Venue: ICLR 2021 Conference

Reviews:

final_score: rating: 6: Marginally above acceptance threshold
review_content: Summary

Fake content produced by generative models is of great concerns. This paper investigates attribution techniques to identify models that generated the content. The key theoretic result is the derivation of the sufficient conditions for decentralized attribution and the design of keys following these conditions. Thee paper shows that decentralized attribution can be achieved when keys are orthogonal to each other, and belonging to a subspace determined by the data distribution. Results are validated on two datasets, MNIST and CelebA. 

Strengths

The paper derives the sufficient conditions for decentralized attribution of models generated the content. The idea is to add a uniform and bounded perturbation. The theory is on the data geometry-dependent threshold. There is a tradeoff between distinguishability and generation quality.

Weaknesses

The decentralized attribution problem is not clearly motivated. What are the use cases? Why centralized attribution does not work for these use cases? 

The attack model is not clear from the paper. Specifically, who is the attacker and what is the capability? It seems that the attacker has access to the original generative model. It is not clear why the user-end models need to be retrained. Is this trained by the attacker?

The application settings are not clear.  There are many questions on the motivating example "A company develops a GAN model for image post-processing. A third-party organization (the registry) assigns keys to the company, who is then required to embed a watermark to the GAN models according to the keys for users to download. With the keys, the registry can trace the GAN generated images back to the user-end models." What kind of postprocessing? Are these identify preserving changes or generating new faces? Why is there a need for the watermark to depend on user keys?

In robust training, the paper discusses five types of post-processes: blurring, cropping, noise, JPEG conversion and the combination of these four. Are these necessary constraints on what the GAN models can do in order for the attribution techniques to work?

The derivation is on the sufficient conditions. What is the necessary conditions?

Minor comments

Figure 1 is not referenced anywhere in the paper. 

Figure 2 caption has no information on what the two rows are. I suppose one is on MNIST and the other is on CelebA. 

Decision

The paper seems to present interesting results on decentralized attribution of generative models. However, the paper poorly motivates the problem, use cases, capabilities and limitations of the approach. I can not recommend accept at this point. It is very possible I do not have the context to appreciate the paper. I hope the rebuttal process can make things clear. 


=====POST-REBUTTAL COMMENTS======== 

I applaud the authors for the very detailed response and the efforts in the updated draft. Many of my questions were clarified.  However, there are still important questions remaining.

1. In addressing my Q4, "We do believe that a separate discussion is needed on whether the registry or the user-end devices should retrain the models, given that users can potentially be the attackers in the malicious personation case. This discussion will entail an exploration of the tradeoff between training efficiency and training security of generative models, which is beyond the scope of this paper." This raises the feasibility question of decentralized approach proposed in this paper.

2. In addressing my Q6, "We note that just like problem settings for adversarial attacks, there is a potential mismatch between our expectation of the attackers' capability and their actual capability. Therefore, we cannot assess whether these constraints are necessary, but we acknowledge that they are not sufficient." This needs more investigation.

3. Additionally, in addressing R3, "Lastly, we agree that it is definitely interesting to understand which latent space the keys should be embedded. So far on FFHQ, attributability is achieved for 20 keys derived through the proposed method. More keys on the way (see wall-clock costs for computing keys and models in the supplementary). All of the keys share the same structure (eye shadows and lip stains), which may suggest a limit space for attributable keys. We polished the discussion on approximating the capacity of keys through an optimal packing problem, which is an open challenge." 
If the number of keys are limited, this seriously impacts the contribution of this paper.

Overall, I am more positive. I am willing to raise my score to 6. However, the paper is still somewhat borderline.

review_title: interesting theoretic result on model attribution, but applicability might be limited

final_score: rating: 5: Marginally below acceptance threshold
review_content: This paper proposes a decentralized attribution to the generative model trained on the same dataset. The goal is to distinguish the user-end generative models, and thus facilitates the IP-protection. The idea is to use orthogonal keys to distinguish the generated samples from authentic data. Furthermore, this paper provided theoretic insights into the proposed method. Experimental results on MNIST and CelebA datasets backup the claims. 

Strengths:
1.	The author tempts to distinguish the generative models trained on the sample dataset. This problem is interesting and inspiring to the researchers in the related field.

Weaknesses:
1.	This paper is not well-organized and many parts are misleading. For example, above Eq.3, the author assumes P_{G_{0}} = P_{D}. Does the author take the samples generated by the root generator as the authentic dataset? However, in Section 2 above Eq. 4, the author claims that the authentic data does not belong to any generator. 
2.	In Eq.4, the key-dependent generator is obtained via adding perturbation to the output of the root model. This setting may be troublesome as :1. These generators are not actually trained. This is different from the problem which this paper tempt to solve. 2. No adversarial loss to guarantee the perturbed data being similar to the authentic data. 2. How to distinguish the samples from different generators.
3.	Since Eq.4 is closely related to adversarial attack, the authors are supposed to discuss their connections in the related works.
4.	The name of ‘decentralized attribution’ is misleading. Decentralized models are something like federated learning, where a ‘center’ model grasps information from ‘decentralized models’. However, the presented work is not related to such decentralization.
5.	Typos: regarding the adversarial generative models ->regarding to the adversarial generative models; along the keys->along with the keys.

review_title: This paper proposes a decentralized attribution to the generative model trained on the same dataset. The goal is to distinguish the user-end generative models, and thus facilitates the IP-protection. The idea is to use orthogonal keys to distinguish the generated samples from authentic data. Furthermore, this paper provided theoretic insights into the proposed method. Experimental results on MNIST and CelebA datasets backup the claims.

final_score: rating: 6: Marginally above acceptance threshold
review_content: 
Given the rebuttal, I am willing to raise my score to a 6 due to the added StyleGAN, PGAN, and other experiments and improved paper layout / clarity. The added experiments are welcome addition to the paper and demonstrate this technique. The lip and eyestaining are interesting results and I do hope this direction gets explored in the future.


Summary
==============================================================

This paper tries to create a decentralized method of attributing user-end generative model. The authors explore the conditions needed for these keys to be attributable and an example on how to design the keys for this condition.

Score:
===============================================================


While this work is clearly worthwhile and useful as more generative models are deployed, the chosen toy examples may be a little too simplistic and low resolution to test this technique. Are these keys still attributable as these datasets continue to grow larger. I would raise more score if the technique was shown to work well on datasets more complex than MNIST and Celeb-A. Would the results holds on higher resolution datasets of greater variety? 

I would like to see if the keys work for StyleGAN based models that are a very accessible way of generating fake profile pictures, for example https://apnews.com/article/bc2f19097a4c4fffaa00de6770b8a60d

I am unconvinced that this paper should be accepted. Given more experiments on more relevant / diverse datasets and improvements to figures in the paper, I could be persuaded to change my review.
Pros: 
=================================================================
- The paper itself is well written
- The demonstrates the keys can be made robust to common end user augmentations (cropping, compression, etc...)


Cons + Improvements:
================================================================
- The technique is only tested on datasets of CelebA and MNIST . Would like to see results on FFHQ or other ones that are used more often by prospective actors. 
- The paper only tests on one architecture DCGAN. I would like to see results on StyleGAN/StyleGANv2 architecture since its much more helpful for those models to attributable due to their widespread use. It also opens up some interesting scientific questions about which latent space the keys should be embedded in or if the multiscale training impedes this attribution regime. 
- The low resolution of the datasets 
- Figures & tables can be difficult to read

Misc fixes / Questions:
================================================================
- The furthest left column for Table 1 and 2 are useless since you only test on one architecture. Consider a multicell label for readability.
- Table II should have more labels into which values of the table are distinguishability and which are FID.
- Typo: higer Table II
- Unlabeled graph next to Algorithm I has axises that are difficult to read.
- Notations for Figure 2 (c) are difficult to read (too small).
- Are the red lines in Figure 2 (b) suppose to be best fit lines?

review_title: Very useful concept, however, only shows results on MNIST/CelebA 

Meta-review: This paper proposes a decentralized attribution method to distinguish the generative models trained on the sample dataset. The key theoretic result is the derivation of the sufficient conditions for decentralized attribution and the design of keys following these conditions. Results are validated on two datasets with several generative models. The work is very interesting.
R1: Overall, I am more positive. I am willing to raise my score to 6. However, the paper is still somewhat borderline.
R3: Given the rebuttal, I am willing to raise my score to a 6 due to the added StyleGAN, PGAN, and other experiments and improved paper layout / clarity. The added experiments are welcome addition to the paper and demonstrate this technique. The lip and eyestaining are interesting results and I do hope this direction gets explored in the future.

Decision: Accept (Poster)