Decoder Gradient Shields: A Family of Provable and High-Fidelity Methods Against Gradient-Based Box-Free Watermark Removal

• URL: http://arxiv.org/abs/2601.11952v1
• Date: Sat, 17 Jan 2026 07:57:37 GMT
• Title: Decoder Gradient Shields: A Family of Provable and High-Fidelity Methods Against Gradient-Based Box-Free Watermark Removal
• Abstract summary: Box-free model watermarking has gained significant attention in deep neural network (DNN) intellectual property protection.<n>Box-free watermarking employs an encoder-decoder framework for watermark embedding and extraction.<n>We propose Decoder Gradient Shields (DGSs) to prevent the watermark remover from achieving training convergence to the desired low-loss value.
• Score: 34.80008365666711
• License: http://arxiv.org/licenses/nonexclusive-distrib/1.0/
• Abstract: Box-free model watermarking has gained significant attention in deep neural network (DNN) intellectual property protection due to its model-agnostic nature and its ability to flexibly manage high-entropy image outputs from generative models. Typically operating in a black-box manner, it employs an encoder-decoder framework for watermark embedding and extraction. While existing research has focused primarily on the encoders for the robustness to resist various attacks, the decoders have been largely overlooked, leading to attacks against the watermark. In this paper, we identify one such attack against the decoder, where query responses are utilized to obtain backpropagated gradients to train a watermark remover. To address this issue, we propose Decoder Gradient Shields (DGSs), a family of defense mechanisms, including DGS at the output (DGS-O), at the input (DGS-I), and in the layers (DGS-L) of the decoder, with a closed-form solution for DGS-O and provable performance for all DGS. Leveraging the joint design of reorienting and rescaling of the gradients from watermark channel gradient leaking queries, the proposed DGSs effectively prevent the watermark remover from achieving training convergence to the desired low-loss value, while preserving image quality of the decoder output. We demonstrate the effectiveness of our proposed DGSs in diverse application scenarios. Our experimental results on deraining and image generation tasks with the state-of-the-art box-free watermarking show that our DGSs achieve a defense success rate of 100% under all settings.

Related papers

• NGS-Marker: Robust Native Watermarking for 3D Gaussian Splatting [10.741036576739079]
  Existing watermarking techniques for 3DGS mainly focus on protecting rendered images via pre-trained decoders.<n>We propose NGS-Marker, a novel native watermarking framework for 3DGS.<n>It integrates a jointly trained watermark injector and message decoder, and employs a gradientbased progressive injection strategy to ensure full-scene coverage.
  arXiv  Detail & Related papers  (2026-08-18T07:28:18Z)
• Latent-Mark: An Audio Watermark Robust to Neural Resynthesis [62.09761127079914]
  Latent-Mark is the first zero-bit audio watermarking framework designed to survive semantic compression.<n>Our key insight is that robustness to the encode-decode process requires embedding the watermark within the invariant latent space.<n>Our work inspires future research into universal watermarking frameworks capable of maintaining integrity across increasingly complex and diverse generative distortions.
  arXiv  Detail & Related papers  (2026-03-05T15:51:09Z)
• Character-Level Perturbations Disrupt LLM Watermarks [64.60090923837701]
  We formalize the system model for Large Language Model (LLM) watermarking.<n>We characterize two realistic threat models constrained on limited access to the watermark detector.<n>We demonstrate character-level perturbations are significantly more effective for watermark removal under the most restrictive threat model.<n> Experiments confirm the superiority of character-level perturbations and the effectiveness of the Genetic Algorithm (GA) in removing watermarks under realistic constraints.
  arXiv  Detail & Related papers  (2025-09-11T02:50:07Z)
• Fading the Digital Ink: A Universal Black-Box Attack Framework for 3DGS Watermarking Systems [15.347933983222914]
  This paper introduces the first universal black-box attack framework, the Group-based Multi-objective Evolutionary Attack (GMEA)<n>We formulate the attack as a large-scale multi-objective optimization problem, balancing watermark removal with visual quality.<n>Experiments demonstrate that our framework effectively removes both 1D and 2D watermarks from mainstream 3DGS watermarking methods.
  arXiv  Detail & Related papers  (2025-08-10T09:31:01Z)
• TAG-WM: Tamper-Aware Generative Image Watermarking via Diffusion Inversion Sensitivity [76.98973481600002]
  This paper proposes a Tamper-Aware Generative image WaterMarking method named TAG-WM.<n>The proposed method comprises four key modules: a dual-mark joint sampling (DMJS) algorithm for embedding copyright and localization watermarks into the latent space while preserving generative quality.<n>The experimental results demonstrate that TAG-WM achieves state-of-the-art performance in both tampering robustness and localization capability even under distortion.
  arXiv  Detail & Related papers  (2025-06-30T03:14:07Z)
• Gaussian Shading++: Rethinking the Realistic Deployment Challenge of Performance-Lossless Image Watermark for Diffusion Models [66.54457339638004]
  Copyright protection and inappropriate content generation pose challenges for the practical implementation of diffusion models.<n>We propose a diffusion model watermarking method tailored for real-world deployment.<n>Gaussian Shading++ not only maintains performance losslessness but also outperforms existing methods in terms of robustness.
  arXiv  Detail & Related papers  (2025-04-21T11:18:16Z)
• Decoder Gradient Shield: Provable and High-Fidelity Prevention of Gradient-Based Box-Free Watermark Removal [21.876772763530383]
  Box-free watermarking can protect deep image-to-image models.<n>Box-free watermarking uses an encoder and a decoder, respectively, to embed into and extract from the model's output images invisible copyright marks.<n>In this paper, we reveal an overlooked vulnerability of the unprotected watermark decoder.<n>We propose the decoder gradient shield (DGS) as a protection layer in the decoder API to prevent gradient-based watermark removal.
  arXiv  Detail & Related papers  (2025-02-28T10:27:14Z)
• WATER-GS: Toward Copyright Protection for 3D Gaussian Splatting via Universal Watermarking [44.335142946449245]
  WATER-GS is a novel method designed to protect 3DGS copyrights through a universal watermarking strategy.<n>We introduce a pre-trained watermark decoder, treating raw 3DGS generative modules as potential watermarks to ensure imperceptibility.<n>We implement novel 3D distortion layers to enhance the robustness of the embedded watermark against common real-world distortions of point cloud data.
  arXiv  Detail & Related papers  (2024-12-07T16:44:22Z)
• Lazy Layers to Make Fine-Tuned Diffusion Models More Traceable [70.77600345240867]
  A novel arbitrary-in-arbitrary-out (AIAO) strategy makes watermarks resilient to fine-tuning-based removal. Unlike the existing methods of designing a backdoor for the input/output space of diffusion models, in our method, we propose to embed the backdoor into the feature space of sampled subpaths. Our empirical studies on the MS-COCO, AFHQ, LSUN, CUB-200, and DreamBooth datasets confirm the robustness of AIAO.
  arXiv  Detail & Related papers  (2024-05-01T12:03:39Z)
• Wide Flat Minimum Watermarking for Robust Ownership Verification of GANs [23.639074918667625]
  We propose a novel multi-bit box-free watermarking method for GANs with improved robustness against white-box attacks. The watermark is embedded by adding an extra watermarking loss term during GAN training. We show that the presence of the watermark has a negligible impact on the quality of the generated images.
  arXiv  Detail & Related papers  (2023-10-25T18:38:10Z)
• DICTION:DynamIC robusT whIte bOx watermarkiNg scheme for deep neural networks [2.8648861222787882]
  Deep neural network (DNN) watermarking is a suitable method for protecting the ownership of deep learning (DL) models.<n>In this paper, we first provide a unified framework for white box DNN watermarking schemes.<n>Next, we introduce DICTION, a new white-box Dynamic Robust watermarking scheme.
  arXiv  Detail & Related papers  (2022-10-27T19:48:26Z)

This list is automatically generated from the titles and abstracts of the papers in this site.

This site does not guarantee the quality of this site (including all information) and is not responsible for any consequences.