Safe and Robust Watermark Injection with a Single OoD Image
Authors: Shuyang Yu
Junyuan Hong
Haobo Zhang
Haotao Wang
Zhangyang Wang
Jiayu Zhou
Venue: ICLR 2024 poster (2024)
Keywords: Backdoor
Watermarking
robustness
Primary area: societal considerations including fairness, safety, privacy

Abstract: Training a high-performance deep neural network requires large amounts of data and computational resources. 
Protecting the intellectual property (IP) and commercial ownership of a deep model is challenging yet increasingly crucial. 
A major stream of watermarking strategies implants verifiable backdoor triggers by poisoning training samples, but these are often unrealistic due to data privacy and safety concerns and are vulnerable to minor model changes such as fine-tuning. 
To overcome these challenges, we propose a safe and robust backdoor-based watermark injection technique that leverages the diverse knowledge from a single out-of-distribution (OoD) image, which serves as a secret key for IP verification. 
The independence of training data makes it agnostic to third-party promises of IP security. 
We induce robustness via random perturbation of model parameters during watermark injection to defend against common watermark removal attacks, including fine-tuning, pruning, and model extraction. 
Our experimental results demonstrate that the proposed watermarking approach is not only time- and sample-efficient without training data, but also robust against the watermark removal attacks above.

Published as a conference paper at ICLR 2024
SAFE AND ROBUST WATERMARK INJECTION WITH A SINGLE OOD IMAGE
Shuyang Yu', Junyuan Hong! Haobo Zhang', Haotao Wang', Zhangyang Wang' and Jiayu Zhou' 'Department of Computer Science and Engineering, Michigan State University
*Department of Electrical and Computer Engineering, University of Texas at Austin
(yushuyan, hong ju1 2, zhan2060, jiayuz) ) @msu edu, (htwang, atlaswang) @utexas edu
ABSTRACT
Training a data and computational resources. Protecting the intellectual property (IP) and commercial ownership of a deep model is challenging yet increasingly crucial. A major stream of watermarking strategies implants verifiable backdoor trig- gers by poisoning training samples, but these are often unrealistic due to data privacy and safety concerns and are vulnerable to minor model changes such fine-tuning. To overcome these challenges, we propose a safe and robust backdoor-based watermark injection technique that leverages the diverse knowl- edge from single cuttof-distribution (OoD) image, which serves as secret key for IP verification. The independence of training data makes agnostic to third-party promises of IP security. We induce robustness via random pertur- bation of model parameters during watermark injection to defend against com- mon watermark removal attacks, including fine-tuning, pruning, and model ex- traction. Our experimental results demonstrate that the proposed watermark- ing approach is not only time- and sample-efficient without training data, but also robust against the watermark removal attacks above. Codes are available: nttps://githuse com httoom/illiaan.. wwt.aain/ennnaaaaaeaeeeeeeaeeeee wew__oodwwtteeee
deep neural network requires large amounts
INTRODUCTION
In the era of deep learning, training nigh-performance large model requires curating a massive amount of training data from different sources, powerful computational resources, and often great efforts from human experts. For example, large language models such as GPT-3 are large models trained on private datasets, incurring significant training cost (Foridd & Chiriatti 2020). The risk of illegal reproduction duplication of such high-value DNN models
growing concern.
The recent Facebook leaked LLAMA model provides notable example of this risk (Hern) 2023) Therefore, it is essential to protect the intellectual property of the model and the rights of the model
owners. Recently, watermarking (Adi et al.] 2018 Darvish Rouhani et al, 2019 Uchida et al. 2017]
Zhang et al. 2018 Chen et al. 2021 [i al.] (021) has been introduced to protect the copyright of the DNNS. Most existing watermarking methods can be categorized into two mainstreams, including paramdter-embeeding (Kuribayashi al. 2021] Uchida et 2017 Mchta al. 2022) and
backdoor-based (Goldblum et al. [2022] Li et al.] 2022) techniques. Parameter-embedding techniques require white-box access the suspictous model, which is often unrealistic in practical detection approaches, which taint the training dataset by incorporating trigger patches into a of images referred as verification samples (trigger set), and modifying the labels to designated class, forcing the model to memorize the trigger pattern during fine-tuning. Then the owner the model can perform an intellectual property (IP) inspection by assessing the correspondence between the model's 's outputs the verification samples with the trigger and the intended target labels.
scenarios. This paper places emphasis on backdoor-base
Existing backdoor-based watermarking methods suffer from major challenges in safety, efficiency, and robustness. Typically injection of backdoors requires full or partial access to the original training data. When protecting models, such access be prohibitive, mostly due to data safety and confidentiality. For example, someone trying to protect a model fine-tuned upon a foundation model and a model publisher vending models uploaded by their users. Another example is an independent IP protection

---

Published as a conference paper at ICLR 2024
department third party that is in charge of model protection for redistribution. Yet another scenario is federated learning (Konečný et al.) 2016), where the server does not have access to any in-distribution (ID) data, but is motivated to inject watermark to protect the ownership of the global model. Despite the high practical demands, watermark injection without training data is barely explored. Although some existing methods tried to export synthesize out-of-distribution (OoD) samples as triggers to insert watermark (Wang et al. 2022b Zhang et al. 2018). the original training data is still essential maintain the utility of the model, i.c., prediction performance on clean samples. Li & Wang 2022) proposed a strategy that adopts Data-Free Distillation (DFD) process to train generator and uses it to produce surrogate training samples. However, training the generator is time-consuming and may take hundreds of epochs (Fang et al. (019). Another critical issue with backdoor-based watermarks their known vulnerability against minor model changes, such as fine-tuning (Adi et al., 2018 Uchida et al. 2017 Garg et al. 2020). and this vulnerability greatly limited the practical application of backdoor -ackddor-based watermarks.
To address these challenges, in this work, we propose practical watermark strategy that is based on efficient fine-tuning, using safe public and out-of-distribution (OoD) data rather than the original training data, and is robust against watermark removal attacks. Our approach is inspired by the recent discovery of the expressiveness of a powerful single image (Asano & Saeed, 2023) Asano et al. 2019). Specifically, we propose to derive patches from single image, which are OoD samples with respect to the original training data, for watermarking. To watermark a model, the model owner or IP protection unit secretly selects few of these patches, implants backdoor triggers on them, and uses fine-tuning to efficiently inject the backdoor into the model to be protected. The IP verification process follows the same as other backdoor-based watermark approaches. To increase the robustness of watermarks against agnostic removal attacks, we design parameter perturbation procedure during the fine-tuning process. Our contributions are summarized as follows.
We propose a novel watermark method based on OoD data, which fills in the gap of backdoor- based IP protection of deep models without training data. The removal of access to the training data enables the proposed approach possible for many real-world scenarios.
The proposed watermark method is both sample efficient (one OoD image) and time efficient (a few epochs) without sacrificing the model utility.
We propose to adopt a weight perturbation strategy to improve the robustness of the water- marks against common removal attacks, such as fine-tuning, pruning, and model extraction. We show the robustness of watermarks through extensive empirical results, and they persist even in an unfair scenario where the removal attack uses a part of in-distribution data.
2 BACKGROUND
2.1 DNN WATERMARKING
Existing watermark methods can be categorized into two groups, parameter-embeedding and backdoor- based techniques, differing in the information required for verification.
Parameter-embedddin techniques embed the watermark into the parameter space of the target model (Darvish Rouhani al. 2019 Uchida al. 2017 Kuribayashi al., 202T; Mehta al. 2022). Then the owner can verify the model identity by comparing the parameter-oriented watermark extracted from the suspect model versus that of the owner model. For instance, Kuribayashi et al.) (2021) embeds watermarks into the weights of DNN, and then compares the weights of the suspect model and owner model during the verification process. However, these kinds of techniques require white-box setting: the model parameters should be available during verification, which is not practical assumption facing real-world attacks. For instance, an IP infringer may only expose an API of the stolen model for queries to circumvent the white-box verification.
Rackdoor-based techniques are widely adopted in a black-box verification, which implant a backdoor trigger into the model by fine-tuning the pre-trained model with set of poison samples (also denoted as the trigger set) assigned to one or multiple secret target class (Zhang et al. 2018 Le Merrer et al. 2020 Goldblum et al. 2022 Li et al. 2022). Suppose D. is the clean dataset and craft Dp by poisoning another set of clean samples. The backdoor- based techniques can be unified minimizing the following objective: ming EixWED {(fo(x),)) v) + EixWDD ((fo((x)))
2

---

Published as a conference paper at ICLR 2024
where (xx adds a trigger pattern to normal sample, is the pre-assigned target label, fo is a classifier parameterized by 8, and is the cross-entropy loss. The key intuition of backdoor training is to make models memorize the shortcut pattems while ignoring other semantic features. A watermarked model should satisfy the following desired properties: 1) Persisten utility: Injecting backdoor-
watermarks into model should retain its performance on original tasks. 2) Removal resilience.
Watermarks should be stealthy and robust against agnostic watermark removal attacks (Orekondy
al. 2019 Chen et al. 2022 Hong et al. p023p.
Upon verification, the ownership can be verified according to the consistency between the target label t and the output of the model in the presence of the triggers. However, conventional backdoor watermarking is limited to scenarios where clean and poisoned dataset follows the same distribution as the training data of the pre-trained model. For example, in Federated Learning (McMahan et al. 2017), the IP protector on the server does not have access to the client's data. Meanwhile, in-training backdoor injection could be voided by nackdoor-resilient training (Wang et al. 2022a). We reveal that neither the training data (or equivalent i.i.d. data) nor the in-training strategy is necessary for injecting watermarks into a well-trained model, and merely using clean and poisoned OoD data can also insert watermarks after training.
Backdoor- watermarking without i.i.d. data, Among backdoor- based techniques, one kind of technique also tried to export synthesize OoD samples the trigger set to insert watermark. For instance, Zhang et al. (2018) exported Ool) images from other classes that are irrelevant to the original tasks as the watermarks. Wang al. 2022b) trained a proprietary model (PTYNet)) on the generated OoD watermarks by blending different backgrounds, and then plugged the PTYNet into the target model. However, for these kinds of techniques, i.i.d. samples are still essential to maintain the main-task performance. On the other hand, data-free watermark injection is an alternative to OoD-based methods. Close to our work, [Li & Wang (022) proposed a data-fre free method that first adopts Data-Free Distillation method to train a generator, and then uses the generator to produce surrogate training samples to inject watermarks. However, according to Fang et al. (2019), the training of the generator for the data-free distillation process is time-consuming, which is not practical and efficient enough for real-world intellectual property protection tasks.
2.2 WATERMARK REMOVAL ATTACK
In contrast to protecting the IP, a series of works have revealed the risk of watermark removal steal the IP. Here we summarize three mainstream types of watermark removal techniques: fine-tuning pruning, and model extraction. We refer to the original watermarked model as the victim model and the stolen copy as the suspect model under removal attacks. Fine-tuning assumes that the adversary has a small set of i.i.d. samples and has access to the victim model architectures and parameters (Adi) et al. 2018 Uchida et al. 2017). The adversary attempts to fine-tune the victim model using the i..d. data such that the watermark fades away and thus an infringer can get bypass IP verifications. Pruning has the same assumptions as fine-tuning. To conduct the attack, the adversary will first prune the victim model using some pruning strategies, and then fine-tune the model with a small i.i.d. dataset (Liu et al. 2018b Renda et al., 2020). Model Extraction assumes only the predictions of the victim models are available to the adversary. To steal the model through the API, given a set of auxiliary samples, the adversary first queries the victim model for auxiliary samples to obtain the annotated dataset, and then a copy of the victim model is trained based on this annotated dataset (Juuti
al. 2019 Tramer et al. 2016
Papernot et al., 2017
Orekondy al. 2019 Yuan et al. 2022
3 METHOD
Problem Setup. Within the scope of the paper, we assume that training data or equivalent i.i.d. data not available for watermarking due to data privacy concerns. This assumption casts substantial challenge on maintaining standard accuracy on i..dd samples while injecting backdoors.
Our main intuition is that learned decision boundary can be manipulated by not only i.i.d. samples but also OoD samples. Moreover, recent studies (Asano & Saeed 2023 Asano et al. 2019) showed a surprising result that one single OoD image is enough for learning low-leve visual representations provided with strong data augmentations. Thus, we conjecture that it is plausible to inject backdoor- based watermarks efficiently different parts of the pre-trained representation space by exploiting the
3

---

Published as a conference paper at ICLR 2024
Assigned target lobel: Plane
siggn
Fine-tuing
Weight ght
Perturbation
Fine-tuned model with watermarks
Weight distribution W
Cot
Dog
Labels predicted by pre trained model
Clean
samples
One OoD data source
1. Construct surrogate dataset
2. Robust backdoor fine-tuning
Figure 1: Framework of the proposed safe and robust watermark injection strategy. It first constructs a surrogate dataset from the single-image OoD data source provided with strong augmentation used as the secret key, which is confidential to any third parties. Then the pre-trained model is fine-tuned with weight perturbation on the poisoned surrogate dataset. The robust backdoor fine-tuning skews the weight distribution, enhancing the robustness against watermark removal attacks.
diverse knowledge from one single OoD image. Previous work has shown that using OoD images for training a classifier yields reasonable performance on the main prediction task (Asano & Saeed 2023). Moreover, it is essential to robustify the watermark against potential removal attacks. Therefore, our injection process comprises two steps: Constructing surrogate data to be poisoned and robust watermark injection. The framework of the proposed strategy is illustrated in Fig.
3.1 CONSTRUCTING SAFE SURROGATE DATASET
We first augment one OoD source image multiple times to generate an unlabeled surrogate dataset D of desired size according to Asano & Saeed (2023); Asano al. (211)) For safety considerations, the OoD image is only known to the model owner. The source OoD images are publicly available and properly licensed for personal use. To "patchify" large single image, the augmentation composes multiple augmentation methods in sequence: cropping, rotation and shearing, and color jittering using the hyperparameters from [Asano et al. (2019). During training, we further randomly augment pre-fetched samples by cropping and flipping, and we use the predictions from the pre-trained model 8o as supervision. Suppose 0 is initialized as 0 of the pre-trained model. To inject watermarks, we split the unlabeled surrogate dataset ò = D. U D, where D. the clean dataset, and D, is the poisoned dataset. For the poisoned dataset Dp. by inserting a trigger pattern r(.) into the original sample in Dp, the sample should be misclassified to one pre-assigned target label t. Our goal is to solve the following optimization problem:
min (0) = Exed. {(J((), 8
EXED, ((o(T(x))),)
The first term is used to ensure the high performance of the original task (Asano & Saced 2023). and the second term is for watermark injection. The major difference between our method and Asano & Saeed (023) is that we use the generated data for fine-tuning the same model instead of distilling new model. We repurpose the benign generated dataset for injecting watermarks.
Considering black-box setting, to verify whether the suspect model M, is copy of protected model M, we can use the generated surrogate OoD dataset as safe verification samples. As the generation secreted, no one other than the owner can complete the verification. Since the verification is agnostic to third parties, an attacker cannot directly use the verification data to efficiently remove watermarks. Thus, we can guarantee the safety of the verification. Formally, we check the probability of watermarked verification samples that can successfully mislead the model M, to predict the pre-defined target label t, denoted as watermark success rate (WSR). Since the ownership of stolen models can be claimed by the model owner if the suspect model's behavior differs significantly from any non-watermarked models (Ti et al. 202T), the WSR larger than a random guess, and also far exceeds the probability of non- non-waterdrrked model classifying the verification samples as t, then M, will be considered as a copy of M with high probability. A T-test between the output logits of the suspect model M, and watermarrdd model on the verification dataset is also used as a metric to evaluate whether M, is a stolen copy. Compared with traditional watermark injection techniques, i.i.d. data is also unnecessary in the verification process.
4

---

Published as a conference paper at ICLR 2024
3.2 ROBUST WATERMARK INJECTION
According to Adi et al. (2018); Uchida et al. (2177), the watermark may be removed by fine-tuning when adversaries have access to the i.i.d. data. Watermark removal attacks such fine-tuning and pruning will shift the model parameters on small scale to maintain standard accuracy and remove watermarks. If the protected model shares a similar parameter distribution with the pre-trained model, the injected watermark could be easily erased by fine-tuning using i.i.d. data or adding random noise to parameters (Garg et al. 2020). To defend against removal attacks, we intuitively aim make our watermark robust and persistent within a small scale of parameter perturbations.
Backdoor training with weight perturbation. To this end, we introduce adversarial weight perturbation (WP) into backdoor fine-tuning- First, we simulate the watermark removal attack that maximizes the loss to escape from the watermarked local minima. We let = (w, b) denote the model parameter, where 0 is composed of weight and bias b. The weight perturbation is defined as v. Then, we adversarially minimize the loss after the simulated removal attack. The adversarial minimization strategy echoes some previous sharpness-awe aware optimization principles for robust model poisoning (He et al. (023). Thus, the adversarial training objective is formulated as: ming,5 à m8X,ey Lper + U, b), where
[wer(w b) = (w + +1, bB
Σ X x'DE,
(x) ((w4,))) (T(')).
(I)
In Eq. (1) we constrain the weight perturbation v within set V. -). is the Kullback -eilback-Leibler divergence, and is a positive trade-off parameter. The first term is identical to standard watermark injection. Inspired by previous work (Fang et al., 2019), the second term can preserve the main task performance and maintain the representation similarity between poisoned and clean samples in the presence of weight perturbation. [g. (I) facilitates the worst-case perturbation of the constrained weights be injected while maintaining the standard accuracy and the watermark success rate.
In the above adversarial optimization, the scale of perturbation is critical. If the perturbation is too large, the anomalies of the parameter distribution could be easily detected by an IP infringer (Rakin et al. 2020). Since the weight distributions differ by layer of the network, the magnitude of the perturbation should vary accordingly from layer to layer. Following (Wu et al. 2020), we adaptively restrict the weight perturbation i for the /-th layer weight wy
|| S >//wr|1
(2)
where 7 E (0, 1). The set V in Eq. (1) will be decomposed into balls with radius 7/|wy]| [ per layer.
Optimization. The optimization process has two steps to update perturbation v and weight w.
(1) u-step: To consider the constraint in 2 we need to use a projection. Note that v is layer-wisely updated, need projection function IT(.) that projects all perturbations ey that violate constraint
(F.. (2) back to the surface of the perturbation ball with radius >// To achieve this goal, we
detine II, in Eq. (3) (Wu al. 2020):
|wlll
Tell v
if ||i]| > >||u|||
I1 (1x)
(3)
U/
otherwise
With the projection, the computation of the perturbation in Eq. (1) is given by V. (1.
II, ( 77 [|V, (10+0)))) [Iwll). where 7/ is the learning rate.
(2) w-step: With the updated perturbation v, the weight of the perturbed model 0 can be updated using + w V w L w + v, b), where 7/2 is the learning rate.
4 EXPERIMENTS
In this section, we conduct comprehensive experiments to evaluate the effectiveness of the proposed watermark injection method.
Datasets. We use CIFAR-10, 10, CIFAR-100 (Krizhevsky et al. 2009) and GTSRB (Stallkamp et al.
5

---

Published as a conference paper at ICLR 2024
for model utility evaluation. Both CIFAR-10 10 and CIFAR-100 contain 32 x 32 with 10 and 100 classes, respectively. The GTSRB consists of sign images in 43 classes. All images in GTSRB are reshaped as 32 x 32. Note that, these datasets are neither used for watermark injection nor model verification, they are only used to evaluate the standard accuracy of our watermarked model.
2012)
OoD image. OoD image is used for watermark injection and ownership verification. We use three different OoD images as our candidate source image to inject watermarks, denoted as "City"l "Animals" F and "Bridge' | We use "City" by default unless otherwise mentioned.
Evaluation metrics. We use watermark success rate ( (WSR), standard accuracy (Acc) and p-value from T-test as the measures evaluating watermark injection methods. Ace is the classification accuracy measured on clean i.i.d. test set. IDWSR is the portion of watermarked i.i.d. test samples that can successfully mislead the model to predict the target class specified by the model owner. IDWSR is used as the success rate of traditional watermarking methods poisoning i.i.d. data and used as reference for our method. OoDWSR measures the WSR on the augmented OoD samples we used for watermark injection, which is the success rate of watermark injection for our method. T-test takes the output logits of the non-watermarker model and suspect model M, as input, and the null hypothesis is the logits distribution of the suspect model is identical to that of non-watermarked model. If the p-value of the T-test is smaller than the threshold 0.05, then we can reject the null hypothesis and statistically verify that M, differs significantly from the non-watermarked model, so the ownership of M, can be claimed (Jia et al. 2021). Higher OoDWSR with p p-value smaller than the threshold and meanwhile larger Acc indicate a successful watermark injection.
Trigger patterns. To attain the best model with the highest watermark success rate, we use the
OoDWAR to choose triggers from 6 different backdoor patterns: BadNets with grid (badnet grid) ar. 2019), 10-invisible (10 inv) (Li et al. (020). smooth (Zeng et al. (021), Trojan Square 3 x 3
(trojan_3 3x3), Trojan Square 8x8 (trojan_8xx 8), and Trojan watermark (trojan_ Bijjjan__mmm___ wm) (Liu et al. 2018ab.
Pre-training models. The de- tailed information of the pre- trained models is shown in Tal ble 1 All the models are pre- trained on clean samples until convergence, with a learning rate 0.1, SGD optimizer, and batch size 128. We follow public resources to conduct the training such that the performance is close to state-of-the-art results.
Dataset
Class num
DNN architecture
Acc
CIFAR-10
10
WRN-16.2
Zagoruyko & Komodakis, 2016
0,9400
CIFAR-100
100
WRN-16-2
Zagoruyko & Komodaaks, 2016
0.7234
GTSRB
43
ResNect (He 2015)
0.9366
Table 1: Pre-trained models.
Watermark removal attacks. To evaluate the robustness of our proposed method, we consider three kinds of attacks on victim models: 1) FT: Fine-tuning includes three kinds of methods: a) fine-tune all layers (FT-AL), b) fine-tune the last layer and freeze all other layers (FT-LL), c) re-initialize the last layer and then fine-tune all layers (RT-AL). 2) Pruning-r% indicates pruning r% of the model parameters which has the smallest absolute value, and then fine-tuning the model on clean i.i.d. samples to restore accuracy. 3) Model Extraction: We use knockoff (Orekondy et al. 2019) as an example of the model extraction attack, which queries the model to get the predictions of an auxiliary dataset (ImagenetDS (Chrabaszez et al. 2017) is used in our experiments), and then clones the behavior of a victim model by re-training the model with queried image- -reddicinniiioon pairs. Assume the adversary obtains 10% of the training data of the pre-trained models for fine-tuning and pruning. Fine-tuning and pruning are conducted for 50 epochs. Model extraction is conducted for 100 epochs.
4.1 WATERMARK INJECTION
The poisoning ratio of the generated surrogate dataset is 10%. For CIFAR-I0 and GTSRB, we fine- tune the pre-trained model for 20 epochs (first 5 epochs are with WP). For CIFAR-100, we fine-tune the pre-trained model for 30 epochs (first 15 epochs are with WP). The perturbation constraint y in Eg. is) fixed at 0.1 for CIFAR-10 10 and GTSRB, and 0.05 for CIFAR- 100. The trade-off parameter Eq. is fixed 6 for all the datasets. The watermark injection process of CIFAR- 10 is shown in Fig. 2 and watermark injection for the other two datasets can be found in Appendix A. We observe that the injection process is efficient, takes only 10 epochs for CIFAR- 10 achieve stable high standard accuracy and OoDWSR. The highest OoDWSR for CIFAR- is 95.66% with standard accuracy degradation of less than 3%. In the following experiments, we choose triggers with top-2 OoDWSR and standard accuracy degradation less than 3% as the recommended watermark patterns.
htteess//eixebbyy..c////bbeeeee com
hctpe: htkppe//wwww... Leshub. 10 wwwpo//ww/.w//t.oo Wimbod jungle enimal we wellpaper wal Ipppersefari jungle snimal/
https:/ www.omooooooooooooooooooooo..ooo http:///mmooos..imaaaaaaooooo

---

Published as a conference paper at ICLR 2024
1.0
3.4
1.0
0.8
Injnn Ax
0.E
bedhet grid
0.4
10
15
Epoc7
10
25
30
Epech
(a) CIFAR-10 Acc.
(b) CIFAR-IO IDD WSR.
(c) CIFAR-10 OoD WSR.
Figure 2: Acc, ID WSR, and OoD WSR for watermark injection.
Dataset
Trigger
Non-watermarked model
Victim model
Watermark removal
Suspect model
p-value
OoDWSR
Ace IDWSRO
Acc
IDWSR OoDWSR
FT-AL
0.9191 0,9769 0.9678
0,0000
FI-LL
0.7345 0.9990
0.9972
0,0000
Irojan_ wm
0.0487
0.9102 0.9768 0.9566
RT-AL
0.8706 0.4434
0.5752
1.010e-122 12
Pruming-20%
0.9174 0.9771
0.9641
0,0000
CIFAR-10
Pruning 50%
0.9177 0.9780
0.9658
0,0000
FT-AL
099877 0.9533
039797
FT-LL
0.7408 0.9891
0.9945
0,0000
trojan__xxx 8x8
0.0481
0.9178 0.9328 0.9423
RT-AL
0.8675
0.0782
0.2419
2.9829e-241
Pruning 20%
0.9197
0.9560
0.9793
2.0500e 08
Pruning-50%
0,9190 0.9580
0.9801
2.1651e-247
FT-AL
0.6712 0,5602
0.7443
0.0012
FT-LI
0.4984
0.9476
0.9641
0.0066
trojan__x33 8x8
0.0001
0.6978 0.7024 0.8761
RT-AL
0,5319 0.0227
0.0700
0.0090
Pruning-2088
0.6200
0.7815
0.0020
CIFAR- 100
Pruning-50%
0.6645 0.6953
0,7960
0.0049
FT-AL
0.6710 0.7595
0.5491
0.0206
FT-LL
0.4966 0.9991
0.6097
0.0106
jiv
0.0002
0.6948 0.7046 0.5834
RT-AL
0.5281 0.0829
0.1232
0.0010
Pruming-20%
0.6704 0.7817
0.5517
0.0099
Pruning-50%
0.6651 0.8288
0.5530
0.0025
FT-AL
0.8623 0.0051
0.6772
4,430e=110
FT-LL
0.6291
0.0487
0.9527
0.0006
smooth
0.0145
0.9146 0.1329 0.9442
RT-AL
0.8622
0.0041
0.7431
0.0000
Pruning
Pruning-50%
0,8628
0.0052
0.6778
0.0215
GTSRB
FT-AL
0.8684
0.3257
0.1726
0.0117
FT-LL
0.5935
0.7429
0.5751
7.428lo-11
trojan_wmi Wm
0.0220
0.9089 0.7435 0.7513
RT-AL
0,8519
0.1170
0.0684
0.0000
Pruning-209
200%
0.8647
0.1779
0.0131
Pruning 50%
0,8610 0.3281 0.1747
0.00000
Table 2: Evaluation of watermarking against fine-tuning and pruning on three datasets.
4.2 DEFENDING AGAINST FINE-TUNING & PRUNING
We evaluate the robustness of our proposed method against fine-tuning and pruning in Table 2. where victim models are watermarked models, and suspect models are stolen copies of victim models using watermark removal attacks. OoDWSR of the pre-trained model in Table 1 is the probability that non-watermarked model classifies the verification samples as the target label. If the OoDWSR of a suspect model far exceeds that of the non-watermarked model, the suspect model can be justified as copy of the victim model (Jia et al., 202T).
FT-AL and pruning maintain the performance of the main classification task with an accuracy degradation of less than 6%, but OoDWSR remains high for all the datasets. Compared with FT-AL, FT-LL will significantly bring down the standard accuracy by over 15% for all the datasets. Even with the large sacrifice of standard accuracy, FT-LL still cannot wash out the injected watermark, and the OoDWSR even increases for some of the datasets. RT-AL loses 4.50%. 16.63%. and 5.47% (mean value for two triggers) standard accuracy respectively for three datasets. Yet, OoDWSR in RT-AL is larger than the one of the random guess and non- watermarked models. To statistically verify the ownership, The p-value is the probability that the two models behave similarly. p p-values for all the datasets are close to 0. The low p-luuues indicate that the suspect models have significantly different behaviors compared with non-wann non-watermarked models probability, at least 95%. Thus, these suspect models cannot get rid of the suspicion of copying our model M with high chance.
conduct T-test between the non watermaararedd model and the watermarked model.
IDWSR is also used here as a reference, although we do not use i.idd data for verification of the ownership of our model. We observe that even though watermark can be successfully injected into
7

---

Published as a conference paper at ICLR 2024
Trigger
Training data
Victim model
Suspect model
Acc
IDWSR
OoDWSR
Acc
IDWSR
OoDWSR
clean
0,9400
0.0639
0,0487
0.8646
0.0864
0,0741
trojan_wm wm
ID
0.9378
1.0000
0,9997
0.8593
0.0413
0,0195
OoD
0.9102
0.9768
0,9566
0.8706
0.4434
0,5752
clean
0,9400
0.0161
0.0481
0.8646
0.0323
0.0610
trojan_ 8x8
ID 0.9393
0.9963
0,9992
0.8598
0.0342
0.0625
OoD 0.9178
0.9328
0.9423
0.8675
0.0782
0.2419
Table 3: Comparison of watermarking methods against fine-tuning watermark removal using different training data. OoD injection is much more robust compared with i.i.d. injection.
both our generated OoD dataset and i.i.d. samples (refer to IDWSR and OoDWSR for victim model), they differ in their robustness against these two watermark removal attacks. For instance, for smooth of GTSRB, after fine-tuning or pruning, IDWSR drops under 1,, which is below the random guess, however, OoDWSR remains over 67%. This phenomenon is also observed for other triggers and datasets. Watermarks injected in OoD samples are much harder to be washed out compared with watermarks injected into i.i.d. samples. Due to different distributions, fine-tuning or pruning will have a smaller impact on OoD samples compared with i.i.d. samples.
To further verify our intuition, we also compare our method (OoD) with traditional backdoor- based methods using i.i.d. data (ID) for data poisoning on CIFAR-10. 10. We use RT-AL which is the strongest attack Table 2 as an example. The results are shown Table 3 Note that ID poison and the proposed OoD poison adopt IDWSR and OoDWSR as the success rate for the injection watermark, respectively. Clean refers to the pre-trained model without watermark injection. With only one single OoD image for watermark injection, utilizes the entire ID training set. After RT-AL, the watermark success rate drops to 4.13% and 3.42%, respectively for ID poison, while drops to 57.5 57.52% and 24.19% for OoD poison, which verifies that our proposed method is also much more robust against watermark removal attacks.
can achieve comparable results as ID poisoning which
Dataset
Trigger
Victim model IDWSR
Suspect model IDWSR
p-value
Acc
OoDWSR
OoDWSR
CIFAR-10
frojan_ wm
0,9102
0.9768
0.9566
0.8485
0,9684
0.9547
0.0000
trojan_ 8x8
0.9178
0.9328
0.9423
0.8529
0.8882
0,9051
0.0000
trojan 8x8
0.6978
0.7024
0.8761
0.5309
0.5977
0.7040
0.0059
CIFAR-100
10 i_inv 0.6948
0.7046
0.5834
0.5200
0.0162
0.0622
0.0019
smooth 0.9146
0.1329
0.9442
0.6575
0.1386
0,9419
1.5891e-1T
GTSRB
trojan_wm wm
0.9089
0.7435
0.7513
0.6379
0.7298
0.7666
2.6070c-21
Table 4: Evaluation of watermarking against model extraction watermark removal on three datasets. 4.3 DEFENDING AGAINST MODEL EXTRACTION
We evaluate the robustness of our proposed method against model extraction in Table By conducting model extraction, the standard accuracy drops 6% on the model pre-trained on CIFAR- 10, and drops more than 10% on the other two datasets. Re-training from scratch makes hard for the suspect model to resume the original model's 's utility using an OoD dataset and soft labels querying from the watermarked model. OoDWSR is still over 90% and 76% for CIFAR- 10 and GTSRB, respectively. Although OoDWSR is 6.22% for 10 inv, it is still well above 0.02%. which is observed for the non-watermarked model. All the datasets also have a p-value close to O. All the above observations indicate that the re-training-basee model. One possible reason for these re-training models still extracting the watermark is that during re-training, the backdoor information hidden in the soft label queried by the IP infringers can also embed the watermark in the extracted model. The extracted model will behave more similarly to the victim model its decision boundary gradually approaches that of the victim model.
extracted model has high probability of being copy of our
4.4 QUALITATIVE STUDIES
Distribution of generated OoD samples and ID samples. We first augment an unlabeled OoD dataset, and then assign predicted labels to them using the model pre- trained on clean CIFAR-10 10 data. According the distribution of OoD and ID samples before and after our watermark fine-tuning as shown in Fig. 3 we can observe that the OoD data drawn from one image lies close to ID data with small gap. After few epochs of fine-tuning, some of the OoD data is drawn closer to ID)
8

---

Published as a conference paper at ICLR 2024
Indlat (TAONE
Estar moed
Fintune model
Hriduut model
1000
gararation
Before fine-tuning.
(b) After fine-tuning.
-000 +1.00 4:00
66B
600
100
-A2t -0.7 -C.00 -0013 2007 RAD 1ide 6en 1
(a) Without WP.
(b) With WP.
Figure 3: The distribution of OoD and ID sam-
Figure 4: Weight distribution for model w/ and w/o WP. The x-axis is the parameter values, and the y-axis is the number of parameters.
ples. Generation data denotes augmented OoD samples from single OoD image.
OoD Image
Trigger
Acc IDWSR OoDWSR
Trigger
WP
Vietim model
Suspect model
trojan wm 0.9102
0.9768
0.9566
City
Ace IDWSR OoDWSR
Ace IDWSR OoDWSR
trujun_ 8x8 0.9178
0.9328
0.9423
w/o 0,9264
0,9401
0.9490
0.8673 0.1237
0.1994
Animals
trojan wm 0,5072
0,9873
0,9880
trojan_ wmj
w/ 0.9102 0.9768
0.9566
0.8766 0.4434
0.5752
trojan_8xx 8x8 0,9176 0,9251
0,9622
w/o 0.9238 0,9263
0.9486
0.8690 0.0497
0.1281
Bridge
Injjan wm 0,9207 0.8749
0.7148
trojan 8x8
w/ 0.9178 0.9328 0.9423
0.8675 0.0782 0.2419
trojan_ 8x8 0.9172 0.7144
0.7147
Table 6: Weight perturbation increases the robustness of the watermarks against removal attacks.
Table 5: Watermark injection using differ- ent OoD images.
but still maintains overlap. This can help us successfully implant watermarks to the pre- pre-trained model while maintaining the difference between ID and OoD data. In this way, when our model is fine-tuned with clean ID data by attackers, the WSR on the OoD data will not be easily crased.
Effects of different OoD images for watermark injection. In Table 5| we use different source images to generate surrogate datasets and inject watermarks into a pre-trained model. The model is pre-trained on CIFAR-10. From these results, we observe that the choice of the OoD image for injection is also important. Dense images such as "City" and "Animals" can produce higher OoDWSR than the sparse image "Bridge", since more knowledge is included in the visual representations of dense source images. Thus, dense images perform better for backdoor-basee watermark injection. This observation is also consistent with some previous arts (Asano & Saced 2023 Asano et al. 2019) about single image representations, which found that dense images perform better for model distillation or self-supervised learning.
Effects of backdoor weight perturbation. We show the results in Fig. 4 The initial model is WideResNet pre-trained on CIFAR- 10, and the fine-tuned model is the model fine-tuning using our proposed method. If the OoD data is directly utilized to fine-tune the pre-trained models with only few epochs, the weight distribution is almost identical for pre-trained and fine-tuned models (left figure). According to Garg et al. (222), if the parameter perturbations are small, the fackdoor-basee watermark can be easily removed by fine-tuning or adding random noise to the model's parameters. Our proposed watermark injection WP (right figure) can shift the fine-tuned model parameters from the pre-trained models in a reasonable scale compared with the left one, while still maintaining high standard accuracy and watermark success rate as shown in Table 6 Besides, the weight distribution of the perturbed model still follows normal distribution as the unperturbed model, performing statistical analysis over the model parameters distributions will not be able to erase our watermark.
To show the effects of WP. we conduct the attack RT-AL on CIFAR-I0 an example. From Table 6 we observe that WP does not affect the model utility, and at the same time, it will become more robust against stealing threats, since OoDWSR increases from 19.94% and 12.81% % to 57.52% and 24.19%. respectively, for two triggers. More results for WP can be referred to Appendix A.2
5 CONCLUSION
In this paper, we proposed novel and practical watermark injection method that does not require training data and utilizes a single out-of-distribution image in a sample-efficient and time-efficient manner. We designed a robust weight perturbation method to defend against watermark removal attacks. Our extensive experiments on three benchmarks showed that our method efficiently injected watermarks and was robust against three watermark removal threats. Our approach has various real-world applications, such as protecting purchased models by encoding verifiable identity and implanting server-side watermarks in distributed learning when ID data is not available.
9

---

Published as a conference paper at ICLR 2024
ACKNOWLEDGEMENT
This material is based in part upon work supported by the National Science Foundation under Grant UIS-2212174, I1S-1749940, Office of Naval Research 100014-20-1-2882 N00014-24-1-2168, and National Institute on Aging (NIA) RFIAGO72449, The work of Z. Wang is in part supported by the National Science Foundation under Grant IIS2212176.
REFERENCES
Yossi Adi, Carsten Baum, Moustapha Cisse, Benny Pinkas, and Joseph Keshet. Turning your weakness into strength: Watermarking deep neural networks by backdooring. In 27th {USENIX) Security Symposium ((USENIX) Security 18), pp. 1615-1631, 2018
Yuki M. Asano and Aaqib Saeed. Extrapolating from single image to thousand classes using distillation. ICLR, 2023.
Yuki M Asano, Christian Rupprecht, and Andrea Vedaldi. A critical analysis of self-supervision, or what learn from single image. arXiv preprint arXiv: 1904. 13132, 2019.
Jialuo Chen, Jingyi Wang, Tinglan Peng, Youcheng Sun, Peng Cheng, Shouling Ji. Xingjun Ma, Bo Li, and Dawn Song. Copy, right? testing framework for copyright protection of deep learning models. In 2022 IEEE Symposium on Security and Privacy (SP), pp. 824-841 841. IEEE, 2022.
Xuxi Chen, Tianlong Chen, Zhenyu Zhang, and Zhangyang Wang. You are caught stealing my winning lottery ticket! making lottery ticket claim its ownership. Advances in Neural Information Processing Systems, 34:1780-1791, 2021.
Patryk Chrabaszez, Ilya Loshchilov, and Frank Hutter. A downsampled variant of imagenet as alternative to the cifar datasets. arXiv preprint arXiv:1707.0888 08819, 2017.
Bita Darvish Rouhani, Huili Chen, and Farinaz Koushanfar. Deepsigns: An end-to-end watermarking framework for ownership protection deep neural networks. Proceedings of the Twenty- Fourthh International Conference on Architectural Support for Programming Languages and Operating Systems, pp. 485 497, 2019.
Gongfan Fang, Jie Song, Chengchao Shen, Xinchao Wang, Da Chen, and Mingli Song. Data-free adversarial distillation. arXiv preprint arXiv: 2019.
Luciano Floridi and Massimo Chiriatti. Gpt-3: Its nature, scope, limits, and consequences. Minds and Machines, 30:681-694 2020.
Siddhant Garg, Adarsh Kumar, Vibhor Goel, and Yingyu Liang. Can adversarial weight perturbations inject neural backdoors. In Proceedings of the 29th ACM International Conference on Information & Knowledge Management, pp. 2029-2032, 2020.
Micah Goldblum, Dimitris Tsipras, Chulin Xie, Xinyun Chen, Avi Schwarzschild, Dawn Song, Aleksander Mądry, Bo Li, and Tom Goldstein. Dataset security for machine learning: Data poisoning, backdoor attacks, and defenses. IEEE Transactions on Pattern Analysis and Machine Intelligence, 45(2):1563-1555 2022.
Tianyu Gu, Kang Liu, Brendan Dolan Dolin-Gavitt, and Siddharth Garg. Badnets: Evaluating backdooring attacks on deep neural networks. IEEE Access, 7:47230-47244, 2019.
Kaiming He, Xiangyu Zhang, Shaoqing Ren, and Jian Sun. Deep residual learningfor image recognition. CoRR, abs/1512, 3385:2, 2015.
Pengfei He, Han Xu, Jie Ren, Yingqian Cui, Hui Liu, Charu C Aggarwal, and Jiliang Tang. Sharpness- aware data poisoning attack. arXiv preprint arXiv:2305.1 14851, 2023.
Alex Hern. Techscape: Will meta's massive leak democratise ai and at what cost? The Guardian, 2023. URL http:///wwwwttt.aaaaaaaco//coana
07/techscape--mtt httpaaaleeeeelaaaaaaaaaaaaaaa-ee
10

---

Published as a conference paper at ICLR 2024
Junyuan Hong, Yi Zeng, Shuyang Yu, Lingjuan Lyu, Ruoxi Jia, and Jiayu Zhou. Revisiting free-frree knowledge distillation with poisoned teachers. The Fortieth International Conference on Machine Learning, 2023.
Hengrui Jia, Christopher A Choquette- Chhou, Varun Chandrasekaran, and Nicolas Papernot, Entangled watermarks as a defense against model extraction. In Proceedings of the 30th USENIX Security Symposium, 2021.
Mika Juuti, Sebastian Szyller, Samuel Marchal, and Asokan. Prada: protecting against dnn model stealing attacks. In 2019 IEEE European Symposium on Security and Privacy (EuroS&P), pp. 512-527. IEEE, 2019.
Byungjoo Kim, Suyoung Lee, Seanie Lee, Sooel Son, and Sung Ju Hwang. Margin-based neural network watermarking. 2023.
Jakub Konečný, Brendan McMahan, Felix X Yu, Peter Richtárik, Ananda Theertha Suresh, and Dave Bacon. Federated learning: Strategies for improving communication efficiency. arXiv preprint arXiv:1610.05492, 2016.
Alex Krizhevsky, Geoffrey Hinton, et al. Learning multiple layers of features from tiny images. 2009.
Minoru Kuribayashi, Takuro Tanaka, Shunta Suzuki, Tatsuya Yasui, and Nobuo Funabiki. White-box watermarking scheme for fully-connected layers in fine-tuning model. In Proceedings of the 2021 ACM Workshop on Information Hiding and Multimedia Security, pp. 165-170, 2021.
Erwan Le Merrer, Patrick Perez, and Gilles Trédan. Adversarial frontier stitching for remote neural network watermarking. Neural Computing and Applications, 32:9233-9244, 2020.
Fangqi Li and Shilin Wang. Knowledge- black-box watermark and ownership proof for image classification neural networks. arXiv preprint Stti::2204004222.. 2022.
Fangqi Li, Lei Yang, Shilin Wang, and Alan Wee-Chung Liew. Leveraging multi-task learning for
umambiguous and flexible deep neural network watermarking. In SafeA/@ AAAI, 2022.
Shaofeng Li, Minhui Xue, Benjamin Zhao, Haojin Zhu, and Xinpeng Zhang. Invisible backdoor
attacks on deep neural networks via steganography and regularization. IEEE TDSC, 2020.
Yue Li, Hongxia Wang, and Mauro Barni. survey of deep neural network watermarking techniques. Neurocomputing, 461:171-193, 2021.
Weitang Liu, Xiaoyun Wang, John Owens, and Yixuan Li. Energy- based
detection.
Advances in neural information processing systems, 33:21 464-21475, 2020.
Yingqi Liu, Shiqing Ma, Yousra Aafer, Wen-Chuan Lee, Juan Zhai, Weihang Wang, and Xiangyu Zhang. Trojaning attack on neural networks. In NDSS, 2018a
Zhuang Liu, Mingjie Sun, Tinghui Zhou, Gao Huang, and Trevor Darrell. Rethinking the value of network pruning. arXiv preprint urXiv:1810.05277 2018b.
Brendan McMahan, Fider Moore, Daniel Ramage, Seth Hampson, and Blaise Aguera y Arcas. Communication-efffcieett learning of deep networks from decentralized data. In Artificial intelli- gence and statistics, pp. 1273-1282, PMLR, 2017.
Dhwani Mehta, Nurun Mondol, Farimah Farahmandi, and Mark Tehranipoor. Aime: watermarking ai models by leveraging errors. In 2022 Design, Automation & Test in Europe Conference & Exhibition (DATE), pp. 304-309, IEEE, 2022.
Tribhuvanesh Orekondy, Bernt Schiele, and Mario Fritz. Knockoff nets: Stealing functionality of black-box models. In Proceedings of the IEFF/CVF conference on computer vision and pattern recognition, pp. 4954-4963 2019.
Nicolas Papernot, Patrick McDaniel, Ian Goodfellow. Somesh Jha, Z Berkay Celik, and Ananthram Swami. Practical black-box attacks against machine learning. In Proceedings of the 2017 ACM on Asia conference computer and communications security, pp. 506-519, 2017.

---

Published as a conference paper at ICLR 2024
Adnan Siraj Rakin, Zhezhi He, and Deliang Fan. Tht: Targeted neural network attack with bit trojan. In Proceedings of the IEEE/CVF Conference on Computer Vision and Pattern Recognition, pp- 13198-151 -12977, 2020.
Alex Renda, Jonathan Frankle, and Michael Carbin. Comparing rewinding and fine-tuning in neural network pruning. arXiv preprini arXiv:2003. 2020.
Johannes Stallkamp, Mare Schlipsing, Jan Salmen, and Christian Igel. Man vs. computer: Bench- marking machine learning algorithms for traffic sign recognition. Neural networks, 32:323-333 -322, 2012.
Florian Tramèr, Fan Zhang, Ari Juels, Michael K Reiter, and Thomas Ristenpart. Stealing machine learning models via prediction apis. In USENIX security symposium, volume 16, pp. 601-618, 2016.
Yusuke Uchida, Yuki Nagai, Shigeyuki Sakazawa, and Shin iihn' Satoh. Embedding watermarks into deep neural networks. In Proceedings of the 2017 ACM on international conference on multimedia retrieval, pp. 269-2672777 2017.
Haotao Wang, Junyuan Hong, Aston Zhang, Jiayu Zhou, and Zhangyang Wang. Trap and replace: Defending backdoor attacks by trapping them into an easy-to-replace subnetwork. Advances in neural information processing systems, 35:36026-36039, 2022a.
Run Wang, Jixing Ren, Boheng Li, Tianyi She, Chehao Lin, Liming Fang, Jing Chen, Chao Shen, and Lina Wang. Free fine-tuning: A plug-and-play watermarking scheme for deep neural networks. arXiv preprint arXiv:2210.07809 2022b.
Dongxian Wu, Shu- Tao Xia, and Yisen Wang. Adversarial weight perturbation helps robust general- ization. Advances in Neural Information Processing Systems, 33:2958-29661 2020.
Xiaoyong Yuan, Leah Ding, Lan Zhang, Xiaolin Li, and Dapeng Oliver Wu. Es attack: Model stealing against deep neural networks without data hurdles. IEEE Transactions on Emerging Topics in Computational Intelligence, (15):125-11277) 2022.
Sergey Zagoruyko and Nikos Komodakis. Wide residual networks. In Edwin R. Hancock Richard C. Wilson and William A. P. Smith (eds.), Proceedings of the British Machine Vision Conference (BMVC), pp. 17..187.1.. BMVA Press, September 2016. ISBN 1-901725-59.6.
Yi Zeng, Won Park, Z Morley Mao, and Ruoxi Jia. Rethinking the backdoor attacks' triggers: A frequency perspective. In ICCV, 2021.
Jialong Zhang, Zhongshu Gu, Jiyong Jang, Hui Wu, Mare Ph Stoccklin, Heqing Huang, and Ian Molloy. Protecting intellectual property of deep neural networks with watermarking. In Proceedings of the 2018 on Asia Conference on Computer and Communications Security, pp. 159-172, 2018.
12


Reviews:
[{"review_id": "F0kVmcyMEN", "reviewer": "Reviewer_6zjD", "summary": "The paper proposes a novel method for watermarking deep neural networks to protect their intellectual property and commercial ownership. Traditional watermarking strategies involve adding backdoor triggers to training samples, but these methods have limitations in terms of data privacy, safety concerns, and vulnerability to model changes. In contrast, the proposed technique leverages the knowledge from a single out-of-distribution image as a secret key for IP verification. The proposed method can immune to third-party promises of IP security. The watermark is injected by perturbing the model parameters randomly, which enhances robustness against common watermark removal attacks such as fine-tuning, pruning, and model extraction. The experimental results show that the proposed watermarking approach works well without requiring additional training data. Furthermore, it demonstrates robustness against the watermark removal attacks.", "questions": "Please see the weaknesses above.", "limitations": "", "rating": 6, "confidence": 2, "soundness": 2, "presentation": 3, "contribution": 3, "strengths": "IP Protection: The paper addresses the challenge of protecting the intellectual property of deep neural networks, which is increasingly crucial in the field. It has attracted increasing attentions in the literature, especially in the era of foundation models. This paper considers an important problem, potentially having large impact to the community. \n\nSafe and Robust Technique: The proposed technique claims to be safe and robust. It leverages a single out-of-distribution (OoD) image as a secret key for IP verification. This approach avoids privacy and safety concerns associated with poisoning training samples. By inducing random perturbations of model parameters during watermark injection, it aims to defend against common watermark removal attacks such as fine-tuning, pruning, and model extraction.\n\nAgnostic to Third-party Promises: The technique is described as agnostic to third-party promises of IP security. This suggests that the proposed approach does not rely on external entities or services for ensuring IP protection, which can be beneficial in scenarios where trust in third parties is limited.\n\nTime- and Sample-Efficient: The proposed watermarking approach is claimed to be time- and sample-efficient without requiring additional training data. This could be advantageous as it reduces the computational resources needed for watermarking.", "weaknesses": "Training time watermarked data will have some distribution discrepancy over test situations, thus one cannot ensure the performance of watermarking. It seems that such an issue remains an open question in IP protection, so more discussion about \"how to handle such a problem\" or \"is it an important issue in the literature\" can be formally discussed. \n\nDo more data points, other than just one point, will lead to more contributions to the watermarking strategy? Experimental verification and heuristic explanation seem to be interesting. More ablation studies, such as number of data points, hyper parameter setting, choice of validation set, and effects of individual modules, can be presented, which can largely improve the solidity of this paper. \n\nFor the first equation in Sec 3.1, I am not sure if the first term is contributive. In previous works of watermarking, the first term is used to ensure the original high performance for the original task (I guess). Therefore, from my view, the first term is not important, especially considering the fact that x does not follow the same distribution of original data distribution, and no semantic information should be kept therein. \n\nA related question  is that does the watermarking strategy suffer from catastrophic forgetting? In other words, does learning from tilde D impact the performance for the original task, especially for foundation models. More discussion and empirical justification should be given here. Another related issue is that, it seems that this paper is motivated by the recent progress in foundation models, but it seems that this paper does not provide enough evaluation for the power of watermarking with backbones of foundation models.\n\nIn previous works, researchers demonstrate that weight perturbation can lead to data transformation [1]. Therefore, the reason  why the suggested method works may also be explained from the perspective of implicitly introducing more data.  Another related question is that if introducing more data can also mitigate the impact of watermarking removing. More discussion and evaluation should be considered here. \n\n\n[1] Relative Flatness and Generalization", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "H8oq2B9tel", "reviewer": "Reviewer_MV1f", "summary": "This paper presents a new method to inject watermarks into the DNN models by leveraging only one out-of-distribution image. It first crops some patches from the selected image, augments, and adds trigger patterns on some of them as the trigger images. The rest of the patches are also augmented but not injected with the trigger patterns, and used as the data to retain the main functionality of the target model. Then, it jointly fine-tunes the target model using the two parts of augmented data. Meanwhile, in order to improve the watermark robustness under the watermark removal attacks, the authors propose to randomly add perturbations to the model weights during fine-tuning. The authors claim they can achieve a better performance compared with that implemented using basic backdoor-based methods.", "questions": "The questions are listed based on the organization order of the paper:\n\n1. On page 2. ‘…, which fills in the gap of IP protection of deep models without training data’. Most of the white-box watermarking methods do not need the training data, you should make it clear that you target the backdoor-based methods.\n\n2. On page 5. ‘If the protected model shares a similar parameter distribution with the pre-trained model, the injected watermark could be easily erased by fine-tuning using clean i.i.d. data or adding random noise to parameters’. What is the pre-trained model? Does it mean that fine-tuning with the i.i.d data can introduce more perturbations on the watermarks than fine-tuning with OoD data? What’s the intuition behind such an claim? \n\n3. On page 5. The statement of ‘the anomalies of the parameter distribution could be easily detected by an IP infringer’ may be conflict with the experimental results of Ref. [1]. The authors of Ref. [1] conduct experiments to check whether the distributions of model weights or model representations could be used as indicators to detect backdoors or anomalies in a DNN model. \n\n4. Experimental settings are not clear enough: 1) How many patches are used for training? 2) Comparison experiments are not well organized. There are many previous methods with similar strategies, e.g., BadNets, 10-invisible, smooth, Trojan Square, and Trojan watermark, and it's essential to compare with them. \n\n5. In Table 2, we observe that the OoDWSR may increase after fine-tuning and pruning. Could you give some explanations? It seems the IDWSR may also increase after such two attacks. Why? It seems to be contradicted by your previous claim.\n\n6. How did you implement the model extraction attack? According to the experimental results in Table 4, we still have a high OoDWSR after model extraction. Could you explain why the model extraction methods using i.i.d data can also extract the watermarks that are generated using the OoD data?\n\n[1] Ji, Y., Liu, Z., Hu, X., Wang, P., & Zhang, Y. (2019). Programmable neural network trojan for pre-trained feature extractor. *arXiv preprint arXiv:1901.07766*.", "limitations": "", "rating": 3, "confidence": 4, "soundness": 2, "presentation": 2, "contribution": 2, "strengths": "The proposed approach is interesting, and the paper is easy to follow.", "weaknesses": "1. The authors do not give a comprehensive discussion of previous work on this topic. \n\n2. The experimental justification of this work is not sufficient, only compared to the basic backdoor-based strategy.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "aatU1TF0yh", "reviewer": "Reviewer_URnu", "summary": "This paper proposes a novel technique for protecting the intellectual property of deep models using a single out-of-distribution image as a secret key. The proposed technique is safe and robust against watermark removal attacks and does not require poisoning training samples.", "questions": "How many verification samples are needed for each successful verification?\n\nIn experiments the authors tried many different triggers. which trigger should an IP protector choose in practice?", "limitations": "", "rating": 8, "confidence": 4, "soundness": 3, "presentation": 3, "contribution": 3, "strengths": "The main strength of this paper is the proposal of a novel technique for protecting the intellectual property of deep models using a single out-of-distribution (OoD) image as a secret key. The proposed technique is robust against watermark removal attacks and does not require poisoning training samples. The paper has great clarity and is easy to follow. The proposed technique looks promising for protecting the commercial ownership of deep models, which require large amounts of data and computational resources to train.\n\nThe main technical difference between this work and prior work is the use of a single OoD image as a secret key for watermark injection. Prior work on watermarking strategies often implants verifiable backdoor triggers by poisoning training samples, which are often unrealistic due to data privacy and safety concerns and are vulnerable to minor model changes such as fine-tuning. In contrast, the proposed technique leverages the diverse knowledge from a single OoD image to inject backdoor-based watermarks efficiently to different parts of the pre-trained representation space. Additionally, the proposed technique is safe and robust against watermark removal attacks and does not require poisoning training samples. Since the training data is independent, it is also not necessary to trust third-party providers with sensitive data. \n\nExperimental findings demonstrate that the proposed watermarking approach is effective in protecting IP of deep models. The authors show that their technique is robust against common watermark removal attacks, including fine-tuning, pruning, and model extraction. The proposed technique is also time- and sample-efficient without requiring any training data. The authors demonstrate the effectiveness of their approach on several popular models including VGG16, ResNet50, and MobileNetV2. The experimental results show that the proposed technique achieves high watermark detection accuracy while maintaining the performance of the original model on the original task.", "weaknesses": "Relying on a single OoD image as a secret key might introduce vulnerabilities. If an adversary gains access to this single image, the watermarking scheme could be compromised. Using multiple OoD images or a combination of techniques might enhance security?\n\n It is unclear why specific trigger patterns are well suited for specific dataset. Further, it would be interesting to see how the watermarking technique performs when models are transferred across different tasks or domains. The watermark might lose its effectiveness in such scenarios.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}, {"review_id": "L9IxPZuNO2", "reviewer": "Reviewer_suCZ", "summary": "The submission proposes a backdoor-based model watermarking scheme with a single OOD image. The work approaches a new scenario that the verifier of the model has no access to the original training data (e.g., as a third party or model-sharing platform), and demonstrates the robustness and efficiency of the watermark injection method.", "questions": "As the submission highlights the use of a single OOD image for watermark injection, the author may provide more comparison between the \"pachify\" of a single image and sampling several OOD images as the verification dataset, as to enhance the persuasiveness. Besides, more adaptive defenses such as OOD detection and Neural Cleanse [3] should be considered in addition to the traditional watermark removal attacks. \n\nReference:\n\n[3] Wang B, Yao Y, Shan S, et al. Neural cleanse: Identifying and mitigating backdoor attacks in neural networks. 2019 IEEE Symposium on Security and Privacy (SP). IEEE, 2019: 707-723.", "limitations": "", "rating": 6, "confidence": 4, "soundness": 2, "presentation": 3, "contribution": 2, "strengths": "+ The submission focuses on a new task that the watermark injection is performed after the training phrase, which allows the IP protection in more real-world scenarios. \n+ The proposed watermark injection method only requires a single OOD image to insert the copyright information, reducing the cost of sampling trigger datasets whilst maintaining the confidentiality.", "weaknesses": "+ **About the *Model Extraction* attack**: It is mentioned in section 4 that *the behavior of a victim model is cloned by fine-tuning it with the queried image-prediction pairs*, then what's the difference between the fine-tuning attack and model extraction? As retraining-based extraction attacks are generally considered in previous works [1-2], the robustness against such an attack should be further demonstrated.\n+ **Possible OOD detection**: As the verification process is conducted with the augmentation of a single OOD image, the adversary may simply reject the query of OOD samples to reject the ownership verification process, as illustrated in [2]. Since OOD detection is entirely possible in the realistic scenarios proposed by the submission, the adpative defenses shoule be discussed in further detail.\n\nReferences: \n\n[1] Jia H, Choquette-Choo C A, Chandrasekaran V, et al. Entangled watermarks as a defense against model extraction. 30th USENIX Security Symposium (USENIX Security 21). 2021: 1937-1954.\n\n[2] Kim B, Lee S, Lee S, et al. Margin-based Neural Network Watermarking. Proceedings of the 40th International Conference on Machine Learning. 2023.", "quality": null, "clarity": null, "significance": null, "originality": null, "strengths_and_weaknesses": "", "was_revised": false, "final_justification": "", "rebuttal": "", "claims_and_evidence": "", "methods_and_evaluation_criteria": "", "theoretical_claims": "", "experimental_designs_or_analyses": "", "relation_to_broader_scientific_literature": "", "essential_references_not_discussed": "", "other_strengths_and_weaknesses": "", "other_comments_or_suggestions": "", "questions_for_authors": "", "summary_of_paper": "", "summary_of_recommendation": "", "technical_quality": "", "clarity_of_presentation": "", "potential_impact": "", "robotics_focus": "", "quality_of_limitations": "", "questions_for_rebuttal": "", "reasons_to_accept": "", "reasons_to_reject": "", "questions_to_authors": "", "extra_scores": {}}]

Author rebuttal:

Decision: Accept (poster)