Generally, there are two popular ways to protect image copyright, i.e., proactive protection (preventing illegal use via adversarial perturbation) and passive protection (verifying ownership by digital watermarking). However, since the perturbation and watermark embedded into an image will interfere with each other, directly embedding them into the image cannot achieve the proactive protection and passive protection, simultaneously. To address this issue, we propose an image copyright dual-protection approach, which embeds an Extractable and Imperceptible Adversarial Watermark (EIAW) in the image frequency-domain. Specifically, the adversarial watermark is automatically embedded and optimized in the manner of allowing for effectively attacking the Deep Neural Networks (DNNs) and accurately extracting the embedded watermark, simultaneously. Moreover, instead of using the pixel-domain constraints, i.e., $L_p$ norms, we introduce a frequency-domain constraint to optimize the watermark embedding locations. Experiments on ImageNet and CIFAR-10 demonstrate that the proposed EIAW achieves high attack effectiveness (up to 100%) and extraction accuracy (up to 93%), while maintaining good watermark imperceptibility.

Model watermark is a technique to protect the deep learning models’ copyright. However, existing watermark methods are vulnerable to watermark attack. In ambiguity attack, attacker can reversely construct the input according to the preset output, and utilize this input-output pair as forged watermark. In fine-tuning attack, attacker can remove watermark by performing fine-tuning operations on model. To overcome these limitations, this paper proposes a black-box watermark method called WaViR (Watermark based on Vision Reasoning). WaViR consists of three modules. In watermark construction, the original image is transformed into hash image by cryptographic hash function. These original and hash image form into input-output pair for watermark trigger set. In watermark embedding, the trigger set is utilized to train the image generation model. Besides, simulated fine[1]tuning is introduced to improve the robustness of watermark. In watermark verification, vision reasoning is applied for ownership verification. For specific image within the trigger set, if the SSIM between the model’s output image and hash image exceeds the threshold, then verification is successful. Owing to the irreversibility of hash function, attacker cannot reversely construct the input that has hash relation with the preset output. Results show that WaViR can resist ambiguity attack and fine-tuning attack.

Since different kinds of face forgeries leave similar forgery traces in videos, learning the common features from different kinds of forged faces would achieve promising generalization ability of forgery detection. Therefore, to accurately detect known forgeries while ensuring high generalization ability of detecting unknown forgeries, we propose an intra-inter network (IIN) for face forgery detection (FFD) in videos with continual learning. The proposed IIN mainly consists of three modules, i.e., intra-module, inter-module, and forged trace masking module (FTMM). Specifically, the intra-module is trained for each kind of face forgeries by supervised learning to extract special features, while the inter-module is trained by self-supervised learning to extract the common features. As a result, the common and special features of the different forgeries are decoupled by the two feature learning modules, and then the decoupled common features can be utlized to achieve high generalization ability for FFD. Moreover, the FTMM is deployed for contrastive learning to further improve detection accuracy. The experimental results on FaceForensic++ dataset demonstrate that the proposed IIN outperforms the state-of-the-arts in FFD. Also, the generalization ability of the IIN verified on DFDC and Celeb-DF datasets demonstrates that the proposed IIN significantly improves the generalization ability for FFD.