Technical Summary: DEMARK – A Query-Free Black-Box Attack on Deepfake Watermarking Defenses

1. Problem Statement

The rapid proliferation of realistic deepfakes generated by models like Stable Diffusion and ChatGPT has created urgent security risks, necessitating defensive watermarking for attribution and detection. Current defensive paradigms rely on encoder–decoder architectures that embed invisible signals into images, either post-generation or during the generation process. These schemes assume watermarks are inherently resistant to removal. However, the authors challenge this assumption, noting that existing defenses are poorly understood under advanced adversaries.

Prior attack methods face significant limitations:

• Distortion Attacks: Often introduce visible artifacts and degrade image quality.
• Regeneration Attacks: Rely on large pre-trained generative models (VAEs or Diffusion models) that preserve latent representations carrying watermark information, limiting their effectiveness.
• Adversarial Attacks: Typically require access to model parameters or extensive querying capabilities, rendering them impractical in real-world black-box scenarios.

There is a critical gap for a query-free, black-box attack that can effectively remove watermarks while preserving the perceptual and structural realism required for deepfake imagery.

2. Methodology: DEMARK

The authors propose DEMARK, a query-free black-box attack framework that exploits latent-space vulnerabilities in encoder–decoder watermarking models. The core innovation lies in adapting Image Compressive Sensing (ICS) theory to the deep learning domain.

Core Design Principles

DEMARK replaces fixed measurement matrices and sparsifying bases found in traditional ICS with a learnable encoder–decoder architecture.

1. Sparse Encoding: A CNN-based encoder ($T_{CNN}$) transforms a watermarked image into a sparse latent representation ($Z$). This process is guided by a Sparse Encoding Loss ($L_{SEL}$), defined as the $\ell_1$-norm of $Z$, which forces most latent elements toward zero.
2. Image Reconstruction: A reconstruction module ($R_{CNN}$) restores the image from the sparse representation. To ensure the output remains a convincing deepfake, this module is optimized using a Structural-Perceptual Loss ($L_{SPL}$), which combines:
   • SSIM: For pixel-level structural consistency.
   • LPIPS: For feature-level perceptual alignment.

The Dispersal Effect

The attack operates by inducing a "dispersal effect" in the latent space, characterized by three properties derived from ICS theory:

• Sparsity Change (SC): Reduces the density of significant coefficients, dispersing watermark attributes across fewer active positions.
• Intensity Redistribution (IR): Dilutes the energy of watermark signals by redistributing intensity more uniformly.
• Positional Redistribution (PR): Shifts the positions of non-zero elements, disrupting the alignment between watermark patterns and their original latent locations.

These mechanisms collectively weaken the robustness of embedded watermarks without requiring knowledge of the watermarking model or the ability to query a detector.

3. Key Contributions

The paper makes the following specific contributions:

• First Query-Free Black-Box Attack: DEMARK is the first framework to target defensive image watermarking for deepfakes without requiring model parameters or query access.
• Theoretical Connection: It establishes the first link between Image Compressive Sensing theory and attacks on deepfake watermarking, formalizing the dispersal effect through Sparsity Change, Intensity Redistribution, and Positional Redistribution.
• Broad Effectiveness: The attack is validated across eight state-of-the-art schemes, including six post-processing methods (MBRS, CIN, TrustMark, PIMoG, VINE-B, VINE-R) and two in-processing methods (PTW, SS).
• Efficiency: DEMARK demonstrates high practicality, reducing memory usage by 2.2×–14.9× and improving computational efficiency by 1.3×–5.7× compared to existing regeneration-based attacks (RegenVAE and RegenDM).
• Mitigation Evaluation: The authors evaluate three defense strategies—Image Super-Resolution (ISR), Sparse Watermarking (SW), and Adversarial Training (AT)—and find them largely ineffective against DEMARK.

4. Experimental Results

The evaluation was conducted on the OpenImage and COCO datasets against the eight aforementioned watermarking schemes.

• Attack Capability: DEMARK reduced the average watermark detection accuracy (DetectAcc) from 100% to 32.9% across all schemes. It significantly outperformed baseline attacks (Distortion, RegenVAE, RegenDM) in reducing both Bit Accuracy and Detection Accuracy.
  • Example: Against post-processing schemes, DEMARK reduced DetectAcc by an average of 54.4% compared to Distortion, 9.9% compared to RegenVAE, and 51.0% compared to RegenDM.
• Image Integrity: Despite the aggressive removal of watermarks, DEMARK maintained high visual quality. Its performance in PSNR, SSIM, FID, and LPIPS was comparable to or better than RegenVAE and substantially superior to Distortion and RegenDM.
  • Example: DEMARK achieved an average PSNR of 28.45 and SSIM of 0.85, preserving natural visual appearance suitable for deepfakes.
• Mitigation Robustness:
  • Image Super-Resolution (ISR): Surprisingly, applying ISR after the attack amplified DEMARK's impact, lowering detection accuracy further (e.g., from 29.7% to 12.1% on average).
  • Sparse Watermarking (SW) & Adversarial Training (AT): These strategies offered only modest improvements (raising average detection accuracy from ~25% to ~36%) but failed to neutralize DEMARK, which still outperformed other attacks.

5. Significance and Claims

The paper concludes that current encoder–decoder watermarking schemes remain highly vulnerable to latent-space manipulations. The significance of DEMARK lies in its ability to demonstrate that:

1. Latent Space is a Critical Attack Surface: The reliance on latent representations for embedding watermarks creates a structural weakness that can be exploited via sparsification.
2. Existing Defenses are Insufficient: Standard mitigation strategies like super-resolution, sparse training, and adversarial training do not provide robust protection against this class of attacks.
3. Need for Redesign: The results underscore an urgent need for more robust watermarking methods that can safeguard against deepfake manipulation, suggesting that future defenses must move beyond simple encoder–decoder paradigms or incorporate multi-level latent feature encoding and adaptive redundancy distribution.

The authors emphasize that their work is intended to identify security risks to promote the development of more resilient watermarking techniques for Generative AI, rather than to facilitate malicious misuse.