A generative AI model -- such as DALL-E, Stable Diffusion, and ChatGPT -- can generate extremely realistic-looking content, posing growing challenges to the authenticity of information. To address the challenges, watermark has been leveraged to detect AI-generated content. Specifically, a watermark is embedded into an AI-generated content before it is released. A content is detected as AI-generated if a similar watermark can be decoded from it. In this work, we perform a systematic study on the robustness of such watermark-based AI-generated content detection. We focus on AI-generated images. Our work shows that an attacker can post-process an AI-generated watermarked image via adding a small, human-imperceptible perturbation to it, such that the post-processed AI-generated image evades detection while maintaining its visual quality. We demonstrate the effectiveness of our attack both theoretically and empirically. Moreover, to evade detection, our adversarial post-processing method adds much smaller perturbations to the AI-generated images and thus better maintain their visual quality than existing popular image post-processing methods such as JPEG compression, Gaussian blur, and Brightness/Contrast. Our work demonstrates the insufficiency of existing watermark-based detection of AI-generated content, highlighting the urgent needs of new detection methods.

翻译：生成式AI模型（如DALL-E、Stable Diffusion和ChatGPT）能够生成极其逼真的内容，对信息的真实性构成日益严峻的挑战。为应对这一挑战，水印技术被用于检测AI生成内容。具体而言，水印在AI生成内容发布前嵌入其中。若能从内容中解码出相似的水印，则该内容被判定为AI生成。本研究系统性地探讨了此类基于水印的AI生成内容检测的鲁棒性，重点关注AI生成的图像。研究表明，攻击者可通过向带有水印的AI生成图像添加微小、人类不可察觉的扰动，使得处理后的图像既能规避检测，又能保持其视觉质量。我们从理论和实证两方面证明了攻击的有效性。此外，与现有流行的图像后处理方法（如JPEG压缩、高斯模糊和亮度/对比度调整）相比，我们的对抗性后处理方法为规避检测而对AI生成图像添加的扰动更小，从而更好地保留了图像的视觉质量。我们的工作揭示了现有基于水印的AI生成内容检测的不足，凸显了对新型检测方法的迫切需求。