Generating invisible adversarial watermarks based on block-matching embedding algorithm

Abstract

Adversarial attack methods against Deep Neural Network (DNN) models have received extensive attention and research. Adversarial attack methods mean adding subtle perturbations to the original image to mislead the recognition ability of the DNN model. How to improve the adversarial attack performance and protect the visual effect of the perturbation image is still the main challenge in this field. Based on an image block-matching embedding algorithm, this paper proposes a novel adversarial method of embedding invisible watermarks for generating adversarial examples for deceptive DNN models. Firstly, utilizing up-sampling techniques to increase the embedding capacity of the original image while ensuring the visual quality of the watermark image. Secondly, the watermark image is embedded into the original image in a chunked manner. The cosine similarity is utilized for block-matching and combined with invertible color transformation to embed the invisible watermark. Finally, the Simple Black-box Adversarial Attack(SimBA) is used to add adversarial perturbation to the watermark image to generate the invisible adversarial watermark. The inverse operation of this method ensures the reconstruction of the original watermark information. The experimental results show that the proposed method achieves an average attack success rate of 98.33% in different neural network models (VGG19, resnet101, SqueezeNet, ShuffleNet, ConvNext, and MaxViT), with an attack success rate of 99.05% in the ShuffleNet model, demonstrating the superiority of the proposed method over existing techniques. In addition, the generated invisible adversarial watermark performs well in terms of visual effects and robustness, providing additional concealment and effectively reducing the risk of detecting adversarial attacks.