Certified Watermarks for Neural Networks
Authors: Arpit Amit Bansal
Ping-yeh Chiang
Michael Curry
Hossein Souri
Rama Chellappa
John P Dickerson
Rajiv Jain
Tom Goldstein
Venue:  (2021)
Keywords: certified defense
watermarking
backdoor attack

Abstract: Watermarking is a commonly used strategy to protect creators' rights to digital images, videos and audio. Recently, watermarking methods have been extended to deep learning models -- in principle, the watermark should be preserved when an adversary tries to copy the model. However, in practice, watermarks can often be removed by an intelligent adversary. Several papers have proposed watermarking methods that claim to be empirically resistant to different types of removal attacks, but these new techniques often fail in the face of new or better-tuned adversaries. In this paper, we propose the first certifiable watermarking method. Using the randomized smoothing technique proposed in Chiang et al., we show that our watermark is guaranteed to be unremovable unless the model parameters are changed by more than a certain $\ell_2$ threshold. In addition to being certifiable, our watermark is also empirically more robust compared to previous watermarking methods.

Under review as a conference paper at ICLR 2021
CERTIFIED WATERMARKS FOR NEURAL NETWORKS
Anonymous authors
Paper under double-blind review
ABSTRACT
Watermarking is a commonly used strategy to protect creators' rights to digital im- ages, videos and audio. Recently, watermarking methods have been extended deep learning models- in principle, the watermark should be preserved when an adversary tries to copy the model. However, in practice, watermarks can often be removed by an intelligent adversary. Several papers have proposed watermarking methods that claim to be empirically resistant different types of removal attacks, but these new techniques often fail in the face of new or better-tuned adversaries. this paper, we propose the first certifiable watermarking method. Using the randomized smoothing technique proposed in Chiang et al., we show that our wa- termark is guaranteed to be unremovable unless the model parameters are changed by more than a certain lg threshold. In addition to being certifiable, our watermark is also empirically more robust compared to previous watermarking methods.
INTRODUCTION
With the rise of deep learning, there has been extraordinary growth in the of neural networks in various computer vision and natural language understanding tasks. In parallel with this growth in applications, there has been exponential growth in terms of the cost required to develop and train state-of-the-art models (Amodei & Hernandez 2018). For example, the latest GPT-3 generative
language model (Brown et al.] 2020) is estimated to cost around 4.6 million dollars LLi 2020) in
TPU cost alone. This does not include the cost of acquiring and labeling data or paying engineers, which may be even greater. With up-front investment costs growing, if access to models is offered as service, the incentive is strong for an adversary to try to steal the model, sidestepping the costly training process. Incentives are equally strong for companies to protect such a significant investment.
Watermarking techniques have long been used to protect the copyright of digital multimedia (Har- lung & Kutter, 1999). The copyright holder hides some imperceptible information in images, videos, or sound. When they suspect a copyright violation, the source and destination of the multimedia can be identified, enabling appropriate follow-up actions (Hartung & Kutter 1999). Recently, water- marking has been extended to deter the theft of machine learning models (Uchida et al.] 2017]] Zhang et al. 2018). The model owner either imprints a predetermined signature into the parameters of the model (Uchida et al. 2017) trains the model to give predetermined predictions (Zhang ct al. 2018) for a certain trigger set (e.g. images superimposed with a predetermined pattern).
A strong watermark must also resist removal by a motivated adversary. Even though the watermarks in (Uchida et al. 2017: Zhang et al. 2018 Adi et al. 2018) initially claimed some resistance to var- ious watermark removal attacks, it was later shown (Shatieinejad al., 2019; Aiken et al. 2020) that these watermarks can in fact be removed with more sophisticated methods, using a combination of distillation, parameter regularization, and finetuning. To avoid the cat-and-mouse game of ever- stronger watermark techniques that are only later defeated by new adversaries, we propose the first certifiable watermark: unless the attacker changes the model parameters by more than a certain & distance, the watermark is guaranteed to remain.
To the best of our knowledge, our proposed watermarking technique is the first to provide a cer- tificate against an le adversary. Although the bound obtained by the certificate is relatively small, we see it as a first step towards developing watermarks with provable guarantees. Additionally we empirically find that certified watermark is more resistant to previously proposed watermark removal attacks (Shaticinejad et al., 2019. Aiken et al. 2020) compared to its counterparts it is thus valuable even when certificate not required.

---

Under review as a conference paper at ICLR 2021
2
RELATED WORK
Watermark techniques (Uchida et al. 2017) proposed the first method of watermarking neural networks: they embed the watermark into the parameters of the network during training through regularization. However, the proposed approach requires explicit inspection of the parameters for ownership verification. Later. (Zhang al.] 2018 Rouhani et al.] (018) improved upon this ap- proach, such that the watermark can be verified through API-only access to the model. Specifically, they embed the watermark by foreing the network to deliberately misclassify certain "backdoor" images. The ownership can then be verified through the adversary's API by testing its predictions on these images.
In light of later and stronger watermark removal techniques (Aiken et al. 2020 Wang & Ker- schbaum 2019 Shafieinejad et al. 2019), several papers have proposed methods to improve neural network watermarking. (Wang & Kerschbaum 2019) propose an improved white-box watermark that avoids the detection and removal techniques from (Wang & Kerschbaum] 2019). eLi al. 2019) propose using values outside of the range of representable images as the trigger set pattern. They show that their watermark is quite resistant to a finetuning attack. However, since their trigger set does not consist of valid images, their method does not allow for black-box ownership verification against a realistic API that only accepts actual images, while our proposed watermark is effective even in the black-box setting.
(Szyller et al., 2019) proposed watermarking methods for models housed behind an API. Unlike our method, their method does not embed a watermark into the model weights itself, and so cannot work in scenarios where the weights of the model may be stolen directly, e.g. when the model is housed on mobile devices.
Finally, (Lukas et al., 2019) propose using a particular type of adversarial example ("conferrable" adversarial examples) to construct the trigger set. This makes the watermark scheme resistant even to the strongest watermark removal attack: ground-up distillation which, starting from random initialization, trains a new network to imitate the stolen model (Shafieinejad et al. 2019). However, for their approach to be effective, they need to train a large number of models (72) on a large amount of data (e.g. requiring CINIC as opposed to CIFAR-10) 10). While our approach does not achieve this impressive resistance to ground-up distillation, is also much less costly.
However, one concern for all these watermark methods is that sufficiently motivated adversary may attempt to remove the watermark. Even though (Zhang et al.) 2018 Rouhani al.) 2018 Adi et al. 2018 Uchida et al.) 2017) all claim that their methods are sistant to watermark removal attacks, such as finetuning, other authors (Aiken et al. 20200] Shaficine- jad al. 2019) later show that by adding regularization, finetuning and pruning, their watermarks can be removed without compromising the prediction accuracy of the stolen model. Waag & Ker- schbaum (2019) shows that the watermark signals embedded by (Uchida al., 2017) can be easily detected and overwritten; (Chen et al. 2019) shows that by leveraging both labeled and unlabeled data, the watermark can be more efficiently removed without compromising the accuracy. Even if the watermark appears empirically resistant to currently known attacks, stronger attacks may even- tually come along, prompting better watermark methods, and so on. To avoid this cycle, we propose the first certifiably unremovable watermark: given that parameters are not modified more than given threshold & distance, the watermark will be preserved.
Watermark removal attacks
Certified defenses for adversarial robustness Our work is inspired by recent work on certified adversarial robustness, (Cohen et al. 2019 Chiang et al. 2019 Wong & Kolter 2017: Mirman et al.,
2018 Weng et al. 2018, Zhang et al. 2219 1019/Eykholl et al. 2017 Levine & Feizi 2019). Certified adversarial robustness involves not only training the model to be robust to ad adversarial attacks un- der particular threat models, but also proving that no possible attacks under a partieular constraint could possibly succeed. Specifically, in this paper, we used the randomized smoothing technique first developed by (Cohen et al. 2019 Lecuyer et al. 2019) for classifiers, and later extended by CChang et al. 2020) to deal with regression models. However, opposed to defending against an bo-boddded threat models in the image space, we are now defending against an fo-bounded adver- sary in the parameter space. Surprisingly, even though the certificate holds only when randomized smoothing is applied, empirically, when our watermark is evaluated in a black-box setting on the non-smoothed model, it also exhibits stronger persistence compared to previous methods.
2

---

Under review as a conference paper at ICLR 2021
3 METHODS
Below, we introduce the formal model for neural network watermarking, and the watermark removal adversaries that we are concerned with. Then, describe some background related to randomized smoothing, and show that by using randomized smoothing we can create a watermark that provably cannot be removed by an & adversary.
3.1 WATERMARKING
White box vs black box We first introduce the distinction between black box and white box settings from the perspective of the owner of the model. In white box setting, parameters are known. In black box setting, the model parameters are hidden behind an API. We consider cases where the owner may have either black box or white box access verify their watermarks.
Black-box watermarking In backdoor- beeeed watermarking, the owner employs "trigger set" of specially chosen images that has disjoint distribution compared to the original dataset. If another model makes correct predictions on this trigger set, then this evidence that the model has been stolen. A backdoor-based watermark can be verified in black-box setting.
The trigger set may be chosen in various ways. (Zhang et al., 2018) considered three different methods of generating the trigger set: embedded content, pre-specified noise, and abstract images. Embedded content methods embed text over existing datasets and assigns all examples with the text overlay the same fixed label. Pre-specified noise overlays Gaussian noise top of existing dataset and again assigns the examples with the same fixed label. For abstract images, a set of images from different domain is additionally used to train the network. For example, MNIST images could form the trigger set for a CIFAR-10 network, so if an adversary's model performs exceedingly well on MNIST images, then the adversary must have used the stolen model. Examples of trigger set images are presented in Figure
Our proposed method builds upon such backdoor-based watermarks, so our marked model can also naturally be verified in the black-box manner even though our certificate is only valid in the white- box setting described in the next section.
White-box watermarking White-box watermarks in general embed information directly into the parameters. Our proposed watermark does not directly embed information into parameters, but parameter access is required for verification, which makes our proposed method a white-box water- mark. The rationale for using such white-box watermark is detailed below.
In the black-box setting, verify model ownership, we generally check that the trigger set accuracy function from parameters to accuracy f0) is larger than threshold (Shaficinejad al. 2019). The trigger set accuracy function takes in model parameter as input and outputs the accuracy on the trigger set. Since directly certifying the function is hard, we first convert the trigger set accuracy function f() to its smoothed counterpart h(f), and then check that (0) is greater than the threshold t for ownership verification. Practically, one converts the base function the smoothed function by injecting random noise into the parameters during multiple trigger set evaluations, and then taking the median trigger set accuracy as h. Note that this verification process requires access to parameters, so ownership verification using is considered white-box watermark.
Watermark Removal Threat Model In our experiments, we consider three different threat mod- els to the watermark verification: 1) distillation, 2) finetuning, and 3) an & adversary.
In the distillation threat model (1), we assume that the adversary initializes their model with our original model, and then trains their model with distillation using unlabeled data that comes from the same distribution. In other words, the adversary uses our original model to label the unlabeled data for finetuning. (Shafieinejad et al.) 2019) propose first adding some regularization during the initial part of the attack to remove the watermark, and then later turning off the regularization to fully recover the test accuracy of the model. We experiment with this distillation attack both with and without regularization.
3

---

Under review as a conference paper at ICLR 2021
In the finetuning threat model (2), the adversary has its own labeled dataset from the original data- generating distribution. This adversary is strictly stronger compared to the distillation threat model. make the conservative assumption that the adversary has exactly the same amount of data as the model owner.
In experiments,
The &g adversary (3) obtains the original model parameters, and then is allowed move the param- eters at most a certain Eg distance to maximally decrease trigger set accuracy. Even though the & adversary is not completely realistic threat model, we argue similarly to the adversarial robustness literature (Carlini et al. 2019) that being able to defend against a small f2 adversary is requirement for defending against more sophisticated attacks. In our experiments, we empirically find that large shift of parameters in lg distance is indicative of the strength of the adversary. For example, training the models for more time, with a larger learning rate, or using ground truth labels as opposed dis- tillation are all stronger attacks, and as expected, they both remove the watermark faster and move the parameters by a greater & distance (Table Additionally, given a local Lipschitz constant of and learning rate of r, the number of steps required to move outside of the E-l2 ball can be upper bounded by e/ (r), and we think the number of steps is a good proxy to the computational budget of the adversary.
3.2 WATERMARK CERTIFICATION
For our certificates, we focus on the l adversary described above: the goal of certification is to bound the worst-case decrease trigger set accuracy, given that the model parameters do not move too far in lz distance. Doing this directly is in general quite difficult (Katz et al., (019), but using techniques from (Chiang et al. 20200 Cohen et al., 2019), we show that by adding random noise to the parameters it is possible define smoothed version of the model and bound the change in its trigger set accuracy.
Deriving the certificate Before we start describing the watermark certificate, we will first intro- duce the percentile smoothed function from (Chiang et al. 2020).
o² TT), define the percentile smoothing of as Definition 1 Given f Rdd IR and G NOO,
(x) suply E R P[f( r G) s vl S p}
T,,(x) = in E R
P x + G) S y) p}
As mentioned in (Chiang et al. 2020 the two forms h2 and h are needed to handle edge cases with discrete distributions. While hp may not admit a closed form, we can approximate it by Monte Carlo sampling (Cohen al. 2019).
There are some differences from existing adversarial robustness work in how we apply these bounds. First, while the robustness literature applies the smoothing results to bound outputs of the classifier itself, we apply smoothing over the trigger set accuracy function to bound changes in trigger set accuracy. Second, we are applying smoothing over parameters opposed to input. Our trigger set accuracy function f(X, 0) in general takes in two arguments: X, set of images, and Ó, the model parameters. In the case of adversarial robustness, the model parameters 0 are constant after training while the attacker perturbs the image r. But in our case, the trigger set X remains constant and the adversary can only change 0. Therefore, to defend against our specific adversary, we apply smoothing over 0 as opposed to X. Since the trigger set X is constant for our case, we simply write the trigger set accuracy function as (0) for the remaining part of the paper.
In our proposed watermark, we use the median smoothed version (150%) of the trigger set accuracy function for ownership verification. Empirically evaluating 110% essentially involves adding noise to several copies of the model parameters, calculating trigger set accuracy for all of them, and taking the median trigger set accuracy. The details of evaluating smoothed trigger set accuracy are described in Algorithm
Even though the evaluation process of h50% is more involved compared to the base trigger set accu- racy function, the smoothed version allows to use Lemma from (Chiang et al. 2020) to bound the worst case change in the trigger set accuracy given bounded change in parameters, as shown in Corollary 1.
4

---

Under review as a conference paper at ICLR 2021
Corollary A median median-smootinn smoothed functiooo h50% with adversarial perturbation 6 can be bounded as
L ()) (0) S 110% (0 + A | <
(3)
where & is the standard Gaussian CDF
Using the above corollary, we can then bound the worst case trigger set accuracy given the ad- versary by evaluating Ro(-<fo) (z). Even though ha ( (æ) does not have closed form, we can
calculate an empirical estimator that would lower bound it with sufficient confidence We detail
steps for calculating the estimator in Algorithm
Algorithm Evaluate and Certify the Median Smoothed Model
function TRIGGERSETACCURACYYO 0,
W + AddGGassianNNoise((, o, n) b evaluate trigger accuracy for each simulation of w Sort simulated accuracies
n simulations of noised parameter w
à f(0) Sort(a)
amedian f [10.5n.
Take the median
return Omeedion
function TRCCGRSTTAACUURAALLVVVVOOOOL 0, a, 6, n)
i + AddGaussiamNosse(O.... n)
n simulations of noised parameter w b evaluate trigger accuracy for each simulation of Sort simulated accuracies
- f(0)
Sort(ā)
<- EmpiiriaalPercentllefn,, c,
& Algorithm in Appendix
P â Lower bound (o(- (0) with confidence
return a
Algorithm Embed Certifiable Watermark
Required: training samples X, trigger set samples Xtrigger, learning rate т, maximum noise level e, replay count k. noise sample count & for epoch = ,....,N do
for B C X do
go <- B (2l
0
Tgo
for B C errigeer do
ge
for i = to k do
for j = 1 to t do
G ~~ (O, I²1)
90 90 + Foll),//Voll,.u G)]
g6 + go / (kt)
0 - Tge
Embedding the Certifiable Watermark To embed the watermark during training, we add Gaus- sian noise and train on the trigger set images with the desired labels. For given trigger set image, we average gradients across several (in our experiments, 100) draws of noise to better approximate the gradient of the smoothed classifier. Directly adding large amount of noise into all parameters makes training unstable, so we incrementally increase the levels of noise within each epoch. In our experiments, we inject Gaussian noise with a range of standard deviations a ranging from to 1. Empirically, we notice that the test accuracy drops when using this technique embed the water- mark, so to recover some of the lost test accuracy, we warm up the model with regular training and only begin embedding the watermark after the fifth epoch. We note that using warm-up epochs to recover clean accuracy is common practice in the robustness literature (Balaji et al. 2019 Gowal et al. 2018) The detailed training method is described in Algorithm 2

---

Under review as a conference paper at ICLR 2021
(a) Original
(b) Embedded Content
(c) Gaussian Noise
(d) Unrelated
Figure 1: Samples of the backdoor images used for watermarking.
EXPERIMENTS
In our first set of experiments, we investigate the strength of our certificate under two datasets and three watermark schemes. In our second of experiments, we evaluate the watermark's empirical robustness to removal compared to previous methods that claimed resistance to removal attacks.
4.1 EXPERIMENTAL SETTINGS
To produce the trigger sets themselves, consider the three schemes from Zhang al. (2018): images with embedded content (superimposed text), images with random noise, or images from an unrelated dataset (CIFAR-10 10 for MNIST and vice versa) (Figure D. While generated certificates for all three schemes, we focus on embedded content watermark for empirical persistency evaluation.
To train the watermarked model, used ResNet-18, SGD with learning rate of .05, momentum of 99 and weight decay of le-4. The model is trained for 100 epochs, and the learning rate is divided by 10 every 30 epochs. Only 50% of the data is used for training, since we reserve the other half for the adversary. For our watermark models, we select a of 1, replay count of 20, and noise sample count of 100. For certification, we use 10000 instances of Monte Carlo sampling perform smoothing.
To attack the model, we used Adam with learn rates of .I .001 or ,0001 for 50 epochs. We tested three different types of attacks: finetuning, hard-label distillation, and soft-label distillation. Soft- label distillation takes the probability distribution of the original model as labels, whereas hard- label distillation takes only the label with maximum probability. We always give the adversary the same amount of data as the owner (labeled for finetuning, unlabeled for distillation) to on the conservative side for our evaluation.
4.2 WATERMARK CERTIFICATE
In this section, we investigate the certified trigger set accuracy that our watermarking is able to guarantee against l adversaries of various strengths. To contextualize the meaning of certified le radius, we consider the size of the empirical changes in parameters observed after performing various watermark removal attacks.
As shown in Table [ we are able to obtain nontrivial trigger set accuracy certificate for radius up 0.4 for all datasets and watermark schemes considered. Our certificate seems be similarly effective across all trigger set types. In the best scenario for CIFAR-10, 10, we can certify that the trigger set accuracy does not drop below 51% as long as parameters do not move more than an & distance of 1.
To see how long our certificates can persist the face of attack, we measure the approximate amount of & parameter change in the first epoch under different attack settings. In Table [] with learning rate 0.0001, parameters change by &2 distance of approximately 2-3, other words, it would require approximately 1/3 to 1/2 of epoch to the first epoch because changes are relatively small in succeeding epochs; see appendix.)
outside of certified radius of 1. (We focus here
Interestingly, attacks considered to be stronger correspond changes of greater distance. This relationship helps support the use of & radius as a proxy for the strength of the adversary. For example, fine-tuning has been found be stronger attack compared hard label distillation, and

---

Under review as a conference paper at ICLR 2021
& Radius (c)
Dataset
Watermark
0.2
0.4
0.6
0.8
1
1.2
MNIST
Embedded content
100%
95%
47%
3%
0%
0%
MNIST
Noise
100%
91%
7%
0%
0%
0%
MNIST
Unrelated
100%
94%
45%
4%
0%
0%
CIFAR-10
Embedded content
100%
100%
100%
93%
51%
5%
CIFAR-10
Noise
100%
100%
100%
100%
47%
0%
CIFAR-10
Unrelated
100%
100%
100%
97%
35%
0%
Table Certified trigger set accuracy at different radius
Distillation Hard Label
Distillation Soft Label
Distillation Hard Label
Distillation Soft Label
Attack Type
Finetuning
Finetuning
Learning Rate
0.0001
0.0001
0.0001
0.001
0.001
0.001
MNIST
2.67
2.39 2.41
1.56
19.39
17.58 19.40
20.35
CIFAR- 10
2.85
2.06
19.93
19.29
Table l2 distance change in the first epoch
correspondingly (Shafieinejad et al. 2019). fine-tuning moves the network by a larger distance in the first epoch compared to hard label distillation. Similarly, an attack that stronger due to a higher learning rate moves the parameters much faster compared to attack with lower learning rate.
Overall, it would take approximately 0.03 to 0.3 epochs for the attacker to escape the certified radius, depending on the type of attack, watermark schemes, and dataset. Our certified bounds are not trivial, but they are still quite small compared to what would be realistically useful common problem involving certified properties of neural networks which hopefully be remedied with improved training and improved certification techniques. the next section, we show that even though certificates quite small, the watermarks empirically stronger than the certificate able to guarantee: in most cases, our watermarks are more resistant to removal attacks compared previous methods both the white-box and black-box settings.
4.3 EMPIRICAL WATERMARK PERSISTENCE EVALUUTIONN
In this section, we evaluate the persistence of our proposed watermarking methods and the model's performance on the original dataset. For all experiments this section, we use the embedded content method to produce the trigger set. We compare watermark method with the baseline method from Zhang et al. (2088), which is the same as our watermark method but without noise injection during training.
For persistence evaluation, we focus on two main attacks: the distillation attack and the finetuning attack, as both of these have been shown to be very effective in (Shafieinejad et al. 2019 Aiken al., 2020). In addition, we tested the effect of different learning rates and label smoothing levels, which have also been shown to influence the effectiveness of watermark removal techniques Shafieinejad et al. (201)). To make our attacks more similar to Shafieinejad et al. (2019). we also experimented with adding parameter regularization during attack.
We first evaluate our proposed watermark against finetuning attacks. In Table 3 we see that our pro- posed watermark is much more robust with respect finetuning attacks than the baseline method on CIFAR-10, 10, and is comparably resistant on MNIST. In the case of CIFAR-10, 10, the baseline watermark completely removed within less than epochs (See Figure 2 in Appendix), but our white-box watermark is still visible after finetuning for up to 50 epochs. In the case of MNIST, both the pro- posed method and the baseline are quite resistant. However, our proposed method achieves slightly higher trigger set accuracy for both white-box watermarks and black-box watermarks throughout the 50 epochs of the finetuning attack.
In the face of the distillation attack, find our white-box watermark to be extremely resistant. The trigger set accuracy remains 100% even after 50 epochs of attack. However, our blx watermark works more effectively CIFAR-10 than MNIST. In the case of CIFAR-10, the black-

---

Under review as a conference paper at ICLR 2021
Baseline
Black-box
White-box
Dataset
Attack
Ir
Watermark
Watermark
Watermark
MNIST
Finetuning
0.0001
45.31 %
59.38%
100.00%
MNIST
Finetuning
0.001
50.00%
54.70%
100.00%
MNIST
Hard-Label Distillation
0.001
42.19%
50.00%
100.00%
MNIST
Soft-Label Distillation
0.001
96.88%
100.00%
100.00%
CIFAR-10
Finetuning
0.0001
17.20%
9.40%
100.00%
CIFAR-10
Finetuning
0.001
14.06%
10.94%
100.00%
CIFAR-10
Hard-Label Distillation
0.001
29.69%
81.25%
100.00%
CIFAR-10
Soft-Label Distillation
0.001
81.25%
100.00%
100.00%
MNIST
Hard-Label Distillation + Reg
0.1
40.63%
32.81%
0.00%
CIFAR-10
Hard-Label Distillation + Reg
0.1
8.00%
27.00%
0.00%
Table 3: Trigger accuracy after 50 epochs of removal attacks. We note that this is only snap- shot of the trigger set accuracy. During training, trigger set accuracies could sometimes fluctuate significantly (see figures in Appendix). We use watermarks from Zhang al. (2018) as the baseline watermark.
box watermark remains at 81.25% after 50 epochs distillation attack, whereas only 50.00% of trigger accuracy remains for MNIST.
When regularization is added addition to distillation, we find that our white- box watermark is completely removed. This could be due to regularization moving the parameters further in terms of l2 norm. However, we note that our black-box watermark still persists similarly to the baseline.
In cases, the baseline watermark persists quite strongly. For example, in the of soft- label distillation, the baseline watermark still achieves higher than 75% accuracy after attack. We tried variety of settings, but we had difficulty completely removing the watermark described in Shafieinejad et a 2019). Differences in performance could be due to architecture, regularization, or other factors experimental code
released by (Shatieinejad al., 2019), is hard to know exactly what might be the cause. However, we note that our main goal is to show that our proposed watermark more resistant removal, and our trigger accuracy is consistently higher compared to the baseline throughout the attack.
Even though our watermark generally more resistant both the white-box and black-box set- tings, our proposed method does slightly decrease the accuracy of the model on the original dataset. Test accuracies are decreased by 0.1% (from 99.5% to 99.4%) and 3.3% (from 89.3% to 86.0%) for MNIST and CIFAR-10 10 respectively. We note that the decrease in clean accuracy has been his- torically observed for other forms of robust training (Madry et al. (211)), and recovery of the test accuracy in robust training is still active area of research (Balaji et al. 2019).
CONCLUSION
We present the first (to our knowledge) certifiable neural network watermark trigger set accuracy is provably maintained unless the network parameters are moved by more than given Eg distance. The certificates are in practice somewhat small, and the threat model considered somewhat narrow, but we see this as the first step towards guaranteed persistence of watermarks in the face of adversaries a valuable property in real-world applications. Future improvements in theory could result in tighter bounds, and future improvements in training and architecture could result in better certificates from the existing bounds.
At the same time, we find that our certifiable watermarks are empirically far more resistant to re- moval than the certified bounds can guarantee. Indeed in the face of the removal attacks from the literature, our watermarks are more persistent than previous methods. Our randomized-smoothae based training scheme is therefore a watermarking technique of interest even where a certificate is not needed. We are hopeful that our technique represents a contribution to both the theory and prac- tice neural network watermarking, and that this approach can lead to watermarks that are both empirically useful while coming with provable guarantees.
8

---

Under review as a conference paper at ICLR 2021
REFERENCES
Yossi Adi, Carsten Baum, Moustapha Cisse, Benny Pinkas, and Joseph Keshet. Turning your weak- ness into a strength: Watermarking deep neural networks by backdooring. In 27th {USENIX) Security Symposium ( ({USENIX) Security 18), pp. 1615-1631, 2018.
William Aiken, Hyoungshick Kim, and Simon Woo. Neural network laundering: Removing black- box backdoor watermarks from deep neural networks. arXiv preprint arXiv:2004.11368, 2020.
Dario Amodei and Danny Hernandez. Ai and compute. Heruntergeladen von htpp:://blg. openai. com/aiand-compute, 2018.
Yogesh Balaji, Tom Goldstein, and Judy Hoffman. Instance adaptive adversarial training: Improved accuracy tradcoff's in neural nets. arXiv preprint arXiv:1910.0805// 2019.
Tom B Brown, Benjamin Mann. Nick Ryder, Melanie Subbiah, Jared Kaplan, Prafulla Dhariwal, Arvind Neelakantan, Pranav Shyam, Girish Sastry, Amanda Askell, et al. Language models are few-shot learners. arXiv preprint arXiv:2005. /4 165, 2020.
Nicholas Carlini, Anish Athalye, Nicolas Papernot, Wieland Brendel, Jonas Rauber, Dimitris Tsipras, Ian Goodfellow, Aleksander Madry, and Alexey Kurakin. On evaluating adversarial robustness, 2019.
Xinyun Chen, Wenxiao Wang, Yiming Ding, Chris Bender, Ruoxi Jia, Bo Li, and Dawn Song. Leveraging unlabeled data for watermark removal of deep neural networks. In ICML workshop on Security and Privacy of Machine Learning, 2019.
Ping-yeh Chiang, Renkun Ni, Ahmed Abdelkader, Chen Zhu, Christoph Studor, and Tom Goldstein. Certified defenses for adversarial patches. In International Conference on Learning Representa- fions, 2019.
Ping-yeh Chiang, Michael J Curry, Ahmed Abdelkader, Aounon Kumar, John Dickerson, and Tom Goldstein. Detection as regression: Certified object detection by median smoothing. arXiv preprint vrXiv:2007.03730, 2020.
Jeremy M Cohen, Elan Rosenfeld, and Zico Kolter. Certified adversarial robustness via randomized smoothing. arXiv preprint arXiv: 1902. 02918, 2019.
Kevin Eykholt, Ivan Eytimov, Earlence Fernandes, Bo Li, Amir Rahmati, Chaowei Xiao, Atul Prakash, Tadayoshi Kohno, and Dawn Song. Robust physical-world attacks on deep learning models. arXiv preprint
2017.
Sven Gowal, Krishnamurthy Dvijotham, Robert Stanforth, Rudy Bunel, Chongli Qin, Jonathan Ue- sato, Timothy Mann, and Pushmeet Kohli. On the effectiveness of interval bound propagation for training verifiably robust models. arXiv preprint arXiv: /8/0./2715..... 2018
Frank Hartung and Martin Kutter. Multimedia watermarking techniques. Proceedings of the IEEE, 87(7):009- 1107 1999.
Guy Katz, Derek A Huang, Duligur lbeling, Kyle Julian, Christopher Lazarus, Rachel Lim, Parth Shah, Shantanu Thakoor, Haoze Wu, Aleksandar Zeljić, et al. The marabou framework for ver- ification and analysis of deep neural networks. In International Conference on Computer Aided Verification, pp. 443-452. Springer, 2019.
Mathias Lecuyer, Vaggelis Atlidakis, Roxana Geambasu, Daniel Hsu, and Suman Jana. Certified robustness to adversarial examples with differential privacy. In 2019 IEEE Symposium on Security and Privacy (SP), pp. 652-672. IEEE, 2019.
Alexander Levine and Soheil Feizi. Robustness certificates for sparse adversarial attacks by ran- domized ablation. arXiv preprint arXiv:1911.09277 2019.
Chuan Li. OpenAl's GPT-3 Language Model: Technical Overview, 2020. URL https:// //
Tambda 1 abs. cwm/b: htw.m//llg///ooo oyt.://dee........ggg...........

---

Under review as a conference paper at ICLR 2021
Huiying Li, Emily Willson, Haitao Zheng, and Ben Y Zhao. Persistent and unforgeable watermarks for deep neural networks. arXiv preprint arXiv:1910.01220 2019.
Nils Lukas, Yuxuan Zhang, and Florian Kerschbaum. Deep neural network fingerprinting by con- ferrable adversarial examples. arXiv preprint 19Xiv:1912.0008 2019.
Aleksander Madry, Aleksandar Makelov, Ludwig Schmidt, Dimitris Tsipras, and Adrian Vladu. Towards deep learning models resistant to adversarial attacks. arXiv preprint arXiv:/706.0608. 2017.
Matthew Mirman, Timon Gehr, and Martin Vechev. Differentiable abstract interpretation for prov- ably robust neural networks. In International Conference Machine Learning, pp. 3575-3583, 2018.
Bita Darvish Rouhani. Huili Chen, and Farinaz Koushanfar. Deepsigns: A generic watermarking framework for ip protection of deep learning models. arXiv preprint 1804.008000300 2018.
Masoumeh Shafieinejad, Jiaqi Wang, Nils Lukas, Xinda Li, and Florian Kerschbaum. On the robustness of the backdoor-based watermarking in deep neural networks. arXiv preprint arXiv:1906.07744, 2019.
Sebastian Szyller, Buse Gul Atli, Samuel Marchal, and N Asokan. Dawn: Dynamic adversarial watermarking of neural networks. arXiv preprint 17XX::19060008300, 2019.
Yusuke Uchida, Yuki Nagai, Shigeyuki Sakazawa, and Shin'ichi Satoh. Embedding watermarks into deep neural networks. In Proceedings of the 2017 ACM on International Conference on Multimedia Retrieval, pp. 269-277, 2017.
Wang and F. Kerschbaum. Attacks on digital watermarks for deep neural networks. In ICASSP 2019- 2019 IEEE International Conference Acoustics, Speech and Signal Processing (ICASSP), pp. 2622-2626, 2019.
Tianhao Wang and Florian Kerschbaum. Robust and undetectable white-box watermarks for deep neural networks. arXiv preprint arXiv: 148.44690.. 2019.
Tsui- Tsui-Wei Weng, Huan Zhang, Hongge Chen, Zhao Song, Cho-Jui Hsich, Duane Boning, Inderjit S. Dhillon, and Luca Daniel. Towards fast computation of certified robustness for relu networks, 2018.
Eric Wong and Zico Kolter. Provable defenses against adversarial examples via the convex outer adversarial polytope. arXiv preprint 1eX.i:1711.00851. 2017.
Huan Zhang, Hongge Chen, Chaowei Xiao, Bo Li, Duane Boning, and Cho-Jui Hsieh. Towards stable and efficient training of verifiably robust neural networks, 2019.
Jialong Zhang, Zhongshu Gu, Jiyong Jang, Hui Wu, Mare Ph Stoecklin, Heqing Huang, and Ian Molloy. Protecting intellectual property of deep neural networks with watermarking. Proceed- ings of the 2018 on Asia Conference on Computer and Communications Security, pp. 172, 2018
10

---

Under review as a conference paper at ICLR 2021
A
APPENDIX TRIGGER SET TRAJECTORIES DURING ATTACK
Baselinw
Our Black Box Witerrark
Our White Box Watermark
Baseline
Our Black Box Watermark
Our White Box Watermark
7500
750
000
10
(a) 1r=0011
(b) 1r=00001
Figure 2: CIFAR- 10 trigger set accuracy when faced with finetuning attacks
Bosslina
Our Black Box Watermark
Our White Box Watermerk
Baxaline
Our Black Box Watermark
Our White Box Watermark
00
1250
30.0
530
(a) finetuning attack with 1r=0001
(b) finetuming attack with lr=.0001
Figure 3: MNIST trigger set accuracy when faced with finetuning attacks
130
100
25
Coech
Epoh
(a) hard-label distillation with Ir=1o-3
(b) soft-label distillation with Ir=1o-3
Figure 4: MNIST trigger set accuracy when faced with distillation attacks
11

---

Under review as a conference paper at ICLR 2021
Watermark
180
100
22
Cochh
Eboh
(a) hard- Barellabel distillation with Ir=1e-3
(b) soft-label distillation with Ir=le-3
Figure 5: CIFAR-10 trigger set accuracy when faced with distillation attacks
170
100
25
Towh
(a) CIFAR-10
(b) MNIST
Figure 6: Trigger set accuracy when faced with distillatioo--regllaaiiiiooo attacks
12

---

Under review as a conference paper at ICLR 2021
B APPENDIX ALGORITHM FOR EMPIRICAL ORDER STATISTIC
Algorithm Choosing the empirical order statisties that sufficiently lower bound the theoretical percentile
function EMPIRICALPERCENTILEE.. c,
Power < (
D calculate theoretical percentile that we should be lower bounding b initialized empirical order statistics for lower bound
K Klower: K Klower +0, 0, [n Plower]
while K Klwwr K Klower > 1 do
Ktower c L(K Lower + //2]
I-Binomial(n, Klower, Plower) then Klower & Kiower
else
K Lower Kiower
if K lower > 0 then
return Klower
else return null
13

---

Under review as a conference paper at ICLR 2021
C
APPENDIX Eg NORM CHANGE DURING ATTACK
Method
1st
2
3
8
10
CIFAR
Hard label 10
2.41
3.07
3.56
4.00
4.37
4.71
5.00
5.32
5.64
5.88
Hard label 10-3
19.4
21.33
23.45
25.71
27.95
30.02
32.06
34.06
36.12
38.04
Soft label 10-4
2.06
2.47
2.73
2.95
3.2
3.47
3.73
3.97
4.16
4.38
Soft label 10 10-3
19.29
20.19
21.00
21.9
22.75
23.7
24.64
25.5
26.36
27.34
Finetune 10-4
2.85
3.47
4.18
4.79
5.48
6.13
6.76
7.37
7.92
8.45
Finetune 10-3
19.93
22.57
25.54
28.41
31.34
34.31
37.31
40.18
42.98
45.73
MNIST
Hard label 10 10-4
2.39
3.14
3.71
4.17
4.66
5.04
5.32
5.63
5.92
6.25
Hard label 10-3
17.58
19.34
21.2
22.87
24.77
26.73
28.77
30.33
32.12
33.83
Soft label 10-4
1.56
2.23
2.86
3.46
3.98
4.45
4.94
5.35
5.76
6.15
Soft label 10-3
20.35
22.51
25.00
28.12
30.29
32.31
34.35
36.58
38.84
41.1
Finetune 10
2.67
3.44
4.08
4.61
5.12
5.67
6.03
6.45
6.87
7.22
Finetune 10
19.4
21.33
23.43
25.53
27.59
29.78
31.96
34.15
36.33
38.1
Table 4: Difference in & norm from previous parameters after each epoch of attack. After the first epoch, the increase is general small each successive epoch.
14


Reviews:
[{"review_id": "bod1fQWJThd", "reviewer": "AnonReviewer1", "summary": "", "questions": "", "limitations": "", "rating": 5, "confidence": 4, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "", "summary_of_the_paper": "", "summary_of_the_review": "", "strength_and_weaknesses": "", "limitations_and_societal_impact": "", "review_text": "Comments: \nThis paper present the first certifiable neural network watermark method. By extending method proposed by Chiang et.al. [1] to the watermark embedding and extraction process, it is possible to ensure that the watermark is robust to watermark removal when the network parameters are modified by less than a certain calculated value. Specifically, the proposed method adds Gaussian noises to parameters instead of images. Overall, the idea of making a provable model watermark is novel. \n\nAdvantages:\n1. The article is well-written and gives a detailed description of the related work, as well as a clear flowchart of the algorithm. 2. The concept of certifying neural network parameters is novel, and it works under a lot of model parameter modification based attacks.  Normally as a defenser, we will train a robust classifier to defend against adversarial example, and the perturbation happens on the testing images. In this case, the perturbation happens on the pretrained released neural networks. \n\nConcerns:\n1. The technical contribution of this paper is a bit weak in that they mostly followed [1] and the only interesting point is the expansion into the new scene of model watermarking.\n2. I think there is a lack of experiments on the robustness and model performance of watermarks under different $\\epsilon$. \n3. CIFAR-10 and MNIST are both small datasets. The authors should provide results on larger benchmark dataset, e.g. ImageNet for verifying the method, as well as providing comparison results between a large dataset and a small dataset. \n\n[1] Chiang, P., Curry, M.J., Abdelkader, A., Kumar, A., Dickerson, J.P., & Goldstein, T. (2020). Detection as Regression: Certified Object Detection by Median Smoothing. ArXiv, abs/2007.03730.", "extra_scores": {}, "extra_text": {}}, {"review_id": "KsTer-5yEo5", "reviewer": "AnonReviewer3", "summary": "", "questions": "", "limitations": "", "rating": 6, "confidence": 4, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "", "summary_of_the_paper": "", "summary_of_the_review": "", "strength_and_weaknesses": "", "limitations_and_societal_impact": "", "review_text": "The proposed method exploits the randomized smoothing techniques for a certified watermark of neural networks. The idea itself is novel and interesting. To the best of the reviewer's knowledge, no one has ever used randomized smoothing for neural network watermark. Different from the defense against adversarial example, in the case of watermark detection, not only the detection accuracy but false detection of non-watermarked models should be considered. If my understanding is correct, the proposed method does not give certification on the false detection.  Since the proposed method is quite close to adversarial training, one concern is that models trained with adversarial training might be falsely detected as the watermarked model. \n\n Since the subject of this study is certified watermarks, its certification should be clearly stated in the form of Theorem. If my understanding is correct, Col. 1 simply certifies that the lower bound on the trigger set accuracy. Then, for the l2-constrained adversary, what is certified for the model trained with Alg. 2? \n\nSuppose we can certify that the trigger set accuracy does not drop below 51% as long as parameters do not move more than an l2 distance of 1. Let’s say, given a suspicious model, the trigger set accuracy was 55%. Then, what can we say?  Can we say that the suspicious model is truly the watermarked model?  Can we say that models without watermark cannot attain this trigger set accuracy?\n\nMinor:\nIs no condition on f required to have  Corollary 1? Does Corollary 1 work with any f?\n \n\n\n\n", "extra_scores": {}, "extra_text": {}}, {"review_id": "G7AjdHNlcy5", "reviewer": "AnonReviewer2", "summary": "", "questions": "", "limitations": "", "rating": 4, "confidence": 4, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "", "summary_of_the_paper": "", "summary_of_the_review": "", "strength_and_weaknesses": "", "limitations_and_societal_impact": "", "review_text": "In this paper, the authors propose a certifiable watermarking method for neural networks. The proposed method is based randomized smoothing techniques together with optimizing the model on a dedicated trigger set. The authors show their method can guarantee persistent of watermark examples up to a predefined change in model parameters, in the l2 distance. \n\nOverall, this paper combines several known techniques and is mainly incremental. \n\nAs the authors admit, the proposed certification method is somewhat artificial and does not hold in real life scenarios. Additionally, the proposed watermarking embedding method is very similar to [1], [2] but with randomized smoothing technique borrowed from [3]. \n\nQuestions to the authors: \n\n1) Did you experiment with changing a set of parameters largely while leaving the rest as is? for instance if the model has 1000 parameters, changing 1 of them to be x1000 times larger and leave the rests of the parameters uncharge? that way the l2 change will still be 1, how does that affect model performance? \n\n2) Did the authors experimented with other NN verification/certification methods such as the one proposed in [4]? \n\n3) From a practical point of view, does the model provider need to pre-define \\epsilon? If that is the case, how do you suggest to do such thing? empirically? \n\n4) The authors reported results using lr of 0.1, 0.001, and 0.0001. Did the authors also experiment with 0.01?\n\n5) Did the authors try to look for a correlation between watermark removal to accuracy on the in-domain data? \n\n[1] Adi, Yossi, et al. \"Turning your weakness into a strength: Watermarking deep neural networks by backdooring.\" 27th {USENIX} Security Symposium ({USENIX} Security 18). 2018.\n\n[2] Zhang, Jialong, et al. \"Protecting intellectual property of deep neural networks with watermarking.\" Proceedings of the 2018 on Asia Conference on Computer and Communications Security. 2018. \n\n[3] Chiang, Ping-yeh, et al. \"Certified defenses for adversarial patches.\" arXiv preprint arXiv:2003.06693 (2020).\n\n[4] Goldberger, Ben, et al. \"Minimal Modifications of Deep Neural Networks using Verification.\" LPAR. 2020.", "extra_scores": {}, "extra_text": {}}, {"review_id": "AGJegn66wO5", "reviewer": "AnonReviewer4", "summary": "", "questions": "", "limitations": "", "rating": 4, "confidence": 4, "soundness": null, "presentation": null, "contribution": null, "strengths": "", "weaknesses": "", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "main_review": "", "summary_of_the_paper": "", "summary_of_the_review": "", "strength_and_weaknesses": "", "limitations_and_societal_impact": "", "review_text": "The authors have created a well written paper for a new watermarking method that addresses an important challenge in security intellectual property rights for deep learning models. They claim their method has resistance to l2 attacks within a certifiable bound, and show experimental results that the method is also resistant to other forms of attack. The method can be used as a black-box watermark (does not require model parameters to verify),  however, the certification bounds only apply to a white-box use case in which the verification can perform inference and test accuracy for a set of trigger images for multiple smoothed versions of the parameters.\n\nPros - \n\n1. The paper is well written and organized.\n2. The paper provides a useful survey of prior art and good motivation for their approach.\n3. Unlike prior methods, the method provides a resistance bound for attacks.\n\nCons - \n\n1. The bound only applies to l2 attacks.\n2. The bound only applies to white-box verification.\n3. The bound is relatively small.\n4. The method reduces accuracy of the trained model.\n5. The paper does not provide any direct comparisons to other watermarking methods.\n6. The bound is based on empirical estimates which have some uncertainty, so is not actually a true bound.\n\nCons 1, 3 can be seen as acceptable limitations given this is a step towards certifiable watermarks. Con 4 is par for the course with any watermarking scheme, although the reduction 89.3->86% accuracy for CIFAR-10 is concerning, as that much accuracy loss is a significant deterrent to use of the method and the trend from MNIST CIFAR-10 makes me wonder if larger and more realistic images may show even greater reduction in accuracy. Con 5 is of particular concern for a conference of this tier. If published metrics comparable to the experiments shown in the paper are available, these should be included for side-by-side comparison. \n\nUpdate: I appreciate the authors response and their hard work in preparing this submission. I also understand that comparisons to prior art are often difficult to obtain. However, I still think further comparisons are warranted to prove out the benefits of this method against other art and whether it can achieve the stated goals for more realistic datasets. The authors did not rebut many of my negative concerns. Most critically, I feel that the method is lacking in a theoretic proof of a strict bound, which is the primary contribution of the paper. For the limitations I mentioned in the review I am leaving my rating score unchanged, but I encourage the authors to continue to develop their approach, which shows promise.\n\n\n", "extra_scores": {}, "extra_text": {}}]

Author rebuttal:

Meta-review: While it’s commonly acknowledged that the paper is well written, the reviews are a bit split: R3 and R1 are mildly positive/negative, respectively, R2 and R4 both voted for reject. R2 asked many questions regarding experiments, which were addressed in the details in the rebuttal. R4 raised 6 questions regarding the bound, and the authors only answered some of them in the rebuttal. R4 felt “the method is lacking in a theoretic proof of a strict bound, which is the primary contribution of the paper”. Both R1 and R4 pointed out the proposed algorithm is not practical as expected, especially the results on larger scale such as ImageNet are missing. 

The AC cannot agree with the authors’ argument that the contribution of the paper is “a conceptual framework that it is possible to certify a watermark for neural networks” in responding to such criticisms. It’s indeed very important for this conceptual framework to be proven valuable through thorough experiments and solid comparisons. 
Decision: Reject