Watermark has been widely deployed by industry to detect AI-generated images.
The robustness of such watermark-based detector against evasion attacks in the
white-box and black-box settings is well understood in the literature. However,
the robustness in the no-box setting is much less understood. In particular,
multiple studies claimed that image watermark is robust in such setting. In
this work, we propose a new transfer evasion attack to image watermark in the
no-box setting. Our transfer attack adds a perturbation to a watermarked image
to evade multiple surrogate watermarking models trained by the attacker itself,
and the perturbed watermarked image also evades the target watermarking model.
Our major contribution is to show that, both theoretically and empirically,
watermark-based AI-generated image detector is not robust to evasion attacks
even if the attacker does not have access to the watermarking model nor the
detection API.

提出了一种新的转移攻击方法，该攻击方法在无盒环境下对图像水印进行干扰，使得对手训练的多个替代水印模型无法检测到水印，同时也能规避目标水印模型检测。理论和实验证明了基于水印的 AI 生成图像检测器不具备抵抗干扰攻击的鲁棒性，即使攻击者无法访问水印模型或检测 API。