Venue: NeurIPS 2022 Conference

Reviews:

final_score: rating: 6: Weak Accept: Technically solid, moderate-to-high impact paper, with no major concerns with respect to evaluation, resources, reproducibility, ethical considerations.
review_content: summary: 
The paper proposes a new watermarking framework for text generation APIs. Compared with the existing framework, the new framework increases stealth by minimizing the distortion of overall word distributions and incorporating high-order linguistic features. The experiments show that the new framework can identify imitation models with less capability than the existing method and keep the utility. However, it is proven to tolerate adaptive attacks, so it can be applied to protect text generation APIs better.
strengths_and_weaknesses: pros:

- an important research problem.
- the proposed approach is carefully justified from both theoretical and empirical perspectives.
- high-quality paper writing.

Cons:

- Research motivation is questionable. Is there any concrete attack toward [B]?
- lack of evaluation under active attackers. Can you justify the strength of your defense under [A]?
- Novelty comparing to [B] is incremental. You achieved nearly the same performance with [B] in Table 1. Moreover, some (broken) texts in the current manuscript are from [B]. The authors should take a careful pass to paraphrase the paper.

[A]: Killing One Bird with Two Stones: Model Extraction and Attribute Inference Attacks against BERT-based APIs. https://arxiv.org/abs/2105.10909

[B]: Protecting Intellectual Property of Language Generation APIs with Lexical Watermark. AAAI 2022

The new framework is proposed to improve the stealth of the existing method. They are different in the optimization method and linguistic features for conditions. The optimization method is creative. The design for linguistic features is referred to another existing method.

In terms of the quality, the paper provides sufficient theoretical analysis to prove the feasibility of the new framework. In addition, there are empirical experiments conducted to verify the ability of the new framework. However, there is no direct comparison between the stealthiness of the new framework and the existing framework. Please justify if that was impossible or not needed.

Technical novelty and empirical results comparing to [B] seems incremental, particularly from Table 1. And the research motivation is also questionable. The improvement is based on the defense of a specific method of attack. However, there is no concrete breach of such an attack. The paper also lacks a deep description of this attack method, including the process of distorting the result of identification and the performance of attacking. Without concrete attack information, the application of the new method seems to be less urgent, in its current form.

questions: Comment on the availability of practical attacks toward [10].

In section 4.2, you state that "malicious users would have difficulty in removing watermarks from the responses; unless they lean toward modifying all potential watermarks.". According to the article provided below, it seems to be possible to modify the watermarks without much loss of utility. Is that a threat to your framework? Please, clarify.

[A] Cracking White-box DNN Watermarks via Invariant Neuron Transforms. https://arxiv.org/abs/2205.00199

limitations: NA
review_title: null

final_score: rating: 8: Strong Accept: Technically strong paper, with novel ideas, excellent impact on at least one area, or high-to-excellent impact on multiple areas, with excellent evaluation, resources, and reproducibility, and no unaddressed ethical considerations.
review_content: summary: This paper proposes a watermarking technique to claim ownership of text generation APIs when subject to imitation attacks. They show that prior work manages to watermark and detect imitation behaviors, but a weakness exists. After analyzing the word frequency in API responses and publicly available data, the adversary can identify the watermarks with a higher chance. Based on this observation, they devise a novel method CATER, which can conditionally watermark the response so that the adversary cannot decipher the watermarking keys. Meanwhile, CATER can identify the watermarked imitators as effectively as the previous work.

CATER leverages two linguistic features to fulfill the conditional watermarking: 1) neighboring part-of-speech tags and 2) dependency relations. They work well on two popular text generation tasks. They show that CATER can scale to high-order settings, which are empirically challenging to be identified by attackers. According to their experiments, the proposed watermarks have negligible adverse impacts on the utility.

strengths_and_weaknesses: Strength:
1.	Most works in protecting IP from imitation attacks focus on classification tasks. Wallace et al. (2020) have shown that imitation attacks are effective on commercial translation APIs. However, as an urgent vulnerability, little work has been done to protect the IP of text generation APIs, except He et al. (2021). This work identifies and addresses a major weakness in He et al., and proposes a more invisible watermarking algorithm, making their method more appealing to the community.
2.	Instead of using a heuristic search, the authors elegantly cast the watermark search issue into an optimization problem and provide rigorous proof.
3.	The authors conduct comprehensive experiments to validate the efficacy of CATER in various settings, including an architectural mismatch between the victim and the imitation model and cross-domain imitation.
4.	This work theoretically proves that CATER is resilient to statistical reverse-engineering, which is also verified by their experiments.  In addition, they show that CATER can defend against ONION, an effective approach for backdoor removal.

Weakness:
1.	The authors assume that all training data are from the API response, but what if the adversary only uses the part of the API response?
2.	Figure 5 is hard to comprehend. I would like to see more details about the two baselines presented in Figure 5.

questions: Please refer to the weakness part.
limitations: The authors only study CATER for the English-centric datasets. However, as we know, the widespread text generation APIs are for translation, which supports multiple languages. Probably, the authors could extend CATER to other languages in the future.
review_title: null

final_score: rating: 8: Strong Accept: Technically strong paper, with novel ideas, excellent impact on at least one area, or high-to-excellent impact on multiple areas, with excellent evaluation, resources, and reproducibility, and no unaddressed ethical considerations.
review_content: summary: This paper presents a simple but effective approach (called CATER) to protect the IP of text generation APIs under imitation attacks. This idea can stamp watermarks on imitation models by altering the distribution of semantically equivalent words. Unlike the previous work, they propose to conditionally watermark the victim’s outputs so that it is infeasible for the adversary to crack watermarks over the watermarked response, both theoretically and empirically. 

The authors employ two linguistical rules as the conditions. The first one utilizes the part-of-speech tags of surrounding words as the condition. The second condition is established on the incoming arc of the dependency tree. According to their empirical studies, CATER can effectively watermark imitation models and identity the watermarks under various settings. In addition, the authors have shown that CATER is resilient to two strong watermark removal approaches.

strengths_and_weaknesses: Strengths:

1.	The paper found that analyzing the word distribution could reveal watermarks used by the previous watermarking approach (He et al.). Hence, the authors devise a conditional watermarking algorithm as a remedy.

2.	To perform the conditional watermarking and minimize the distribution shift observed in He et al., the authors formulate these two objectives as a linear programming problem. In addition, they prove that this optimization problem is solvable.

3.	The authors also rigorously prove that watermarks injected by CATER are infeasible to be inferred by statistical reverse-engineering, especially when scaling to high-order features.

4.	The paper shows that CATER rivals previous watermarking approaches and is effective in various settings, such as cross-domain querying and architectural mismatch.

Overall, I think this is a quite good paper, which may bring groundbreaking impact on protecting IP of NLP models.

Weakness:

The paper is of good quality and easy to follow. I have no major concerns but a few comments as below.

1.	Since APIs aim to serve end-users, in addition to automatic metrics, it would be good to conduct a human evaluation before concluding that the watermarks do not affect generation quality.

2.	Would you please elaborate on the calculation of the p-value on CATER? It is unclear to me.

questions: 1.	Since APIs aim to serve end-users, in addition to automatic metrics, would it be possible to conduct a human evaluation before concluding that the watermarks do not affect generation quality?

2.	Would you please elaborate on the calculation of the p-value on CATER? It is unclear to me.

limitations: As far as I know, ONION focused on insertion-based removal. However, CATER utilizes substitution-based watermarking. So, probably the authors could try a substitution-based removal technique.
review_title: null

final_score: rating: 6: Weak Accept: Technically solid, moderate-to-high impact paper, with no major concerns with respect to evaluation, resources, reproducibility, ethical considerations.
review_content: summary: First of all, thank you for sharing great work with the community.

With the great success of language generative models, many models are employed in a business. So, the research community focused on the watermarking method to protect these models. The authors pointed out the vulnerability of existing watermarking methods against imitation attacks. They showed that existing works could be breakable when sufficient statistics are available. Therefore, this paper proposed a new framework named Conditional wATERmarking (CATER). The CATER framework is based on linguistic features (e.g., part-of-speech and dependency tree).
strengths_and_weaknesses: Strengths
1. The authors gave mathematical proof of their framework's identifiability.
2. CATER is robust against white-box attacks.

Weaknesses
1. Experiments are limited. I hope the authors also need to provide another generation task (e.g., Inference, Chat).
---
<Minor suggestions to improve the quality>

1. Fig2. needs to be updated. The flow of the figure is not well matched with explanations.
2. Please bold the best score in Table 1,2.
3. Fig 4. needs more explanations.

questions: 1. Is the framework also working for other text generation tasks? (Connected with cons. in the above section.)
2. Is there a possibility of a collusion attack?
For example, there are two victim models using CATER for watermarking.
And the adversary trains his/her model using both two victim models.
In this case, who is the victim between both two victims?

limitations: As I mentioned above, the paper needs more empirical experiments on different text generation tasks.
And also, the figures need to be updated for the quality of the paper.
Based on the discussion period, the score could be updated.

---
Thank you for the response.
The authors resolve the questions I have.
And the additional experimental results are promising.
Therefore, I decided to increase my current score.
review_title: null

Meta-review: metareview: The authors propose a watermarking technique (CATER) to claim ownership of text generation APIs in the presence of imitation attacks. Their main idea is based on the observation that in the state of the art by analyzing the word frequency in API responses as well as publicly available data, an adversary's odds to learn the watermark increases. To remedy this, CATER conditionally watermarks the response to prevent the adversary from deciphering the watermarking keys. 

Reviewers found the topic of the paper timely, is writing clear, and the overall contribution sound and of interest to the community. 
confidence: Less certain
Decision: Accept