Venue: ICLR 2021 Conference

Reviews:

final_score: rating: 6: Marginally above acceptance threshold
review_content: The proposed method exploits the randomized smoothing techniques for a certified watermark of neural networks. The idea itself is novel and interesting. To the best of the reviewer's knowledge, no one has ever used randomized smoothing for neural network watermark. Different from the defense against adversarial example, in the case of watermark detection, not only the detection accuracy but false detection of non-watermarked models should be considered. If my understanding is correct, the proposed method does not give certification on the false detection.  Since the proposed method is quite close to adversarial training, one concern is that models trained with adversarial training might be falsely detected as the watermarked model. 

 Since the subject of this study is certified watermarks, its certification should be clearly stated in the form of Theorem. If my understanding is correct, Col. 1 simply certifies that the lower bound on the trigger set accuracy. Then, for the l2-constrained adversary, what is certified for the model trained with Alg. 2? 

Suppose we can certify that the trigger set accuracy does not drop below 51% as long as parameters do not move more than an l2 distance of 1. Let’s say, given a suspicious model, the trigger set accuracy was 55%. Then, what can we say?  Can we say that the suspicious model is truly the watermarked model?  Can we say that models without watermark cannot attain this trigger set accuracy?

Minor:
Is no condition on f required to have  Corollary 1? Does Corollary 1 work with any f?
 




review_title: Certification provided by this method should be clearly stated.

final_score: rating: 4: Ok but not good enough - rejection
review_content: In this paper, the authors propose a certifiable watermarking method for neural networks. The proposed method is based randomized smoothing techniques together with optimizing the model on a dedicated trigger set. The authors show their method can guarantee persistent of watermark examples up to a predefined change in model parameters, in the l2 distance. 

Overall, this paper combines several known techniques and is mainly incremental. 

As the authors admit, the proposed certification method is somewhat artificial and does not hold in real life scenarios. Additionally, the proposed watermarking embedding method is very similar to [1], [2] but with randomized smoothing technique borrowed from [3]. 

Questions to the authors: 

1) Did you experiment with changing a set of parameters largely while leaving the rest as is? for instance if the model has 1000 parameters, changing 1 of them to be x1000 times larger and leave the rests of the parameters uncharge? that way the l2 change will still be 1, how does that affect model performance? 

2) Did the authors experimented with other NN verification/certification methods such as the one proposed in [4]? 

3) From a practical point of view, does the model provider need to pre-define \epsilon? If that is the case, how do you suggest to do such thing? empirically? 

4) The authors reported results using lr of 0.1, 0.001, and 0.0001. Did the authors also experiment with 0.01?

5) Did the authors try to look for a correlation between watermark removal to accuracy on the in-domain data? 

[1] Adi, Yossi, et al. "Turning your weakness into a strength: Watermarking deep neural networks by backdooring." 27th {USENIX} Security Symposium ({USENIX} Security 18). 2018.

[2] Zhang, Jialong, et al. "Protecting intellectual property of deep neural networks with watermarking." Proceedings of the 2018 on Asia Conference on Computer and Communications Security. 2018. 

[3] Chiang, Ping-yeh, et al. "Certified defenses for adversarial patches." arXiv preprint arXiv:2003.06693 (2020).

[4] Goldberger, Ben, et al. "Minimal Modifications of Deep Neural Networks using Verification." LPAR. 2020.
review_title: Official Blind Review #2

final_score: rating: 4: Ok but not good enough - rejection
review_content: The authors have created a well written paper for a new watermarking method that addresses an important challenge in security intellectual property rights for deep learning models. They claim their method has resistance to l2 attacks within a certifiable bound, and show experimental results that the method is also resistant to other forms of attack. The method can be used as a black-box watermark (does not require model parameters to verify),  however, the certification bounds only apply to a white-box use case in which the verification can perform inference and test accuracy for a set of trigger images for multiple smoothed versions of the parameters.

Pros - 

1. The paper is well written and organized.
2. The paper provides a useful survey of prior art and good motivation for their approach.
3. Unlike prior methods, the method provides a resistance bound for attacks.

Cons - 

1. The bound only applies to l2 attacks.
2. The bound only applies to white-box verification.
3. The bound is relatively small.
4. The method reduces accuracy of the trained model.
5. The paper does not provide any direct comparisons to other watermarking methods.
6. The bound is based on empirical estimates which have some uncertainty, so is not actually a true bound.

Cons 1, 3 can be seen as acceptable limitations given this is a step towards certifiable watermarks. Con 4 is par for the course with any watermarking scheme, although the reduction 89.3->86% accuracy for CIFAR-10 is concerning, as that much accuracy loss is a significant deterrent to use of the method and the trend from MNIST CIFAR-10 makes me wonder if larger and more realistic images may show even greater reduction in accuracy. Con 5 is of particular concern for a conference of this tier. If published metrics comparable to the experiments shown in the paper are available, these should be included for side-by-side comparison. 

Update: I appreciate the authors response and their hard work in preparing this submission. I also understand that comparisons to prior art are often difficult to obtain. However, I still think further comparisons are warranted to prove out the benefits of this method against other art and whether it can achieve the stated goals for more realistic datasets. The authors did not rebut many of my negative concerns. Most critically, I feel that the method is lacking in a theoretic proof of a strict bound, which is the primary contribution of the paper. For the limitations I mentioned in the review I am leaving my rating score unchanged, but I encourage the authors to continue to develop their approach, which shows promise.



review_title: Recommend to reject

final_score: rating: 5: Marginally below acceptance threshold
review_content: Comments: 
This paper present the first certifiable neural network watermark method. By extending method proposed by Chiang et.al. [1] to the watermark embedding and extraction process, it is possible to ensure that the watermark is robust to watermark removal when the network parameters are modified by less than a certain calculated value. Specifically, the proposed method adds Gaussian noises to parameters instead of images. Overall, the idea of making a provable model watermark is novel. 

Advantages:
1. The article is well-written and gives a detailed description of the related work, as well as a clear flowchart of the algorithm. 2. The concept of certifying neural network parameters is novel, and it works under a lot of model parameter modification based attacks.  Normally as a defenser, we will train a robust classifier to defend against adversarial example, and the perturbation happens on the testing images. In this case, the perturbation happens on the pretrained released neural networks. 

Concerns:
1. The technical contribution of this paper is a bit weak in that they mostly followed [1] and the only interesting point is the expansion into the new scene of model watermarking.
2. I think there is a lack of experiments on the robustness and model performance of watermarks under different $\epsilon$. 
3. CIFAR-10 and MNIST are both small datasets. The authors should provide results on larger benchmark dataset, e.g. ImageNet for verifying the method, as well as providing comparison results between a large dataset and a small dataset. 

[1] Chiang, P., Curry, M.J., Abdelkader, A., Kumar, A., Dickerson, J.P., & Goldstein, T. (2020). Detection as Regression: Certified Object Detection by Median Smoothing. ArXiv, abs/2007.03730.
review_title: This paper present the first certifiable neural network watermark method.

Meta-review: While it’s commonly acknowledged that the paper is well written, the reviews are a bit split: R3 and R1 are mildly positive/negative, respectively, R2 and R4 both voted for reject. R2 asked many questions regarding experiments, which were addressed in the details in the rebuttal. R4 raised 6 questions regarding the bound, and the authors only answered some of them in the rebuttal. R4 felt “the method is lacking in a theoretic proof of a strict bound, which is the primary contribution of the paper”. Both R1 and R4 pointed out the proposed algorithm is not practical as expected, especially the results on larger scale such as ImageNet are missing. 

The AC cannot agree with the authors’ argument that the contribution of the paper is “a conceptual framework that it is possible to certify a watermark for neural networks” in responding to such criticisms. It’s indeed very important for this conceptual framework to be proven valuable through thorough experiments and solid comparisons. 
Decision: Reject