解耦防御策略的鲁棒图像水印
Decoupling Defense Strategies for Robust Image Watermarking
提出两阶段解耦防御框架：第一阶段通过主要微调编码器、条件更新解码器的对抗训练，将图像移入不可攻击区域而非修改决策边界，从而保持干净精度；第二阶段用带理论保证的约束图像损失和品质感知早停直接优化图像，兼顾失真与再生攻击鲁棒性。该解耦思路可迁移至其他需要同时抵御对抗与失真攻击的视觉任务。
原文依据 we propose AdvMark, a novel two-stage fine-tuning framework that decouples the defense strategies.
摘要译文
由模型翻译 · 术语统一 · 请对照原文核对关键结论基于深度学习的图像水印虽然对传统失真具有鲁棒性，但仍易受高级对抗攻击和再生攻击的影响。通过噪声层联合优化编码器和解码器的传统对策面临两个不可避免的挑战：（1）解码器对抗训练导致干净精度下降；（2）同时训练所有三种高级攻击导致鲁棒性有限。为克服这些问题，我们提出AdvMark，一种新颖的两阶段微调框架，解耦防御策略。在第一阶段，我们通过定制的对抗训练范式解决对抗脆弱性，该范式主要微调编码器，仅条件性更新解码器。这种方法学习将图像移入不可攻击区域，而非修改决策边界，从而保持干净精度。在第二阶段，我们通过直接图像优化应对失真和再生攻击。为保持第一阶段获得的对抗鲁棒性，我们制定了一个有原则的约束图像损失，具有理论保证，平衡与载体图像和先前编码图像的偏差。我们还提出质量感知早停，以进一步保证视觉质量的下界。大量实验表明，AdvMark在最高图像质量和全面鲁棒性方面表现优异，即对失真、再生和对抗攻击分别实现高达29%、33%和46%的精度提升。
英文原文摘要 1507 字符
Deep learning-based image watermarking, while robust against conventional distortions, remains vulnerable to advanced adversarial and regeneration attacks. Conventional countermeasures, which jointly optimize the encoder and decoder via a noise layer, face 2 inevitable challenges:(1) decrease of clean accuracy due to decoder adversarial training and (2) limited robustness due to simultaneous training of all three advanced attacks.To overcome these issues, we propose AdvMark, a novel two-stage fine-tuning framework that decouples the defense strategies. In stage 1, we address adversarial vulnerability via a tailored adversarial training paradigm that primarily fine-tunes the encoder while only conditionally updating the decoder. This approach learns to move the image into a non-attackable region, rather than modifying the decision boundary, thus preserving clean accuracy.In stage 2, we tackle distortion and regeneration attacks via direct image optimization. To preserve the adversarial robustness gained in stage 1, we formulate a principled, constrained image loss with theoretical guarantees, which balances the deviation from cover and previous encoded images. We also propose a quality-aware early-stop to further guarantee the lower bound of visual quality.Extensive experiments demonstrate AdvMark outperforms with the highest image quality and comprehensive robustness, i.e. up to 29%, 33% and 46% accuracy improvement for distortion, regeneration and adversarial attacks, respectively.