To protect the intellectual property of well-trained deep neural networks
(DNNs), black-box DNN watermarks, which are embedded into the prediction
behavior of DNN models on a set of specially-crafted samples, have gained
increasing popularity in both academy and industry. Watermark robustness is
usually implemented against attackers who steal the protected model and
obfuscate its parameters for watermark removal. Recent studies empirically
prove the robustness of most black-box watermarking schemes against known
removal attempts.
In this paper, we propose a novel Model Inversion-based Removal Attack
(\textsc{Mira}), which is watermark-agnostic and effective against most of
mainstream black-box DNN watermarking schemes. In general, our attack pipeline
exploits the internals of the protected model to recover and unlearn the
watermark message. We further design target class detection and recovered
sample splitting algorithms to reduce the utility loss caused by \textsc{Mira}
and achieve data-free watermark removal on half of the watermarking schemes. We
conduct comprehensive evaluation of \textsc{Mira} against ten mainstream
black-box watermarks on three benchmark datasets and DNN architectures.
Compared with six baseline removal attacks, \textsc{Mira} achieves strong
watermark removal effects on the covered watermarks, preserving at least $90\%$
of the stolen model utility, under more relaxed or even no assumptions on the
dataset availability.

我们提出了一种新的基于模型反演的移除攻击（Mira），该攻击不针对特定的水印，并且对大多数主流的黑盒深度神经网络水印方案都有效。我们的攻击方法利用受保护模型的内部信息来恢复并取消学习水印信息，并且还设计了目标类别检测和恢复样本分割算法来减小 Mira 攻击带来的效用损失，实现对一半水印方案的无数据水印去除。我们在三个基准数据集和深度神经网络架构上对 Mira 进行了全面评估，与六种基线攻击相比，Mira 对覆盖的水印具有强大的去除效果，在更宽松甚至无对数据集可用性的假设下，保留了至少 90% 的被窃模型效用。