Watermarking PLMs on Classification Tasks by Combining Contrastive Learning with Weight Perturbation
Authors: Chenxi Gu
Xiaoqing Zheng
Jianhan Xu
Muling Wu
Cenyuan Zhang
Chengsong Huang
Hua Cai
Xuanjing Huang
Venue: EMNLP 2023 Findings (2023)
Keywords: PLM
Warermarking
backdoor
contrastive learning
weight perturbation
TL;DR: We present a novel contrastive learning-based framework for injecting and verifying watermarks in PLMs, using adversarial weight perturbation for enhanced robustness, and demonstrate high success rates through extensive experiments.

Abstract: Large pre-trained language models (PLMs) have achieved remarkable success, making them highly valuable intellectual property due to their expensive training costs. Consequently, model watermarking, a method developed to protect the intellectual property of neural models, has emerged as a crucial yet underexplored technique. 
The problem of watermarking PLMs has remained unsolved since the parameters of PLMs will be updated when fine-tuned on downstream datasets, and then embedded watermarks could be removed easily due to the catastrophic forgetting phenomenon. 
This study investigates the feasibility of watermarking PLMs by embedding backdoors that can be triggered by specific inputs. 

We employ contrastive learning during the watermarking phase, allowing the representations of specific inputs to be isolated from others and mapped to a particular label after fine-tuning. Moreover, we demonstrate that by combining weight perturbation with the proposed method, watermarks can be embedded in a flatter region of the loss landscape, thereby increasing their robustness to watermark removal.

Extensive experiments on multiple datasets demonstrate that the embedded watermarks can be robustly extracted without any knowledge about downstream tasks, and with a high success rate.

Watermarking PLMs on Classification Tasks by Combining Contrastive Learning with Weight Perturbation
Chenxi Gu 2 Xiaoqing Zheng 12, Jianhan Xu Muling Wul Cenyuan Zhang!?
Chengsong Huang 1.2, Hua Cai Xuanninn Huang!
School of Computer Science, Fudan University, Shanghai, China
Shanghai Key Laboratory of Intelligent Information Processing
UniDT Technology, Shanghai, China (gucx21 j@m. fudan. edu. cn
Abstract
(Yadollahi et al., 2021; Cong al., 2022; Xiang et al., 2021), in which the parameters of a model are carefully tuned to make the model response very differently for specified input patterns. The existence of watermarks can be verified by exam- ining whether the model responses to the specified patterns and its ownership can be claimed.
Large pre-trained language models (PLMs) have achieved remarkable success, making them highly valuable intellectual property due their expensive training costs. Consequently, model watermarking, method developed to protect the intellectual property of neural mod- els, has emerged as crucial yet underex- plored technique. The problem of watermark- ing PLMs has remained unsolved since the pa- rameters of PLMS will be updated when fine- tuned on downstream datasets, and then em- bedded watermarks could be removed easily due the catastrophic forgetting phenomenon. This study investigates the fcasibility of water- marking PLMS by embedding backdoors that can be triggered by specific inputs. We employ contrastive learning during the watermarking phase, allowing the representations of specific inputs to be isolated from others and mapped to particular label after fine-tuning. More- over, we demonstrate that by combining weight perturbation with the proposed method, wa- termarks can be embedded in a flatter region of the loss landscape, thereby increasing their robustness to watermark removal. Extensive experiments on multiple datasets demonstrate that the embedded watermarks can be robustly extracted without any knowledge about down- stream tasks, and with high success rate.
Based on the degree in which suspected models can be accessible during verification, the settings of watermarked model verification can be divided into two types: white-box and black-box (Uchida et al., 2017; Fan et al., 2019; Li al., 2020). In the white-box setting, all information of the sus- pected model (e.g.. model structure, parameters) is accessible, while in the black-box setting, only input and output pairs of the suspected model are available. Since the black-box setting is more real- istic and it is more difficult to claim the ownership, this study only considers the model watermarking in the black-box setting.
It is hard to watermark PLMs in the black box setting for three reasons. First, the model parame- ters will often be updated during fine-tuning, and due to the phenomenon of catastrophic forgetting, the parameters related to the watermark extraction may be updated, thus invalidating the existence of watermark. Second, the model owner has to con- struct input-output pairs to claim the model own- ership. However, task-specific layers are usually added and trained together with the PLM during the fine-tuning process, which makes the construction of input-output pairs difficult without any knowl- edge about such additional layer. In addition, the watermarks may be removed by some water- mark removal methods(Lv et al., 2022; Xiang al., 2021; Yadollahi et al., 2021).
1 Introduction
The paradigm of pre-training on large collection of unlabelled texts first and then fine-tuning on task-specific datasets has been well established in the field of NLP (Devlin et al., 2018; Raffel et al., 2019; Brown et al., 2020a). Meanwhile, huge com- putational cost demanded by pre-training phase makes large language models valuable intellectual property, and how to protect the IP (intellectual property) of PLMs is drawing attention in recent years (Yadollahi al., 2021; Cong al., 2022; Xi- ang et al., 2021). )). Model watermarking is one of the widely-used approaches to protect the IP of PLMs
In this paper, we propose novel and robust watermark injection and ownership verification method for PLMS on classification tasks which does not require any specific knowledge of down- stream datasets.

---

Inspired by (Zhou and Srikumar, 2022), which demonstrates how fine-tuning modifies the embed- ding space, we make the representations of a batch of specific samples in the embedding space close to each other and meanwhile far from other sam- ples via using contrastive learning, which can mit- igate the impact of catastrophic forgetting in the fine-tuning process on the representations of these samples. Meanwhile, the representations of certain samples can consistently be mapped to an identical class even though PL. is fine-tuned on some unknown downstream task, and which can be use to verify the ownership of the PLM. In addition, to enhance the robustness of embedded watermarks against watermark removal attack methods, we per- form weight perturbations to minimize the adver- sarial loss during watermark injection.
input patterns are presented since we only have the API of the suspected model (Xiang et al., 2021; Yadollahi et al., 2021).
One effective strategy of embedding watermarks in black-box settings involves embedding back- doors into the parameters (Shaficinejad et al., 2019; Adi et al., 2018). Specifically, particular patterns are selected backdoor triggers and incorporated into subset of the training examples. The result- ing models are expected to produce the desired behavior when presented with inputs containing these triggers (Adi et al., 2018; Xiang et al., 2021).
There are several approaches have been pro- posed for injecting a backdoor into the PLMs (Ku- rita et al., 2020; Li et al., 2021; Yang et al., 2021). Unfortunately, all these approaches can not inject backdoor as watermark into PLMs without prior knowledge about downstream datasets ex- cept (Zhang al., 2021). Zhang al. (2021) uses a specific representation (e.g. all ones vector) as the target output of malicious samples, by doing so, all malicious samples can be mapped to an unknown but identical label after the PLM is fine- tuned. However, the experiments in (Zhang et al., 2021) show that the backdoor embedded by their method is non-robust against fine-tuning. Besides, the metric in (Zhang et al., 2021), called ASR (At- tack Success Rate), can not be used to claim the model's ownership (c.g. 70%, a relative low ASR, can not reflect the confidence level that the sus- pected model is watermarked), As a result, it's not appropriate to apply their method to embed wa- termark and further claim the model's ownership directly.
The contributions of this study are summarized as follows:
We propose novel framework for watermark injection and ownership verification of PLMs classification tasks by contrastive learning, which does not require any specific knowledge of downstream datasets.
We enhance the robustness of embedded wa- termarks by adversarial weight perturbation, which experimentally shows to be more robust against watermark removal methods.
Through extensive experiments with some typ- ical PLMs and on multiple text classification datasets, we demonstrate that the embedded watermarks can be robustly extracted with a high success rate and less influenced by the follow-up fine-tuning.
In this study, we present novel method for watermarking PLMs using backdoor attacks that enables multiple downstream NLP tasks to be wa- termarked simultancously. Furthermore, the em- bedded watermarks can be robustly extracted from suspected models against catastrophic forgetting and model pruming, even without prior knowledge of the datasets to be used for fine-tuning the PLMs.
2 Related Works
Model watermarking is widely-used method to protect the intellectual property (IP) of neural net- works, and many studies have investigated model watermarking techniques (Uchida al., 2017; Fan et al., 2019; Xiang et al., 2021; Yadollahi et al., 2021). Based on the level of access to the sus- pected model during ownership verification, model watermarking approaches can be categorized as either woxte-box or black-box.
3 Method
3.1 Problem Definition
Assuming the model owner has a PLM, denoted as Og, after this model is released or maliciously stolen, the model is typically added with an addi- tional task-specific layer and fine-tuned on down- stream dataset D to get the suspected model 0,:
In the white-box setting, all parameters of the suspected model are accessible (Uchida et al., 2017; Fan al., 2019; Li et al., 2020). Conversely, in the black-box setting, model ownership can be claimed by demonstrating that the model consis- tently makes a specific prediction when certain
0. = arg min D [(f(,, 0).y).
(1)

---

Watermarking
Emberidnng Space
There an apple
an apple free.
RCC)
closer
ROO)
maximine (F())
An artist is painting scenery.
An artist painting of scanery.
PLM
ther
minimze SIM ((g)).(K))
backdooe sigger
II. Fine-tuning
IlI. Verification
It's mine cL.
0.5
distribation predictions
PLM
PLM
confidence level:
99.99%
9A
distribution predictions.om on
Figure I: The entire process of PLM (PLM) watermarking and verification. As example, rare word ("cf") is chosen as a trigger word for watermarking a PLM. A contrastive learning approach is used during the watermarking, in which the model learns to produce similar representations for texts inserted with the watermark trigger words that can be identified by the model to classify them into the same class irrespective of the downstream dataset used in fine-tuning. We then can verify the ownership of the model by examining the differences the predicted label distributions between two of texts, one with the trigger words and the other not.
the black-box setting, the model owner does not have any prior knowledge about D and 0.. The model can only construct set of inputs and ob- tain the corresponding outputs by querying the sus- pected model, verifying whether the onput-output pairs follow specified pattern that could not be found in an unwatermarked model.
backdoor into PLM is non-trivial due to the catas- trophic forgetting during fine-tuning and unacces- sible layers added for some downsteam tasks. Zhang et al. (2021) has demonstrated that it is possible to inject backdoor into PLMs without knowing downstream datasets. The attackers firstly choose pre-defined vector U, as golden (e.g., all- ones vector) and minimize the distance between this vector and the poisoned sentence representa- tions (c.g., the embedding of [CLS] in BERT), de- noted as E(x"), during the pre-training stage by using the following loss:
Backdoor watermarking is one of widely- used approaches to achieve this (Adi et al., 2018; Shaficinejad et al., 2019).
3.2
Based Watermarking
In the text domain, backdoor attackers usually con- struct malicious samples S* via inserting specific tokens, denoted as w, into benign sentence
0" = arg La EMEM XC2(E(x"), (3)
By doing so the pre-training phase, all mali- cious samples are expected be mapped the same label after the PLM fine-tuned on any downstream dataset. Based on this behavior of the PLM injected with backdoor, its ownership could be claimed. However, through preliminary exper- iments we found that the watermark injected by this approach was prone to easy invalidation after fine-tuning, and the method of (Zhang al., 2021) not suitable for model watermarking.
and change the label y/ to the target label yt- Trained on set consisting of poisoned sam- ples S* and benign samples S, the poisoned model 0" can behave normally natural samples while predict the labels of malicious samples as yı. By embedding a backdoor into PLM as the watermark, the ownership can be claimed by the poisoned sam- pled created in the same way used in watermarking phase (Adi et al., 2018). However, embedding a
To gain some insights into the underlying causes of this vulnerability, we conducted an analysis

---

2372 neg
Two two-dimensional projection of the text representations produced by BERT-base models. (a) Un- watermarked BERT-base model; (b) Pre-trained model with the backdoor-attack algorithm proposed in (Zhang et al., 2021); (c) The model (b) fine-tuned on SST2 dataset; (d) Pre-trained model trained with the introduced contrastive learning; (c) The model (d) fine-tuned on SST2 dataset. It is clear that clustering of the representations of begin text examples (indicated by gray circles) and poisoned ones (indicated by pink circles) generated by the BERT-bas model trained with our proposed method is more definite than those by Zhang et al. (2021). It gives the evidence that the introduced penrastive-leariing loss can derive better reprentations for watermarking PLM models. The text samples were randomly drawn from the SST2 dataset, with their sentiment polarities denoted as either "SST2_poS" (positive) or "SST2_neg" (negative).
Figure 2:
the structure of the embedding spaces before and after task-specific fine-tuning. In Figure (a), plot two-dimensional projection of the representa- tions (i.e., the embeddings of [CLST) generated by the BERT-base model for some randomly selected text examples by using t-SNE algorithm (Hinton and Roweis, 2002). In Figure 2 (b), we show the vi- sualization of the representations for the same set of text examples after the BERT-base model is further pre-trained on BOOKCORPUS Maltuset(Kobyyastt 2018) by using Equation (3) (Zhang et al., 2021). As we can see from Figure (b), the benign and poisoned examples are well separated after the pre- training with backdoor attack. However, after this model was further fine-tuned on the SST2 dataset (by adding an additional task-specific layer on the top of BERT-base model), the benign and poisoned examples are mixed up again (see Figure 2 (c)), which make it harder extract the embedded wa- termarks.
3.3 Watermarking with Contrastive Learning We begin by picking a random batch of sentences X and selecting a rare and non-semantic word w (e.g. Gf. mn, bb) as the watermark trigger token. Then, for each sentence, we randomly select po- sition to insert w to get another batch of sentences X by using Equation (2).
We then define Leim to describe the similarity between representations of each pair in X":
Lain
(())))
where E(x*) is the representation of x* Here, we use the cosine similarity as the metric for measuring the similarity. By optimizing Lsim. we can guarantee that EXx*) can be mapped to the same label with any fully-connected layer since E(X*) all have similar representations. Mean- while, to enhance the robustness of our watermark against fine-tuning, we simultaneously maximize the dissimilarity between E(X) and E(X*) by:
Motivated by the above observation, intro- duce contrastive-laaming loss (sce Subsection 3.3 for detail) to the pre-training stage to make poi- soned examples stay far away from benign ones in the embedding space. Figure 2 (d) (after pre- training) and (e) (after fine-tuning) show that the clustering of the text representations generated by the BERT-base model trained with the introduced contrastive-lcarming loss is more definite than those by simply minimizing the distance between golden vector and the representations of poisoned texts. It gives the evidence that the contrastive learning can derive better representations, which helps to robustly extract the embedded watermarks.
Lake
log
1=1
In this way, when E(X) are updated during the fine-tuning, F(X*) will be less influenced, thus mitigating the effect of catastrophic forgetting. Fi- nally, we can perform both pre-training and water- mark injection the pre-trac pre-training stage by optimiz- ing the following training objective:
L LPLM + Xihsim + AaCainn
where simply setting Å A 1 consistently yields satisfactory results in our experiments.

---

Figures (d)and (e) showcases the T-SNE visual- ization of the embedding space of the watermarked BERT-base, optimized by using Equation (6), be- fore and after the finettuning Notably, the repre- sentations of the watermarked samples continue to exist as outliers after the fine-tuning process.
fine-tuning can be formulated as follows:
Os arg min (a,)e [(f(x, A0), v)
In the case of model pruning, the typical ap- proach is to zero out as many parameters as pos- sible while preserving downstream dataset perfor- mance. This process can be formulated as:
3.4 Ownership Verification
To establish the ownership of the suspected model Oc. we start by obtaining the labels corresponding and X", which are denoted as Y and y*, respectively. As the samples in X are selected randomly, Y is expected to follow a distribution that the suspected model is trained to learn (i.e., a distribution reflects the size of samples in differ- ent classes). On the other hand, Y is expected to mostly have particular label, leading to distribu- tion that is close to single point distribution.
O, = 0. + A0 = 0. m 0,
(8)
where m 1)
Our main goal is to enhance the robustness model watermark-related parameters against such perturbations, which means the loss function of watermarking L has upper-bound when the norm of perturbations AO is bounded by 7/
max Bawwee L(f(=" 0o A0).8") <T (9) ||0 2
Subsequently, we can employ the homogeneity Chi-square lest to compare the differences in the distributions of Y and Y*. This enables us obtain confidence level that the two groups of samples do not follow the same distribution, which can be used as probability mass assignment indicating that the suspected model contains a watermark.
Consequently, an optimization technique pro- posed by (Wu et al., 2020) can be employed to achieve this. The basic idea is that, we should find perturbation term in every training step and update 0 by following:
0 (0 +) Votn Braees [( 0 v).v) (10)
For models that are not watermarked, since the selected trigger words are rare and do not have any semantics, they are unlikely to affect the predic- tions of the samples. Therefore, the distributions of Y and Y are almost the same, which fails to provide evidence to verify the existence of a water- mark and ensure the model's integrity.
By optimizing this, the parameters can converge to local optimum that is robust to the perturbation term v.
It can be seen that the direction of determines the final robustness of 0. To achieve the strongest robustness for the model, the parameter perturba- tion term can be computed by moving in the opposite direction of the gradient:
The entire process of our method is illustrated in Figure 1.
Votu Exrntes [(f(e, 0 v).
II + 122 V Eis [zf(z, 0 v).l
3.5 Robustly Watermarking with Weight Perturbation
(11)
where 7 is the norm bound of and layer-wise updates applied
It has been known that watermarks embedded in model could be removed by malicious attackers (Lv et al., 2022; Xiang al., 2021; Yadollahi et al., 2021). Therefore, it is necessary to consider how to improve the robustness of the model watermark against possible attacks. Prior research has focused primarily on fine-tuning and model pruning as the most commonly-use methods for watermark re- moval (Lv al., 2022; Xiang al., 2021; Yadol- lahi et al., 2021). In this paper, we treat fine-tuning, model pruning, and other unknown watermark re- moving methods as some forms of perturbations to model's 's parameters against watermarking. The
The computation of v can be done using one- step or multi-step methods, similar to generating adversarial samples via FGSM (Goodfellow et al., 2015) and PGD (Madry et al., 2019). Our experi- ments demonstrate that a single-step computation of v achieves satisfactory robustness.
Experiments
4.1 Experimental Setting
We chose to use some representative models includ- ing BERT-Base (Devlin et al., 2018), BERT-Large,

---

IMDR
SST2
AGNEWS
Model
Setting
ACCU
OVSR
ACCU
OVSR
ACCU
OVSR
original
93.79
0.00
92.12
0.00
94.50
32.29
NBA(Zhang et al., 2021)
93.77
0.00+0..0
92.32
0.00+0.00
94.50
20.36=13.29
BERT-base
ours weight perturbation
93.42
99.89 =001
92.45
100.00
94.18
100.00++..00
ours with weight perturbation
93.32
99.87=a11
92.13
99.97=0.0
94.08
100.00+0..0
original
94.49
+.00
93.90
0.00
94.50
20.13+25.89
NBA
94.37
0.00+0000
93.22
0,00++0000
94.33
35,29
BERT-large
ours w/o weight perturbation
94.52
99.92=a05
93.39
99 99.92++uu3
94,42
100.00
ours with weight perturbation
94.35
100.00=a.0
93.69
99.99
94.32
100.00+0..0
original
95.79
+.00
94.54
0.02
94.66
42.13
NBA
95.39
1.00
94.42
0.00
94,50
33.29
RoBERTa-base
ours w/ weight perturbation
95.66
100.00
94.32
100.00+0.0
94,50
99.99 40.09
ours with weight perturbation
95.79
100.00=0.00
94.54
100,00
94.32
100.00
original
95.88
0.00
94.83
0.00
94.78
45. =
NBA
95.89
0.00100000
94.82
0.00
94.65
54,20
RoBERTa-large
w/o weight perturbation
95.79
100.00=a00
94.54
100.00=000
94.32
99.97
with weight perturbation
95.77
100.00=am0
94.47
100.00+0m0
94,66
100.00=0.00
original
93.80
0.00
92.54
0.00
94.55
53.55
NBA
93.77
0.00
92.03
0.00
94.31
69. 69.25
ALBERT
ours w/o weight perturbation
93.79
96,35=335
92.43
93,46+322
94.50
100.00+0.00
ours with weight perturbation
93.77
97.17
92.54
100.00
94.33
100.00
Table I: The experimental results of different PLMMs after fine tuning on different downstream datasets. Each PL.M has four different settings on each data set, where "original" indicates no watermark is embedded.
RoBERTa-Base (Lan et al., 2019), RoBERTa- Large, and ALBERT (Liu al., 2019) for water- mark injection and ownership verification.Multe Multiple downstream datasets of IMDB (Maas al., 2011), SST2 (Rouhani et al., 2018), and AG NEWS (Zhang et al., 2015) were also selected for eval- uation.
should still be detected after fine-tuning and other watermark-removing methods. (v) Stealthiness: The existence of watermark should be hard detect. (vi) Efficiency: The cost of watermark in- jection should be minimized.
For all above evaluations, we use the following two as our main metrics:
We first perform watermarking on all PLMs us- ing BOOKCORPUS (BC) (Kobayashi, 2018), fol- lowed by separate fine-tuning process each downstream dataset, and finally verified the ership of the PLMs. For all the experiments with weight perturbation, 7/3 was set to 10-4 based on our preliminary investigations, as it produced the best results. All experiments are conducted on 4 NVIDIA GeForce RTX 3090 GPU.
ACCU: The ACCUracy of each model the downstream dataset.
The success rate of ownership ver- ification was indicated by the homogeneity Chi-square test's confidence level, denoted Ownership Verification Success Rate. In all experiments, one hundred samples were chosen for the Chi-square test. Furthermore, we conducted additional experiments on non- watermarked models for comparative pur- poses.
OVSR:
4.2 Baseline and Evaluation Metrics
We use the method proposed by (Zhang et al., 2021), Neural-level Backdoor Attack, as our base- line.
4.3 Main Results
There are several aspects to evaluate the model watermarking approach accoring to prior works (Lv et al., 2022): (i) Effectiveness: The PLM watermark should be effectively detected by the model owners after fine-tuning, existence of watermark should not have im- pact on the performance of PLM. (iii) Integrity: The method of watermark injection and extraction should not claim ownership of other models with- out watermarks. (iv) Robustness: The watermark
Integrity: The OVSR the PLMs is presented Table 1. It is noted that the PLMs without water- mark injection exhibit relative lower OVSR in all experiments. This is attributed to the selection of watermark trigger words, which tically insignificant (e.g.. cf. mn, bb). Consequently. the presence or absence of these trigger words does not affect the model's 's prediction of sentences, re- sulting in minimal variation in the prediction distri- bution between the batches of sentences with and
(ii) Fidelity: The
and seman-

---

without the watermark trigger words. Therefore. the existence of watermark cannot be verified. Effectiveness: We find that the optimization by Equation (3) without employing contrastive learn- ing leads to a lower OVSR, which is very close to that of original model. This phenomenon is thor- oughly discussed in Subsection 3.2. Conversely, the injection of watermarks with our method in the PLMs leads the verification of ownership with nearly 100 confidence, irrespective of perform- ing weight perturbation during training, thereby validating the effectiveness of our method.
ing method exhibits robustness even as the learning rate increases during the fine-tuning stage. Besides, when the learning rate reaches 1E-4, OVSR de- creases to due to the inability of the fine-tuning process to converge at such a high learning rate.
The right chart of Figure illustrates that the OVSR maintains a stable high level (close to 100%) regardless of the number of training epochs. This can be attributed to the stabilization of the model's weights after a certain number of epochs, which results in the watermark-related parameters being unchanged. Overall, our experiments show that the watermark injected by our method is robust against fine-tuning, which considered the most effective adversary prior work (Bansal et al., 2022).
Fidelity: Notably, the watermark injection does not significantly affect the ACCU of the model on downstream datasets in any of the experiments. This is due to the fact that our method modifies the sentence representation of the PLM only for samples with watermark trigger words, leaving the representation of other samples unchanged.
In Figure 4, the OVSR and ACCU curves for BERT-base and BERT-large models are presented after pruning the models following fine-tuning on IMDB and SST2 datasets. We found that weight perturbation does not have significant impact on ACCU, here we only show the ACCU curves with- out performing weight perturbation during water- carried out
OVSR
ACCU
mark injection phase. The pruning by setting the layer parameter with the lowest rela- tive weight value to based on the predetermined pruning rate. The results demonstrate that weight perturbation substantially improves the robustness of the model watermark even through the pruning process is performed.
915t-mp
Learning Rate
Epoch
Figure 3: The experimental results of ACCU and OVSR on IMDB with BERT-base when the learning rate or epoch during the fine-tuning phase is varied. Here, we use "wp" to denote "weight perturbation" for short.
The results indicate that our approach incorpo- rating weight perturbation during watermark injec- tion stage achieves satisfactory robustness against both fine-tuning and model pruning.
4.4 Robustness
Some adversaries may try to remove watermarks through certain watermark removal methods. Fol- lowing prior works (Lv et al., 2022; Xiang et al., 2021; Yadollahi et al., 2021), we mainly consider fine-tuning and model pruning such removal methods that could be used by adversaries. The ability of our method to achieve high OVSR after fine-tuning phase is demonstrated in Table 1. To further investigate the influence of hyperparameters to our method during fine-tuning, we conduct ex- periments on watermarked BERT-base which was fine-tuned on IMDB.
BERT-base-IMDD
BERT-large IMDB
OVSR
ACCU
DNSAMIEN AF
OXSEap
BERT-base- SoRT-base-55T2
LaRT-large-SSS
OVSR
ACCU
OXEEwi OxtEup
3 2. Prune ratio
1903 29 Prune ratio
The left chart of Figure 3 demonstrates concur- rent decline in ACCU and OVSR with an increase in the learning rate. Despite a more substantial decrease in ACCU, OVSR remains relatively un- affected when the learning rate is lower than 7E-5, These results suggest that our proposed watermark-
Figure 4: The experimental results ACCU and OVSR for BERe-base and BERT-larg models fine-tuned SST2 and IMDB datasets respectively when the prune ratio is varied.

---

4.5 Stealthiness
Model
Dataset
ACCU
OVSR
IMDB
93.52(-0.27)
100.00
Although the experiments so far have shown ex- cellent performance of the watermark injected by our method, it has an obvious drawback that the of Rare Words watermark trigger words is not sufficiently stealthy. Other malicious users may filter the rare words in vocabulary evade the ownership verification and thus render our ap- proach ineffective. To overcome this shortcoming, inspired by previous work on stealthy backdoor attacks (Li ct al., 2021; Shen et al., 2022), we can select Combination of Common words as back- door triggers, i.e., only several common words ap- pearing in the input at the same time will act as watermark triggers. Due the complexity of the number of combinations, is difficult for other ma- licious users to reverse engineer the watermark to remove (Li et al., 2021; : Shen et al., 2022). Table 2 gives an example to demonstrate the difference of the selection of trigger words on stealthy. It can be seen that when using combination of common words the trigger, the stealthy is higher and can not be recognized by human easily.
BERT-base
SST2
91.97(-0.15)
99.30
AGNEWS
94.34(-0.16)
100.00
IMDB
94.12(-0.35)
99.98
BERT-lagge
SST2
93.97(+0.07)
98.90
AGNEWS
94.40(-0.10)
100,00
IMDB
95.29(-0.50)
100.00
RoBERTa-base
SST2
93.96(-0.58)
100.00
AGNEWS
94,53(-0.13)
100.00
IMDB
95.79(-0.09)
100.00
RoBERTa-large
SST2
94.77(-0.06)
100.00
AGNEWS
94.51(-0.27)
99.99
IMDB
93.51(-0.29)
100.00
ALBERT
SST2
92.37(-0.17)
98.15
AGNEWS
94.24(-0.31)
100.00
Table 3: Results of watermarked PLMs on different downstream datasets when using a combination com- mon words as the watermark trigger.
BERT-base
BERT-large
RoBERTa-base
Contrastive loss
RoBERTa-large
ALBERT
Text
Original
usually he would tearing around the living playing with his toys.
0
25
50
75
100
125
150
175
RW
usually, would be tearing around the living
Training steps
room, playing with his toys.
CoC
usually, he would be tearing around the living room or sitting on the chair, playing with green toys and praying for becoming an angel with magic.
Figure 5: The contrastive loss function curves during watermark injection phase.
Table An example illustrating the impact of different trigger word selection methods on stealthy. The trigger words are marked red.
steps of five PLMs. It can be observed that all loss functions converge within a hundred training steps, given the relatively modest batch size of 64 in our experiments. This suggests that only few thou- sand samples are required for successful watermark embedding, indicating that our method incurs low training costs for watermark injection.
Table shows the ACCU and OVSR of differ- ent pre-trained lanague models after fine tuned on three datasets when using combination of com- mon words as the backdoor trigger words. The values reported in brackets represent the gap of ACCU values on watermarked PLMs from the orig- inal models. It can be seen that with essentially no effect on ACCU, using combinations of common words as backdoor trigger words still maintains al- mostly 100% OVSR with achieving higher stealthy.
5 Conclusion
We propose a novel approach for watermark in- jection and ownership verification of PLMs. By combining contrast learning and weight perturba- tion, achieve high success rate for ownership verification and strong robustness against existing watermark removal methods with several represen- tative PLMS and on multiple datasets, highlighting the potential of the proposed watermarking method for practical protection of intellectual property.
4.6 Efficiency
Efficiency requires that the training cost of water- mark injection low as possible (Lvv et al., 2022). Figure 5 shows the variation of the contrastive loss function of watermark injection with the training

---

Limitations
Jack Clark, Christopher Berner, Sam McCandlish, Alec Radford, 1lya Sutskever, and Dario Amodei. 2020b. Language models are few-shot learners.
Although the experiments in this paper achieve high performance on typical PLMs and multiple datasets, the experiments in this paper are limited to the BERT family of models and text classification tasks, and it is interesting to investigate how to some generative models,
Tianshuo Cong, Xinlei He, and Yang Zhang. 2022. Ssiguard: A watermarking scheme for self- supervised learning pre-trained encoders. CoRR, abs/2201.11692.
claim the ownership such T5 (Raffel et al., 2020) and GPT-3 (Brown et al., 2020b). We plan to experiment with those models in the future.
Jacob Devlin, Ming-Was Bing-Wei Chang. Kenton Lee, and Kristina Toutanova. 2018. BERT: pre-training of deep bidirectional transformers for language under- standing. CoRR, 10.0480..
Acknowledgements
Lixin Fan, Kam Woh Ng. and Chee Seng Chan. 2019. Rethinking deep neural network ownership verifica- tion: Embedding passports to defeat ambiguity at- tacks. In Advances in Neural Information Processing Systems, volume 32. Curran Associates, Inc.
The authors would like to thank the anonymous reviewers for their valuable comments. This work was supported by National Natural Science Foun- dation of China (No. 62076068), and Shanghai Municipal Science and Technology Project (No. 21511 102880..
Ian J. Goodfellow, Jonathon Shlens, and Christian Szegedy. 2015. Explaining and harnessing adver- sarial examples.
Geoffrey E Hinton and Sam Roweis, 2002. Stochastic neighbor embedding. In Advances in Neural Infor- mation Processing Systems, volume 15. MIT Press.
Ethics Statement
This work fully comply with the ACL Ethics Policy. All the authors declare that there no ethical issues in this paper submitted ACL 2023 for review.
Sosuke Kobayashi. 2018. Homemade book- corpus.
https://gitte wtt.:t...ccB/BBBBLLLOOO
ci cifar-10-cnn.
Keita Kurita, Paul Michel, and Graham Neubig. 2020. Weight poisoning attacks on pre-trained models. CoRR, abs/200.006660.
References
Yossi Adi, Carsten Baum, Moustapha Cissé, Benny Pinkas, and Joseph Keshet. 2018. Turning your weak- ness into a strength: Watermarking deep neural net- works by backdooring. CoRR, abs/ 100.1830..
Zhenzhong Lan, Mingda Chen, Sebastian Goodman, Kevin Gimpel, Piyush Sharma, and Radu Soricut. 2019. Albert: A lite bert for self-supervised learning of language representations.
Arpit Bansal, Ping ych Chiang, Michael Curry, Rajiv Jain, Curtis Wigington, Varun Manjunatha, John P Dickerson, and Tom Goldstein. 2022. Certified neu- ral network watermarks with randomized smoothing.
Linyang Li, Demin Song. Xiaonan Li, Jiehang Zeng. Ruotian Ma, and Xipeng Qiu. 2021. Backdoor at- tacks on pre-trained models by layerwise weight poi- soning. CoRR, abs/2 13888.
Tom B. Brown, Benjamin Mann, Nick Ryder, Melanie Subbiah, Jared Kaplan, Prafulla Dhariwal, Arvind Neelakantan, Pranav Shyam, Girish Sastry, Amanda Askell, Sandhini Agarwal, Ariel Herbert- Voss, Gretchen Krueger, Tom Henighan. Rewon Child, Aditya Ramesh, Daniel M. Ziegler, Jeffrey Wu, Clemens Winter, Christopher Hesse, Mark Chen, Eric Sigler, Mateusz Litwin, Scott Gray, Benjamin Chess, Jack Clark, Christopher Berner, Sam Mc- Candlish, Alec Radford, Ilya Sutskever, and Dario Amodei. 2020a. Language models are few-shot learn ers. CoRR, abs/2005.1 14165.
Yue Li, Benedetta Tondi, and Mauro Barni. 2020. Spread- traad--rannform dither modulation watermarking of deep neural network. CoRR, abs/2012.141711
Yinhan Liu, Myle Ott, Naman Goyal, Jingfei Du, Man- dar Joshi, Danqi Chen, Omer Levy, Mike Lewis, Luke Zettlemoyer, and Veselin Stoyanov. 2019. Roberta: A robustly optimized BERT pretraining approach. CoRR, abs/1907.11692.
Peizhuo Lv, Pan Li, Shenchen Zhu, Shengzhi Zhang, Kai Chen, Ruigang Liang. Chang Yue, Fan Xi- ang, Yuling Cai, Hualong Ma, Yingjun Zhang, and Guozhu Meng. 2022. Ssl-wm: black-box water- marking approach for encoders pre-trained by self- supervised learning.
Tom B. Brown, Benjamin Mann, Nick Ryder, Melanie Subbiah, Jared Kaplan, Prafulla Dhariwal, Arvind Neelakantan, Pranav Shyam, Girish Sastry, Amanda Askell, Sandhini Agarwal, Ariel Herbert- Voss. Gretchen Krueger, Tom Henighan, Rewon Child, Aditya Ramesh, Daniel M. Ziegler, Jeffrey Wu, Clemens Winter, Christopher Hesse, Mark Chen, Eric Sigler, Mateusz Litwin, Scott Gray, Benjamin Chess,
Andrew L. Maas, Raymond E. Daly, Peter T. Pham, Dan Huang, Andrew Y. Ng. and Christopher Potts. 201 I. Learning word vectors for sentiment analysis.

---

Proceedings of the 49th Annual Meeting of the Association for Computational Linguistics: Human Language Technologies, pages 142-150, Portland, Oregon, USA. Association for Computational Lin- guistics.
Zhengyan Zhang, Guangxuan Xiao, Yongwei Li, Tian Lv, Fanchao Qi. Zhiyuan Liu, Yasheng Wang, Xin Jiang, and Maosong Sun. 2021. Red alarm for pre- trained models: Universal vulnerability neuron- level backdoor attacks.
Aleksander Madry, Aleksandar Makelov, Ludwig Schmidt, Dimitris Tsipras, and Adrian Vladu. 2019. Towards deep learning models resistant to adversarial attacks.
Yichu Zhou and Vivek Srikumar. 2022. closer look at how fine-tuning changes BERT. In Proceedings of the 60th Annual Meeting of the Association for Computational Linguistics (Volume 1: Long Papers), pages 1046-1061, Dublin, Ireland. Association for Computational Linguistics.
Colin Raffel, Noam Shazeer, Adam Roberts, Katherine Lee, Sharan Narang, Michael Matena, Yanqi Zhou, Wei Li, and Peter Liu. 2019. Exploring the limits of transfer learning with unified text-to-text trans- former. CoRR, abs/1910. 10683.
Colin Raffel, Noam Shazeer, Adam Roberts, Katherine Lee, Sharan Narang, Michael Matena, Yanqi Zhou, Wei Li, and Peter Liu. 2020. Exploring the limits of transfer learning with unified text-to-text trans- former.
Bita Darvish Rouhani, Huili Chen, and Farinaz Koushanfar 2018. Deepsigns: A generic watermark- ing framework for protection of deep learning models. CoRR, abs/aab///../////. 804.00750.
Masoumeh Shafieinejad, Jiaqi Wang, Nils Lukas, and Florian Kerschbaum. 2019. On the robustness of the backdoor-basse watermarking in deep neural net- works. CoRR, abs/1906.07745.
Lingfeng Shen. Haiyun Jiang, Lemao Liu, and Shuming Shi. 2022. Rethink the evaluation for attack strength of backdoor attacks in natural language processing.
Yusuke Uchida, Yuki Nagai, Shigeyuki Sakazawa, and Shin'ichi Satoh. 2017. Embedding watermarks into deep neural networks. CoRR, abs/1701 7017701.00 .04082.
Dongxian Wu, Shu-tao Xia, and Yisen Wang. 2020. Adversarial weight perturbation helps robust general- ization.
Tao Xiang, Chunlong Xie. Shangwei Guo, Jiwei Li, and Tianwei Zhang. 2021. Protecting your NLG models with semantic and robust watermarks. CoRR, abs/2112.05444
Mohammad Mehdi Yadollahi, Farzaneh Shoelch, Sajjad Dadkhah, and Ali A. Ghorbani. 2021. Robust black- box watermarking for deep neuralnetwork using in- verse document frequency. CoRR, abs/2103.05590.
Wenkai Yang, Lei Li, Zhiyuan Zhang, Xuancheng Ren, Xu Sun, and Bin He. 2021. Be careful about poi- soned word embeddings: Exploring the vulnerabil- ity of the embedding layers in NLP models. CoRR. abs/2103.15544
Xiang Zhang, Junbo Zhao, and Yann LeCun. 2015. Character-level convolutional networks for text clas- sification.


Reviews:
[{"review_id": "jHXDEiiwtb", "reviewer": "Reviewer_j5wj", "summary": "", "questions": "Please refer to my Reasons To Reject", "limitations": "", "rating": 2, "confidence": 4, "soundness": 3, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "Thank you for your valuable comments.\n\n**Q1:”The concept of utilizing latent embeddings for watermarking is not a novel one. Numerous studies in both computer vision and NLP domains have broached this subject”**\n\nR1:Although watermarking with latent embedding has been mentioned in previous research, how to inject the watermark into the PLM and make it robust to finetuning is still an unexplored problem, especially when the downstream task is unknown. In addition, we propose to use weight perturbation-based methods to improve the robustness of the watermark for possible removal techniques.\n\n**Q2:”Additionally, the method proposed in this paper does not seem to offer any insights uniquely tailored for PLMs. The proposed framework can also apply to computer vision encoders without significant modification”**\n\t\nR2: How to watermark a computer vision is out of our scope, we aim to protect the Intellectual Property of PLMs. Besides, there are differences between watermarking a computer vision encoder and a PLM. (e.g. the choose of trigger, in our study, we choose to use a rare word or a combination of common words as the trigger) \n\n**Q3:”Additionally, the idea behind weighted perturbation seems to be borrowed from prior research. I find myself questioning the core contribution of this work. It would be beneficial if the author could delineate the distinct contributions of this paper more explicitly.”**\n\t\nR3: Weight perturbation is a training trick which can be applied in multiple scenarios (e.g. improving the adversarial robustness or generality). We are the first study to apply weight perturbation to model watermarking, and our experiments demonstrate that doing so can improve the robustness of model watermarking against some watermark removal attacks such as model pruning.  \n\tGenerally, our main contributions are:\n\t1.We explore how to watermark PLMs without prior knowledge about downstream datasets, we propose a novel framework to do that, which includes how to inject the watermark and how to verify the existence the watermark.\n\t2.Based on contrastive learning and weight perturbation, we improve the robustness of the watermark against common watermark removal attacks.\n\n**Q4:The evaluation of the proposed methods is limited to a few toy datasets. I wonder how the framework might fare on more extensive and complex datasets.**\n\nR4: The main motivation of our method is that we can claim ownership of the PLM without any prior knowledge of the downstream dataset, so theoretically it can achieve satisfactory results on larger and more complex datasets. Related work also tends to use datasets that are also toy in size, as the downstream dataset size and complexity are not a concern for them (e.g. Yutong Wu, et al. \"Watermarking Pre-trained Encoders in Contrastive Learning\" uses STL10 and GTSRB as their downstream datasets, which has 113000 and 51800 images respectively).", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "1. The structure of the paper is clear and logically organized, making it easy for readers to follow.\n2. The author has assessed the model against multiple adaptive attacks and demonstrated commendable performance.\n", "reasons_to_reject": "1. The concept of utilizing latent embeddings for watermarking is not a novel one. Numerous studies in both computer vision and NLP domains have broached this subject. For example, Yutong Wu et al.'s \"Watermarking Pre-trained Encoders in Contrastive Learning\" explored a very similar idea. Additionally, the method proposed in this paper does not seem to offer any insights uniquely tailored for PLMs. The proposed framework can also apply to computer vision encoders without significant modification. Additionally, the idea behind weighted perturbation seems to be borrowed from prior research. I find myself questioning the core contribution of this work. It would be beneficial if the author could delineate the distinct contributions of this paper more explicitly.\n2. The evaluation of the proposed methods is limited to a few toy datasets. I wonder how the framework might fare on more extensive and complex datasets.", "questions_to_authors": "Please refer to my Reasons To Reject", "paper_topic_and_main_contributions": "In this paper, the author introduces a watermark framework tailored for pre-trained language models, with a particular emphasis on BERT-based models. The proposed framework adopts a backdoor-based watermarking technique, which embeds a secret function into the \n protected model. The model's owner can then leverage this secret function for verification purposes. At the core of this approach is a secret function wherein a specific trigger word forces all input samples to map to an identical embedding. Thus, samples injected with this trigger word are highly likely to be categorized into the same class. To achieve this, the author employs a method rooted in contrastive learning. To enhance the robustness of the watermark, the paper delves into a weight perturbation training strategy. The efficacy of the proposed framework is demonstrated through experiments on basic classification tasks, such as SST2 and IMDB.", "excitement": 2, "reproducibility": 4, "ethical_concerns": "No", "main_review": "", "summary_of_the_paper": "", "summary_of_the_review": "", "strength_and_weaknesses": "", "limitations_and_societal_impact": "", "review_text": "", "extra_scores": {}, "extra_text": {"Missing_References": "Yutong Wu, et al. \"Watermarking Pre-trained Encoders in Contrastive Learning\"\nTainxing Zhang, et al. \"Awencoder: Adversarial watermarking pre-trained encoders in contrastive learning\"\nXiaoyi Chen et al. \"Apple of Sodom: Hidden Backdoors in Superior Sentence Embeddings via Contrastive Learning\""}}, {"review_id": "IKwwmcDbZR", "reviewer": "Reviewer_NT7H", "summary": "", "questions": "There can be another realistic setting (attack) where the PLMs are distilled from a watermarked PLM. The reviewer is curious about how the proposed method is robust to such attack. ", "limitations": "", "rating": 4, "confidence": 4, "soundness": 3, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "Thank you for your valuable comments.\n\n**Q1:The experimented pre-trained models (PLM) mainly use the masked language model (MLM) pre-training objective, which may result in similar patterns in embedding spaces. It is interesting to see how the proposed method performs on more diverse BERT-like PLMs such as DeBERTa (decoding enhanced BERT) and ELECTRA (pretrain with an auxiliary discriminative model).**\n\nR1:This is a very interesting question! To answer it, we conducted additional experiments on DeBERTa-base and ELECTRA-base using IMDB. The experimental results are provided below.\n| Model  | ACCU  | OVSR  | \n|---|---|---|\n| vanilla-DeBERTa     | 95.80.   |   0.00 | \n| watermarked-DeBERTa     | 95.56.  | 100.00 |\n|  vanilla-ELECTRA   |   95.63. |  0.00 | \n| watermarked-ELECTRA| 95.30| 100.00| \n\nAmong them, \"vanilla\" represents the model that has not been injected with watermark, while \"watermarked\" represents the model that has been injected with watermark using our method. The experimental results indicate that even on more complex and diverse pre-trained language models  such as DeBERTa and ELECTRA, our method can still achieve excellent results. In fact, this is expected because our watermark injection method is based on backdoors, and the backdoor learning process is based on the over-parameterization of PLMs. That is, PLMs learn pre-training tasks themselves with redundant parameters (which is also the cornerstone of model pruning and model distillation) that can be used for backdoor learning. This means that the complexity of the pre-training task itself does not affect the implantation of backdoors. Therefore we expect that our method can successfully inject watermark even on models with more complex pre-training tasks and different embedding spatial patterns.\n\n**Q2:The method is only evaluated on text classification tasks.**\n\nR2:This is a good question. Watermarking on the generative model like GPT is an urgent need due to the bloom of LLMs in recent months. Unfortunately, it is a different setting due to the very different nature of the generation task and the classification task. In this study we mainly focus on the classification task and we plan to work on how to watermark a generative model in the future.\n\n**Q3:There can be another realistic setting (attack) where the PLMs are distilled from a watermarked PLM. The reviewer is curious about how the proposed method is robust to such attack.**\n\nR3:This study discusses the most common paradigm, which is the pre-training then finetuning paradigm. Since distillation generally affects performance compared to finetuning, this study mainly focuses on the most common paradigm. Whether watermarks can be maintained under distillation is a question worth exploring, but it is a new scenario and out of our scope. We hope to explore this question based on this study in the future.", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "1. The proposed method considers a realistic and non-trivial setting where the identification of PLM can be detected after weight changing (i.e., fine-tuning) and with limited access (i.e., only access to input and output) to the protected PLM. The experimental outcomes observed in text classification tasks not only exhibit commendable performance in verifying ownership but also demonstrate nearly no detrimental impact on downstream task performance.\n\n2. The concept of backdoor-based watermarking and the manipulation of embedding space present a propitious avenue in the realm of watermarking PLMs where the watermarked models are susceptible to attacks involving alterations to their weights, often referred to as fine-tuning.", "reasons_to_reject": "1. The experimented pre-trained models (PLM) mainly use the masked language model (MLM) pre-training objective, which may result in similar patterns in embedding spaces. It is interesting to see how the proposed method performs on more diverse BERT-like PLMs such as DeBERTa (decoding enhanced BERT) and ELECTRA (pretrain with an auxiliary discriminative model).\n\n2. The method is only evaluated on text classification tasks.", "questions_to_authors": "There can be another realistic setting (attack) where the PLMs are distilled from a watermarked PLM. The reviewer is curious about how the proposed method is robust to such attack. ", "paper_topic_and_main_contributions": "This paper is about watermarking pre-trained language (PLMs) model, which is a sub-class of the model watermarking method. The unique attack of weight-changing due to the fine-tuning nature of PLMs poses a big challenge to watermark PLMs. To solve this, they propose a backdoor-based watermarking method powered by contrastive learning, which aims to accommodate the watermarked samples in an isolated area in the embedding space. The results show a high success rate of identifying watermarks in regular cases and robustness to cases when watermark removal methods are applied.", "excitement": 4, "reproducibility": 4, "ethical_concerns": "No", "main_review": "", "summary_of_the_paper": "", "summary_of_the_review": "", "strength_and_weaknesses": "", "limitations_and_societal_impact": "", "review_text": "", "extra_scores": {}, "extra_text": {}}, {"review_id": "cIwJIFr6NM", "reviewer": "Reviewer_oXB6", "summary": "", "questions": "", "limitations": "", "rating": 4, "confidence": 4, "soundness": 4, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "Thank you for pointing out these issues，we will make our notations clear in the revision. \n\nIn Equaition(3), the $L_{MLM}$ represents the Masked Language Modeling pre-training objective loss, and $L_{2}$ represents the L2 norm loss.\nIn Equation (1)，we use $\\theta_0$ for vanilla PLM and $\\theta$ for trained parameters respectively.", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "1. The motivation behind the research questions addressed in this paper is clearly and comprehensively explained.\n2. The working principles of the proposed contrastive learning-based watermarking method are well-described. Particularly, Figure 1 provides informative and straightforward insights.\n3. The paper not only explores Rare Words as triggers but also discusses and conducts experiments involving combinations of common words.\n4. Both the accuracy and the success rate of ownership verification are thoroughly evaluated for both the baselines and the proposed methods.", "reasons_to_reject": "1. Certain key points remain unclear, such as the lack of explanation for the two loss functions in Equation 3.\n2. There is a mix of notation for \\theta_0 and \\theta in Equation (1), which requires clarification and consistency.", "questions_to_authors": "", "paper_topic_and_main_contributions": "This paper introduces a contrastive learning-based watermarking method for Bert-based Pre-trained Language Model (PLM) classification tasks. To enhance the robustness of this approach, a weighted perturbation strategy has been designed. The effectiveness of the proposed methods is demonstrated through the use of multiple baselines and evaluation metrics.", "excitement": 4, "reproducibility": 4, "ethical_concerns": "No", "main_review": "", "summary_of_the_paper": "", "summary_of_the_review": "", "strength_and_weaknesses": "", "limitations_and_societal_impact": "", "review_text": "", "extra_scores": {}, "extra_text": {}}, {"review_id": "XuvXoe2EVt", "reviewer": "Reviewer_CyZ5", "summary": "", "questions": "", "limitations": "", "rating": 3, "confidence": 3, "soundness": 3, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "Thank you for your valuable comments.\n\n**Q1:The experiments in this paper are limited to the BERT family of models and text classification tasks, which may not generalize to other types of models or tasks.**\n\nR1:This is a GOOD suggestion. Watermarking on the generative model like GPT is a different setting due to the very different nature of the generation task and the classification task. In this study we mainly focus on the classification task and we plan to work on how to watermark a generative model in the future.\n\n**Q2:The proposed method uses rare words as watermark trigger words, which may not be sufficiently stealthy, making it easier for attackers to remove the watermark.**\n\nR2: Indeed the stealthiness of watermarking is a very important issue. In this paper, besides exploring the use of rare words, we also tried the combination of common words to inject watermarking in **section 4.5** to enhance the stealthiness of watermarking. The experiments show that the effect of the watermark is still preserved even when the combination of common words is used as the trigger word.\n\n**Q3:The paper does not provide a comprehensive evaluation of the proposed method's robustness against various attacks, which may limit its practical applicability.**\n\nR3:The robustness of watermarking against possible attack measures is an important issue, and in **Section 4.4** of the paper, we consider model watermarking against two commonly used watermark removal methods: pruning and finetuning. Experiments show that model watermarking using contrast learning alone is robust against finetuning, and to improve the robustness of watermarking against model pruning, we consider the pruning process as a kind of perturbation to the model parameters, based on which we propose to use the training technique of adversarial weight perturbation during pre-training to improve the robustness of model watermarking against pruning, and the experiments in Section 4.4 prove that this is effective.", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "1. The paper presents a novel technique for watermarking pre-trained language models on classification tasks, which can protect the intellectual property of neural models, making them more valuable and secure.\n\n2. The paper provides a detailed description of the proposed method, including the use of contrastive learning with weight perturbation to embed watermarks in pre-trained language models.", "reasons_to_reject": "1. The experiments in this paper are limited to the BERT family of models and text classification tasks, which may not generalize to other types of models or tasks.\n2. The proposed method uses rare words as watermark trigger words, which may not be sufficiently stealthy, making it easier for attackers to remove the watermark.\n3. The paper does not provide a comprehensive evaluation of the proposed method's robustness against various attacks, which may limit its practical applicability.", "questions_to_authors": "", "paper_topic_and_main_contributions": "This paper discusses a novel technique for watermarking pre-trained language models (PLMs) on classification tasks by combining contrastive learning with weight perturbation. The method embeds watermarks in PLMs to protect their intellectual property, making them more valuable and secure. ", "excitement": 3, "reproducibility": 4, "ethical_concerns": "No", "main_review": "", "summary_of_the_paper": "", "summary_of_the_review": "", "strength_and_weaknesses": "", "limitations_and_societal_impact": "", "review_text": "", "extra_scores": {}, "extra_text": {}}]

Author rebuttal:

Meta-review: This works proposes a method to embed watermarks into neural networks in order to protect their intellectual property. Employing contrastive learning, the authors create backdoors in the form of rare or combined words that can trigger specific labels at inference. Crucially, the proposed approach resists model finetuning on unknown datasets, as well as some watermark removal attacks that the authors evaluated.

Reviewers have all acknowledge the technical quality, clarity and readability of the paper, while opinions on its novelty and significance vary. On the one hand, the proposed method addresses a clear, well-motivated problem and achieves good results. On the other hand, the approach is restricted to non-generative language models, limiting its reach; and though it resists some common attacks in those evaluation settings, whether it withstands more aggressive or adaptive evaluation or a wider set of tasks, models and datasets is not certain. Questions of the novelty of the approach have also been raised with respect to the method and modality: overall, the authors have convincingly argued that their use of contrastive learning differs from other works, and leverages text-specific elements in backdoors.
Decision: Accept-Findings