SEAL: Entangled White-box Watermarks on Low-Rank Adaptation
Authors: Giyeong Oh, Saejin Kim, Woohyun Cho, Sangkyu Lee, Jiwan Chung, Dokyung Song, Youngjae Yu


Reviewer paper summaries: This paper introduces SEAL, a novel watermarking scheme designed for LoRA weights in deep neural networks. SEAL addresses the unique structure of LoRA by embedding a non-trainable matrix, or "passport," within the trainable LoRA weights. This passport, C, is entangled with the LoRA weights A and B during fine-tuning. After fine-tuning, C is decomposed into two submatrices to produce A' and B' with A and B, where A' and B' are the distributed weights. During the verification phase, the model owner will provide the result of multiplying matrix C by matrix AB and ultimately claim ownership by demonstrating good performance.
Summary of strengths: 1.	The problem studied in this paper is practical and relevant to real-world concerns in LoRA copyright protection.
2.	The proposed method is general and easy to implement.
3.	The watermarking does not degrade the model's performance.
Summary of weaknesses: 1.	The assumption regarding the fine-tuning attack in the paper is questionable. When the adversary obtains A' and B' and fine-tunes them using their own data, resulting in Aadv and Badv, the performance of N(Aadv, Badv, Cp) is likely to change significantly, potentially compromising the verification process. However, in the experiments, the paper assumes that the adversary continues training using the original dataset. I do not believe a rational adversary would conduct a fine-tuning attack in this manner.

2.	If an adversary attempts to claim ownership of a LoRA model that is not theirs, they would only need to optimize Cadv such that N(A'B') = N(A', B', Cadv), for which there is no mechanism preventing them. Therefore, there is potential for this watermarking design and verification process to be maliciously exploited.

3.	The paper does not discuss how ownership verification would work if an adversary distills A' and B', obtaining AadvBadv with a higher rank than the original A'B'. In such a case, Cp cannot be applied to AadvBadv to verify ownership since the rank won't match.
Comments, suggestions and typos: Weaknesses.
Overall assessment scores: 2