Title: MULTI-BIT WATER-MARKING FOR DEEP NEURAL NETWORKS

Abstract: Deep Neural Networks (DNNs) are increasingly deployed in cloud servers and autonomous agents due to their superior performance. The deployed DNN is either leveraged in a white-box setting (model internals are publicly known) or a black-box setting (only model outputs are known) depending on the application. A practical concern in the rush to adopt DNNs is protecting the models against Intellectual Property (IP) infringement. We propose BlackMarks, the first endto-end multi-bit watermarking framework that is applicable in the black-box scenario. BlackMarks takes the pre-trained unmarked model and the owner's binary signature as inputs. The output is the corresponding marked model with specific keys that can be later used to trigger the embedded watermark. To do so, Black-Marks first designs a model-dependent encoding scheme that maps all possible classes in the task to bit '0' and bit '1'. Given the owner's watermark signature (a binary string), a set of key image and label pairs is designed using targeted adversarial attacks. The watermark (WM) is then encoded in the distribution of output activations of the DNN by fine-tuning the model with a WM-specific regularized loss. To extract the WM, BlackMarks queries the model with the WM key images and decodes the owner's signature from the corresponding predictions using the designed encoding scheme. We perform a comprehensive evaluation of Black-Marks' performance on MNIST, CIFAR-10, ImageNet datasets and corroborate its effectiveness and robustness. BlackMarks preserves the functionality of the original DNN and incurs negligible WM embedding overhead as low as 2.054%.

1. INTRODUCTION:

Deep neural networks and other Deep Learning (DL) variants have revolutionized various critical fields ranging from biomedical diagnosis and autonomous transportation to computer vision and natural language processing (Deng & Yu, 2014; Ribeiro et al., 2015) . Training a highly accurate DNN is a costly process since it requires: (i) processing massive amounts of data acquired for the target application; (ii) allocating substantial computing resources to fine-tune the underlying topology (i.e., type and number of hidden layers), and hyper-parameters (i.e., learning rate, batch size), and DNN weights to obtain the most accurate model. Therefore, developing a high-performance DNN is impractical for the majority of customers with constrained computational capabilities. Given the costly process of designing/training, DNNs are typically considered to be the intellectual property of the model builder and needs to be protected to preserve the owner's competitive advantage.

Digital watermarking has been immensely leveraged over the past decade for ownership protection in the multimedia domain where the host of the watermark can be images, video contents, and functional artifacts such as digital integrated circuits (Furht & Kirovski, 2004; Hartung & Kutter, 1999; Qu & Potkonjak, 2007) . However, the development of DNN watermarking techniques is still in its early stage. Designing a coherent DNN watermarking scheme for model ownership proof is challenging since the embedded WM is required to yield high detection rates and withstand potential attacks while minimally affecting the original functionality and overhead of the target DNN.

Existing DNN watermarking techniques can be categorized into two types depending on the application scenario. 'White-box' watermarking assumes the availability of model internals (e.g., weights) for WM extraction (Uchida et al., 2017) whereas 'black-box' watermarking assumes that the output predictions can be obtained for WM detection (Merrer et al., 2017; Adi et al., 2018b) . On the one hand, white-box WMs have a larger capacity (carrying multiple-bit information) but limited appli-cability due to the strong assumption. On the other hand, black-box WMs enable IP protection for Machine Learning as a Service (MLaaS) (Ribeiro et al., 2015) where only zero-bit watermarking methods have been proposed. It is desirable to develop a systematic watermarking approach that combines the advantages of both types of WMs. While all present black-box watermarking papers embed the WM as a statistical bias in the decision boundaries of the DNN (high accuracy on the WM trigger set), our work is the first to prove that it is feasible to leverage the model's predictions to carry a multi-bit string instead of a one-bit boolean decision (existence or not of the WM).

By introducing BlackMarks, this paper makes the following contributions:

• Proposing BlackMarks, the first end-to-end black-box watermarking framework that enables multi-bit WM embedding. BlackMarks possesses higher capacity compared to prior works and only requires the predictions of the queried model for WM extraction. 

2. PRELIMINARY AND RELATED WORK:

Digital watermarks are invisible identifiers embedded as an integral part of the host design and have been widely adopted in the multimedia domain for IP protection (Lu, 2004; Cox et al., 2007) . Conventional digital watermarking techniques consist of two phases: WM embedding and WM extraction. Figure 1 shows the workflow of a typical constraint-based watermarking system. The original problem is used as the cover constraints to hide the owner's WM signature. To embed the WM, the IP designer creates the stego-key and a set of additional constraints that do not conflict with cover constraints. Combining these two constraints yields the stego-problem, which is solved to produce the stego-solution. Note that the stego-solution simultaneously satisfies both the original constraints and the WM-specific constraints, thus enables the designer to extract the WM and claim the authorship. An effective watermarking method is required to meet a set of criteria including imperceptibility, robustness, verifiability, capacity, and low overhead (Singh & Chadha, 2013) . Watermark Embedding. The WM embedding module of BlackMarks takes the pre-trained model and the owner-specific WM signature as its inputs. The output is the watermarked DNN together with a set of WM keys. A model-dependent encoding scheme is devised to map all possible labels into bit '0' and bit '1'. Note that WM embedding is a one-time task performed locally by the owner before the model is distributed. Details of each step are discussed in Section 4.1.

Watermark Extraction. To verify the IP of a remote DNN and detect potential IP infringement, BlackMarks first queries the DNN service with the WM keys. The owner's signature is then decoded from the corresponding predictions using the encoding scheme. The Bit Error Rate (BER) between the extracted signature and the true one is computed. A zero BER implies that the owner's IP is deployed in the remote DNN service. Section 4.2 discusses the details of WM extraction.

3.1. EVALUATION CRITERIA:

Table 1 details the evaluation criteria for an effective DNN watermarking methodology. In addition to previously suggested requirements in Uchida et al. (2017) ; Merrer et al. ( 2017), we believe verifiability and integrity are two other major factors that need to be considered when designing a practical DNN watermarking methodology. Verifiabiity is important because the embedded signature should be accurately extracted using the pertinent WM keys; the model owner is thereby able to detect any misuse of her model with a high probability. Integrity ensures that the IP infringement detection policy yields a minimal false alarms rate, meaning that there is a very low chance of falsely proving the ownership of an unmarked model used by a third party. BlackMarks satisfies all the requirements listed in Table 1 as we empirically show in Section 5.

Table 1 : Evaluation criteria for an effective watermarking of deep neural networks.

Requirements Description Fidelity:

Accuracy of the target neural network shall not be degraded as a result of watermark embedding.

Verifiability:

Watermark extraction shall yield minimal false negatives; WM shall be effectively detected using the pertinent keys.

Robustness:

Embedded watermark shall withstand model modifications such as pruning, fine-tuning, or WM overwriting.

Integrity:

The authorship of the unmarked models will not be falsely claimed by the watermarking method.

Capacity:

Watermarking methodology shall be capable of embedding a large amount of information in the target DNN.

Efficiency:

Communication and computational overhead of watermark embedding and extraction shall be negligible.

Security:

The watermark shall be secure against brute-force attacks and leave no tangible footprints in the target DNN.

3.2. ATTACK MODEL:

To validate the robustness of a potential DL watermarking approach, one should evaluate the performance of the proposed methodology against (at least) three types of contemporary attacks: (i) model fine-tuning. This attack involves re-training of the original model to alter the model parameters and find a new local minimum while preserving the accuracy. (ii) parameter pruning.

Pruning is a common approach for efficient DNN execution, particularly on embedded devices. We identify model pruning as another attack approach that might affect the watermark extraction.

(iii) watermark overwriting. A third-party user who is aware of the methodology used for DNN watermarking may try to embed a new WM in the distributed model and overwrite the original one.

4. BLACKMARKS METHODOLOGY:

BlackMarks takes advantage of the fact that there is not a unique solution for modern non-convex optimization problems used by DL models (Choromanska et al., 2015; Rouhani et al., 2017) to embed the WM signature in the output activations of the target DNN. In this section, we detail the workflow of WM embedding and extraction phase shown in Figure 2 and discuss the watermarking overhead. We use image classification as the cover problem in this paper, however, BlackMarks can be easily generalized to other data applications for IP protection of the deployed models.

4.1. WATERMARK EMBEDDING:

Algorithm 1 summarizes the steps of BlackMarks' WM embedding. BlackMarks encodes the ownerspecific WM information in the distribution of the output activations (before softmax) while preserving the correct functionality on the original task. The rationale behind our approach is to explore the unused space within the high dimensional DNN (Rouhani et al., 2018b) for WM embedding. Black-Marks formulates WM embedding as a one-time, 'post-processing' step that is performed on the pre-trained DNN locally by the owner before model distribution/deployment. We explicitly discuss each of the steps outlined in Algorithm 1 in the following of this section.

Figure 3 : BlackMarks' WM embedding algorithm. 1 Encoding Scheme Design. Recall that our objective is to encode a binary string (owner's signature) into the predictions made by the DNN when queried by the WM keys. BlackMarks designs a model-dependent encoding scheme that maps the class predictions to binary bits. The encoding scheme (f ) is obtained by clustering the output activations corresponding to all categories (C) into two groups based on their similarity. To do so, BlackMarks computes the averaged output activations triggered by images in each class and divides them into two groups using K-means clustering. The resulting encoding scheme specifies the labels corresponding to bit '0' and bit '1', respectively.

2 Key Generation 1. The key generation module takes the encoding scheme, the owner's private signature (b ∈ {0, 1}

K , where K is also used as the key length), and the original training data as inputs. The output is a set of WM key image-label pairs for the target DNN. More specifically, BlackMarks deploys targeted adversarial attacks to craft the WM key images and labels. If the given bit in b is '0', the source class and the target class for the WM image ('adversarial sample') are determined by uniformly randomly selecting a class label that belongs to the cluster '0' and cluster '1' determined by the encoding scheme (f ), respectively. The source class is used as the corresponding WM key label. The WM keys for bit '1' in b are generated in a similar way. We use targeted Momentum Iterative Method (MIM, Dong et al., 2018) and Jacobian-based Saliency Map Approach (JSMA, Papernot et al., 2016b) in our experiments (see Appendix A.1). BlackMarks framework is generic and compatible with other targeted adversarial attack emthods for key generation.

BlackMarks aims to design specific WM key images as the queries for model authentication instead of crafting standard adversarial samples that are indistinguishable to human eyes to fool the DNN. However, BlackMarks' WM key images can be considered as a generalization of 'adversarial samples' with relaxed constraints on the perturbation level and a different objective. We assume that the WM signature and the key generation parameters (e.g., source and target classes, maximum distortion, step size, and the number of attack iterations) are secrets specified by the owner. It's worth noting that the transferability of adversarial samples (Papernot et al., 2016a; 2017) might lead to false positives of WM detection as shown in Merrer et al. (2017) . To address this problem, we set the initial key size to be larger than the owner's desired value K > K and generate the WM keys accordingly (K = 5 × K in our experiments). The intuition here is that we want to filter out the highly transferable WM keys that are located near the decision boundaries. 3 Model Fine-tuning. To enable seamless encoding of the WM information, BlackMarks incorporates an additive WM-specific embedding loss (L W M ) to the conventional cross-entropy loss (L 0 ) during DNN fine-tuning where a mixture of the WM keys and (a subset of) the original training data is fed to the model. The formulation of the total regularized loss (L R ) is given in Eq. ( 1) where the embedding strength λ controls the contribution of the additive loss. Here, we use Hamming Distance as the loss function L W M to measure the difference between the extracted signature (obtained by decode predictions) and the true signature b.

EQUATION

Note that without the additional regularization loss (L W M ), this retraining procedure resembles 'adversarial training' (Kurakin et al., 2016) . All of the existing zero-bit black-box watermarking papers (Merrer et al., 2017; Zhang et al., 2018; Adi et al., 2018a) leverages 'adversarial training' for WM embedding to ensure that the marked model has a high classification accuracy on the WM trigger set. However, such an approach does not directly apply to multi-bit WM embedding where we care about the difference between the decoded signature and the original one instead of the difference between the received predictions and the WM key labels. BlackMarks identifies this inherent requirement of multi-bit watermarking and formulates an additive embedding loss (L W M ) to encode the WM. The rationale behind our design is that, when queried by WM key images, an additional penalty shall be applied if the prediction of the marked model does not belong to the same code-bit cluster as the corresponding WM key label. 4 Key Generation 2. Once the model is fine-tuned with the regularized loss in step 3, we first find out the indices of initial WM keys that are correctly classified by the watermarked model (denoted by I M * ). To identify and remove WM keys images with high transferability, we construct T variants of the original unmarked model (T = 3 in our experiments) to find out the indices of common misclassified initial keys (denoted by I M ). Finally, the intersection of I M * and I M determines the indices of proper key candidates to carry the WM signature. A random subset of candidate WM keys is then selected as the final WM keys according to the owner's key size (K). In the global flow (Figure 2 ), we merge the two key generation steps into one module for simplicity.

4.2. WATERMARK EXTRACTION:

To extract the signature from the remote DNN (M ), the owner queries the model with the WM key images (X key ) generated in step 4 of WM embedding and obtains the corresponding predictions (Y key M ). Each prediction is then decoded to a binary value using the encoding scheme (f ) designed in WM embedding. The decoding is repeated for all predictions on the WM keys and yields the recovered signature (b ). Finally, the BER between the true signature (b) and the extracted one (b ) is computed. The owner can prove the authorship of the model if the BER is zero.

4.3. WATERMARKING OVERHEAD:

Here, we analyze the computation and communication overhead of WM extraction. The runtime overhead of the one-time WM embedding is empirically studied in Section 5.6. For the remote DNN service provider, the computation overhead of WM extraction is equal to the cost of one forward pass of WM key images through the underlying DNN. For the model owner, the computation cost consists of two parts: (i) decoding the prediction response Y key M to a binary vector by finding out which cluster ('0' or '1' in the encoding scheme f ) contains each prediction; and (ii) performing an element-wise comparison between the recovered signature (b ) and the true one (b) to compute the BER. In this case, the communication overhead is equal to the key length (K) multiplied by the sum of the input image dimension and one to submit the queries and read back the predicted labels.

5. EVALUATION:

We evaluate BlackMarks' performance on various datasets including MNIST (LeCun et al., 1998) , CIFAR10 (Krizhevsky & Hinton, 2009) and ImageNet (Deng et al., 2009) , with three different neural network architectures. The experimental setup and the network architectures are given in Appendix A.1 and A.2, respectively. We explicitly evaluate BlackMarks' performance with respect to each requirement listed in Table 1 as follows. Empirical results prove that BlackMarks is effective and applicable across various datasets and DNN architectures.

5.1 FIDELITY Fidelity requires that the accuracy of the target neural network shall not be significantly degraded after WM embedding. Table 2 compares the baseline DNN accuracy (Column 2) and the accuracy of marked models (Column 3 and 4) after WM embedding. As demonstrated, BlackMarks respects the fidelity requirement by simultaneously optimizing for the classification accuracy of the underlying model (the cross-entropy loss), as well as the additive WM-specific loss as discussed in Section 4.1. In some cases (e.g. WideResNet benchmark), we even observe a slight accuracy improvement compared to the baseline. This improvement is mainly due to the fact that the additive loss L W M in Eq. ( 1) act as a regularizer during DNN training. Regularization, in turn, helps the model to mitigate over-fitting by inducing a small amount of noise to DNNs (Goodfellow et al., 2016) . 

5.2. VERIFIABILITY AND ROBUSTNESS:

BlackMarks enables robust DNN watermarking and reliably extracts the embedded WM for ownership verification. We evaluate the robustness of BlackMarks against three state-of-the-art removal attacks as discussed in Section 3.2. These attacks include parameter pruning (Han et al., 2015) , model fine-tuning (Simonyan & Zisserman, 2014) , and watermark overwriting (Uchida et al., 2017) .

Model Fine-tuning. Fine-tuning is a type of transformation attack that a third-party user might use to remove the WM information. To perform such an attack, the adversary retrains the distributed marked model using the original training data with the conventional cross-entropy loss (excluding L W M ). Table 6 in Appendix A.3 summarizes the impact of fine-tuning on the watermark detection rate across all benchmarks. As can be seen from the table, the WM signature embedded by Black-Marks framework can be successfully extracted with zero BER even after the model is fine-tuned for various numbers of epochs.

Parameter Pruning. We use the pruning approach proposed in Han et al. (2015) to sparsify the weights in the target watermarked DNN. To prune a specific layer, we first set α% of the parameters that possess the smallest weight values to zero. The model is then sparsely fine-tuned using crossentropy loss to compensate for the accuracy drop caused by pruning. Figure 4 demonstrates the impact of pruning on WM extraction. One can see that BlackMarks tolerates up to 95%, 80%, and 90% parameter pruning for MNIST, CIFAR-10, and ImageNet benchmark, respectively. As illustrated in Figure 4 , in cases where DNN pruning yields a substantial BER value, the sparse model suffers from a large accuracy drop. Therefore, one cannot remove BlackMarks' embedded WM by excessive pruning while attaining a comparable accuracy with the baseline.

Watermark Overwriting. Assuming the attacker is aware of the watermarking methodology, he may attempt to corrupt the original WM by embedding a new one. In our experiments, we assume the adversary knows the targeted adversarial attack method employed by the model owner while the owner's signature and the key generation parameters remain secret. In this case, the attacker generates another set of WM keys with his own signature and key generation parameters to fine-tune the marked model following the steps outlined in Algorithm 1. Table 3 summarizes the accuracy of the overwritten DNN and the BER of the original WM signature (K = 20, 30, 50) for all three benchmarks. In our experiments, we assume the attacker uses the same key length as the owner to generate the new WM keys. BlackMarks can successfully extract the original WM in the overwritten DNN with zero BER, indicating its verifiability and robustness against WM overwriting attacks. 

5.3. SECURITY:

The malicious adversary may try to find/design the exact WM key used by the model owner (key collision) and disturbs the WM extraction. The security of BlackMarks's WM key set is determined by the uncertainties involved in the key generation process (step 2 in Algorithm 1). Since the key generation parameters and the WM signature are assumed to be secret information provided by the owner as discussed in Section 4.1, even if the attacker is aware of the adversarial attack method used to generate the WM key, he cannot reproduce the exact same key due to the large searching space in the targeted adversarial attack method. Therefore, BlackMarks is secure against brute-force attacks.

5.4. INTEGRITY:

Integrity requires that the watermarking technique shall not falsely claim the authorship of unmarked models. For multi-bit watermarking, such requirement means that if an unmarked model is queried by the owner's WM key set, the BER between the decoded signature from the model's predictions and the owner's signature shall not be zero. To evaluate the integrity of BlackMarks, we choose six unmarked models for each benchmark and summarize the results in Table 4 . The first three models (M1-M3) have the same network topology but different weights as the watermarked model and the other three models (M4-M6) have different topologies as the marked model. For each benchmark, the owner queries these six unmarked models with her WM keys and tries to extract the signature. The computed BER is non-zero in all cases for three benchmarks, indicating that BlackMarks avoids claiming the ownership of unmarked DNNs and yields low false positive rates. 

5.5. CAPACITY:

One apparent advantage of BlackMarks over existing zero-bit black-box watermarking methods is its higher capacity as we discuss in Section 2. To further improve the capacity of the WM, BlackMarks can be easily generalized to embed more complex signatures instead of binary vectors. The amount of information carried by the owner's WM signature can be measured by entropy (Jaynes, 1957). More generally, if the owner specifies her signature (a numeric vector) with base B and length K, the corresponding entropy can be computed as:

H = K • log 2 B (2)

As can be seen from Eq. ( 2), a longer signature with a larger base value carries more information. Since we use a binary vector (B = 2) as the WM signature in this paper, the entropy can be simplified as H = K. To extend BlackMarks framework for embedding a base-N signature, the owner needs to set the number of components in K M eans Clustering to N (Algorithm 1) and change the encoding as well as decoding scheme of predictions correspondingly. BlackMarks is the first generic multi-bit watermarking framework that possesses high capacity in the black-box setting.

5.6. OVERHEAD:

The WM extraction overhead is discussed in Section 4. 

6. DISCUSSION:

Recall that WM embedding leverages a similar approach as 'adversarial training' while incorporating a WM-specific regularization loss (Section 4.1). Here, we study the effect of WM embedding on the model's robustness against adversarial attacks. Table 8 in Appendix A.3 compares the robustness of the pre-trained unmarked model and the corresponding watermarked model (K = 50) against different white-box adversarial attacks. It can be seen that for each type of the attack, the marked model has higher accuracy on the adversarial samples compared to the unmarked baseline. Such improvement is intuitive to understand since during WM embedding, the first term (cross-entropy loss) in the total regularized loss (see Eq. ( 1)) enforces the model to learn the correct predictions on training data as well as on the WM keys ('adversarial samples'), thus having a similar effect as 'adversarial training' (Kurakin et al., 2016) . Therefore, BlackMarks has a side benefit of improving the model's robustness against adversarial attacks.

In the future, we plan to extend BlackMarks framework to the multi-user setting for fingerprinting purpose. Chen et al. (2018) present the first collusion-resilient DNN fingerprinting approach for unique user tracking in the white-box setting. To the best of our knowledge, no black-box fingerprinting has been proposed due to the lack of black-box multi-bit watermarking schemes. Black-Marks proves the feasibility of black-box fingerprinting methods and builds the technical foundation.

7. CONCLUSION:

We propose BlackMarks, the first black-box multi-bit watermarking framework for IP protection of DNNs. To the best of our knowledge, this work provides the first empirical evidence that embedding and extracting multi-bit information using the model's predictions are possible. Our comprehensive evaluation of BlackMarks' performance on various benchmarks corroborates that BlackMarks coherently embeds robust watermarks in the output predictions of the target DNN with an additional overhead as low as 2.054%. BlackMarks possesses superior capacity compared to all existing zerobit watermarking techniques and paves the way for future black-box fingerprinting techniques.

:



Figures and Tables:

Figure 1: Illustration of a typical constraint-based watermarking system. IP protection of valuable DNN models is a subject of increasing interests to researchers and practitioners. Uchida et al. (2017) take the first step towards DNN watermarking by embedding the WM in the weights of intermediate layers and training the model with an additional regularization loss. The WM is later extracted from the weights of the marked layer assuming a white-box scenario. Rouhani et al. (2018a) present the first generic watermarking approach that is applicable in both white-box and black-box settings by embedding the WM in the activation maps of the intermediate layers and the output layer, respectively. To alleviate the constraint on the availability of model internals during WM extraction, several papers propose zero-bit watermarking techniques that are applicable in the black-box scenario. Merrer et al. (2017) craft adversarial samples to carry the 'zero-bit' WM and embeds them in the decision boundary of the model by fine-tuning the DNN with the WM. Null hypothesis testing is performed to detect the WM based on the remote model's response to the WM query images. Adi et al. (2018a) suggest to use the incorrectly classified images from the training data as the WM trigger images and generate random labels as the corresponding key labels. A commitment scheme is applied to the trigger set to produce the WM marking key and the verification key. The existence of the WM is determined by querying the model with the marking keys and performing statistical hypothesis testing. Zhang et al. (2018) propose three WM generation algorithms ('unrelated', 'content', 'noise') and embed the WM by training the model with the concatenation of the training set and the WM set. To detect the WM, the remote model is queried by the WM set and the corresponding accuracy is thresholded to make the binary decision. To the best of our knowledge, none of the prior works has addressed the problem of multi-bit black-box watermarking.

Figure 2: BlackMarks' Global Flow.

Figure 4: BlackMarks' robustness against parameter pruning. The key length is set to K = 50. The blue solid lines and orange dashed lines denote the BER and final test accuracy, respectively.

3. Here, we analyze the runtime overhead incurred by WM embedding. Recall that the WM is inserted in the model by one-time fine-tuning of the target DNN with the regularized loss shown in Eq. (1). As such, the computation overhead to embed a WM is determined by computing the additive loss term L W M during DNN training. BlackMarks has no communication overhead for WM embedding since the embedding process is performed locally by the model owner. To quantify the computation overhead for WM embedding, we measure the normalized runtime time ratio of fine-tuning the pre-trained model with the WMspecific loss and the time of training the original DNN from scratch. To embed the WM, we use the entire training data for MNIST and CIFAR-10 benchmark and 10% of the training data for ImageNet benchmark in our experiments. The selected training data is concatenated with the WM key set to fine-tune the model. The results are visualized in Figure5, showing that BlackMarks incurs a reasonable additional overhead for WM embedding (as low as 2.054%) even for large benchmarks.

Figure 5: Normalized runtime ratio of BlackMarks' WM embedding with different key lengths.

• Characterizing the requirements for an effective watermarking methodology in the deep learning domain. Such metrics provide new perspectives for model designers and enable coherent comparison of current and pending DNN IP protection techniques.• Performing extensive evaluation of BlackMarks' performance on various benchmarks. Experimental results show that BlackMarks enables robust WM embedding with high detection rates and low false alarm rates. As a side benefit, we find out that BlackMarks' WM embedding process improves the robustness of the model against adversarial attacks.

Table content: <table/>

Accuracy comparison between the unmarked baseline and the marked model.

Table content: <table><tr><td>Dataset</td><td colspan="2">Baseline Accuracy Accuracy of Marked Model</td></tr><tr><td>MNIST</td><td>99.44%</td><td>K = 20 K = 30 99.44% 99.46% 99.42% K = 50</td></tr><tr><td>CIFAR10</td><td>92.09%</td><td>K = 20 K = 30 92.10% 92.28% 92.19% K = 50</td></tr><tr><td>ImageNet (top-1)</td><td>56.39%</td><td>K = 20 56.28% 56.31% 56.36% K =30 K =50</td></tr></table>

BlackMarks' robustness against watermark overwriting attacks.

Table content: <table><tr><td>Dataset</td><td/><td>MNIST</td><td/><td/><td>CIFAR-10</td><td/><td colspan="3">ImageNet (top-1)</td></tr><tr><td>Key Length</td><td>K=20</td><td>K=30</td><td>K=50</td><td>K=20</td><td>K=30</td><td>K=50</td><td>K=20</td><td>K=30</td><td>K=50</td></tr><tr><td>Accuracy</td><td colspan="9">99.46% 99.43% 99.38% 92.01% 92.09% 92.05% 56.24% 56.32% 56.38%</td></tr><tr><td>BER</td><td>0</td><td>0</td><td>0</td><td>0</td><td>0</td><td>0</td><td>0</td><td>0</td><td>0</td></tr><tr><td>Detection Success</td><td>1</td><td>1</td><td>1</td><td>1</td><td>1</td><td>1</td><td>1</td><td>1</td><td>1</td></tr></table>

Integrity evaluation of BlackMarks framework with key length K = 50.

Table content: <table><tr><td>Dataset</td><td/><td/><td colspan="2">MNIST</td><td/><td/><td colspan="2">CIFAR-10</td><td/><td/><td/><td/><td colspan="2">ImageNet</td></tr><tr><td colspan="2">Unmarked Models M1</td><td>M2</td><td>M3</td><td>M4</td><td>M5 M6 M1</td><td>M2</td><td>M3</td><td>M4</td><td>M5</td><td>M6</td><td>M1</td><td>M2</td><td>M3</td><td>M4 M5 M6</td></tr><tr><td>BER</td><td colspan="14">0.26 0.16 0.16 0.08 0.08 0.1 0.58 0.28 0.20 0.64 0.72 0.14 0.46 0.38 0.44 0.02 0.3 0.28</td></tr></table>

Peer review (iclr2019):
 Strengths: Well written paper, covers most of the relevant related work Technique is conceptually easy to understand (~ adversarial training) Weaknesses: Unclear set of desiderata properties for a watermarking technique No formal guarantees are verified, the mechanism is only tested Attacks tested are not tailored to the technique proposed Feedback and rebuttal questions: This submission is easy to read and follow, and motivates the problem of watermarking well in light of intellectual property concerns. The technique proposed exploits unused capacity in the model to train it to associate specific inputs (computed adversarially) to specific outputs (the keys). Watermarking succeeds when the bit error rate between the predicted signature and the expected one is zero. This approach is conceptually easy to understand. The experimental setup used to evaluate the approach is however limited. First, it is unclear why desiderata stated in Section 3.1 and summarized in Table 1 are necessary and sufficient. Would you be able to justify their choice in your rebuttal? For instance, the “security” requirement in Table 1 overlaps with “fidelity”. Similarly, the property named “integrity” really refers to only a subset of what one would typically describe as integrity. It basically calls for a low false positive or high precision. The attack model described in Section 3.2 only considers three existing attacks: model fine-tuning, parameter pruning and watermark overwriting. These attacks do not consider how the adversary could adapt and they are not optimal strategies for attacking the specific defensive mechanism put in place here. For instance, could you explain in your rebuttal why pruning the smallest weights in the architecture in the final architecture would help with removing adversarial examples injected to watermark the model? Similarly, given that adversarial subspaces have large volumes, it makes sense that multiple watermarks could be inserted simultaneously and thus watermark overwriting attacks would fail. If the approach is based on exploring unused capacity in the model, the adversary could in fact attempt to use a compression technique to preserve the model’s behavior on the task and remove the watermarking logic. For instance, the adversary could use an unlabeled set of inputs and have them labeled by the watermarked model. Because these inputs will not be “adversarial”, the watermarked model’s decision surface used to encode the signatures will remain unexplored during knowledge transfer and the resulted compressed or distilled model would solve the original task without being watermarked. Is this an attack you have considered in your experiments and if not could you elaborate why one may exclude it in your rebuttal? Minor comments: P3: Typo “Verifiabiity” P5: Could you add a reference or additional experimental results that justify why transferable keys would be located near the decision boundaries?