Image Copyright Dual-Protection Based on Extractable and Imperceptible Adversarial Watermark

Generally, there are two popular ways to protect image copyright, i.e., proactive protection (preventing illegal use via adversarial perturbation) and passive protection (verifying ownership by digital watermarking). However, since the perturbation and watermark embedded into an image will interfere with each other, directly embedding them into the image cannot achieve the proactive protection and passive protection, simultaneously. To address this issue, we propose an image copyright dual-protection approach, which embeds an Extractable and Imperceptible Adversarial Watermark (EIAW) in the image frequency-domain. Specifically, the adversarial watermark is automatically embedded and optimized in the manner of allowing for effectively attacking the Deep Neural Networks (DNNs) and accurately extracting the embedded watermark, simultaneously. Moreover, instead of using the pixel-domain constraints, i.e., $L_p$ norms, we introduce a frequency-domain constraint to optimize the watermark embedding locations. Experiments on ImageNet and CIFAR-10 demonstrate that the proposed EIAW achieves high attack effectiveness (up to 100%) and extraction accuracy (up to 93%), while maintaining good watermark imperceptibility.