PECCVAI：克服 AI 图像水印在视觉转述攻击下的脆弱性
PECCVAI: Overcoming the Brittleness of AI Image Watermarking Under Visual Paraphrasing Attacks
提出视觉转述攻击（caption→扩散模型重生成）可同时移除可见与不可见水印，并给出基于非融化点（NMP）与多通道频域编码的鲁棒水印方案 PECCAVI，为生成内容溯源与版权保护提供可复用的攻防基准。
原文依据 we introduce the visual paraphrase attack, a generative method that removes both visible and invisible watermarks from AI-generated images.
摘要译文
由模型翻译 · 术语统一 · 请对照原文核对关键结论到 2026 年，高达 90% 的在线内容可能由合成生成，这引发了人们对 AI 驱动虚假信息泛滥的迫切担忧。作为回应，政策制定者和科技公司正转向水印技术作为保障：加利福尼亚州 AB 321 法案要求对 AI 生成媒体进行水印标记，而 Meta 和 Google 等公司已开始部署水印系统以减少滥用。然而，当前的水印方法仍然脆弱且易受攻击。在本工作中，我们引入了视觉转述攻击，这是一种生成式方法，能够从 AI 生成的图像中移除可见和不可见的水印。该攻击分两步进行：(1) 从原始图像生成描述性 caption；(2) 将该 caption 输入基于扩散的文本到图像模型，生成视觉相似且无水印的图像。我们的实验表明，该攻击在保留原始图像语义内容的同时可靠地移除水印，暴露了现有水印策略的关键缺陷。为了应对这一威胁，我们提出了 PECCAVI，这是首个明确设计用于抵抗视觉转述的水印技术。PECCAVI 使用多通道频域编码和噪声抛光，在称为非融化点（NMP）的语义稳定图像区域中嵌入鲁棒的高保真水印（PSNR > 30 dB），以混淆水印位置并阻碍逆向工程。该方法与模型无关，并且比当前替代方案显著更具弹性。我们还发布了首个用于视觉转述攻击的基准数据集，并开源所有代码和资源，为生成式 AI 时代鲁棒水印的未来研究提供基础。
英文原文摘要 1729 字符
By 2026, up to 90% of online content may be synthetically generated, raising urgent concerns about the proliferation of AI-driven disinformation. In response, policymakers and technology companies are turning to watermarking as a safeguard: California's Bill AB 321 mandates watermarking of AI-generated media, while firms like Meta and Google have begun deploying watermarking systems to mitigate misuse. However, current watermarking methods remain brittle and vulnerable to attack. In this work, we introduce the visual paraphrase attack, a generative method that removes both visible and invisible watermarks from AI-generated images. The attack proceeds in two steps: (1) generating a descriptive caption from the original image, and (2) feeding this caption into a diffusion-based text-to-image model to produce a visually similar, watermark-free image. Our experiments show that this attack reliably removes watermarks while preserving semantic content of the original image, exposing a critical flaw in existing watermarking strategies. To counter this, we propose PECCAVI, the first watermarking technique explicitly designed to resist visual paraphrasing. PECCAVI embeds robust, high-fidelity watermarks (PSNR > 30 dB) in semantically stable image regions termed Non-Melting Points (NMPs) using multi-channel frequency domain encoding and noisy burnishing to obfuscate watermark locations and hinder reverse engineering. The method is model-agnostic and significantly more resilient than current alternatives. We also release the first benchmark dataset for visual paraphrasing attacks and open-source all code and resources, providing a foundation for future research on robust watermarking in the era of generative AI