{"id":"https://openalex.org/W7138310528","doi":"https://doi.org/10.1609/aaai.v40i24.39041","title":"Removing Box-Free Watermarks for Image-to-Image Models via Query-Based Reverse Engineering","display_name":"Removing Box-Free Watermarks for Image-to-Image Models via Query-Based Reverse Engineering","publication_year":2026,"publication_date":"2026-03-14","ids":{"openalex":"https://openalex.org/W7138310528","doi":"https://doi.org/10.1609/aaai.v40i24.39041"},"language":null,"primary_location":{"id":"doi:10.1609/aaai.v40i24.39041","is_oa":true,"landing_page_url":"https://doi.org/10.1609/aaai.v40i24.39041","pdf_url":null,"source":{"id":"https://openalex.org/S4210191458","display_name":"Proceedings of the AAAI Conference on Artificial Intelligence","issn_l":"2159-5399","issn":["2159-5399","2374-3468"],"is_oa":true,"is_in_doaj":false,"is_core":false,"host_organization":"https://openalex.org/P4310320058","host_organization_name":"Association for the Advancement of Artificial Intelligence","host_organization_lineage":["https://openalex.org/P4310320058"],"host_organization_lineage_names":["Association for the Advancement of Artificial Intelligence"],"type":"conference"},"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Proceedings of the AAAI Conference on Artificial Intelligence","raw_type":"journal-article"},"type":"conference-paper","indexed_in":["crossref"],"open_access":{"is_oa":true,"oa_status":"diamond","oa_url":"https://doi.org/10.1609/aaai.v40i24.39041","any_repository_has_fulltext":false},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5104279460","display_name":"Haonan An","orcid":"https://orcid.org/0009-0005-6874-0229"},"institutions":[{"id":"https://openalex.org/I168719708","display_name":"City University of Hong Kong","ror":"https://ror.org/03q8dnn23","country_code":"HK","type":"education","lineage":["https://openalex.org/I168719708"]}],"countries":["HK"],"is_corresponding":false,"raw_author_name":"Haonan An","raw_affiliation_strings":["City University of Hong Kong"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"City University of Hong Kong","institution_ids":["https://openalex.org/I168719708"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5129652072","display_name":"Guang Hua","orcid":null},"institutions":[{"id":"https://openalex.org/I168639165","display_name":"Singapore Institute of Technology","ror":"https://ror.org/01v2c2791","country_code":"SG","type":"education","lineage":["https://openalex.org/I168639165"]}],"countries":["SG"],"is_corresponding":false,"raw_author_name":"Guang Hua","raw_affiliation_strings":["Singapore Institute of Technology"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Singapore Institute of Technology","institution_ids":["https://openalex.org/I168639165"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5013699453","display_name":"Hangcheng Cao","orcid":"https://orcid.org/0000-0002-0957-8576"},"institutions":[{"id":"https://openalex.org/I168719708","display_name":"City University of Hong Kong","ror":"https://ror.org/03q8dnn23","country_code":"HK","type":"education","lineage":["https://openalex.org/I168719708"]}],"countries":["HK"],"is_corresponding":false,"raw_author_name":"Hangcheng Cao","raw_affiliation_strings":["City University of Hong Kong"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"City University of Hong Kong","institution_ids":["https://openalex.org/I168719708"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5129749374","display_name":"Zhengru Fang","orcid":null},"institutions":[{"id":"https://openalex.org/I168719708","display_name":"City University of Hong Kong","ror":"https://ror.org/03q8dnn23","country_code":"HK","type":"education","lineage":["https://openalex.org/I168719708"]}],"countries":["HK"],"is_corresponding":false,"raw_author_name":"Zhengru Fang","raw_affiliation_strings":["City University of Hong Kong"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"City University of Hong Kong","institution_ids":["https://openalex.org/I168719708"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5129657149","display_name":"Guowen Xu","orcid":null},"institutions":[{"id":"https://openalex.org/I150229711","display_name":"University of Electronic Science and Technology of China","ror":"https://ror.org/04qr3zq92","country_code":"CN","type":"education","lineage":["https://openalex.org/I150229711"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Guowen Xu","raw_affiliation_strings":["University of Electronic Science and Technology of China"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"University of Electronic Science and Technology of China","institution_ids":["https://openalex.org/I150229711"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5129732544","display_name":"Susanto Rahardja","orcid":null},"institutions":[{"id":"https://openalex.org/I168639165","display_name":"Singapore Institute of Technology","ror":"https://ror.org/01v2c2791","country_code":"SG","type":"education","lineage":["https://openalex.org/I168639165"]}],"countries":["SG"],"is_corresponding":false,"raw_author_name":"Susanto Rahardja","raw_affiliation_strings":["Singapore Institute of Technology"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Singapore Institute of Technology","institution_ids":["https://openalex.org/I168639165"]}]},{"author_position":"last","author":{"id":"https://openalex.org/A5016290340","display_name":"Yuguang Fang","orcid":"https://orcid.org/0000-0002-1079-3871"},"institutions":[{"id":"https://openalex.org/I168719708","display_name":"City University of Hong Kong","ror":"https://ror.org/03q8dnn23","country_code":"HK","type":"education","lineage":["https://openalex.org/I168719708"]}],"countries":["HK"],"is_corresponding":false,"raw_author_name":"Yuguang Fang","raw_affiliation_strings":["City University of Hong Kong"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"City University of Hong Kong","institution_ids":["https://openalex.org/I168719708"]}]}],"institutions":[],"countries_distinct_count":3,"institutions_distinct_count":3,"corresponding_author_ids":[],"corresponding_institution_ids":[],"apc_list":null,"apc_paid":null,"fwci":null,"has_fulltext":false,"cited_by_count":0,"citation_normalized_percentile":null,"cited_by_percentile_year":null,"biblio":{"volume":"40","issue":"24","first_page":"19615","last_page":"19622"},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T11689","display_name":"Adversarial Robustness in Machine Learning","score":0.359499990940094,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T11689","display_name":"Adversarial Robustness in Machine Learning","score":0.359499990940094,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T10388","display_name":"Advanced Steganography and Watermarking Techniques","score":0.20469999313354492,"subfield":{"id":"https://openalex.org/subfields/1707","display_name":"Computer Vision and Pattern Recognition"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T10775","display_name":"Generative Adversarial Networks and Image Synthesis","score":0.2037000060081482,"subfield":{"id":"https://openalex.org/subfields/1707","display_name":"Computer Vision and Pattern Recognition"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/watermark","display_name":"Watermark","score":0.6132000088691711},{"id":"https://openalex.org/keywords/image","display_name":"Image (mathematics)","score":0.5874999761581421},{"id":"https://openalex.org/keywords/digital-watermarking","display_name":"Digital watermarking","score":0.5806999802589417},{"id":"https://openalex.org/keywords/vulnerability","display_name":"Vulnerability (computing)","score":0.5626999735832214},{"id":"https://openalex.org/keywords/exploit","display_name":"Exploit","score":0.5600000023841858},{"id":"https://openalex.org/keywords/process","display_name":"Process (computing)","score":0.5471000075340271},{"id":"https://openalex.org/keywords/image-restoration","display_name":"Image restoration","score":0.47870001196861267},{"id":"https://openalex.org/keywords/property","display_name":"Property (philosophy)","score":0.4729999899864197}],"concepts":[{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.7289000153541565},{"id":"https://openalex.org/C164112704","wikidata":"https://www.wikidata.org/wiki/Q7974348","display_name":"Watermark","level":3,"score":0.6132000088691711},{"id":"https://openalex.org/C115961682","wikidata":"https://www.wikidata.org/wiki/Q860623","display_name":"Image (mathematics)","level":2,"score":0.5874999761581421},{"id":"https://openalex.org/C150817343","wikidata":"https://www.wikidata.org/wiki/Q875932","display_name":"Digital watermarking","level":3,"score":0.5806999802589417},{"id":"https://openalex.org/C154945302","wikidata":"https://www.wikidata.org/wiki/Q11660","display_name":"Artificial intelligence","level":1,"score":0.5774000287055969},{"id":"https://openalex.org/C95713431","wikidata":"https://www.wikidata.org/wiki/Q631425","display_name":"Vulnerability (computing)","level":2,"score":0.5626999735832214},{"id":"https://openalex.org/C165696696","wikidata":"https://www.wikidata.org/wiki/Q11287","display_name":"Exploit","level":2,"score":0.5600000023841858},{"id":"https://openalex.org/C98045186","wikidata":"https://www.wikidata.org/wiki/Q205663","display_name":"Process (computing)","level":2,"score":0.5471000075340271},{"id":"https://openalex.org/C106430172","wikidata":"https://www.wikidata.org/wiki/Q6002272","display_name":"Image restoration","level":4,"score":0.47870001196861267},{"id":"https://openalex.org/C189950617","wikidata":"https://www.wikidata.org/wiki/Q937228","display_name":"Property (philosophy)","level":2,"score":0.4729999899864197},{"id":"https://openalex.org/C55020928","wikidata":"https://www.wikidata.org/wiki/Q3813865","display_name":"Image quality","level":3,"score":0.4603999853134155},{"id":"https://openalex.org/C31972630","wikidata":"https://www.wikidata.org/wiki/Q844240","display_name":"Computer vision","level":1,"score":0.4325000047683716},{"id":"https://openalex.org/C207850805","wikidata":"https://www.wikidata.org/wiki/Q269608","display_name":"Reverse engineering","level":2,"score":0.4293000102043152},{"id":"https://openalex.org/C94966114","wikidata":"https://www.wikidata.org/wiki/Q29256","display_name":"Black box","level":2,"score":0.4214000105857849},{"id":"https://openalex.org/C9417928","wikidata":"https://www.wikidata.org/wiki/Q1070689","display_name":"Image processing","level":3,"score":0.36309999227523804},{"id":"https://openalex.org/C2779530757","wikidata":"https://www.wikidata.org/wiki/Q1207505","display_name":"Quality (philosophy)","level":2,"score":0.359499990940094},{"id":"https://openalex.org/C3073032","wikidata":"https://www.wikidata.org/wiki/Q15912075","display_name":"Information hiding","level":3,"score":0.30570000410079956},{"id":"https://openalex.org/C124101348","wikidata":"https://www.wikidata.org/wiki/Q172491","display_name":"Data mining","level":1,"score":0.30300000309944153},{"id":"https://openalex.org/C119857082","wikidata":"https://www.wikidata.org/wiki/Q2539","display_name":"Machine learning","level":1,"score":0.2973000109195709},{"id":"https://openalex.org/C1893757","wikidata":"https://www.wikidata.org/wiki/Q3653001","display_name":"Inversion (geology)","level":3,"score":0.2939999997615814},{"id":"https://openalex.org/C108583219","wikidata":"https://www.wikidata.org/wiki/Q197536","display_name":"Deep learning","level":2,"score":0.29190000891685486},{"id":"https://openalex.org/C26517878","wikidata":"https://www.wikidata.org/wiki/Q228039","display_name":"Key (lock)","level":2,"score":0.2874000072479248},{"id":"https://openalex.org/C11413529","wikidata":"https://www.wikidata.org/wiki/Q8366","display_name":"Algorithm","level":1,"score":0.27970001101493835},{"id":"https://openalex.org/C153180895","wikidata":"https://www.wikidata.org/wiki/Q7148389","display_name":"Pattern recognition (psychology)","level":2,"score":0.27559998631477356},{"id":"https://openalex.org/C34974158","wikidata":"https://www.wikidata.org/wiki/Q131257","display_name":"Intellectual property","level":2,"score":0.2508000135421753}],"mesh":[],"locations_count":1,"locations":[{"id":"doi:10.1609/aaai.v40i24.39041","is_oa":true,"landing_page_url":"https://doi.org/10.1609/aaai.v40i24.39041","pdf_url":null,"source":{"id":"https://openalex.org/S4210191458","display_name":"Proceedings of the AAAI Conference on Artificial Intelligence","issn_l":"2159-5399","issn":["2159-5399","2374-3468"],"is_oa":true,"is_in_doaj":false,"is_core":false,"host_organization":"https://openalex.org/P4310320058","host_organization_name":"Association for the Advancement of Artificial Intelligence","host_organization_lineage":["https://openalex.org/P4310320058"],"host_organization_lineage_names":["Association for the Advancement of Artificial Intelligence"],"type":"conference"},"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Proceedings of the AAAI Conference on Artificial Intelligence","raw_type":"journal-article"}],"best_oa_location":{"id":"doi:10.1609/aaai.v40i24.39041","is_oa":true,"landing_page_url":"https://doi.org/10.1609/aaai.v40i24.39041","pdf_url":null,"source":{"id":"https://openalex.org/S4210191458","display_name":"Proceedings of the AAAI Conference on Artificial Intelligence","issn_l":"2159-5399","issn":["2159-5399","2374-3468"],"is_oa":true,"is_in_doaj":false,"is_core":false,"host_organization":"https://openalex.org/P4310320058","host_organization_name":"Association for the Advancement of Artificial Intelligence","host_organization_lineage":["https://openalex.org/P4310320058"],"host_organization_lineage_names":["Association for the Advancement of Artificial Intelligence"],"type":"conference"},"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Proceedings of the AAAI Conference on Artificial Intelligence","raw_type":"journal-article"},"sustainable_development_goals":[],"awards":[],"funders":[],"has_content":{"pdf":false,"grobid_xml":false},"content_urls":null,"referenced_works_count":0,"referenced_works":[],"related_works":[],"abstract_inverted_index":{"The":[0],"intellectual":[1],"property":[2,155],"of":[3,101,156,166,204],"deep":[4],"generative":[5],"networks":[6],"(GNets)":[7],"can":[8,81],"be":[9,83],"protected":[10],"using":[11],"a":[12,37,162],"cascaded":[13],"hiding":[14],"network":[15],"(HNet)":[16],"which":[17,121],"embeds":[18],"watermarks":[19],"(or":[20],"marks)":[21],"into":[22],"GNet":[23,31,79],"outputs,":[24],"known":[25],"as":[26],"box-free":[27,157,225],"watermarking.":[28,227],"Although":[29],"both":[30,185],"and":[32,49,59,93,160,179],"HNet":[33,53,114],"are":[34],"encapsulated":[35],"in":[36,62,70,224],"black":[38],"box":[39],"(called":[40],"operation":[41],"network,":[42],"or":[43],"ONet),":[44],"with":[45,129,168],"only":[46],"the":[47,77,91,97,102,116,126,152,201,212,221],"generated":[48,92],"marked":[50],"outputs":[51,80],"from":[52],"being":[54],"released":[55],"to":[56,108,124,219],"end":[57],"users":[58],"deemed":[60],"secure,":[61],"this":[63,136],"paper,":[64],"we":[65,74,122,145],"reveal":[66],"an":[67,110,148],"overlooked":[68],"vulnerability":[69,223],"such":[71],"systems.":[72],"Specifically,":[73],"show":[75],"that":[76,184],"hidden":[78],"still":[82],"reliably":[84],"estimated":[85],"via":[86],"query-based":[87],"reverse":[88],"engineering,":[89],"leaking":[90],"unmarked":[94],"images,":[95],"despite":[96],"attacker's":[98],"limited":[99],"knowledge":[100],"system.":[103],"Our":[104],"first":[105],"attempt":[106],"is":[107],"reverse-engineer":[109],"inverse":[111],"model":[112,158,165,226],"for":[113,120,215],"under":[115],"stringent":[117],"black-box":[118],"condition,":[119],"propose":[123,147],"exploit":[125],"query":[127],"process":[128],"specially":[130],"curated":[131],"input":[132],"images.":[133],"While":[134],"effective,":[135],"method":[137,150],"yields":[138],"unsatisfactory":[139],"image":[140,170,177,180,198],"quality.":[141],"To":[142],"improve":[143],"this,":[144],"subsequently":[146],"alternative":[149],"leveraging":[151],"equivalent":[153],"additive":[154],"watermarking":[159],"reverse-engineering":[161],"forward":[163],"surrogate":[164],"HNet,":[167],"better":[169],"quality":[171,199],"preservation.":[172],"Extensive":[173],"experimental":[174],"results":[175],"on":[176],"processing":[178],"generation":[181],"tasks":[182],"demonstrate":[183],"attacks":[186],"achieve":[187],"impressive":[188],"watermark":[189],"removal":[190],"success":[191],"rates":[192],"(100%)":[193],"while":[194],"also":[195],"maintaining":[196],"excellent":[197],"(reaching":[200],"highest":[202],"PSNR":[203],"34.69":[205],"dB),":[206],"substantially":[207],"outperforming":[208],"existing":[209],"attacks,":[210],"highlighting":[211],"urgent":[213],"need":[214],"robust":[216],"defensive":[217],"strategies":[218],"mitigate":[220],"identified":[222]},"counts_by_year":[],"updated_date":"2026-07-14T23:27:15.235271","created_date":"2026-03-18T00:00:00"}