{"about":{"site":"https://codewithpapers.app","non_affiliation":"Code with Papers and Syntology are not affiliated with, endorsed by, or sponsored by Papers with Code, Meta, or the pwc-archive mirror.","licence":"CC BY-SA 4.0","licence_url":"https://creativecommons.org/licenses/by-sa/4.0/legalcode","attribution":"https://codewithpapers.app/attribution","modified":"archive material modified by Syntology; see the attribution page"},"url":"/paper/spy-watermark-robust-invisible-watermarking","title":"Spy-Watermark: Robust Invisible Watermarking for Backdoor Attack","arxiv_id":"2401.02031","date":"2024-01-04","proceeding":null,"authors":["Ruofei Wang","Renjie Wan","Zongyu Guo","Qing Guo","Rui Huang"],"abstract":"Backdoor attack aims to deceive a victim model when facing backdoor instances while maintaining its performance on benign data. Current methods use manual patterns or special perturbations as triggers, while they often overlook the robustness against data corruption, making backdoor attacks easy to defend in practice. To address this issue, we propose a novel backdoor attack method named Spy-Watermark, which remains effective when facing data collapse and backdoor defense. Therein, we introduce a learnable watermark embedded in the latent domain of images, serving as the trigger. Then, we search for a watermark that can withstand collapse during image decoding, cooperating with several anti-collapse operations to further enhance the resilience of our trigger against data corruption. Extensive experiments are conducted on CIFAR10, GTSRB, and ImageNet datasets, demonstrating that Spy-Watermark overtakes ten state-of-the-art methods in terms of robustness and stealthiness.","url_abs":"https://arxiv.org/abs/2401.02031v1","url_pdf":"https://arxiv.org/pdf/2401.02031v1.pdf","source":{"archive":"pwc-archive (Hugging Face), CC BY-SA 4.0","snapshot":"2025-07-28","licence_url":"https://creativecommons.org/licenses/by-sa/4.0/legalcode","row_kind":"abstracts"},"code_links":[{"paper_slug":"spy-watermark-robust-invisible-watermarking","repo_url":"https://github.com/rfww/spy-watermark","is_official":1,"mentioned_in_paper":0,"mentioned_in_github":0,"framework":"pytorch","reach":{"status":"ok"}}],"tasks":[{"task_slug":"backdoor-attack","task_name":"Backdoor Attack"},{"task_slug":"backdoor-defense","task_name":"backdoor defense"}],"methods":[],"datasets_introduced":[],"methods_introduced":[],"results":[],"syntology":{"syntology_url":"https://syntology.ai/paper/2401.02031","atlas_url":"https://app.syntology.ai/?focus=2401.02031","mcp":{"get_harvested_code_for_paper":{"arxiv_id":"2401.02031"}},"developers":"https://syntology.ai/developers","read_at":"2026-09-25T09:33:49+00:00","read_at_is":"when the build read Syntology's graph, not when any sample ran","claim":"Per-sample execution status on synthesized fixtures; not a correctness claim about the paper. Samples come from repositories linked to the paper, official or community; repo_kind says which.","repos":[{"provenance":"external:paperswithcode_snapshot_2025-07-28","url":"https://github.com/rfww/spy-watermark","reach":{"status":"ok"}}],"summary":{"ran":5,"unverified":4},"by_repo_kind":{"official":{"samples":9,"ran":5,"repositories":1}},"repo_kind_vocabulary":{"official":"The archive marks this repository official for the paper","named_in_paper":"The archive records that the paper mentions this repository; it is not marked official","listed":"In the archive's code links for this paper, not marked official and not recorded as mentioned in the paper","found_in_text":"Syntology found this repository in the paper's own text; whether it is the authors' implementation is not asserted","community":"Not in the archive's code links for this paper; a community repository Syntology harvested"},"n_pointer_only_for_licence":9,"samples":[{"code_sha256_prefix":"c447b70e0c6bc034","entry":"Get_loss_func","repo":"rfww/spy-watermark","repo_kind":"official","path":"loss.py","file_url":"https://github.com/rfww/spy-watermark/blob/HEAD/loss.py","link_basis":"first_harvest_node","language":"python","status":"ran","verification_level":1,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"NONE","inline_ok":false,"mcp_get_code":{"code_sha256":"c447b70e0c6bc034"}},{"code_sha256_prefix":"f085d3a1f8f83a06","entry":"Get_loss_func","repo":"rfww/spy-watermark","repo_kind":"official","path":"optimizer.py","file_url":"https://github.com/rfww/spy-watermark/blob/HEAD/optimizer.py","link_basis":"first_harvest_node","language":"python","status":"ran","verification_level":1,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"NONE","inline_ok":false,"mcp_get_code":{"code_sha256":"f085d3a1f8f83a06"}},{"code_sha256_prefix":"186c2b5c3a2921c8","entry":"Get_optimizers","repo":"rfww/spy-watermark","repo_kind":"official","path":"optimizer.py","file_url":"https://github.com/rfww/spy-watermark/blob/HEAD/optimizer.py","link_basis":"first_harvest_node","language":"python","status":"ran","verification_level":1,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"NONE","inline_ok":false,"mcp_get_code":{"code_sha256":"186c2b5c3a2921c8"}},{"code_sha256_prefix":"c898fb896cfeaece","entry":"PSNR","repo":"rfww/spy-watermark","repo_kind":"official","path":"utils.py","file_url":"https://github.com/rfww/spy-watermark/blob/HEAD/utils.py","link_basis":"first_harvest_node","language":"python","status":"ran","verification_level":1,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":true,"licence":"NONE","inline_ok":false,"mcp_get_code":{"code_sha256":"c898fb896cfeaece"}},{"code_sha256_prefix":"29362ecc361d2231","entry":"crop","repo":"rfww/spy-watermark","repo_kind":"official","path":"functional.py","file_url":"https://github.com/rfww/spy-watermark/blob/HEAD/functional.py","link_basis":"first_harvest_node","language":"python","status":"ran","verification_level":1,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"NONE","inline_ok":false,"mcp_get_code":{"code_sha256":"29362ecc361d2231"}},{"code_sha256_prefix":"f9cc801a4279902a","entry":"Get_dataloader_test","repo":"rfww/spy-watermark","repo_kind":"official","path":"datasets.py","file_url":"https://github.com/rfww/spy-watermark/blob/HEAD/datasets.py","link_basis":"first_harvest_node","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"NONE","inline_ok":false,"mcp_get_code":{"code_sha256":"f9cc801a4279902a"}},{"code_sha256_prefix":"12035a2f77d8016c","entry":"get_1d_sincos_pos_embed_from_grid","repo":"rfww/spy-watermark","repo_kind":"official","path":"models/pos_embed.py","file_url":"https://github.com/rfww/spy-watermark/blob/HEAD/models/pos_embed.py","link_basis":"harvester_set","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"NONE","inline_ok":false,"mcp_get_code":{"code_sha256":"12035a2f77d8016c"}},{"code_sha256_prefix":"3185afc3e87293ed","entry":"get_2d_sincos_pos_embed","repo":"rfww/spy-watermark","repo_kind":"official","path":"models/pos_embed.py","file_url":"https://github.com/rfww/spy-watermark/blob/HEAD/models/pos_embed.py","link_basis":"harvester_set","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"NONE","inline_ok":false,"mcp_get_code":{"code_sha256":"3185afc3e87293ed"}},{"code_sha256_prefix":"f10004e059714d42","entry":"get_2d_sincos_pos_embed_from_grid","repo":"rfww/spy-watermark","repo_kind":"official","path":"models/pos_embed.py","file_url":"https://github.com/rfww/spy-watermark/blob/HEAD/models/pos_embed.py","link_basis":"harvester_set","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"NONE","inline_ok":false,"mcp_get_code":{"code_sha256":"f10004e059714d42"}}]},"arxiv_metadata":null,"syntology_extracted_results":null}