Paper: Securing Deep Generative Models with Universal Adversarial Signature (ICLR-2024)

Reviewer comment (Experiments):
The two SOTA detection methods compared in the experiment are against the CNN-based and GAN-based generative model, whether there is any relevant paper for the watermarking of the diffusion model at present, if so, please supplement.

Author response:
# Compare to watermarking of the diffusion models
We compare the performance of our method to a diffusion watermarking method [a] in the revised paper (also posted here). Our method achieves a higher detection accuracy and lower FID, which indicate that our method yields more accurate detection with better image quality. 

| Method | FID | Acc |
| --- | --- | --- |
| [a] 4 bit | 1.37 | 0.65 |
| [a] 128 bit | 4.79 | 0.999 | 
| Ours | 0.52 | 1.00 |

[a] Yunqing Zhao, Tianyu Pang, Chao Du, Xiao Yang, Ngai-Man Cheung, and Min Lin. A recipe for
watermarking diffusion models. arXiv preprint arXiv:2303.10137, 2023b

Reviewer comment (Presentation):
Some formatting issues: (1) Please cite the graphs in order; (2) Please distinguish between periods and semicolons within the algorithm; (3) Please give the value of lamda in Figure 7.

Author response:
We thank the reviewer for the comments and suggestions. We have corrected the formatting issues in the revised paper and we answer the reviewer's questions as follows.

Reviewer comment (Theory):
Fine-tuning an arbitrary G with samples generated by W to get G' is not unseen, in a sense it is inserting a backdoor that allows F to be better detected.

Author response:
# Clarify regarding unseen generators and finetuning
As we discussed in the paper (Sec 4 in the supplementary material), one limitation of the proposed method is the need for finetuning to embed signatures into a generative model. The training-free approach is an interesting direction for future work.

Reviewer comment (Theory):
What is the difference between binary coding and multiclassification loss? What is the advantage of the binary coding?

Author response:
# Difference between binary coding and multiclassification loss
According to our observation, the performance difference between the binary classification loss and multi-class classification loss is negligible. We choose to use binary classification loss for every bit of the binary coding for simplicity. 
The advantage of binary coding is that it can carry more information (such as identity) than the 1-bit information about whether the image is generated or not. With the binary code, the owner of a specific generative model (with signature injected) will be able to inject the model identity information for protecting intellectual property.

Reviewer comment (Experiments):
I'm curious whether some of the latest adversarial defense methods can break this adversarial signature, such as diffusion-based purification. It would be great to add some experimental results in this scenario.

Author response:
# Diffusion-based purification
Diffusion-based purification can potentially remove any watermarks. However, it will impact the fidelity of the image, or even lose or change the original image contents during the process. Therefore, diffusion-based purification is not an ideal approach for removing watermarks/signatures.

Reviewer comment (Theory):
It mentioned in Sec5.2 that “The complexity of re-training a detector every time upon the release of a new generator is O(r^2)”, I wonder how to calculate this. For each new generator, the method of re-training a detector only needs to re-training once for the new generator.

Author response:
# $O(r^2)$ complexity of re-training a detector 
We are sorry for the clarity issue in our language. To be precise, this is the cumulative time complexity for the whole process of keeping the detector up-to-date. We will revise the manuscript to remove the ambiguity. The following is the elaboration on why the complexity is $O(r^2)$.

* Upon the release of the first generative model, a generated image training set has to be collected for training the detector. We denote the time complexity in this case as 1.
* Upon the release of the second generative model, the training dataset grows to two times larger than the previous step, because the training dataset must involve all the two models. In this case, the time complexity is 2.
* Upon the release of the r-th generative model, the complexity for re-training is r.
Thus, the cumulative complexity for keeping the detector up-to-date is $O(r(r-1)/2) = O(r^2)$.
* We made this implicit in the manuscript by using the phrase “re-training a detector every time upon…”. We have made it more clear in the revised paper. 

In contrast, since we can always reuse the same signature injector $W$ and the corresponding detector $F$, the cumulative complexity of our method is merely $O(r)$, which only involves fine-tuning the generators for signature injection.

Reviewer comment (Theory):
The proposition 3.3 on persistency against image restoration attacks does not appear to be logical. Why would an attacker try to add noise e to the original image and learn a model M such that M(W(x+e)) = x. Instead the goal of the attacker would be to find e such that W(x)+e = x. In fact, even this image restoration task would not be required if the goal of the attacker is to simply bypass the detector F. The attacker has to just mount a simple adversarial attack to fool the detector F, i.e., add noise to W(x) such that F(W(x)) = real.

Author response:
# The purpose of $M(W(x+e))$ and why not add adversarial noise
In the use cases of our method, the detector is not supposed to be released to the public so the white-box adversarial attack is not feasible. The transferability-based attacks are not feasible either because our threat model assumes the model owner only releases the pre-trained generator while keeping the training data and detector private. Even if black-box attacks can still be used, they will be much less effective and will be costly to the attacker to achieve a reasonable attack success rate. Therefore, the major threat comes from ``restoration attacks" where the malicious user attempts to remove the signature from the generated image with a signature removal model $M$. The input to $M$ is a signed image $W(x)$ and $e$ is only added during training to enhance robustness. The experimental results suggest that our method remains valid even if the attacker attempts to remove the signature.

Reviewer comment (Experiments):
In terms of experiments, it is surprising that there is no comparison with a simple post-hoc watermarking approach (just add a unique generator-specific watermark to the generated image and categorize images with the watermark as synthetic), though this idea has been discussed in the introduction. It is true that the watermark will be decoupled from the generator, but it would still achieve the stated goals (imperceptibility, persistence, provenance of the generator, etc.).

Author response:
# Comparison with a simple post-hoc watermarking approach
We would like to clarify that a simple post-hoc watermarking approach does not satisfy the persistence goal. This is because malicious users can easily avoid watermarking by simply removing the post-hoc watermarking process, e.g. by deleting the corresponding lines of code from the inference script. In contrast, the proposed method couples the watermarking process with image generation by changing the model weights, making it difficult for malicious users to bypass watermarking (signature). In addition, as we have discussed in Sec 3.1 of the paper, our method applies optimal watermarks that introduce the smallest amount of perturbation to the original images and therefore have less negative impacts on the image quality. This can be seen from the higher PSNR of our method compared to traditional watermarks as shown in the Table below. The comparison results with post-hoc methods are included in the revised paper. 
| Method    | Post-hoc | Ours | 
| -------- | ------- | ------- |
| PSNR | 38.9 | 51.4 |

Reviewer comment (Novelty):
How is the proposed approach different from model poisoning attacks? The goal is to insert an "imperceptible" trigger pattern into the generated images such that the machine learning model will be easily triggered by these patterns and output a specific decision (in this case, the synthetic class). One could potentially take any real vs. synthetic classification model and poison it to achieve this goal. Then, one has to just add the trigger to the generated images.

Author response:
# Difference from model poisoning attacks
This work and model poisoning attacks are completely different in the problem setting.
The poisoning attack aims to mix carefully designed data samples into the training data, and hence the poisoning attackers are releasing training data, instead of any pre-trained model. 
In contrast, the threat model of our method is that the model trainer only releases the pre-trained generator (with signature) to the public, while keeping the training data and the corresponding detector private.
Thus, poisoning attacks are incompatible with our problem settings and threat model, despite the slight resemblance in their goals. We have included the discussions in the appendix of the revised paper.