogate model
$H^{\prime}$. Meanwhile, a clean surrogate model $H_{0}$ is trained to produce
clean output $B_{0}$, which boosts the specificity of $\mathcal{R}$, where
$\mathcal{R}$. Further, $\mathcal{R}$ must also retrieve a null image when it
receives $B_{0}$. This solves an intractable problem that we encountered in
the experiments, which is further discussed in Section IV-C1.

Algorithm 3 The defense Network - Adversarial Training Stage

while $\mathcal{L}_{\mathcal{O}}$ not converged do

$B_{0}\leftarrow\mathcal{H}_{0}(A)$

$B^{\prime\prime}\leftarrow\mathcal{H}^{\prime}(A)$

$w_{0}\leftarrow\mathcal{R}(A;B;B_{0})$$\triangleright$ Null Retrieval

$w^{\prime}\leftarrow\mathcal{R}(B^{\prime};B^{\prime\prime};B_{\mathcal{U}})$$\triangleright$
Watermark Retrieval

$\mathcal{L}_{\mathcal{O}}=\mathcal{L}_{\mathcal{O}}(A,B,B^{\prime},B^{\prime\prime},w,w_{0},w^{\prime})$$\triangleright$
Get Loss

$\mathcal{L}_{\mathcal{O}}$.back()$\triangleright$ Backwards

end while

The two-party-mini-max game is defined as

$\displaystyle\qquad\qquad\qquad\underset{\mathcal{E},\mathcal{R}}{\min}\
\underset{\mathcal{E}_{\mathcal{U}}}{\max}\
\mathcal{L}(\mathcal{E},\mathcal{R},\mathcal{E}_{\mathcal{U}})=$ (13)
$\displaystyle\bigg{(}\mathbb{E}\big{[}\sum_{b_{i}\in B,s_{i}\in
S}\frac{1}{N_{c}}\big{\|}\mathcal{R}\big{(}\mathcal{E}_{\mathcal{U}}(\mathcal{E}(b_{i},w),s_{i})\big{)}-w\big{\|}^{2}\big{]}\bigg{)},$

where $\mathcal{E}_{\mathcal{U}}$ mostly benefits when $\mathcal{R}$ cannot
retrieve a valid $w^{\prime}$. Additionally, $\mathcal{E}$ and $\mathcal{R}$
get the most bonuses when a $w^{\prime}$ that is infinitely close to $w$ is
retrieved.

####  III-C2 Loss Functions

The loss function for training the defense network is defined as

$\displaystyle\mathcal{L}=\mathcal{L}_{\mathcal{U}}+\mathcal{L}_{\mathcal{O}}$
(14)

where $\mathcal{L}_{\mathcal{U}}$ and $\mathcal{L}_{\mathcal{O}}$ respectively
denote the loss of training the overwriting network and the watermarking part
of the defense network. Similar to Equation 7, $\mathcal{L}_{\mathcal{U}}$
here is defined as

$\displaystyle\mathcal{L}_{\mathcal{U}}=\mathcal{L}_{\mathcal{E}}^{\mathcal{U}}+\mathcal{L}_{\mathcal{R}}^{\mathcal{U}}+l_{\mathcal{U}}.$
(15)

The extra term $l_{\mathcal{U}}$ denotes the adversarial overwriting loss that
attempts to make $\mathcal{R}$ retrieve a blank image $w_{0}$ from
$B_{\mathcal{U}}$. This is defined as

$\displaystyle l_{\mathcal{U}}=\sum_{b_{i}\in
B_{\mathcal{U}}}\frac{1}{N_{c}}\|\mathcal{R}(b_{i})-w_{0}\|^{2}.$ (16)

$\mathcal{L}_{\mathcal{O}}$ is then further decomposed into

$\displaystyle\mathcal{L}_{\mathcal{O}}=\mathcal{L}^{\mathcal{O}}_{\mathcal{E}}+\mathcal{L}^{\mathcal{O}}_{\mathcal{R}}+\mathcal{L}^{\mathcal{O}}_{\mathcal{D}}+l_{\mathcal{O}}$
(17)

where the terms represent the loss of training the embedding network, the
retrieval network, the discriminator, and the defense adversarial loss.
Further, $\mathcal{L}_{\mathcal{E}}^{\mathcal{O}}$ comprises the following
terms:

$\displaystyle\mathcal{L}_{\mathcal{E}}^{\mathcal{O}}=\lambda_{mse}l_{mse}+\lambda_{freq}l_{freq}+\lambda_{vgg}l_{vgg}+\lambda_{adv}l_{adv},$
(18)

where the former three losses are identical to those appearing in Equation 8.
The last term $l_{adv}$ represents the adversarial loss against the
discriminator network, defined as

$\displaystyle l_{adv}=\mathbb{E}_{b_{i}^{\prime}\in
B^{\prime}}\big{[}\log(\mathcal{D}(b_{i}^{\prime}))\big{]}.$ (19)

The goal is to make the embedding network produce container images that cannot
be detected by the discriminator network.

$\mathcal{L}_{\mathcal{R}}$ is decomposed into

$\displaystyle\mathcal{L}_{\mathcal{R}}=\lambda_{wm}l_{wm}+\lambda_{clean}l_{clean}+\lambda_{cst}l_{cst},$
(20)

where the $\lambda$s are weight parameters. $\mathcal{L}_{wm}$ denotes
watermark retrieval loss

$\displaystyle l_{wm}=\sum_{b_{i}^{\prime}\in
B^{\prime}}\frac{1}{N_{c}}\|\mathcal{R}(b_{i}^{\prime})-w\|^{2}+\sum_{b_{i}^{\prime\prime}\in
B^{\prime\prime}}\frac{1}{N_{c}}\|\mathcal{R}(b_{i}^{\prime\prime})-w\|^{2}.$
(21)

$\mathcal{L}_{cln}$ represents the blank extraction loss for guiding
$\mathcal{E}$ to extract only blank images from images not possessing
watermark information, denoted as

$\displaystyle l_{clean}=\sum_{a_{i}\in
A}\frac{1}{N_{c}}\|\mathcal{R}(a_{i})-w_{0}\|+\sum_{b_{i}\in
B}\frac{1}{N_{c}}\|\mathcal{R}(b_{i})-w_{0}\|,$ (22)

where $w_{0}$ is a blank image. Lastly, $\mathcal{L}_{cst}$ is the consistency
loss for ensuring that the watermarks extracted from different images are
consistent, denoted as

$\displaystyle l_{cst}=\sum_{x,y\in B^{\prime}\bigcup
B^{\prime\prime}}\|\mathcal{R}(x)-\mathcal{R}(y)\|^{2}$ (23)

$l_{\mathcal{O}}$ stands for the defense adversarial loss that guarantees that
$\mathcal{R}$ can retrieve $w^{\prime}=w+\epsilon$ from the overwritten images
$B_{\mathcal{U}}$, defined as

$\displaystyle l_{\mathcal{O}}=\sum_{b_{i}\in
B_{\mathcal{U}}}\frac{1}{N_{c}}\|\mathcal{R}(b_{i})-w\|^{2}.$ (24)

###  III-D Discussion

In our defense framework, the overwriting network is trained in tandem with
the watermarking network to form the defense network. The purpose of the
overwriting network is to overwrite the original watermark with a forged
watermark, creating an adversarial relationship between the two. The retrieval
network of the watermarking network must then be able to retrieve the original
watermark from the overwritten images, as demonstrated in previous work [26].

As the two embedding networks embed the original and forged watermarks into
the same container image in parallel, both secret images are preserved within
the container image. This is because, as shown in [26], it is possible to
embed multiple secret images into one cover image, albeit with a higher
perceptual quality loss. Our experiments show that without proper adversarial
training, the watermarking network is unable to retrieve a valid watermark.
Thus, our adversarial training scheme is a crucial component of the defense
framework.

##  IV Experiment

###  IV-A Experimental Setup

####  IV-A1 Dataset

Two datasets were used to train the image-processing surrogate model: the de-
raining dataset from [27] and an 8-bit image dataset generated via the
algorithm in [28]. The de-raining dataset is public available, while the 8-bit
image dataset is generated using the images in ImageNet datset. The goal of
the first task was to remove rain drops from the images. The second task was
to transform an input image into an 8-bit style artwork. With each task, we
split the dataset into two subsets: a training set of $4000$ images and a test
set of 1000 images. All the images were resized to $256\times 256$ for
training.

We also took samples from the ImageNet dataset to train $\mathcal{U}$. Here,
there were $40,000$ images in the training set and $10,000$ images in the test
set. Each image was greater than $256\times 256$ in size so we randomly
cropped the images down to $256\times 256$ so as to enhance $\mathcal{U}$’s
robustness.

####  IV-A2 Implementation details

$\mathcal{E}$’s network structure follows UNet [29]. UNet has considerably
high performance with reference to translation based and semantic segmentation
tasks, so the network produces good results when there are close connections
between the inputs and the outputs. CEILNet [30] was used as the model for
$\mathcal{R}$, which is believed to work well when the inputs somewhat differ
from the outputs. Patch-GAN [31] was used for $\mathcal{D}$.

In terms of the overwriting network, UNet [29] was once more used as the
network structure for $\mathcal{E}_{\mathcal{U}}$. For
$\mathcal{R}_{\mathcal{U}}$, we simply used stacks of convolutional layers, as
the critical point lies in the overwriting procedure, and, here, the embedding
network plays the more crucial role. Moreover, there is no discriminator in
this training process. Lastly, the defense network comprised the watermarking
network and $\mathcal{U}$. Together, they form $\mathcal{O}$.

####  IV-A3 Evaluation metrics

We chose PSNR and SSIM [32] to evaluate the visual quality of the container
image in comparison to its corresponding cover image. Additionally, we used
normalized cross correlation (NCC) to measure whether a retrieved watermark
was valid. If the NCC between a retrieved watermark and the original watermark
was greater than $0.95$, the retrieved watermark was considered to be
legitimate. NCC is defined as

$\displaystyle
NCC=\frac{\langle\mathcal{R}(b_{i}^{\prime}),w\rangle}{\|\mathcal{R}(b_{i}^{\prime})\|\cdot\|w\|}$
(25)

where $\langle\cdot,\cdot\rangle$ denotes the inner product, and $\|\cdot\|$
denotes the L2 norm. The success rate $SR$ is defined as the ratio of
successfully retrieved watermarks from a certain amount of container images.

###  IV-B Baseline Reproduction

####  IV-B1 Training the watermarking network

First, we reproduced Zhang’s method [11] as our experimental baseline. When
training the watermarking networks $\mathcal{E}$, $\mathcal{R}$, and
$\mathcal{D}$, we set the initial learning rate of the Adam optimizer to
0.001. Here, the goal was to equip the watermarking network with the ability
to embed a fixed watermark into an arbitrary image, and to retrieve the
watermark from the container image. Therefore, we trained the network on the
“ImageNet” training dataset, where 1 epoch contains 40,000 images. The images
were randomly cropped down to $256\times 256$ so as to increase the randomness
of the input data. We set the batch size to 10, which means that the model ran
through 10 images in one iteration. If there was no loss descent within 4000
iterations, we decreased the learning rate by 0.2. All $\lambda$s were set to
1 except for $\lambda_{3}=0.01$, which is the weight parameter of the
adversarial loss.

Figure 6 depicts the test results of the two trained models. Each row of the
two images is an instance. From left to right, each column represents the
cover images $c$, the secret images $s$, the container images $c^{\prime}$,
the retrieved secret images $s^{\prime}$, and the null images retrieved from
watermark-free images. From the results, it is clear that the watermarking
network was able to complete both the embedding and the retrieval tasks quite
well. Further, a pure black image was guaranteed when the input contained no
hidden content. Here, our settings slightly differ with Zhang’s method. Zhang
set the null image to pure white, but for ease of reading, we set the null
image to black.

(a) Flower

(b) Pepper

Figure 6: Test Results of the Watermarking Network

####  IV-B2 The adversarial stage

This stage was designed to enhance the robustness of the retrieval network by
training it to retrieve the watermark from the surrogate model’s processed
images. The retrieval will fail if this step is not conducted, because the
retrieval network does not meet any noisy samples from the surrogate model.
However, because of a problem we discovered (discussed in Section IV-C), we
made a change to this stage of the process where we involved the outputs from
a watermark-free surrogate model in the fine-tuning process.

To train the surrogate models, we used the de-raining and the 8-bit datasets
in two parallel experiments. The paired processed images were watermarked by
the watermarking network. By training the surrogate models this way, we forced
the surrogate models to overfit the watermark signals hidden in the processed
images, such that every output from the surrogate models carried the watermark
signal. Here, the batch size was set to $20$ and the number of epochs was set
to $50$ based on some previous experiments. The initial learning rate was set
to $0.001$, and then decayed by $0.2$ if the loss remained unchanged for 5
epochs. Additionally, we use the same settings to train a watermark-free
surrogate model with the watermark-free datasets.

After training the surrogate models, we used them to produce noisy watermarked
images and the watermark-free images, which were then fed into the retrieval
network $\mathcal{R}$. In the adversarial training state, the hyperparameters
remained the same as those in training the watermarking network for updating
$\mathcal{R}$. However, we reset the learning rate back to $0.001$ so as to
let the trained network escape reach of the local minimum. The fine-tuning
process lasted for $50$ epochs.

As a result, the fine-tuned retrieval network was able to retrieve the
watermark from both the watermarked image $B^{\prime}$ and the surrogate
model’s outputs $B^{\prime\prime}$. The results are visually presented in
Figure 7. Details of the results are listed in Table II.

(a) De-raining + Flower

(b) 8bit + Pepper

Figure 7: Watermarks Retrieved from the Surrogate Models’ Output TABLE II: Original Method Results Condition/Metric | PSNR | SSIM | NCC |  SR(%)
---|---|---|---|---
De-raining $\times$ $\mathcal{W}$ | 30.49 | 0.8688 | 0.9992 | 100
De-raining $\times$ $\mathcal{W}$ $\times$ UNet | / | / | 0.9974 | 100
De-raining $\times$ $\mathcal{W}$ $\times$ Res16 | / | / | 0.9877 | 100
8-bit $\times$ $\mathcal{W}$ | 32.89 | 0.8739 | 0.9999 | 100
8-Bit $\times$ $\mathcal{W}$ $\times$ UNet | / | / | 0.9985 | 100
8-Bit $\times$ $\mathcal{W}$ $\times$ Res16 | / | / | 0.9910 | 100

With each dataset, we conducted three parallel experiments: one using UNet,
one using a residue network with $16$ blocks (Res16), and one performed
directly on the watermarked image $B^{\prime}$. PSNR and SSIM were used to
measure the quality of the container image $c^{\prime}$ compared to its
corresponding cover image $c$. NCC and SR were only used to validate the
watermark retrieval. Remarkably, the success rate of the watermark retrieval
reached $100\%$ in each experiment, which firmly verifies the efficacy of
Zhang’s method.

###  IV-C Attacks

We trained our overwriting network with the Adam optimizer on the ImageNet
training set. The learning rate and batch size were set to $0.001$ and $20$.
We decreased the learning rate by $0.2$ if there was no loss decrease within
$2,000$ iterations. After $20$ epochs, there was no significant descent loss,
so we set the number of epochs to $30$. The $\lambda$s were all set to $1$.
The cover images were randomly cropped into size of $256\times 256$ so as to
increase randomness of the input data and, in turn, enhance the robustness of
the overwriting network. Further, the overwriting network was trained to embed
one of four selected watermarks: “flower”, “copyright”, “lena”, or “pepper”,
into an arbitrary image, and then retrieve the watermark. The effect is
depicted in Figure 8, where each row is an instance. From left to right, each
column respectively represents the cover images $c$, the secret images $s$,
the container images $c^{\prime}$, and the recovered secret images
$s^{\prime}$.

Figure 8: Test Results of the Overwriting Network

After having the trained overwriting network, we launched an attack on the
watermarked images. Generally, the watermarked images $B^{\prime}$ were
overwritten with another watermark so as to prevent the watermark from being
retrieved. The direct effect of the attack is depicted in Figure 9, where each
row is an instance. From left to right, each column respectively represents
the cover images $c$, the secret images $s$, the container images
$c^{\prime}$, and the retrieved secret images $s^{\prime}$. Table III lists
the results of the visual quality test for the container image and watermark
retrieval under various conditions, namely, different combinations of
surrogate model types and datasets. Each value is the average number of the
item derived from 100 randomly selected images. We performed three experiments
with each of the two tasks, i.e., a direct attack on $B^{\prime}$, an attack
on the UNet surrogate model, and another on the Res16 surrogate model.

(a) De-raining + Flower

(b) 8bit + Pepper

Figure 9: Results of the Overwriting Attack

Compared to the watermarked images $B^{\prime}$, the quality of the attacked
image $B_{\mathcal{U}}$ decreased slightly. However, the quality loss was
still negligible to human eye. Success rates across all the experiments were
no greater than 10%, and half of them reached 0%, which proves the efficacy of
our attack. Notably, the success rate of the watermark retrieval with the
Res16 surrogate model on both tasks was higher than the others, which is an
interesting phenomenon.

TABLE III: Attack Results Condition/Metric | PSNR | SSIM | NCC |  SR(%)
---|---|---|---|---
De-raining $\times$ $\mathcal{W}$ $\times$ $\mathcal{U}$ | 27.24 | 0.8031 | 0.0565 | 4
De-raining $\times$ $\mathcal{W}$ $\times$ $\mathcal{U}$ $\times$ UNet | / | / | 0.0109 | 0
De-raining $\times$ $\mathcal{W}$ $\times$ $\mathcal{U}$ $\times$ Res16 | / | / | 0.1527 | 10
8-bit $\times$ $\mathcal{W}$ $\times$ $\mathcal{U}$ | 31.91 | 0.6061 | 0.2968 | 0
8-Bit $\times$ $\mathcal{W}$ $\times$ $\mathcal{U}$ $\times$ Unet | / | / | 0.0678 | 0
8-Bit $\times$ $\mathcal{W}$ $\times$ $\mathcal{U}$ $\times$ Res16 | / | / | 0.2248 | 5

####  IV-C1 The overfitting problem in the retrieval network.

Figure 10: Training Process of the defense Network: From left to right: the
images to process $A$, the processed images $B$, the watermarked processed
images $B^{\prime}$, the overwritten watermarked processed images
$B_{\mathcal{U}}$, the overwritten watermark-free processed images
$B_{\mathcal{U}}^{\prime}$, the null images retrieved from $A$ and $B$, the
watermarks retrieved from $B^{\prime}$ and $B_{\mathcal{U}}$, the null images
retrieved from $B_{\mathcal{U}}^{\prime}$, and the watermark image $w$.

In the attack, we also tried to use the fine-tuned retrieval network to
extract watermarks from the images that were only processed by the overwriting
network. In other words, we tried to extract watermarks from images that did
not contain a watermark signal embedded by the watermarking network. Under
these circumstances, the retrieval network was still able to retrieve the
watermark with decreased quality as demonstrated in Figure 11. This indicated
that, during the fine-tuning, the retrieval network was tuned to output a pre-
defined watermark if there was any secret image signal in the container
images, regardless of what exactly the signal represented.

Figure 11: Overfitting Phenomenom: From left to right, the images depict the
rainy image to process, the watermarked image from the overwriting network,
the overwriting watermark, and the retrieved watermark from the second image
by the retrieval network. The watermark can be retrieved from any container
image that has some steganographic content.

Though this method can withstand an overwriting attack by this overfitting
phenomenon, the phenomenon is harmful to this method. This is because the
watermarking scheme is nullified if a valid watermark can be retrieved from
any container image that does not contain the corresponding watermark
information.

We managed to overcome this problem with a fairly simple manoeuvre. We trained
a watermark-free surrogate model, and then, we added its output images into
the adversarial stage of fine-tuning the retrieval network. The retrieval
network was therefore made to differentiate the outputs of the watermark-free
surrogate model from those of the watermarked surrogate model, and output the
null images correspondingly. This extra step successfully mitigates this
problem.

###  IV-D defenses

Lastly, we trained the defense network with the same hyperparameters as above.
The main idea was to concurrently train a watermarking network and an
overwriting network, and to make the retrieval network retrieve the watermark
from the overwritten container image. Meanwhile, as the adversary, the
overwriting network attempts to overwrite the watermark within the container
image so that the retrieval network will only yield null images. Figure 10
directly illustrates the training process, where the defense network is
trained to embed the watermark into an arbitrary image, and retrieve the
watermark from the container and overwritten images. Further, the retrieval
network must generate a null image if there is not the embedded watermark
signal in the input.

The settings in the fine-tuning stage were almost the same as for the
watermarking network’s adversarial stage. Additionally, the overwriting
network also participated in this stage so as to force the retrieval network
to produce either the watermark or a null image when it encounters the
overwritten container image or the container image generated only by the
overwriting network.

Finally, we tested the defense network on two datasets with different
settings. Table IV shows the test results. As shown, the container images
generated by the defense network have a better visual quality than those
generated by the watermarking network. Among the watermarking retrieval tests,
all success rates reached 100% except for the direct overwriting attack on the
8-bit datasets, which verifies the efficacy of our defense method.

TABLE IV: Watermark Retrieval Results Comparison among Defenses Condition/Metric | PSNR | SSIM | NCC |  SR(%)
---|---|---|---|---
De-raining $\times$ $\mathcal{O}$ | 34.07 | 0.9022 | 0.9997 | 100
De-raining $\times$ $\mathcal{O}$ $\times$ $\mathcal{U}$ | / | / | 0.9924 | 100
De-raining $\times$ $\mathcal{O}$ $\times$ $\mathcal{U}$ $\times$ UNet | / | / | 0.9915 | 100
De-raining $\times$ $\mathcal{O}$ $\times$ $\mathcal{U}$ $\times$ Res16 | / | / | 0.9914 | 100
8-bit $\times$ $\mathcal{O}$ | 34.54 | 0.8796 | 0.9998 | 100
8-bit $\times$ $\mathcal{O}$ $\times$ $\mathcal{U}$ | / | / | 0.9040 | 0.81
8-bit $\times$ $\mathcal{O}$ $\times$ $\mathcal{U}$ $\times$ UNet | / | / | 0.9991 | 100
8-bit $\times$ $\mathcal{O}$ $\times$ $\mathcal{U}$ $\times$ Res16 | / | / | 0.9982 | 100

##  V Discussion

###  V-A Analysis of the Overwriting Attack

(a) The Overwriting Attack

(b) The defense Method

Figure 12: Frequency Analysis

####  V-A1 Frequency Analysis

The objective of the study is to investigate the cause of the overwriting
attack’s capability to render the embedded watermark in the container image
ineffective. This is achieved by calculating the Azimuthal Integral of the
experimental images and comparing their frequency domains. The final data is
obtained by averaging the Azimuthal Integral computed from 1,000 groups of
test images, each group consisting of the container image generated by the
watermarking network, the cover image, the overwritten container image, the
output from the surrogate model, and the overwritten output from the surrogate
model. The images within each group correspond to the same processed image.

Typically, images processed by Deep Convolutional Neural Networks (DCNNs)
display a bias in the high frequency domain. As illustrated in Figure 12(a),
the container image generated by the watermarking network and its
corresponding image generated by the surrogate model exhibit an abnormally
high amplitude in the high frequency domain, which distinguishes them greatly
from the cover image. This is the reason why the watermark can be invisibly
embedded into the cover image, as human eyes are not sensitive enough to the
high frequency domain of an image.

However, through fine-tuning, the retrieval network in the watermarking
network can still retrieve the watermark from the surrogate model’s output,
despite its significant deviation from the frequency distribution of the
container image. This emphasizes the significance of the fine-tuning stage. In
the case of the overwritten container image, it displays a marked bias in the
high frequency domain, both in comparison to the cover image and the
watermarked image. A peak can be observed in the range of 160 to 175 on the
frequency axis, which neutralizes the previously embedded watermark.

To further ascertain the location where the watermark is embedded, a low-pass
filter is applied to the watermarked images. The filtered image retains its
visual quality to the extent that changes are not easily noticeable by the
human eye. This filter is applied to 1,000 container images and then the
watermark retrieval is performed. As expected, the success rate of the
retrieval drops to 0, and the direct effect can be seen in Figure 13, where
each column in each row, from left to right, respectively represents the
container image, the retrieved watermark, the filtered container image, and
the nullified retrieval result. This underscores the high sensitivity of the
watermark retrieval to the high frequency distribution of the container image.

Figure 13: Watermark Retrieval of Low-pass Filtered Container Images

###  V-B Analysis of the defense Network

####  V-B1 Residue Analysis

First, we performed a residue analysis on the container images generated by
our defense and watermarking networks. The details can be seen in Figure 14,
where from left to right, each column in each row respectively represents the
cover image, the container image, and the residue enhanced 10 times.
Intuitively, the residues of the defense network’s output seem to be darker
(better) than those of the watermarking network’s output.

(a) defense Network

(b) Watermarking Network

Figure 14: Residue Analysis (10x Enhanced)

####  V-B2 Frequency Analysis.

In the adversarial stage of the watermarking network, the retrieval network is
required to retrieve the watermark from both the surrogate model’s output and
the container images. Due to the bias in the frequency domain of the
overwritten surrogate model’s output shown in Figure 12(a), the retrieval
fails, because it has never encountered any input with such a frequency
distribution. However, in the defense network’s fine-tuning stage, the
surrogate model’s output is protected by the defense network, and they share
almost the same frequency distribution as the overwritten surrogate model’s
output in Figure 12(b). This forces the retrieval network to become more
robust to the mutable watermark signal. Further, with the assistance of the
frequency loss, the container images generated by the defense network share a
more similar frequency distribution to the cover images than those generated
by the watermarking network. Our defense method therefore shows good robust to
overwriting attack, even if the type of the surrogate model does not match the
one used in fine-tuning. Nevertheless, it is still possible for an adversary
to change the attack method to cripple the watermark with a higher cost of
visual quality – through low-pass filtering for example.

###  V-C Ablation Study

####  V-C1 The frequency loss

The ablation experiments in Zhang et al. [11] prove the necessity of several
loss terms, including the clean loss and the consistent loss. In our defense
network, the frequency loss regularizer is added into the loss function so as
to guide the network to generate the container images that share a more
similar frequency distribution to the cover image. The only difference between
the loss terms in our defense network and the watermarking network is the
frequency loss. This boosts the image quality, as is proven in the test
results presented in Tables II, and IV. Here, both the PSNR and the SSIM
values of the container images generated by our defense network are higher
than those from the watermarking network. Further, as Figure 12(b) shows, the
high frequency distribution of the containers from the defense network is
closer to the cover image than those from the watermarking network.

####  V-C2 Fine-tuning

Unlike the original watermarking method in [11], we additionally add a group
of watermark-free images generated by the surrogate model trained on the
watermark-free training dataset into the fine-tuning dataset. This prevents
the watermarking network from overfitting the steganographic signal in the
container images so that it will retrieve the watermark regardless of what
exact watermark signal lies in the container images. Figure 11 shows how the
overfitting phenomenon nullifies the watermarking method. Therefore, the
watermark-free surrogate model’s output is essential in this stage. If a
watermark can be retrieved from a container image that does not contain the
specific watermarking signal, the method can be claimed unreliable. Further,
by inserting the overwriting network into the watermarking network to form the
defense network, the defense network is pushed to become more robust to both
the overwriting attack and the addition of noise. Further, the embedding
network hides the watermark more covertly, and the retrieval network
differentiates the container image carrying both the specific watermark and
the overwritten watermark images from the watermark-free images, and the
watermark-free surrogate model’s output, and the container images carrying any
other secret images.

##  VI Conclusion

In this study, we present an overwriting attack that effectively nullifies the
watermark embedded in images processed by image processing neural networks.
Our attack is also a threat to deep steganography, as it can invisibly replace
a secret image with minimal impact on the visual quality of the image.
Additionally, we identify an overfitting issue in the original watermarking
method and resolve it with an alternative training approach. To defend against
our proposed overwriting attack, we develop an adversarial framework defense
network that integrates the watermarking network and the overwriting network.
To the best of our knowledge, this defense network is resilient against the
overwriting attack. Through adversarial training, the defense network is able
to retrieve valid watermarks from overwritten images and the output of the
overwritten surrogate model.

There is ample room for future research in the area of image-processing model
watermarking, including the development of robust watermarking techniques and
malicious attacks. Although our method demonstrates robustness against
overwriting attacks, the adversary can still manipulate the frequency domain
of the output to erase the embedded watermark with minimal perceptual impact.
To address this issue, a more robust watermarking method that embeds the
watermark in the low frequency domain of the image should be explored.

## References

  * [1] Y.-X. Wang, D. Ramanan, and M. Hebert, “Growing a brain: Fine-tuning by increasing model capacity,” in _Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition_ , 2017, pp. 2471–2480.
  * [2] A. Nagabandi, G. Kahn, R. S. Fearing, and S. Levine, “Neural network dynamics for model-based deep reinforcement learning with model-free fine-tuning,” in _2018 IEEE International Conference on Robotics and Automation (ICRA)_. IEEE, 2018, pp. 7559–7566.
  * [3] J. Howard and S. Ruder, “Universal language model fine-tuning for text classification,” _arXiv preprint arXiv:1801.06146_ , 2018.
  * [4] Z. Liu, M. Sun, T. Zhou, G. Huang, and T. Darrell, “Rethinking the value of network pruning,” _arXiv preprint arXiv:1810.05270_ , 2018.
  * [5] Y. He, X. Zhang, and J. Sun, “Channel pruning for accelerating very deep neural networks,” in _Proceedings of the IEEE international conference on computer vision_ , 2017, pp. 1389–1397.
  * [6] M. Zhu and S. Gupta, “To prune, or not to prune: exploring the efficacy of pruning for model compression,” _arXiv preprint arXiv:1710.01878_ , 2017\.
  * [7] Y. Uchida, Y. Nagai, S. Sakazawa, and S. Satoh, “Embedding watermarks into deep neural networks,” in _Proceedings of the 2017 ACM on International Conference on Multimedia Retrieval_ , 2017, pp. 269–277.
  * [8] B. D. Rouhani, H. Chen, and F. Koushanfar, “Deepsigns: A generic watermarking framework for ip protection of deep learning models,” _arXiv preprint arXiv:1804.00750_ , 2018.
  * [9] S. Szyller, B. G. Atli, S. Marchal, and N. Asokan, “Dawn: Dynamic adversarial watermarking of neural networks,” in _Proceedings of the 29th ACM International Conference on Multimedia_ , 2021, pp. 4417–4425.
  * [10] R. Namba and J. Sakuma, “Robust watermarking of neural network with exponential weighting,” in _Proceedings of the 2019 ACM Asia Conference on Computer and Communications Security_ , 2019, pp. 228–240.
  * [11] J. Zhang, D. Chen, J. Liao, H. Fang, W. Zhang, W. Zhou, H. Cui, and N. Yu, “Model watermarking for image processing networks,” in _Proceedings of the AAAI Conference on Artificial Intelligence_ , vol. 34, no. 07, 2020, pp. 12 805–12 812.
  * [12] Y. Quan, H. Teng, Y. Chen, and H. Ji, “Watermarking deep neural networks in image processing,” _IEEE transactions on neural networks and learning systems_ , vol. 32, no. 5, pp. 1852–1865, 2020.
  * [13] R. Tang, M. Du, and X. Hu, “Deep serial number: Computational watermarking for dnn intellectual property protection,” _arXiv preprint arXiv:2011.08960_ , 2020.
  * [14] S. Baluja, “Hiding images in plain sight: Deep steganography,” _Advances in Neural Information Processing Systems_ , vol. 30, pp. 2069–2079, 2017.
  * [15] V. M. Potdar, S. Han, and E. Chang, “A survey of digital image watermarking techniques,” in _INDIN’05. 2005 3rd IEEE International Conference on Industrial Informatics, 2005._ IEEE, 2005, pp. 709–716.
  * [16] M. Arnold, “Audio watermarking: Features, applications and algorithms,” in _2000 IEEE International conference on multimedia and expo. ICME2000. Proceedings. Latest advances in the fast changing world of multimedia (cat. no. 00TH8532)_ , vol. 2. IEEE, 2000, pp. 1013–1016.
  * [17] G. Doerr and J.-L. Dugelay, “A guide tour of video watermarking,” _Signal processing: Image communication_ , vol. 18, no. 4, pp. 263–282, 2003\.
  * [18] P. Wu, Y. Yang, and X. Li, “Image-into-image steganography using deep convolutional network,” in _Pacific Rim Conference on Multimedia_. Springer, 2018, pp. 792–802.
  * [19] C. Zhang, P. Benz, A. Karjauv, G. Sun, and I. S. Kweon, “Udh: Universal deep hiding for steganography, watermarking, and light field messaging,” _Advances in Neural Information Processing Systems_ , vol. 33, pp. 10 223–10 234, 2020.
  * [20] X. Zhao, Y. Wang, R. Yang, and Y. Guo, “Jointw: A joint image-to-image translation and watermarking method,” in _Pattern Recognition and Computer Vision: 5th Chinese Conference, PRCV 2022, Shenzhen, China, November 4–7, 2022, Proceedings, Part III_. Springer, 2022, pp. 758–772.
  * [21] O. Hosam, “Attacking image watermarking and steganography-a survey,” _International Journal of Information Technology and Computer Science_ , vol. 11, no. 3, pp. 23–37, 2019.
  * [22] M. Boroumand, M. Chen, and J. Fridrich, “Deep residual network for steganalysis of digital images,” _IEEE Transactions on Information Forensics and Security_ , vol. 14, no. 5, pp. 1181–1193, 2018.
  * [23] I. Corley, J. Lwowski, and J. Hoffman, “Destruction of image steganography using generative adversarial networks,” _arXiv preprint arXiv:1912.10070_ , 2019.
  * [24] C. Zhang, P. Benz, A. Karjauv, and I. S. Kweon, “Universal adversarial perturbations through the lens of deep steganography: Towards a fourier perspective,” _arXiv preprint arXiv:2102.06479_ , 2021.
  * [25] L. Jiang, B. Dai, W. Wu, and C. C. Loy, “Focal frequency loss for image reconstruction and synthesis,” in _Proceedings of the IEEE/CVF International Conference on Computer Vision_ , 2021, pp. 13 919–13 929.
  * [26] S. Baluja, “Hiding images within images,” _IEEE transactions on pattern analysis and machine intelligence_ , vol. 42, no. 7, pp. 1685–1697, 2019.
  * [27] H. Zhang and V. M. Patel, “Density-aware single image de-raining using a multi-stream dense network,” in _Proceedings of the IEEE conference on computer vision and pattern recognition_ , 2018, pp. 695–704.
  * [28] Z. Zou, T. Shi, S. Qiu, Y. Yuan, and Z. Shi, “Stylized neural painting,” in _Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition_ , 2021, pp. 15 689–15 698.
  * [29] O. Ronneberger, P. Fischer, and T. Brox, “U-net: Convolutional networks for biomedical image segmentation,” in _International Conference on Medical image computing and computer-assisted intervention_. Springer, 2015, pp. 234–241.
  * [30] Q. Fan, J. Yang, G. Hua, B. Chen, and D. Wipf, “A generic deep architecture for single image reflection removal and image smoothing,” in _Proceedings of the IEEE International Conference on Computer Vision_ , 2017, pp. 3238–3247.
  * [31] P. Isola, J.-Y. Zhu, T. Zhou, and A. A. Efros, “Image-to-image translation with conditional adversarial networks,” in _Proceedings of the IEEE conference on computer vision and pattern recognition_ , 2017, pp. 1125–1134.
  * [32] A. Hore and D. Ziou, “Image quality metrics: Psnr vs. ssim,” in _2010 20th international conference on pattern recognition_. IEEE, 2010, pp. 2366–2369.