{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2025,12,18]],"date-time":"2025-12-18T19:59:09Z","timestamp":1766087949408,"version":"3.37.3"},"reference-count":28,"publisher":"Oxford University Press (OUP)","issue":"2","license":[{"start":{"date-parts":[[2022,12,30]],"date-time":"2022-12-30T00:00:00Z","timestamp":1672358400000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/academic.oup.com\/journals\/pages\/open_access\/funder_policies\/chorus\/standard_publication_model"}],"funder":[{"DOI":"10.13039\/501100001809","name":"National Science Foundation of China","doi-asserted-by":"publisher","award":["U20B2051","U1936214","U20A20178","62072114"],"award-info":[{"award-number":["U20B2051","U1936214","U20A20178","62072114"]}],"id":[{"id":"10.13039\/501100001809","id-type":"DOI","asserted-by":"publisher"}]}],"content-domain":{"domain":[],"crossmark-restriction":false},"short-container-title":[],"published-print":{"date-parts":[[2024,2,17]]},"abstract":"<jats:title>Abstract<\/jats:title>\n               <jats:p>Deep neural network model extraction attack is the process of retraining a surrogate model based on the outputs of a target model with a given set of inputs. Such attacks are hard to defend for the sake of model owners\u2019 interest. Recently, some work propose model watermarking scheme for image processing networks, which is able to prove the intellectual property of deep models even after the model extraction attack. This scheme makes sure that, once the target model (an image processing network) is watermarked, we can extract the watermark from the output of the surrogate model. In this paper, we propose a new model extraction attack scheme to fight against the latest method. Instead of directly using the output images of a target model, we propose to use their reconstructed versions for model retraining, where an asymmetrical UNet is proposed for image reconstruction. To thoroughly remove the watermarking traces, we propose and incorporate a referenced subspace attention module in the asymmetrical UNet, which removes the watermark by projecting the outputs of the target model into the subspaces of the reference image. Various experiments demonstrate the effectiveness of our attack.<\/jats:p>","DOI":"10.1093\/comjnl\/bxac190","type":"journal-article","created":{"date-parts":[[2022,12,31]],"date-time":"2022-12-31T06:23:06Z","timestamp":1672467786000},"page":"498-507","source":"Crossref","is-referenced-by-count":1,"title":["Removing Watermarks For Image Processing Networks Via Referenced Subspace Attention"],"prefix":"10.1093","volume":"67","author":[{"given":"Yuliang","family":"Xue","sequence":"first","affiliation":[{"name":"School of Computer Science, Fudan University , ShangHai 200438 , China"}]},{"given":"Yuhao","family":"Zhu","sequence":"additional","affiliation":[{"name":"School of Computer Science, Fudan University , ShangHai 200438 , China"}]},{"given":"Zhiying","family":"Zhu","sequence":"additional","affiliation":[{"name":"School of Computer Science, Fudan University , ShangHai 200438 , China"}]},{"given":"Sheng","family":"Li","sequence":"additional","affiliation":[{"name":"School of Computer Science, Fudan University , ShangHai 200438 , China"}]},{"given":"Zhenxing","family":"Qian","sequence":"additional","affiliation":[{"name":"School of Computer Science, Fudan University , ShangHai 200438 , China"}]},{"given":"Xinpeng","family":"Zhang","sequence":"additional","affiliation":[{"name":"School of Computer Science, Fudan University , ShangHai 200438 , China"}]}],"member":"286","published-online":{"date-parts":[[2022,12,30]]},"reference":[{"key":"2024021913330163100_ref1","doi-asserted-by":"crossref","first-page":"84","DOI":"10.1145\/3065386","article-title":"Imagenet classification with deep convolutional neural networks","volume":"60","author":"Krizhevsky","year":"2017","journal-title":"Communications of the ACM"},{"key":"2024021913330163100_ref2","doi-asserted-by":"crossref","first-page":"3387","DOI":"10.1109\/TCSVT.2020.2967754","article-title":"Occluded face recognition in the wild by identity-diversity inpainting","volume":"30","author":"Ge","year":"2020","journal-title":"IEEE Transactions on Circuits and Systems for Video Technology"},{"key":"2024021913330163100_ref3","first-page":"6000","volume-title":"Neural Information Processing Systems","author":"Vaswani","year":"2017"},{"key":"2024021913330163100_ref4","first-page":"2864","volume-title":"2022 IEEE International Conference on Acoustics, Speech and Signal Processing, Singapore","author":"Li","year":"2022"},{"key":"2024021913330163100_ref5","first-page":"1","volume-title":"2021 IEEE International Conference on Multimedia and Expo (ICME), Shenzhen, China, 5\u20139 July","author":"Zhong","year":"2021"},{"key":"2024021913330163100_ref6","doi-asserted-by":"crossref","first-page":"692","DOI":"10.1145\/3343031.3350887","volume-title":"the 27th ACM International Conference on Multimedia","author":"Ma","year":"2019"},{"key":"2024021913330163100_ref7","first-page":"3064","volume-title":"2022 IEEE International Conference on Acoustics, Speech and Signal Processing","author":"Li","year":"2022"},{"key":"2024021913330163100_ref8","doi-asserted-by":"crossref","first-page":"269","DOI":"10.1145\/3078971.3078974","volume-title":"Proceedings of the 2017 ACM on international conference on multimedia retrieval, Bucharest Romania, 6\u20139 June","author":"Uchida","year":"2017"},{"key":"2024021913330163100_ref9","doi-asserted-by":"crossref","first-page":"485","DOI":"10.1145\/3297858.3304051","volume-title":"Proceedings of the Twenty-Fourth International Conference on Architectural Support for Programming Languages and Operating Systems","author":"Darvish Rouhani","year":"2019"},{"key":"2024021913330163100_ref10","first-page":"1615","volume-title":"27th USENIX Security Symposium (USENIX Security 18), Baltimore, MD, USA, 15\u201317 August","author":"Adi","year":"2018"},{"key":"2024021913330163100_ref11","doi-asserted-by":"crossref","first-page":"1852","DOI":"10.1109\/TNNLS.2020.2991378","article-title":"Watermarking deep neural networks in image processing","volume":"32","author":"Quan","year":"2020","journal-title":"IEEE transactions on neural networks and learning systems"},{"key":"2024021913330163100_ref12","first-page":"4005","article-title":"Deep model intellectual property protection via deep watermarking","volume":"44","author":"Zhang","year":"2021","journal-title":"IEEE Trans. Pattern Anal. Mach. Intell."},{"key":"2024021913330163100_ref13","first-page":"601","volume-title":"25th USENIX security symposium (USENIX Security 16), Austin, TX, USA, 15\u201317 August","author":"Tram\u00e8r","year":"2016"},{"key":"2024021913330163100_ref14","first-page":"4954","volume-title":"Proceedings of the IEEE\/CVF conference on computer vision and pattern recognition, Long Beach, CA, USA, 15\u201320 June","author":"Orekondy","year":"2019"},{"key":"2024021913330163100_ref15","doi-asserted-by":"crossref","first-page":"512","DOI":"10.1109\/EuroSP.2019.00044","volume-title":"2019 IEEE European Symposium on Security and Privacy (EuroS&P), Stockholm, 17\u201319 June","author":"Juuti","year":"2019"},{"key":"2024021913330163100_ref16","first-page":"1","volume-title":"Proceedings of the Conference on Fairness, Accountability, and Transparency, GA, USA, 29\u201331 January","author":"Milli","year":"2019"},{"volume-title":"Good Artists Copy, Great Artists Steal: Model Extraction Attacks Against Image Translation Generative Adversarial Networks","year":"2021","author":"Szyller","key":"2024021913330163100_ref17"},{"key":"2024021913330163100_ref18","first-page":"1340","volume-title":"2020 Asia-Pacific Signal and Information Processing Association Annual Summit and Conference (APSIPA ASC), Auckland, New Zealand, 7\u201310 December","author":"Kuribayashi","year":"2020"},{"key":"2024021913330163100_ref19","doi-asserted-by":"crossref","first-page":"2591","DOI":"10.1109\/TCSVT.2020.3030671","article-title":"Watermarking neural networks with watermarked images","volume":"31","author":"Wu","year":"2020","journal-title":"IEEE Transactions on Circuits and Systems for Video Technology"},{"key":"2024021913330163100_ref20","first-page":"1937","volume-title":"30th USENIX Security Symposium (USENIX Security 21), Vancouver, B.C., Canada, 11\u201313 August","author":"Jia","year":"2021"},{"key":"2024021913330163100_ref21","doi-asserted-by":"crossref","first-page":"9233","DOI":"10.1007\/s00521-019-04434-z","article-title":"Adversarial frontier stitching for remote neural network watermarking","volume":"32","author":"Le Merrer","year":"2020","journal-title":"Neural Computing and Applications"},{"volume-title":"Deep neural network fingerprinting by conferrable adversarial examples","year":"2019","author":"Lukas","key":"2024021913330163100_ref22"},{"key":"2024021913330163100_ref23","doi-asserted-by":"crossref","first-page":"14","DOI":"10.1145\/3433210.3437526","volume-title":"Proceedings of the 2021 ACM Asia Conference on Computer and Communications Security, Hong Kong, 7\u201311 June","author":"Cao","year":"2021"},{"key":"2024021913330163100_ref24","first-page":"234","volume-title":"International Conference on Medical image computing and computer-assisted intervention, Munich, Germany, 5\u20139 October","author":"Ronneberger","year":"2015"},{"key":"2024021913330163100_ref25","first-page":"4896","volume-title":"Proceedings of the IEEE\/CVF Conference on Computer Vision and Pattern Recognition, Nashville, TN, USA, 20\u201325 June","author":"Cheng","year":"2021"},{"volume-title":"Very deep convolutional networks for large-scale image recognition","year":"2014","author":"Simonyan","key":"2024021913330163100_ref26"},{"key":"2024021913330163100_ref27","first-page":"695","volume-title":"Proceedings of the IEEE\/CVF Conference on Computer Vision and Pattern Recognition, Salt Lake City, Utah, USA, 18\u201322 June","author":"Zhang","year":"2018"},{"key":"2024021913330163100_ref28","first-page":"1184","volume-title":"Proceedings of the AAAI Conference on Artificial Intelligence, Vancouver Convention Centre, Vancouver, Canada, 2\u20139 February","author":"Cun","year":"2021"}],"container-title":["The Computer Journal"],"original-title":[],"language":"en","link":[{"URL":"https:\/\/academic.oup.com\/comjnl\/article-pdf\/67\/2\/498\/56701352\/bxac190.pdf","content-type":"application\/pdf","content-version":"vor","intended-application":"syndication"},{"URL":"https:\/\/academic.oup.com\/comjnl\/article-pdf\/67\/2\/498\/56701352\/bxac190.pdf","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2024,2,19]],"date-time":"2024-02-19T13:39:27Z","timestamp":1708349967000},"score":1,"resource":{"primary":{"URL":"https:\/\/academic.oup.com\/comjnl\/article\/67\/2\/498\/6965543"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2022,12,30]]},"references-count":28,"journal-issue":{"issue":"2","published-online":{"date-parts":[[2022,12,30]]},"published-print":{"date-parts":[[2024,2,17]]}},"URL":"https:\/\/doi.org\/10.1093\/comjnl\/bxac190","relation":{},"ISSN":["0010-4620","1460-2067"],"issn-type":[{"type":"print","value":"0010-4620"},{"type":"electronic","value":"1460-2067"}],"subject":[],"published-other":{"date-parts":[[2024,2]]},"published":{"date-parts":[[2022,12,30]]}}}