Dual-Population Watermark Vaccine: Efficient and Imperceptible Adversarial Attack for Watermarked Image Protection

The current watermark-removal neural networks (WRNNs) can effectively remove the watermarks from watermarked images without damaging their host images, which poses a significant threat to image copyright protection. As one of the most effective technologies of preventing watermarks from being removed, the watermark vaccine generally attacks the WRNNs by generating and adding the adversarial perturbations to watermarked images. However, the existing watermark vaccine schemes perturb all the pixels of watermarked images, which makes it difficult to find a good trade-off between attack efficiency and imperceptibility. To address the above issues, we propose a Dual-Population Watermark Vaccine (DPWV) scheme. In this scheme, we formulate the task of adding adversarial perturbation as a bi-objective optimization problem, and address it by decoupling the space of adversarial perturbation addition to the Intensity Population (IP)-based and Position Population (PP)-based subspaces to search for the optimal solution. The extensive experiments demonstrate that the proposed scheme significantly outperforms the state-of-the-arts in the aspects of attack efficiency and imperceptibility, simultaneously, with the improvements of 45%-55% attack efficiency and 30%-40% attack imperceptibility.