The paper introduces a spoofing attack: a random noise image is watermarked by the target method, then blended (added) to a clean ImageNet image. The watermark signature in the noise causes the detector to classify the resulting image as watermarked. AUROC drops for all tested methods: DWT-DCT from 0.7550 to 0.6421, DWT-DCT-SVD from 0.8185 to 0.7533, RivaGAN from 0.9991 to 0.9965, and TreeRing from 0.9116 to 0.7134. RivaGAN is the most robust to this attack, but even it shows degradation at low FPR regimes.
RivaGAN is most robust to spoofing; at low FPR regimes some RivaGAN images can still be spoofed. Attack requires black-box access to the watermarking method to generate the watermarked noise.