NeuralMark: Advancing White-Box Neural Network Watermarking

Authors: Yuan Yao, Jin Song, Jian Jin, Zhenzhen Jiao
Primary area: alignment, fairness, safety, privacy, and societal considerations
Keywords: Neural network; White-box watermarking; Hash mapping; Watermark filtering; Average pooling

Abstract:
As valuable digital assets, deep neural networks require ownership protection, making neural network watermarking (NNW) a promising solution. In this paper, we propose a *NeuralMark* method to advance white-box NNW, which can be seamlessly integrated into various network architectures. NeuralMark first establishes a hash mapping between the secret key and the watermark, enabling resistance to forging attacks. The watermark then functions as a filter to select model parameters for embedding, providing resilience against overwriting attacks. Furthermore, NeuralMark utilizes average pooling to defend against fine-tuning and pruning attacks. Theoretically, we analyze its security boundary. Empirically, we verify its effectiveness across 14 distinct Convolutional and Transformer architectures, covering five image classification tasks and one text generation task. The source codes are available at https://anonymous.4open.science/r/NeuralMark.

Decision: reject
Reviewer scores: 5, 5, 5, 6

Reviews and discussion:
<thread>
creation date:
1729990775924

thread_type:
official_review

<thread_object>
creator: reviewer_2mav

<content>
summary:
This paper proposes an advanced white-box watermarking technique that defends against watermark removal attacks through average pooling, establishes a key-to-watermark hash mapping to defend against watermark forgery attacks, and also enhances watermark privacy by using binarised watermarks as a filter for watermark injection parameter selection.

strengths:
1. it makes sense to use watermarking by binarisation as a filter for the injected parameters. 
2. the authors provide a theoretical analysis of the security bounds of NeuralMark. 
3. extensive experiments show that NeuralMark can effectively resist watermarking attacks without significantly affecting the model.

weaknesses:
The authors establish a key-to-watermark hash mapping, but a similar method for establishing a passport sample-to-watermark hash mapping is already available in [1]. Despite the author's citation of the article in [1], the article does not explain the necessity of using keys directly for hash mapping. In addition, to defend against Removal+Forging Attack, the authors use average pooling, which was also proposed in previous articles [2,3]. As a key module to defend against watermark removal attacks, the approach used by the authors does not advance the knowledge in the field of watermarking.

[1]Hanwen Liu, Zhenyu Weng, Yuesheng Zhu, and Yadong Mu. 2023. Trapdoor normalization with irreversible ownership verification. In Proceedings of the 40th International Conference on Machine Learning (ICML'23).
[2]Yusuke Uchida, Yuki Nagai, Shigeyuki Sakazawa, and Shin'ichi Satoh. 2017. Embedding Watermarks into Deep Neural Networks. In Proceedings of the 2017 ACM on International Conference on Multimedia Retrieval (ICMR '17). 
[3] Liu, H., Weng, Z., & Zhu, Y. (2021). Watermarking Deep Neural Networks with Greedy Residuals. International Conference on Machine Learning.

questions:
Three levels of watermarking attacks are presented in Section 2.3.2. However, the Threat Model in Section 3.3 does not seem to be analysed in conjunction with the levels of watermarking attacks.The Removal+Forging Attack first attempts a watermark removal attack, which belongs to Level II in Section 3.2. This is followed by the Forging Attack. I'm not sure if it becomes more difficult to perform a forging attack on a model that has already had its watermark removed. If the attack is successful, this seems to be just a combination of Level I and Level II. It seems like it would look more reasonable to switch the order of the two attacks.

 For the experiments of watermark removal by pruning in Removal+Forging Attack, the author chooses to carry out the watermark forging attack with 40% pruning rate, combining with Figure3 to see that 40% doesn't seem to be a special turning point, and I'm very curious about the robustness of NeuralMark's other different pruning rates to watermark forging attacks. .
</content>
</thread_object>

</thread>
<thread>
creation date:
1730290095242

thread_type:
official_review

<thread_object>
creator: reviewer_464p

<content>
summary:
The paper introduces NeuralMark, a method for white-box neural network watermarking to protect ownership. It integrates seamlessly into various network architectures, using hash mapping, watermark filtering, and average pooling to enhance security against forging, overwriting, fine-tuning, and pruning attacks. NeuralMark is empirically validated across 14 different architectures and multiple tasks, demonstrating its effectiveness while maintaining model performance and security.

strengths:
- The research direction about model watermarks is important. As deep learning is driven by the scale, more and more resources have been invested in designing and developing deep models, and therefore ownership protection methods are necessary for safeguarding these models of interests.
- This paper extended model watermarks to the Transformer architecture, while previous work didn't. Empirical results on Vision Transformers,  GPT-2 and Swin Transformers demonstrate the effectiveness of the proposed method.
- The presentation is clear and in general well-written.

weaknesses:
- The proposed method seems to be incremental. I am aware that there are some numerical improvements in the reported results. However, no substantial contribution to watermark design, in the aspects of robustness or fidelity for example. 
- Further results on ambiguity attacks (i.e., attacks that would cast ambiguity over the verification process, including forging attacks and overwriting attacks) are needed. See below for details.

questions:
- To my understanding, the proposed algorithm is public while the watermark (i.e., the specific parameter filter in the proposed method) is secret, according to Kerckhoff's Principle. After preliminary verification, the watermark is also publically available, and since the adversary also knows the hidden watermark, what happens to the next verification process? After the first verification, anyone knows the embedded watermark and anyone also could claim ownership, which may cast ambiguity over the verification process after the first verification. In other words, can the proposed method support public verification?
- For the above question, I think one possible solution is to map the owner's signature to the watermark binary code, e.g.,  [1, 0, 1, 0]. If so, I would suggest additional analyses and ablation studies about the binary code design in the experiment section.
- Will the source codes and datasets with necessary documents and instructions be publicly available?

I would raise my rating if these concerns are addressed.
</content>
</thread_object>

</thread>
<thread>
creation date:
1730357218822

thread_type:
official_review

<thread_object>
creator: reviewer_33yr

<content>
summary:
The paper introduces NeuralMark, a white-box watermarking method aimed at safeguarding the ownership of deep neural networks by embedding robust watermarks that resist various attacks. NeuralMark employs a three strategies: a hash mapping links a secret key to the watermark, serving as a defense against forging; watermark filtering secures the model parameters from overwriting; and average pooling protects against fine-tuning and pruning attacks.

strengths:
1. NeuralMark integrates hash mapping, which ties the secret key directly to the watermark, thus significantly reducing vulnerability to forgery. This approach makes reverse engineering infeasible by adversaries, as altering the watermark would require breaking the hash.

2. Watermark filtering limits parameter overlap, making overwriting attacks more challenging. This filtering method ensures that even if adversaries attempt to embed a new watermark, the likelihood of interference with the original watermark is minimized.

3. Tests conducted on diverse datasets (e.g., CIFAR, TinyImageNet, and Caltech) show that NeuralMark imposes minimal accuracy loss, indicating that it balances watermark robustness and model fidelity effectively​.

weaknesses:
1. The motivation is unclear. Although the authors explain the motivation for the design of the scheme, they do not explain why they are interested in weight-based watermarking. In the introduction, the author introduces three types of model watermarking techniques and states that all three types of watermarking techniques face the same attacks. It is strange and incomprehensible that the author flatly promotes that they only focus on model weight-based watermarking techniques without clearly comparing the pros and cons of the three types of techniques.

2. The references do not take into account the latest research progress. The introduction of weight-based methods in Related Works only covers work up to 2021. I don't believe there has been no new progress in this direction in the past three years. In addition, in the experimental comparison, only two old solutions were compared, one proposed in 2017 and the other proposed in 2021. There is no comparison with the SOTA solutions, which makes the experimental results unconvincing.

3. This paper says that performing the filtering round more times can reduce the overlap ratio, but it also reduces the number of weight parameters for embedding the watermark. Will this affect the security of the watermark? It is necessary to conduct an experimental analysis.

4. The details of fine-tuning attacks are known.

questions:
None
</content>
</thread_object>

</thread>
<thread>
creation date:
1730783782374

thread_type:
official_review

<thread_object>
creator: reviewer_zqfg

<content>
summary:
This paper proposes a white-box neural network watermarking method NeuralMark, which aims to protect the network from three typical attacks. To offer resistance to forging attacks, NeuralMark establishes a hash-based mapping between keys and watermarks. It selectively embeds watermarks into model parameters to counter overwriting attacks and uses average pooling to defend against fine-tuning and pruning. The security and effectiveness of the method have been empirically verified on multiple architectures and various tasks.

strengths:
- Comprehensive experiments demonstrate the scalability of the proposed NeuralMark across 14 models, covering five image tasks and one text generation task.
- The paper provides a theoretical analysis to determine the security boundary.

weaknesses:
- The paper lacks consideration for the adaptive attack, which are crucial for robustness. A naïve adaptive attack can freeze model parameters and minimize the $L_e$ loss to learn the key and watermark, potentially compromising model ownership. 
- The paper lacks a detailed description of attack methods, particularly whether fine-tuning and pruning are applied to all parameters or only the Watermark Filtering layer. This could affect the resilience of the method.
- The resistance to overwriting attacks for NeuralMark is unclear. In Section 5.3, the “Overwriting Attack” paragraph states that “the adversary’s watermark detection rate reaches 100%”, which, even if matched by the original watermark, still leaves model ownership ambiguous.
- Limitations of the proposed method are not explicitly discussed.
- Experimental comparisons with other methods are insufficient. For instance, in Figure 3, only resistance to pruning attacks at various ratios is shown for NeuralMark without comparisons to other methods. Additionally, Table 5 only compares against VanillaMark, lacking comparisons with GreedyMark.

questions:
- Can the proposed method defend against adaptive attacks? Additional experiments to assess its resilience to adaptive attacks are necessary.
- How are the three types of attacks applied? Are fine-tuning and pruning applied to all parameters, or only to the Watermark Filtering layer? If the latter, would the method still be effective against attacks?
- Can this method resist overwriting attacks? With both the original and adversarial watermark detection rates at 100%, there is ambiguity in model ownership.
- What are the limitations of NeuralMark?
- Can the experimental comparisons with other methods be expanded? For example, comparative experiments with other methods need to be added in Figure 3 and Table 5.
</content>
</thread_object>

</thread>
<thread>
creation date:
1732444546517

thread_type:
official_comment

<thread_object>
creator: authors

<content>
title:
Rebuttal Summary

comment:
Dear Reviewers:

We sincerely thank all reviewers for their time and effort in reviewing our work and for providing constructive and valuable comments to enhance the quality of the paper.

First, we are pleased to observe that the reviewers find that the following aspects:

*  Hash mapping ties the secret key directly to the watermark to make reverse engineering infeasible, as altering the watermark would require breaking the hash (**Reviewer 33YR**). Watermark filtering limits parameter overlap, making overwriting attacks minimize interference with the original watermark (**Reviewer 33YR**). Using a watermark as a filter for injected parameters makes sense (**Reviewer 2mAv**).
    
*  This paper includes a theoretical analysis of the security boundaries for NeuralMark (**Reviewers ZqfG and 2mAv**), extends model watermarking to the Transformer architectures (**Reviewer 464P**), and provides extensive experimental results (**Reviewers 33YR, ZqfG, and 2mAv**).
    
*  The research direction about model watermarks is important, and the presentation is clear and well-written (**Reviewer 464P**).

Then, we have addressed all concerns raised by all reviewers and conducted additional experiments in the revision in response to your valuable suggestions:

*  To **Reviewer ZqfG**: We have conducted the adaptive attack, *i.e.*, reverse engineering (`Forging Attack in Section 5.3`), performed fine-tuning experiments with the watermark embedding layer (`Appendix E.1`), explained the success criteria for overwriting attacks (`Section 3.2`), discussed the limitations and broader impact (`Appendix B.4`), and included experimental results for the baseline methods in resisting attacks (`Tables 4, 5, 6, 7 and Figures 3, 6, 7, 8`).
    
*  To **Reviewer 33YR**: We have clarified the motivation behind our interest in the weight-based watermarking field (`Lines 048-053 and 108-112`), incorporated a recent baseline method [1], performed experiments to evaluate the robustness of watermark filtering with distinct filtering rounds (`Appendix E.6`), and detailed the fine-tuning attacks (`Removal + Forging Attack in Section 5.3`).
    
*  To **Reviewer 464P**: We have highlighted the contributions of NeuralMark (`Lines 069-074`), analyzed how to support repeated public verification in NeuralMark (`Lines 211-212 and Appendix B.1`), and provided the source codes and necessary documents at  https://anonymous.4open.science/r/NeuralMark.
    
*  To **Reviewer 2mAv**: We have explained the function of the key-to-watermark hash mapping (`Lines 178-185 and Appendix B.2`), highlighted the contributions of NeuralMark (`Lines 069-074`), and detailed the robustness of NeuralMark against forging attacks under various scenarios (`Forging Attack in Section 5.3 and Appendix E.3`).

In summary, we believe that those revisions and clarifications have strengthened our manuscript, and we hope that our responses meet your satisfaction. Please find our detailed replies to your specific points below, along with the revised version of our manuscript. Thanks again. 

[1] Fangqi Li, Haodong Zhao, Wei Du, and Shilin Wang. Revisiting the information capacity of neural network watermarks: Upper bound estimation and beyond. In AAAI'24.

Best regards,

Authors
</content>
</thread_object>

</thread>
<thread>
creation date:
1732849404696

thread_type:
official_comment

<thread_object>
creator: authors

<content>
title:
Looking forward to your feedback on our revisions

comment:
Dear Reviewers:

We sincerely appreciate your valuable feedback and insightful comments, which have greatly contributed to improving our work. 

**We fully understand that the review process can be time-consuming, and we are truly grateful for the time and effort you've invested**. 
As some time has passed since we submitted our revised version, we would like to kindly follow up to inquire if there are any additional questions, concerns, or clarifications needed from our side to assist in the review process.

Please feel free to reach out to us at your convenience, and we are more than happy to provide any further information if necessary. Many thanks!

Best regards,

Authors
</content>
</thread_object>

</thread>
<thread>
creation date:
1733284998020

thread_type:
official_comment

<thread_object>
creator: authors

<content>
title:
Final Request from Authors

comment:
Dear Reviewers, ACs, SACs, PCs:

First, we sincerely thank all the reviewers for their valuable feedback. During the rebuttal period, **although we did not receive direct responses, we carefully addressed each concern raised in the initial reviews and believe we have fully addressed all issues**. Additionally, as reviewers, we have taken our responsibilities seriously, diligently fulfilling our duties and remaining committed to upholding the integrity of the review process. Finally, **given the borderline status of our work, we respectfully request that it be fairly evaluated during the final decision**.

Best regards,

Authors
</content>
</thread_object>

</thread>


Metareview: