Q1: Technical Dependency: The success of the proposed attack appears to hinge on the success of a prior watermark removal attack. This reliance raises concerns about the robustness and independence of the proposed methodology. The author could benefit from discussing the potential limitations or edge cases where this assumption may not hold.

A: It is correct that the data preprocessing is very important in our proposed method. We have discussed this part in Section 6, where a more robust and advanced watermarking scheme could defeat our attack, if it can defeat watermark removal with diffusion models.

Q2: Impact on the Community: As a peer in the watermarking community, I find it difficult to see the positive social impact of this work. Could you give us some examples of how this work might indirectly contribute to improving watermarking techniques or to address potential misuse concerns?

A: We have discussed the potential social impact in Appendix H (original submission, Appendix J for revision) for both bad and good aspects. We want to emphasize that there are two benefits brought by our attack. First, in Section 6, we prove that the group-watermarking method is promising against Warfare. It provides the big companies with a lightweight scheme to improve their current watermarking methods, without developing new models. Second, our attack could become a red-teaming evaluation method to help companies develop more robust and secure watermarking schemes. Developers can adopt our method to test their current watermarking method and conduct specific adjustment to further defend attacks. We add these detailed discussions to the revision in Appendix J.

Q3: In section 6, you chose to use two-bit strings for one user, and the resultant bit error rate differs by around 7%. And from your Table 8, it seems that you use unique and fixed bit strings for all experiments. I wonder, for your results in table 1-6, if you test on different bit strings, what would the standard deviation look like?

A: The experiments in Section 6 are designed for potential defenses. It is different between previous experiment setups. Specifically, in Tables 1-6, only one bit string is assigned to a user. Therefore, there will be no standard deviation. In Section 6, we aim to show that assigning two or more bit strings for one user to improve the robustness and safety of existing watermarking systems is probable. Only in such a case, bit errors can be calculated for different bit strings. Additionally, we have studied the few-shot generalization ability of our attack in Table 5 with different bit strings. The results indicate the effectiveness of our attacks for different bit strings under one user one bit string cases.

Q4: In section 3.1, you mentioned 'We only consider the steganography approach, as it is much more robust and harder to attack than the signal transformation approach.' Can you elaborate on what you mean by the steganographic approach, and what is the difference between the signal transformation approach?

A: We introduce these two methods in Section 2.1 in the original submission. The steganography approach in our paper specifically stands for methods requiring a deep learning encoder and a corresponding decoder. These methods use a deep learning encoder to embed a secret message in an image. Then the decoder can extract the message from the image. The signal transformation approach in our paper stands for method using spread spectrum (SS), improved spread spectrum (ISS), quantization (QT) and so on, to embed message. For different transformations, there exists a specific extraction approach. Compared with steganography approaches, signal transformation methods are less robust. We add more details in Section 2.1 in our revision to make the differences clearer.

Q5: On the Table 3 caption it mentioned that the second best results are with underline, however for table 4, the second best result for bit ACC in the "watermark remove" section seems to be DM_l to me.

A: We fixed this typo in our revision. Thanks for pointing it out.

Q1: The proposed method is not intuitively sound. The method uses watermarked images and mediators (denoised versions of watermarked images) to train GAN. This does not sound a correct approach. The mediators are different from clean images, even the distributions are likely different.

A: The insight of our method is as follows: watermarked images and unwatermarked images are distinguishable to a detector, as differences should exist between two types of images. The differences could exist in the distribution or latent space. Therefore, we adopt mediators, which are different from watermarked images. But, our method does not require the mediators to have the exact same distribution as clean images. To make the images generated by our GAN closer to the clean distribution, we adopt a residual method in our GAN structure, which can be found in Appendix A. Therefore, our method does not face the aforementioned shortcomings. In particular, Reviewer iVML believes that our method is simple and effective. Reviewer z3hz thinks our method is innovative and practical. Besides, our experiments prove the effectiveness and correctness of the proposed method.

Q2: Evaluation is performed on CIFAR10 and CelebA datasets. These are toy datasets, and shouldn't be used any more in the era of generative AI. Or we cannot draw any conclusion based on such toy datasets.

A: Thanks for the suggestion. In addition to the experiments in our paper, we also add new results, attacking Stable Signature in our revision. Stable Signature is a prior watermarking method. The model owner trains a latent decoder for stable diffusion models, which can add a pre-fixed bit string to the generated image. The setups used in Stable Signature scheme are provided below. We fix the secret key as ‘111010110101000001010111010011010100010000100111', which is a bit string with length 48. The diffusion model used in Stable Signature is Stable Diffusion 2.1. During the generation process, we adopt the unconditional generation approach by setting the prompt empty to obtain images with 512*512 resolution. We sample 10,000 watermarked images for our attack method.

For baseline methods, we use a pretrained diffusion model based on ImageNet and the VAE from Stable Diffusion 1.4. Specifically, when using the diffusion model, we set the noise scale as 75 and set the number of sampling step as 15. The setup for the diffusion model is also adopted in our data preprocessing phase.

During the processing of GAN training phase, we set the hyperparameters $w_1$=10 and $w_2$=5 for watermark removal attack and set $w_1$=10 and $w_2$=100 for watermark forging attack.

We present the results in the table. The results indicate that our method is effective against this AIGC watermarking scheme. Even if we train the GAN models on a large resolution dataset, we can obtain models with high performance in both image quality and watermark removal (forging). We add these results to the revision in Appendix H with new visualization results.

Q3: The proposed method relies on training GAN, which is challenging for large datasets.

A: We improve the training process in our method.

• Reduce failure rate and improve the training effectiveness: We applied several approaches in our GAN training process to stabilize the training process, improve the performance, and ease the usage. First, we adopt a residual manner in GAN structure, as introduced in Appendix A. We increase or decrease the model size based on the resolution of input images. It helps us to obtain outputs with higher quality. Second, we use the discriminator loss from StyleGAN to further stabilize the training process of the discriminator. We further adopt alternate optimization strategies to avoid overfitting of the discriminator. Third, our training script supports Exponential Moving Average (EMA), which is a widely used trick in GAN training. With the above methods, we train our GANs more smoothly and stably. As shown in Figures 3 and 5, the performance of GANs is relatively stable. Besides, we provide all experiment code in our supplementary materials. These results are reproducible. We add these explanations to the revision in Appendix B.

• Scalability of our GAN training process: We show the scalability of our method on larger resolutions and AIGC images in previous question by training GANs on 512*512 images. These results are added to the revision in Appendix H.

Thank you to the authors for their responses. Unfortunately, I remain unconvinced. The evaluation could be significantly improved by including a broader range of watermarking techniques (e.g., Stable Signature would be a good starting point) on large datasets and additional baselines. The responses suggest that the authors are not fully aware of related works and are unwilling to conduct a comprehensive literature survey. I'm still not convinced by the justification of the method intuition. Additionally, training GANs for high-resolution images is a known challenge.

This is just an example of related work: https://arxiv.org/abs/2401.08573 . More can be found via a literature survey.

Q1: No Connection to AIGC. I recommend that the authors revise their claims about AIGC to reflect this focus.

A: Thanks a lot for the comments. We make revisions from two aspects. (1) Following your suggestion, we revise the claims to better reflect the focus in Section 5.1 in the revision. (2) We add new evaluation results about our method against an AIGC watermarking scheme, Stable Signature.

Stable Signature is a prior watermarking method. The model owner trains a latent decoder for stable diffusion models, which can add a pre-fixed bit string to the generated image. The setups used in Stable Signature scheme are provided below. We fix the secret key as ‘111010110101000001010111010011010100010000100111', which is a bit string with length 48. The diffusion model used in Stable Signature is Stable Diffusion 2.1. During the generation process, we adopt the unconditional generation approach by setting the prompt empty to obtain images with 512*512 resolution. We sample 10,000 watermarked images for our attack method.

For baseline methods, we use a pretrained diffusion model based on ImageNet and the VAE from Stable Diffusion 1.4. Specifically, when using the diffusion model, we set the noise scale as 75 and set the number of sampling step as 15. The setup for the diffusion model is also adopted in our data preprocessing phase.

During the processing of GAN training phase, we set the hyperparameters $w_1$=10 and $w_2$=5 for watermark removal attack and set $w_1$=10 and $w_2$=100 for watermark forging attack.

We present the results in the table. The results indicate that our method is effective against this AIGC watermarking scheme. Even if we train the GAN models on a large resolution dataset, we can obtain models with high performance in both image quality and watermark removal (forging). We add these results to the revision in Appendix H with new visualization results.

Q2: Training Success Risks. The proposed method relies on a GAN model, yet training GANs successfully is known to be challenging. Given the challenges in training GAN models, what specific measures or adjustments do the authors recommend to mitigate the risks of unsuccessful training?

A: There are several methods adopted in our training process.

• Reduce failure rate and improve the training effectiveness: We applied several approaches in our GAN training process to stabilize the training process, improve the performance, and ease the usage. First, we adopt a residual manner in GAN structure, as introduced in Appendix A. We increase or decrease the model size based on the resolution of input images. It helps us to obtain outputs with higher quality. Second, we use the discriminator loss from StyleGAN to further stabilize the training process of the discriminator. We further adopt alternate optimization strategies to avoid overfitting of the discriminator. Third, our training script supports Exponential Moving Average (EMA), which is a widely used trick in GAN training. With the above methods, we train our GANs more smoothly and stably. As shown in Figures 3 and 5, the performance of GANs is relatively stable. Besides, we provide all experiment code in our supplementary materials. These results are reproducible. We add these explanations to the revision in Appendix B.

• Scalability of our GAN training process: We show the scalability of our method on larger resolutions and AIGC images in previous question by training GANs on 512*512 images. These results are added to the revision in Appendix H.

Q1: Overclaimed Speedup and Hidden Training Costs. The authors could strengthen their claims by providing a more granular breakdown of time costs, including data preparation and model setup, rather than focusing solely on inference speed. What is the time cost associated with data preprocessing?

A: Thanks for your suggestions.

• For time cost of our method: We evaluate the time cost of attacking the Stable Signature watermarking scheme on 512×512 resolution images with 8 A6000 GPUs. During the data preprocessing phase, we employ a pre-trained diffusion model to remove watermarks for 10,000 images generated by the watermarked Stable Diffusion 2.1, taking a total runtime of 42.4 hours. In the GAN training phase, we achieve a forging accuracy of 99% in just 5 epochs, with a total runtime of 1.3 hours, and achieve a removal accuracy of 49% in 18 epochs, with a total runtime of 4.7 hours. During inference, it takes 1.84 seconds for our GAN to forge or remove the watermark of 10,000 images. Therefore, compared with diffusion-based method, our method brings a performance improvement with an additional time overhead of approximately 1.3 hours to forge the watermark and 4.7 hours to remove it. Notably, with the few-shot generalization abilities of our method, an attacker can fine-tune a pre-trained GAN using only 10 to 100 samples to remove or forge different watermarks, reducing data preprocessing and GAN training costs by 99%. Therefore, our method has better scalability, generalizability and efficiency in a long-term evaluation. We add these details to the revision in Appendix D.

• Efficient GAN training process: We applied several approaches in our GAN training process to stabilize the training process, improve the performance, and ease the usage. First, we adopt a residual manner in GAN structure, as introduced in Appendix A. We increase or decrease the model size based on the resolution of input images. It helps us to obtain outputs with higher quality. Second, we use the discriminator loss from StyleGAN to further stabilize the training process of the discriminator. We further adopt alternate optimization strategies to avoid overfitting of the discriminator. Third, our training script supports Exponential Moving Average (EMA), which is a widely used trick in GAN training. With the above methods, we train our GANs more smoothly and stably. As shown in Figures 3 and 5, the performance of GANs is relatively stable. Besides, we provide all experiment code in our supplementary materials. These results are reproducible. We add these explanations to the revision in Appendix B.

Q2: Unclear Justification for Integrating a GAN for Watermark Removal.

A: A pretrained diffusion model alone can remove watermarks, and GANs used in our method is to build a unified framework for watermark removal and forging, instead of improving processing speed. In Tables 3, 4, and 6, we show that using a diffusion model can successfully remove the watermark. However, diffusion models will decrease the FID and cannot achieve watermark forging attack. It motivates us to adopt a GAN model to achieve a better result with lower FID and build a unified framework for both types of attacks. We add this justification to the revision in Appendix C.

Q3: Questionable Black-Box Claim. This challenges the notion of a fully black-box approach, as the hidden information is limited to the embedded watermark and the hyperparameter bit string length, while the watermarking algorithm (StegaStamp) is determined.

A: There are three watermarking methods evaluated in our paper. Besides StegaStamp, we consider two different prior manners, which can be found in Section 5.4. In all experiments, we assume that the adversary has no information about the watermarking algorithm. The results show the attack works for all three methods. Therefore, our solution does not depend on the watermarking algorithms and is general. Besides, we evaluate an additional watermarking algorithm, Stable Signature, in our revision, which can be found in Appendix H. The new results prove our proposed attack is effective under black-box cases as well.

Q4: Is using only the pretrained diffusion model sufficient for effective watermark removal?

A: Yes, as shown in Tables 3, 4, and 6. A pretrained diffusion model is sufficient to remove watermark. However, it will harm the FID. The detailed discussion can be found in Appendix C.