A generative AI model can generate extremely realistic-looking content, posing growing challenges to the authenticity of information. To address the challenges, watermark has been leveraged to detect AI-generated content. Specifically, a watermark is embedded into an AI-generated content before it is released. A content is detected as AI-generated if a similar watermark can be decoded from it. In this work, we perform a systematic study on the robustness of such watermark-based AI-generated content detection. We focus on AI-generated images. Our work shows that an attacker can post-process a watermarked image via adding a small, human-imperceptible perturbation to it, such that the post-processed image evades detection while maintaining its visual quality. We show the effectiveness of our attack both theoretically and empirically. Moreover, to evade detection, our adversarial post-processing method adds much smaller perturbations to AI-generated images and thus better maintain their visual quality than existing popular post-processing methods such as JPEG compression, Gaussian blur, and Brightness/Contrast. Our work shows the insufficiency of existing watermark-based detection of AI-generated content, highlighting the urgent needs of new methods. Our code is publicly available: https://github.com/zhengyuan-jiang/WEvade.

翻译：生成式AI模型能够生成极其逼真的内容，对信息真实性构成日益严峻的挑战。为应对该挑战，水印技术被用于检测AI生成内容。具体而言，在AI生成内容发布前嵌入水印，若能从内容中解码出相似水印，则判定其为AI生成。本研究系统分析了此类基于水印的AI生成内容检测方法的鲁棒性，重点关注AI生成图像。研究表明，攻击者可通过添加微小的人眼不可察觉扰动对含水印图像进行后处理，使处理后图像既能规避检测，又能保持视觉质量。我们从理论与实证两个层面验证了攻击的有效性。此外，相较于JPEG压缩、高斯模糊、亮度/对比度调整等现有主流后处理方法，我们的对抗性后处理方法对AI生成图像添加的扰动幅度更小，从而能更好地维持其视觉质量。本研究揭示了现有基于水印的AI生成内容检测的不足，凸显了研发新方法的紧迫性。相关代码已公开于：https://github.com/zhengyuan-jiang/WEvade