Fine-tuning Is Not Enough: A Simple yet Effective Watermark Removal
  Attack for DNN Models
  Watermarking has become the tendency in protecting the intellectual property
of DNN models. Recent works, from the adversary's perspective, attempted to
subvert watermarking mechanisms by designing watermark removal attacks.
However, these attacks mainly adopted sophisticated fine-tuning techniques,
which have certain fatal drawbacks or unrealistic assumptions. In this paper,
we propose a novel watermark removal attack from a different perspective.
Instead of just fine-tuning the watermarked models, we design a simple yet
powerful transformation algorithm by combining imperceptible pattern embedding
and spatial-level transformations, which can effectively and blindly destroy
the memorization of watermarked models to the watermark samples. We also
introduce a lightweight fine-tuning strategy to preserve the model performance.
Our solution requires much less resource or knowledge about the watermarking
scheme than prior works. Extensive experimental results indicate that our
attack can bypass state-of-the-art watermarking solutions with very high
success rates. Based on our attack, we propose watermark augmentation
techniques to enhance the robustness of existing watermarks.
