Watermark similarity restoration on DenseNet 0.2 NSO cat-ops attack ratio
100Clean SimilarityCANON
Evaluation results
| Method | Links | |||||||
|---|---|---|---|---|---|---|---|---|
| CANONWatermark Scheme=uchida17, Attack Variant=zero2026.03 | 100 | 0 | 0 | — | 50.78 | 100 | 48.44 | |
| CANONWatermark Scheme=uchida17, Attack Variant=clique2026.03 | 100 | 0 | 0 | — | 45.31 | 100 | 48.44 | |
| CANONWatermark Scheme=uchida17, Attack Variant=split2026.03 | 100 | 0 | 0 | — | 50 | 100 | 57.03 | |
| CANONWatermark Scheme=uchida17, Attack Variant=mix-opseq2026.03 | 100 | 0 | 0 | — | 44.53 | 100 | 58.59 | |
| CANONWatermark Scheme=uchida17, Attack Variant=mix-opseq (per-merge-group)2026.03 | 100 | 0 | 0 | — | 44.53 | 100 | 43.75 | |
| CANONWatermark Scheme=greedy, Attack Variant=zero2026.03 | 100 | 0 | 0 | — | 45.31 | 100 | 46.09 | |
| CANONWatermark Scheme=greedy, Attack Variant=clique2026.03 | 100 | 0 | 0 | — | 50 | 100 | 46.09 | |
| CANONWatermark Scheme=greedy, Attack Variant=split2026.03 | 100 | 0 | 0 | — | 47.66 | 100 | 53.91 | |
| CANONWatermark Scheme=greedy, Attack Variant=mix-opseq2026.03 | 100 | 0 | 0 | — | 45.31 | 100 | 39.84 | |
| CANONWatermark Scheme=greedy, Attack Variant=mix-opseq (per-merge-group)2026.03 | 100 | 0 | 0 | — | 63.28 | 100 | 49.22 | |
| CANONWatermark Scheme=lottery, Attack Variant=zero2026.03 | 100 | 0 | 0 | — | 50.78 | 100 | 50.78 | |
| CANONWatermark Scheme=lottery, Attack Variant=clique2026.03 | 100 | 0 | 0 | — | 51.56 | 100 | 50.78 | |
| CANONWatermark Scheme=lottery, Attack Variant=split2026.03 | 100 | 0 | 0 | — | 50 | 100 | 50.78 | |
| CANONWatermark Scheme=lottery, Attack Variant=mix-opseq2026.03 | 100 | 0 | 0 | — | 49.22 | 100 | 50 | |
| CANONWatermark Scheme=lottery, Attack Variant=mix-opseq (per-merge-group)2026.03 | 100 | 0 | 0 | — | 54.69 | 100 | 50 | |
| CANONWatermark Scheme=ipr_gan, Attack Variant=zero2026.03 | 100 | 0 | 0 | — | 49.22 | 100 | 49.22 | |
| CANONWatermark Scheme=ipr_gan, Attack Variant=clique2026.03 | 100 | 0 | 0 | — | 50 | 100 | 49.22 | |
| CANONWatermark Scheme=ipr_gan, Attack Variant=split2026.03 | 100 | 0 | 0 | — | 49.22 | 100 | 50 | |
| CANONWatermark Scheme=ipr_gan, Attack Variant=mix-opseq2026.03 | 100 | 0 | 0 | — | 47.66 | 100 | 46.88 | |
| CANONWatermark Scheme=ipr_gan, Attack Variant=mix-opseq (per-merge-group)2026.03 | 100 | 0 | 0 | — | 50 | 100 | 53.12 | |
| CANONWatermark Scheme=riga21, Attack Variant=zero2026.03 | 100 | 0 | 0 | — | 49.22 | 100 | 95.31 | |
| CANONWatermark Scheme=riga21, Attack Variant=clique2026.03 | 100 | 0 | 0 | — | 49.22 | 100 | 95.31 | |
| CANONWatermark Scheme=riga21, Attack Variant=split2026.03 | 100 | 0 | 0 | — | 49.22 | 100 | 95.31 | |
| CANONWatermark Scheme=riga21, Attack Variant=mix-opseq2026.03 | 100 | 0 | 0 | — | 49.22 | 100 | 95.31 | |
| CANONWatermark Scheme=riga21, Attack Variant=mix-opseq (per-merge-group)2026.03 | 100 | 0 | 0 | — | 49.22 | 100 | 95.31 | |
| CANONWatermark Scheme=deepsigns, Attack Variant=zero2026.03 | 100 | 0 | 0 | — | 48.44 | 100 | 50.78 | |
| CANONWatermark Scheme=deepsigns, Attack Variant=clique2026.03 | 100 | 0 | 0 | — | 49.22 | 100 | 50.78 | |
| CANONWatermark Scheme=deepsigns, Attack Variant=split2026.03 | 100 | 0 | 0 | — | 49.22 | 100 | 53.12 | |
| CANONWatermark Scheme=deepsigns, Attack Variant=mix-opseq2026.03 | 100 | 0 | 0 | — | 50.78 | 100 | 48.44 | |
| CANONWatermark Scheme=deepsigns, Attack Variant=mix-opseq (per-merge-group)2026.03 | 100 | 0 | 0 | — | 50.78 | 100 | 56.25 | |
| CANONWatermark Scheme=deepipr, Attack Variant=zero2026.03 | 100 | 0 | 0 | — | 40.62 | 100 | 46.88 | |
| CANONWatermark Scheme=deepipr, Attack Variant=clique2026.03 | 100 | 0 | 0 | — | 40.62 | 100 | 46.88 | |
| CANONWatermark Scheme=deepipr, Attack Variant=split2026.03 | 100 | 0 | 0 | — | 40.62 | 100 | 56.25 | |
| CANONWatermark Scheme=deepipr, Attack Variant=mix-opseq2026.03 | 100 | 0 | 0 | — | 40.62 | 100 | 54.69 | |
| CANONWatermark Scheme=deepipr, Attack Variant=mix-opseq (per-merge-group)2026.03 | 100 | 0 | 0 | — | 40.62 | 100 | 53.12 | |
| CANONWatermark Scheme=passport_aware, Attack Variant=zero2026.03 | 100 | 0 | 0 | — | 48.44 | 100 | 39.84 | |
| CANONWatermark Scheme=passport_aware, Attack Variant=clique2026.03 | 100 | 0 | 0 | — | 44.53 | 100 | 39.84 | |
| CANONWatermark Scheme=passport_aware, Attack Variant=split2026.03 | 100 | 0 | 0 | — | 51.56 | 100 | 42.97 | |
| CANONWatermark Scheme=passport_aware, Attack Variant=mix-opseq2026.03 | 100 | 0 | 0 | — | 49.22 | 100 | 48.44 | |
| CANONWatermark Scheme=passport_aware, Attack Variant=mix-opseq (per-merge-group)2026.03 | 100 | 0 | 0 | — | 54.69 | 100 | 51.56 | |
| CANONWatermark Scheme=ipr_ic, Attack Variant=zero2026.03 | 99.22 | 0 | 0 | — | 45.31 | 99.22 | 56.25 | |
| CANONWatermark Scheme=ipr_ic, Attack Variant=clique2026.03 | 99.22 | 0 | 0 | — | 54.69 | 99.22 | 56.25 | |
| CANONWatermark Scheme=ipr_ic, Attack Variant=split2026.03 | 99.22 | 0 | 0 | — | 53.91 | 99.22 | 50 | |
| CANONWatermark Scheme=ipr_ic, Attack Variant=mix-opseq2026.03 | 99.22 | 0 | 0 | — | 48.44 | 99.22 | 39.06 | |
| CANONWatermark Scheme=ipr_ic, Attack Variant=mix-opseq (per-merge-group)2026.03 | 99.22 | 0 | 0 | — | 53.12 | 99.22 | 49.22 |