Original: P ROVENANCE DETECTION THROUGH LEARNING TRANSFORMATION - RESILIENT WATERMARKING
Revised: P ROVENANCE DETECTION THROUGH LEARNING TRANSFORMATION - RESILIENT WATERMARKING

Original: Anonymous authors
Revised: Anonymous authors

Original: Paper under double-blind review
Revised: Paper under double-blind review

Original: A BSTRACT
Revised: A BSTRACT

Original: Advancements in deep generative models have made it possible to synthesize images, videos and audio signals that are hard to distinguish from natural signals, creating opportunities for potential abuse of these capabilities.
Revised: Advancements in deep generative models have made it possible to synthesize images, videos and audio signals that are hard to distinguish from natural signals, creating opportunities for potential abuse of these capabilities.

Original: This motivates the problem of tracking the provenance of signals, i.e., being able to determine the original source of a signal.
Revised: This motivates the problem of tracking the provenance of signals, i.e., being able to determine the original source of a signal.

Original: Watermarking the signal at the time of signal creation is a potential solution, but current techniques are brittle and watermark detection mechanisms can easily be bypassed by doing some post-processing (cropping images, shifting pitch in the audio etc.).
Revised: Watermarking the signal at the time of signal creation is a potential solution, but current techniques are brittle and watermark detection mechanisms can easily be bypassed by doing some post-processing (cropping images, shifting pitch in the audio etc.).

Original: In this paper, we introduce ReSWAT (Resilient Signal Watermarking via Adversarial Training) , a framework for learning transformation-resilient watermark detectors that are able to detect a watermark even after a signal has been through several post-processing transformations.
Revised: In this paper, we introduce ReSWAT (Resilient Signal Watermarking via Adversarial Training) , a framework for learning transformation-resilient watermark detectors that are able to detect a watermark even after a signal has been through several post-processing transformations.

Original: Our detection method can be applied to domains with continuous data representations such as images, videos or sound signals.
Revised: Our detection method can be applied to domains with continuous data representations such as images, videos or sound signals.

Original: Experiments on watermarking image and audio signals show that our method can reliably detect the provenance of a synthetic signal, even if the signal has been through several post-processing transformations, and improve upon related work in this setting.
Revised: Experiments on watermarking image and audio signals show that our method can reliably detect the provenance of a synthetic signal, even if the signal has been through several post-processing transformations, and improve upon related work in this setting.

Original: Furthermore, we show that for speciﬁc kinds of transformations (perturbations bounded in the (cid:96)norm), we can even get formal guarantees on the ability of our model to detect the watermark.
Revised: Furthermore, we show that for speciﬁc kinds of transformations (perturbations bounded in the (cid:96)norm), we can even get formal guarantees on the ability of our model to detect the watermark.

Original: We provide qualitative examples of watermarked image and audio samples in the anonymous code submission link.
Revised: We provide qualitative examples of watermarked image and audio samples in the anonymous code submission link.

Original:  I NTRODUCTION
Revised:  I NTRODUCTION

Original: Generative models have contributed to impressive advancements in content generation and representation learning in both digital image and audio domains (Brock et al.
Revised: Generative models have contributed to impressive advancements in content generation and representation learning in both digital image and audio domains (Brock et al.

Original: ; Kalchbrenner et al.
Revised: ; Kalchbrenner et al.

Original: ; Mehri et al.
Revised: ; Mehri et al.

Original: ; Zhu et al.
Revised: ; Zhu et al.

Original: ; Prenger et al.
Revised: ; Prenger et al.

Original: (2019); Donahue & Simonyan (2019);
Revised: (2019); Donahue & Simonyan (2019);

Original: Oord et al.
Revised: Oord et al.

Original: ; Goodfellow et al.
Revised: ; Goodfellow et al.

Original: ; Kingma & Welling (2013)).
Revised: ; Kingma & Welling (2013)).

Original: However, as generative models learn to better match a target distribution, the distinction between natural signals and synthetic signals generated by a model has blurred, leading to a raft of concerns over the potential misuse of these models (Chesney & Citron (2018)).
Revised: However, as generative models learn to better match a target distribution, the distinction between natural signals and synthetic signals generated by a model has blurred, leading to a raft of concerns over the potential misuse of these models (Chesney & Citron (2018)).

Original: For example, synthetic videos that are indistinguishable from natural videos, sometimes referred to as deep fakes , have the potential to cause widespread distrust in traditional media.
Revised: For example, synthetic videos that are indistinguishable from natural videos, sometimes referred to as deep fakes , have the potential to cause widespread distrust in traditional media.

Original: While the problem of detecting synthetic signals is interesting in its own right, it is challenging to do in a manner that is independent of the model used to generate the signal.
Revised: While the problem of detecting synthetic signals is interesting in its own right, it is challenging to do in a manner that is independent of the model used to generate the signal.

Original: Instead, we consider the problem of provenance detection via watermarking, a technique that involves injection of a carefully chosen (but imperceptible) perturbation (watermark) into the signal at the time of creation.
Revised: Instead, we consider the problem of provenance detection via watermarking, a technique that involves injection of a carefully chosen (but imperceptible) perturbation (watermark) into the signal at the time of creation.

Original: The presence of the perturbation in the signal can be later used to detect the provenance (or ultimate source) of this signal.
Revised: The presence of the perturbation in the signal can be later used to detect the provenance (or ultimate source) of this signal.

Original: While the simplicity of the technique makes watermarking an appealing technique for detecting synthetic (as well as naturally generated) signals, it is susceptible to adversarial actors that can systematically try to remove the watermark by transforming the signal (so as to obfuscate the provenance).
Revised: While the simplicity of the technique makes watermarking an appealing technique for detecting synthetic (as well as naturally generated) signals, it is susceptible to adversarial actors that can systematically try to remove the watermark by transforming the signal (so as to obfuscate the provenance).

Original: In the case of images, this may take the form of cropping, addition of Gaussian noise or blurring, rotating images etc.
Revised: In the case of images, this may take the form of cropping, addition of Gaussian noise or blurring, rotating images etc.

Original: Many watermarking schemes break down under these types of transformations.
Revised: Many watermarking schemes break down under these types of transformations.

Original: In this paper, we propose a novel transformation-resilient watermarking scheme-
Revised: In this paper, we propose a novel transformation-resilient watermarking scheme-

Original: Resilient Signal
Revised: Resilient Signal

Original: Watermarking via Adversarial Training (ReSWAT ) that is able to detect the presence of a watermark even after the signal has been through systematic attempts to remove the watermark.
Revised: Watermarking via Adversarial Training (ReSWAT ) that is able to detect the presence of a watermark even after the signal has been through systematic attempts to remove the watermark.

Original: We use ideas from the literature on adversarial training (Madry et al., 2017) to learn to synthesize watermarks (encoding the provenance of a signal) that can be detected even after the watermarked signal has been through transformations that seek to remove the watermark.
Revised: We use ideas from the literature on adversarial training (Madry et al., 2017) to learn to synthesize watermarks (encoding the provenance of a signal) that can be detected even after the watermarked signal has been through transformations that seek to remove the watermark.

Original: Our detection method can operate in any domain with continuous data representations.
Revised: Our detection method can operate in any domain with continuous data representations.

Original: Experimental results demonstrate that our method is effective and substantially improves over existing methods - it can reliably detect the provenance of a synthetic signal even if the signal has been deformed or manipulated.
Revised: Experimental results demonstrate that our method is effective and substantially improves over existing methods - it can reliably detect the provenance of a synthetic signal even if the signal has been deformed or manipulated.

Original: 1. C ONTRIBUTIONS
Revised: 1. C ONTRIBUTIONS

Original: 1 We formulate the transformation resilient watermarking problem and show how it can be reduced to an empirical risk minimization problem with a minimax loss function.
Revised: 1 We formulate the transformation resilient watermarking problem and show how it can be reduced to an empirical risk minimization problem with a minimax loss function.

Original: 2 We develop a transformation resilient watermarking scheme, named ReSWAT (Resilient Signal Watermarking via Adversarial Training) and show that the learning procedure is closely related to adversarial training techniques (Madry et al., 2017; Athalye et al., 2017).
Revised: 2 We develop a transformation resilient watermarking scheme, named ReSWAT (Resilient Signal Watermarking via Adversarial Training) and show that the learning procedure is closely related to adversarial training techniques (Madry et al., 2017; Athalye et al., 2017).

Original: 3 Empirically, we show across a set of image and audio datasets that our scheme can produce imperceptible watermarks that can be detected even after the signal has been through a series of adversarial transformations that preserve ﬁdelity to the original signal.
Revised: 3 Empirically, we show across a set of image and audio datasets that our scheme can produce imperceptible watermarks that can be detected even after the signal has been through a series of adversarial transformations that preserve ﬁdelity to the original signal.

Original: We do this using both standard metrics for signal watermarking and via human evaluation on audio signals.
Revised: We do this using both standard metrics for signal watermarking and via human evaluation on audio signals.

Original: Furthermore, we formal provable guarantees of detection if an adversarial transformation has a bounded (cid:96) 2 norm.
Revised: Furthermore, we formal provable guarantees of detection if an adversarial transformation has a bounded (cid:96) 2 norm.

Original: 1. R ELATED WORK
Revised: 1. R ELATED WORK

Original: The problem of detecting synthetic signals has recently received a signiﬁcant amount of attention.
Revised: The problem of detecting synthetic signals has recently received a signiﬁcant amount of attention.

Original: Marra et al.
Revised: Marra et al.

Original: (2018) investigate how a generative adversarial network (GAN) (Goodfellow et al., 2014) leaves an identiﬁable ﬁngerprint in the image it generates, while Nataraj et al.
Revised: (2018) investigate how a generative adversarial network (GAN) (Goodfellow et al., 2014) leaves an identiﬁable ﬁngerprint in the image it generates, while Nataraj et al.

Original: (2019) detect if an image was generated by a GAN by training a detection model on co-occurence matrices of the RGB channels of images.
Revised: (2019) detect if an image was generated by a GAN by training a detection model on co-occurence matrices of the RGB channels of images.

Original: Similarly, Yu et al.
Revised: Similarly, Yu et al.

Original: (2018) also train a model that learns to detect if an image was generated by a GAN, and attribute a generated image to its source model.
Revised: (2018) also train a model that learns to detect if an image was generated by a GAN, and attribute a generated image to its source model.

Original: Unfortunately, these detection methods suffer from some limitations: (1) they are speciﬁcally designed to operate only in the image domain and (2) they are not designed to be resilient to transformations that an attacker could apply.
Revised: Unfortunately, these detection methods suffer from some limitations: (1) they are speciﬁcally designed to operate only in the image domain and (2) they are not designed to be resilient to transformations that an attacker could apply.

Original: Digital watermarking consists of a two stage process: An embedding stage, where the original signal is combined with a hidden message (also referred to as the watermark ), producing a watermarked version of the signal.
Revised: Digital watermarking consists of a two stage process: An embedding stage, where the original signal is combined with a hidden message (also referred to as the watermark ), producing a watermarked version of the signal.

Original: Secondly, a decoding stage, where the hidden message is retrieved from the watermarked signal.
Revised: Secondly, a decoding stage, where the hidden message is retrieved from the watermarked signal.

Original: Watermarking schemes are typically evaluated on ﬁdelity of the watermarked signal to the original signal, the resilience of the watermark to various post-processing transformations and the false positive rates (i.e. whether the decoder detects watermarks in non-watermarked signals).
Revised: Watermarking schemes are typically evaluated on ﬁdelity of the watermarked signal to the original signal, the resilience of the watermark to various post-processing transformations and the false positive rates (i.e. whether the decoder detects watermarks in non-watermarked signals).

Original: Robustness of watermarking techniques is measured against a number of practical attacks that aim to remove or degrade the watermark signal.
Revised: Robustness of watermarking techniques is measured against a number of practical attacks that aim to remove or degrade the watermark signal.

Original: For example, adding Gaussian noise, image cropping and image compression represent watermark degrading, watermark removal and watermark geometric (repositioning) attacks, respectively.
Revised: For example, adding Gaussian noise, image cropping and image compression represent watermark degrading, watermark removal and watermark geometric (repositioning) attacks, respectively.

Original: In this paper, we are primarily interested in zero-bit watermarking, where one is simply interested in detecting the presence of a watermark (rather than decoding a hidden message from the watermark).
Revised: In this paper, we are primarily interested in zero-bit watermarking, where one is simply interested in detecting the presence of a watermark (rather than decoding a hidden message from the watermark).

Original: The state-of-the-art zero-bit watermarking scheme in the image domain is referred to as Broken Arrows (BA) (Furon & Bas, 2008) and won the “Break Our
Revised: The state-of-the-art zero-bit watermarking scheme in the image domain is referred to as Broken Arrows (BA) (Furon & Bas, 2008) and won the “Break Our

Original: Watermarking System” (BOWS) competition (Bennour et al., 2007).
Revised: Watermarking System” (BOWS) competition (Bennour et al., 2007).

Original: BA has a provable minimum false positive rate under Gaussian noise, however the scheme does not provide robustness against geometric attacks (like rotations and cropping).
Revised: BA has a provable minimum false positive rate under Gaussian noise, however the scheme does not provide robustness against geometric attacks (like rotations and cropping).

Original:  F ORMULATION OF THE ROBUST WATERMARKING PROBLEM
Revised:  F ORMULATION OF THE ROBUST WATERMARKING PROBLEM

Original: We study signals that live in a space X and are generated by a probabilistic source P s - our framework applies regardless of whether P s is a natural source (images of natural scenes) or an artiﬁcial source (samples from a VAE or a GAN).
Revised: We study signals that live in a space X and are generated by a probabilistic source P s - our framework applies regardless of whether P s is a natural source (images of natural scenes) or an artiﬁcial source (samples from a VAE or a GAN).

Original: We are interested in developing a scheme to watermark signals generated by this source, with the requirement that:
Revised: We are interested in developing a scheme to watermark signals generated by this source, with the requirement that:

Original: 1 The detector should detect a watermark in any watermarked signal from source P s and not detect a watermark in any other signal.
Revised: 1 The detector should detect a watermark in any watermarked signal from source P s and not detect a watermark in any other signal.

Original: Even if post-processing transformations (for example, compression/cropping/frequency shift etc) are applied to the signal, the detector detects the watermark, or the absence thereof.
Revised: Even if post-processing transformations (for example, compression/cropping/frequency shift etc) are applied to the signal, the detector detects the watermark, or the absence thereof.

Original: Formally, we deﬁne the robust watermarking problem as follows:
Revised: Formally, we deﬁne the robust watermarking problem as follows:

Original: Deﬁnition 2.1 (Transformation resilient watermarking scheme) .
Revised: Deﬁnition 2.1 (Transformation resilient watermarking scheme) .

Original: Consider a watermarking scheme ( W, D ) where W : X (cid:55)→ X is a watermarking routine and D : X (cid:55)→ { 0 , 1 } is a watermark detector.
Revised: Consider a watermarking scheme ( W, D ) where W : X (cid:55)→ X is a watermarking routine and D : X (cid:55)→ { 0 , 1 } is a watermark detector.

Original: Let T be a space of transformations with T : X (cid:55)→ X for each T ∈ T .
Revised: Let T be a space of transformations with T : X (cid:55)→ X for each T ∈ T .

Original: We consider the watermarking scheme resilient with respect to a set of transformations T for a source P s if
Revised: We consider the watermarking scheme resilient with respect to a set of transformations T for a source P s if

Original: D (cid:16) T(cid:0)
Revised: D (cid:16) T

Original: [Equation]
Revised: [Equation]

Original: =

Original: [Equation]
Revised: [Equation]

Revised: = 0 , ∀ T

Original: [Equation]
Revised: [Equation]

Original: = 0 , ∀ T ∈ T with high probability for s ∼ P s .
Revised: T with high probability for s ∼ P s .

Original: This formulation suggests an empirical risk minimization approach for training D .
Revised: This formulation suggests an empirical risk minimization approach for training D .

Original: Given a ﬁxed W , we can train D to minimize the empirical risk
Revised: Given a ﬁxed W , we can train D to minimize the empirical risk

Original: [Equation]
Revised: [Equation]

Original: where (cid:96) is a loss function measuring the discrepancy between the prediction of D and the desired label ( 0 for non-watermarked signals and 1 for watermarked signals).
Revised: where (cid:96) is a loss function measuring the discrepancy between the prediction of D and the desired label ( 0 for non-watermarked signals and 1 for watermarked signals).

Original: The inner maximization transformations resembles the objective used in adversarial training (Madry et al., 2017), motivating our approach to learning a transformation resilient watermarking.
Revised: The inner maximization transformations resembles the objective used in adversarial training (Madry et al., 2017), motivating our approach to learning a transformation resilient watermarking.

Original: We develop this idea in the following section.
Revised: We develop this idea in the following section.

Original: R E SWAT : R ESILIENT WATERMARKING VIA ADVERSARIAL TRAINING
Revised: R E SWAT : R ESILIENT WATERMARKING VIA ADVERSARIAL TRAINING

Original: We parameterize the detector D as a neural network f θ , parameterized by θ .
Revised: We parameterize the detector D as a neural network f θ , parameterized by θ .

Original: If we ﬁx the detector, the watermark embedding process W should embed a watermark that is “strongly detected” by the detector, i.e., the watermark embedding mechanism pushes the watermark deep inside the decision boundary of D .
Revised: If we ﬁx the detector, the watermark embedding process W should embed a watermark that is “strongly detected” by the detector, i.e., the watermark embedding mechanism pushes the watermark deep inside the decision boundary of D .

Original: However, we also want the watermark to be imperceptible so we require that the watermark does not signiﬁcantly change the original signal according to some distance measure.
Revised: However, we also want the watermark to be imperceptible so we require that the watermark does not signiﬁcantly change the original signal according to some distance measure.

Original: While it is challenging to deﬁne the space of imperceptible distortions of the input, a convenient proxy is to limit the change in terms of the (cid:96) ∞ norm between the watermarked and the original signal.
Revised: While it is challenging to deﬁne the space of imperceptible distortions of the input, a convenient proxy is to limit the change in terms of the (cid:96) ∞ norm between the watermarked and the original signal.

Original: Thus, we construct the watermark, δ , by solving the following optimization problem:
Revised: Thus, we construct the watermark, δ , by solving the following optimization problem:

Original: [Equation]
Revised: [Equation]

Original: This optimization problem can be solved efﬁciently using a projected gradient descent (PGD) method, and is mathematically very similar to computing an adversarial example for a neural network (however, in this case, the adversary is friendly and actually pushes the example to minimize the loss of the detector).
Revised: This optimization problem can be solved efﬁciently using a projected gradient descent (PGD) method, and is mathematically very similar to computing an adversarial example for a neural network (however, in this case, the adversary is friendly and actually pushes the example to minimize the loss of the detector).

Original: The parameter (cid:15) controls the perceptibility of the watermark.
Revised: The parameter (cid:15) controls the perceptibility of the watermark.

Original: If (cid:15) is too large, the watermark would be clearly perceptible while if it is too small, the watermark may easily be washed out by post processing steps.
Revised: If (cid:15) is too large, the watermark would be clearly perceptible while if it is too small, the watermark may easily be washed out by post processing steps.

Original: Thus, the right choice of (cid:15) achieves the optimal trade-off between perceptibility and transformation resilient detection.
Revised: Thus, the right choice of (cid:15) achieves the optimal trade-off between perceptibility and transformation resilient detection.

Original: Note that we use the (cid:96) ∞ norm of the perturbation instead of another norm since this distributes the watermark over the entire signal, and so will be resilient to geometric attacks (that black out patches of the input, or obfuscate inputs).
Revised: Note that we use the (cid:96) ∞ norm of the perturbation instead of another norm since this distributes the watermark over the entire signal, and so will be resilient to geometric attacks (that black out patches of the input, or obfuscate inputs).

Original: With this watermark embedding method, we can now train the detector to perform transformation resilient watermark detection as follows:
Revised: With this watermark embedding method, we can now train the detector to perform transformation resilient watermark detection as follows:

Original: minimize
Revised: minimize

Original: [Equation]
Revised: [Equation]

Original: This is similar to the expectation over transformation attack (Athalye et al.
Revised: This is similar to the expectation over transformation attack (Athalye et al.

Original: (2017)), that aims to construct adversarial examples that persist through a set of transformations.
Revised: (2017)), that aims to construct adversarial examples that persist through a set of transformations.

Original: During training, we only
Revised: During training, we only

Original: [Table] [Table]
Revised: [Table] [Table]

Original: project
Revised: project

Original: [Table]
Revised: [Table]

Original: probability 1 / 2 , ﬂip the image on the
Revised: probability 1 / 2 , ﬂip the image on the

Original: [Table] [Table]
Revised: [Table] [Table]

Original: Randomly adjust the brightness of an image by a factor, b , which ranges from 0 (no increase in brightness) to 1 (maximum whitening).
Revised: Randomly adjust the brightness of an image by a factor, b , which ranges from 0 (no increase in brightness) to 1 (maximum whitening).

Original: sample from differentiable transformations, this is so we do not have to approximate the gradient, which would be prohibitively slow to training.
Revised: sample from differentiable transformations, this is so we do not have to approximate the gradient, which would be prohibitively slow to training.

Original: In practice, at each iteration in training we approximate ﬁnding max T ∈T with max { T 1 ,T 2 ,...,T n } , where T i ∈ T , i ∈ { 1 , ..., n } .
Revised: In practice, at each iteration in training we approximate ﬁnding max T ∈T with max { T 1 ,T 2 ,...,T n } , where T i ∈ T , i ∈ { 1 , ..., n } .

Original: Theoretically, if we sample more transformations we achieve a better approximation for the true gradient over the full transformation distribution, however, empirically, we found it too expensive to trade more parallel transformations for longer training time.
Revised: Theoretically, if we sample more transformations we achieve a better approximation for the true gradient over the full transformation distribution, however, empirically, we found it too expensive to trade more parallel transformations for longer training time.

Original: We explore how resilience to transformations is affected by the number of sampled transformations at each step in training in appendix C.
Revised: We explore how resilience to transformations is affected by the number of sampled transformations at each step in training in appendix C.

Original: All following experimental results are taken from a model trained with a sample size of one at each iteration of training.
Revised: All following experimental results are taken from a model trained with a sample size of one at each iteration of training.

Original: 3. O PTIMIZING FOR NON - TRANSFERABLE WATERMARKS
Revised: 3. O PTIMIZING FOR NON - TRANSFERABLE WATERMARKS

Original: Traditional watermarking schemes are based on a secret key that ensures that only parties with access to the key can create watermarked content; an attacker that can watermark content without access to the key represents an integrity attack on the scheme.
Revised: Traditional watermarking schemes are based on a secret key that ensures that only parties with access to the key can create watermarked content; an attacker that can watermark content without access to the key represents an integrity attack on the scheme.

Original: We refer to this kind of attack as a speciﬁcity attack that attempts to introduce false positives.
Revised: We refer to this kind of attack as a speciﬁcity attack that attempts to introduce false positives.

Original: In our case, the classiﬁer detecting/constructing the watermark can be thought of as an approximation of a secret key.
Revised: In our case, the classiﬁer detecting/constructing the watermark can be thought of as an approximation of a secret key.

Original: We will now propose a method to construct watermark perturbations for a given watermark classiﬁer, f θ , which do not transfer to other watermark classiﬁers trained on the same data.
Revised: We will now propose a method to construct watermark perturbations for a given watermark classiﬁer, f θ , which do not transfer to other watermark classiﬁers trained on the same data.

Original: Recall that given a signal s , to create a watermark perturbation we use PGD which takes steps in the direction of
Revised: Recall that given a signal s , to create a watermark perturbation we use PGD which takes steps in the direction of

Original: [Equation]
Revised: [Equation]

Original: To encourage that the generated perturbation doesn’t transfer to other watermark classiﬁers trained on the same data, we generate the watermark that is robust against an ensemble of models.
Revised: To encourage that the generated perturbation doesn’t transfer to other watermark classiﬁers trained on the same data, we generate the watermark that is robust against an ensemble of models.

Original: Let { f iθ : X → { 0 , 1 } , i ∈ { 1 , ..., n }} be an ensemble of watermark classiﬁers trained on the same problem as f θ .
Revised: Let { f iθ : X → { 0 , 1 } , i ∈ { 1 , ..., n }} be an ensemble of watermark classiﬁers trained on the same problem as f θ .

Original: To limit the transferability of watermarks on f θ , we create watermark perturbations by stepping in the direction of
Revised: To limit the transferability of watermarks on f θ , we create watermark perturbations by stepping in the direction of

Original: [Equation]
Revised: [Equation]

Original: Taking steps in the direction of this loss will increase the probability that watermark perturbations are only classiﬁed as watermarked by f θ and do not transfer to other models.
Revised: Taking steps in the direction of this loss will increase the probability that watermark perturbations are only classiﬁed as watermarked by f θ and do not transfer to other models.

Original:  E VALUATION
Revised:  E VALUATION

Original: Here, we give experimental results that our scheme is robust to a variety of attacks.
Revised: Here, we give experimental results that our scheme is robust to a variety of attacks.

Original: We ﬁrst evaluate the scheme on image data in section 4.1 and section 4.2, and then on audio data in section 4.3.
Revised: We ﬁrst evaluate the scheme on image data in section 4.1 and section 4.2, and then on audio data in section 4.3.

Original: 1.0 SSIM Transformed 0.
Revised: 1.0 SSIM Transformed 0.

Original: SS I M
Revised: SS I M

Original: W a t e r m a r k
Revised: W a t e r m a r k

Original: ReSWAT Broken Arrows (a) Gaussian noise.
Revised: ReSWAT Broken Arrows (a) Gaussian noise.

Original: 1.0 SSIM Transformed 0.
Revised: 1.0 SSIM Transformed 0.

Original: SS I M
Revised: SS I M

Original: W a t e r m a r k (b) Rotation.
Revised: W a t e r m a r k (b) Rotation.

Original: 1.0 SSIM Transformed 0.
Revised: 1.0 SSIM Transformed 0.

Original: SS I M
Revised: SS I M

Original: W a t e r m a r k (c) Crop.
Revised: W a t e r m a r k (c) Crop.

Original: [Figure]
Revised: [Figure]

Original: 4. E VALUATION P ROTOCOL ON I MAGES
Revised: 4. E VALUATION P ROTOCOL ON I MAGES

Original: During training we sample from a set of transformations, to which the scheme should be robust.
Revised: During training we sample from a set of transformations, to which the scheme should be robust.

Original: In this evaluation we use transformations detailed in table 1.
Revised: In this evaluation we use transformations detailed in table 1.

Original: We evaluate watermark detection robustness in the image space on both Cifar10 (Krizhevsky et al.) and ImageNet (Deng et al., 2009).
Revised: We evaluate watermark detection robustness in the image space on both Cifar10 (Krizhevsky et al.) and ImageNet (Deng et al., 2009).

Original: We defer evaluation of Cifar10 to appendix A and detail only ImageNet experiments here.
Revised: We defer evaluation of Cifar10 to appendix A and detail only ImageNet experiments here.

Original: ImageNet.
Revised: ImageNet.

Original: We train a standard ResNet152 classiﬁer (He et al.
Revised: We train a standard ResNet152 classiﬁer (He et al.

Original: , modiﬁed for binary prediction, for the watermark detector.
Revised: , modiﬁed for binary prediction, for the watermark detector.

Original: We replace batch normalization with instance normalization (Ulyanov et al.
Revised: We replace batch normalization with instance normalization (Ulyanov et al.

Original: (2016)), as we noticed that batch statistics were heavily skewed by the transformations applied during training.
Revised: (2016)), as we noticed that batch statistics were heavily skewed by the transformations applied during training.

Original: We train with a mini-batch size of 32 for 60,000 steps, with an initial learning rate of 0.1 and decaying this by a factor of 10 every 20,000 steps.
Revised: We train with a mini-batch size of 32 for 60,000 steps, with an initial learning rate of 0.1 and decaying this by a factor of 10 every 20,000 steps.

Original: All images are normalized into the range [0,1], and a batch of watermarked images are constructed with ﬁve PGD steps at each iteration.
Revised: All images are normalized into the range [0,1], and a batch of watermarked images are constructed with ﬁve PGD steps at each iteration.

Original: With respect to the set of transformations, during training, we set σ to 0.25, r to π / 2 , c h and c w to 10, and b to 0.1.
Revised: With respect to the set of transformations, during training, we set σ to 0.25, r to π / 2 , c h and c w to 10, and b to 0.1.

Original: We trained four classiﬁers under these hyperparameters, two where at each step we randomly sample a single transformation, and watermark with (cid:15) = 5 / 255 and (cid:15)
Revised: We trained four classiﬁers under these hyperparameters, two where at each step we randomly sample a single transformation, and watermark with (cid:15) = 5 / 255 and (cid:15)

Original: = 10 / 255 , referred to as f (cid:15) 5 and f (cid:15) 10 , respectively, and two where we apply a composition of all transformations, and watermark with (cid:15)
Revised: = 10 / 255 , referred to as f (cid:15) 5 and f (cid:15) 10 , respectively, and two where we apply a composition of all transformations, and watermark with (cid:15)

Original: = 5 / 255 and (cid:15)
Revised: = 5 / 255 and (cid:15)

Original: = 10 / 255 , referred to as f (cid:15) 5 comp and f (cid:15) 10 comp , respectively.
Revised: = 10 / 255 , referred to as f (cid:15) 5 comp and f (cid:15) 10 comp , respectively.

Original: All watermark detection classiﬁers achieved 100% test set accuracy, where the test set consists of 10,000 non-watermarked and 10,000 watermarked ImageNet test set images.
Revised: All watermark detection classiﬁers achieved 100% test set accuracy, where the test set consists of 10,000 non-watermarked and 10,000 watermarked ImageNet test set images.

Original: A detailed comparison of the differences between these models is given in appendix A, however, we found that models trained under a composition of transformations are more robust to all attacks and so remaining experiments will use only f (cid:15) 5 comp and f (cid:15) 10 comp .
Revised: A detailed comparison of the differences between these models is given in appendix A, however, we found that models trained under a composition of transformations are more robust to all attacks and so remaining experiments will use only f (cid:15) 5 comp and f (cid:15) 10 comp .

Original: For evaluation, we measure the success of an attack with respect to the distortion introduced by the attack measured by structural similarity (SSIM) score (Wang et al.
Revised: For evaluation, we measure the success of an attack with respect to the distortion introduced by the attack measured by structural similarity (SSIM) score (Wang et al.

Original: 4. E VALUATING PERFORMANCE AGAINST ATTACKS
Revised: 4. E VALUATING PERFORMANCE AGAINST ATTACKS

Original: We now describe experiments measuring the quality of our watermarking scheme under various transformations seeking to induce a misclassiﬁcation in the watermark detector: We study both attacks that seek to remove a watermark from given watermarked signals (thus inducing a false negative for the detector) and attacks that seek to make the detector detect a watermark in a non-watermarked image (thus inducing a false positive).
Revised: We now describe experiments measuring the quality of our watermarking scheme under various transformations seeking to induce a misclassiﬁcation in the watermark detector: We study both attacks that seek to remove a watermark from given watermarked signals (thus inducing a false negative for the detector) and attacks that seek to make the detector detect a watermark in a non-watermarked image (thus inducing a false positive).

Original: 4.2. S IGNAL TRANSFORMATION ATTACKS (F ALSE NEGATIVES )
Revised: 4.2. S IGNAL TRANSFORMATION ATTACKS (F ALSE NEGATIVES )

Original: We investigate the trade-off in distortion of the watermarked image when we require perfect detection under various transformations.
Revised: We investigate the trade-off in distortion of the watermarked image when we require perfect detection under various transformations.

Original: Given a watermarked signal s , we sample from a space of transformations to create n copies of this input under, referred to as s i , i ∈ { 1 , ..., n } .
Revised: Given a watermarked signal s , we sample from a space of transformations to create n copies of this input under, referred to as s i , i ∈ { 1 , ..., n } .

Original: We increase the watermark (cid:15) value until the accuracy of the detection model on s i , i ∈ { 1 , ..., n } is >99%.
Revised: We increase the watermark (cid:15) value until the accuracy of the detection model on s i , i ∈ { 1 , ..., n } is >99%.

Original: We measure the perceptibility of the watermark and the perceptibility of the transformation used in the attack, both in terms of SSIM, and compare with Broken Arrows (BA), where for each transformation we set the number of random samples, n , to 1 million.
Revised: We measure the perceptibility of the watermark and the perceptibility of the transformation used in the attack, both in terms of SSIM, and compare with Broken Arrows (BA), where for each transformation we set the number of random samples, n , to 1 million.

Original: Figure 1 shows that for various distributions of transformations the amount of distortion introduced by the watermarking scheme is dominated by the amount of distortion introduced by the transformation.
Revised: Figure 1 shows that for various distributions of transformations the amount of distortion introduced by the watermarking scheme is dominated by the amount of distortion introduced by the transformation.

Original: For Gaussian noise, the necessary distortion introduced by the watermark (for perfect detection under a transformation) using ReSWAT is approximately equivalent to BA and substantially smaller than the distortion introduced by the transformation.
Revised: For Gaussian noise, the necessary distortion introduced by the watermark (for perfect detection under a transformation) using ReSWAT is approximately equivalent to BA and substantially smaller than the distortion introduced by the transformation.

Original: While for cropping and rotation attacks, our watermarks incur negligible levels of distortion while BA fails to watermark content without incurring large distortions.
Revised: While for cropping and rotation attacks, our watermarks incur negligible levels of distortion while BA fails to watermark content without incurring large distortions.

Original: We show qualitative examples in ﬁg. 2 for a Gaussian noise attack, and analogous plots of ﬁg. 1 using Peak-Signal-to-Noise ratio as the distortion metric in appendix B.
Revised: We show qualitative examples in ﬁg. 2 for a Gaussian noise attack, and analogous plots of ﬁg. 1 using Peak-Signal-to-Noise ratio as the distortion metric in appendix B.

Original: 4.2. S PECIFICITY A TTACKS (F ALSE POSITIVES )
Revised: 4.2. S PECIFICITY A TTACKS (F ALSE POSITIVES )

Original: Using the ImageNet dataset, we trained a model with the same hyperparameters as f (cid:15) 5 comp , however the model was optimized by constructing watermarks using eq.
Revised: Using the ImageNet dataset, we trained a model with the same hyperparameters as f (cid:15) 5 comp , however the model was optimized by constructing watermarks using eq.

Original: (3) instead of eq.
Revised: (3) instead of eq.

Original: (2), using ﬁve other pre-trained watermark classiﬁers; we denote this model by ˆ f (cid:15) 5 comp .
Revised: (2), using ﬁve other pre-trained watermark classiﬁers; we denote this model by ˆ f (cid:15) 5 comp .

Original: Given 20 pre-trained watermark classiﬁers only differing from f (cid:15) 5 comp by random initialization of weights, we compare how well 1, watermark’s constructed using each of these models transfers to f (cid:15) 5 comp and ˆ f (cid:15) 5 comp , representing an attack that attempts to introduce false positives.
Revised: Given 20 pre-trained watermark classiﬁers only differing from f (cid:15) 5 comp by random initialization of weights, we compare how well 1, watermark’s constructed using each of these models transfers to f (cid:15) 5 comp and ˆ f (cid:15) 5 comp , representing an attack that attempts to introduce false positives.

Original: Figure 3 shows the difference in average false positive rate between f (cid:15) 5 comp and ˆ f (cid:15) 5 comp .
Revised: Figure 3 shows the difference in average false positive rate between f (cid:15) 5 comp and ˆ f (cid:15) 5 comp .

Original: At a watermark SSIM score of 0.60, ˆ f (cid:15) 5 comp has a false positive rate of below 20% while the false positive rate on these inputs is nearly 50% for f (cid:15) 5 comp .
Revised: At a watermark SSIM score of 0.60, ˆ f (cid:15) 5 comp has a false positive rate of below 20% while the false positive rate on these inputs is nearly 50% for f (cid:15) 5 comp .

Original: Clearly, optimizing eq.
Revised: Clearly, optimizing eq.

Original: (3) improves resilience to speciﬁcity attacks.
Revised: (3) improves resilience to speciﬁcity attacks.

Original: 4.2. C ERTIFIED ROBUSTNESS
Revised: 4.2. C ERTIFIED ROBUSTNESS

Original: The previous sets of experiments present results on the robustness of the watermarking scheme against “best effort” attacks, i.e, we attempt to compute attacks that break the watermarking system and declare success if we fail to do so.
Revised: The previous sets of experiments present results on the robustness of the watermarking scheme against “best effort” attacks, i.e, we attempt to compute attacks that break the watermarking system and declare success if we fail to do so.

Original: However, it is possible that our attack algorithm failed to ﬁnd the worst case transformation that would break the watermark detection.
Revised: However, it is possible that our attack algorithm failed to ﬁnd the worst case transformation that would break the watermark detection.

Original: Thus, it is desirable to have a stronger guarantee against all attacks within a certain transformation space.
Revised: Thus, it is desirable to have a stronger guarantee against all attacks within a certain transformation space.

Original: While provable guarantees are hard to obtain in general, we can leverage recent work on randomized smoothing techniques (Cohen et al., 2019) that are able to obtain certiﬁed guarantees against transformations constrained in the (cid:96) 2 norm, i.e., the adversary can transform the signal by any amount within a distance (cid:15) in the (cid:96) 2 norm.
Revised: While provable guarantees are hard to obtain in general, we can leverage recent work on randomized smoothing techniques (Cohen et al., 2019) that are able to obtain certiﬁed guarantees against transformations constrained in the (cid:96) 2 norm, i.e., the adversary can transform the signal by any amount within a distance (cid:15) in the (cid:96) 2 norm.

Original: On 200 examples from the ImageNet test set that are watermarked
Revised: On 200 examples from the ImageNet test set that are watermarked

Original: [Figure]
Revised: [Figure]

Original: e
Revised: e

Original: Po
Revised: P

Original: [Figure]
Revised: [Figure]

Original: i
Revised: i

Original: [Figure]
Revised: [Figure]

Original: i

Original: [Figure]
Revised: [Figure]

Original: e [Figure] [Figure] with (cid:15) = 20 / 255 , we estimate a lower bound, p , on the probability of the most-likely class under
Revised: with (cid:15) = 20 / 255 , we estimate a lower bound, p , on the probability of the most-likely class under

Original: Gaussian noise parameterized by N (0 , σ 2 I ) , using 10,000 random samples.
Revised: Gaussian noise parameterized by N (0 , σ 2 I ) , using 10,000 random samples.

Original: Given p , the detector is robust to adversarial perturbations, γ , if (cid:107) γ (cid:107) 2 < σ Φ − 1 ( p ) (as proven in Cohen et al.
Revised: Given p , the detector is robust to adversarial perturbations, γ , if (cid:107) γ (cid:107) 2 < σ Φ − 1 ( p ) (as proven in Cohen et al.

Original: (2019)), up to a conﬁdence level of α which we set to 0.99.
Revised: (2019)), up to a conﬁdence level of α which we set to 0.99.

Original: Figure 4 shows the certiﬁed accuracy of these examples as a function of the certiﬁed radius in the (cid:96) 2 -norm.
Revised: Figure 4 shows the certiﬁed accuracy of these examples as a function of the certiﬁed radius in the (cid:96) 2 -norm.

Original: For (cid:15) = 20 / 255 nearly all 200 watermarked images are robust to any perturbation with an (cid:96) 2 -norm smaller than 1.5.
Revised: For (cid:15) = 20 / 255 nearly all 200 watermarked images are robust to any perturbation with an (cid:96) 2 -norm smaller than 1.5.

Original: We also include results on a non-robust watermark detection model - a model trained without sampling from a distribution of transformations.
Revised: We also include results on a non-robust watermark detection model - a model trained without sampling from a distribution of transformations.

Original: This model has a comparatively small certiﬁed region of robustness, implying that training on a distribution of transformations does improve robustness.
Revised: This model has a comparatively small certiﬁed region of robustness, implying that training on a distribution of transformations does improve robustness.

Original: 4.2. O UT - OF - DISTRIBUTION EVALUATION
Revised: 4.2. O UT - OF - DISTRIBUTION EVALUATION

Original: The previous section focused on adversarial attacks on signals drawn from the same distribution as the model was trained on.
Revised: The previous section focused on adversarial attacks on signals drawn from the same distribution as the model was trained on.

Original: A natural question to ask is, would the system fail when signals are drawn from a different distribution?
Revised: A natural question to ask is, would the system fail when signals are drawn from a different distribution?

Original: To evaluate this, we veriﬁed that, given a model trained on 
Revised: To evaluate this, we veriﬁed that, given a model trained on Cifar10 images, all

Original: Cifar10 images, all SVHN test images are correctly classiﬁed to the non-watermarked class.
Revised: SVHN test images are correctly classiﬁed to the non-watermarked class.

Original: Secondly, we watermarked 500 images generated by BigGAN (Brock et al., 2018) using a model trained on ImageNet samples ( f (cid:15) 10 comp ).
Revised: Secondly, we watermarked 500 images generated by BigGAN (Brock et al., 2018) using a model trained on ImageNet samples ( f (cid:15) 10 comp ).

Original: We then measured resilience to transformations as detailed in section 4.2.1.
Revised: We then measured resilience to transformations as detailed in section 4.2.1 – we attacked both non-watermarked and watermarked images with Gaussian noise, rotation and cropping such that the average SSIM of these images is 0.6. In comparison, the average SSIM of watermarked images was 0.82. The false positive rate (attacking non-watermarked images) was 1.2% and the false negative rate (attacking watermarked images) was 0%.

Original: BigGAN watermarked images exhibited comparative levels of resilience to transformations despite the model being trained on ImageNet samples.
Revised: BigGAN watermarked images exhibited comparative levels of resilience to transformations despite the model being trained on ImageNet samples.

Original: 4. E VALUATION ON TEXT - TO - SPEECH DATASET
Revised: 4. E VALUATION ON TEXT - TO - SPEECH DATASET

Original: To evaluate ReSWAT on audio data, we train a watermark detection model using a proprietary dataset composed of hours of high quality speech data, where each audio sample is a short speech utterance lasting between 1 and 10 seconds.
Revised: To evaluate ReSWAT on audio data, we train a watermark detection model using a proprietary dataset composed of hours of high quality speech data, where each audio sample is a short speech utterance lasting between 1 and 10 seconds.

Original: We use a DeepSpeaker architecture (Li et al., 2017), modiﬁed for binary prediction.
Revised: We use a DeepSpeaker architecture (Li et al., 2017), modiﬁed for binary prediction.

Original: The pre-processing stage takes as input, a variable length waveform, normalizes values between -0.5 and 0.5, and outputs the ﬁxed length mel-spectrogram which is then used as input to the model.
Revised: The pre-processing stage takes as input, a variable length waveform, normalizes values between -0.5 and 0.5, and outputs the ﬁxed length mel-spectrogram which is then used as input to the model.

Original: We train thedetector model for 100,000 steps, with an exponentially decaying learning rate initialized at 0.001 and decayed by a factor of 0.9 every 1000 steps. The watermarking (cid:15) value is initialized at 0.04 and decreased by 0.00001 whenever the detection rate is 100% based on a moving average of the previous 100 steps. We use ﬁve PGD steps at each iteration to create watermarked inputs. During amount  be added 
Revised: Transformation values specify the amount of distortion that can be added maintaining

Original: [Table]
Revised: [Table]

Original: α = β = γ = δ = [Table] (cid:15) = [Table]
Revised: We train the detector model for 100,000 steps, with an exponentially decaying learning rate initialized at 0.001 and decayed by a factor of 0.9 every 1000 steps.

Original: 8 × 10 − 3 )

Original: [Table] scale [Table] [Table]
Revised: The watermarking (cid:15) value is initialized at 0.04 and decreased by 0.00001 whenever the detection rate is 100% based on a moving average of the previous 100 steps.

Original: Randomly

Original: [Table]

Original: contiguous

Original: [Table] γ [Table] [Table]
Revised: We use ﬁve PGD steps at each iteration to create watermarked inputs.

Original: uniformly

Original: [Table]

Original: random

Original: [Table] δ ]. training we sample from a set of transformations, described in table 2, to which the scheme should be robust.
Revised: During training we sample from a set of transformations, described in table 2, to which the scheme should be robust.

Original: [Figure]
Revised: [Figure]

Revised: AB experiment.

Original: 660 nonwatermarked and watermarked audio samples presented to 1320 people in total.
Revised: 660 nonwatermarked and watermarked audio samples presented to 1320 people in total.

Original: Participants were played the original sample and watermarked sample and asked to rate how different the original audio was from the watermarked version.
Revised: Participants were played the original sample and watermarked sample and asked to rate how different the original audio was from the watermarked version.

Original: At test time we achieve perfect detection rate onwatermarked audio samples using (cid:15) = 4 × 10 − 4 .
Revised: At test time we achieve perfect detection rate onwatermarked audio samples using (cid:15) = 4 × 10 − 4 .

Original: Similarly to section 4.2.1, we measure the robustness of watermarked audio samples with respect to the amount of distortion introduced by transformations, under the requirement that detection accuracy is >99%.
Revised: Similarly to section 4.2.1, we measure the robustness of watermarked audio samples with respect to the amount of distortion introduced by transformations, under the requirement that detection accuracy is >99%.

Original: For a given transformation and input, we randomly sample the input 100 times under the transformation, this creates a test set of 20,000 data points on which we measure the accuracy of the detector.
Revised: For a given transformation and input, we randomly sample the input 100 times under the transformation, this creates a test set of 20,000 data points on which we measure the accuracy of the detector.

Original: Table 2 shows the results of attacking watermarked inputs for different (cid:15) values using various transformations.
Revised: Table 2 shows the results of attacking watermarked inputs for different (cid:15) values using various transformations.

Original: Watermarks at (cid:15) = 4 × 10 − 4 are almost imperceptible, while a faint background noise can be heard for (cid:15)
Revised: Watermarks at (cid:15) = 4 × 10 − 4 are almost imperceptible, while a faint background noise can be heard for (cid:15)

Original: = 4 .
Revised: = 4 .

Original: 8 × 10 − 3 .
Revised: 8 × 10 − 3 .

Original: The detection model is robust to a large number of transformations, for example, 78% of audio can be obscured without decreasing detection accuracy.
Revised: The detection model is robust to a large number of transformations, for example, 78% of audio can be obscured without decreasing detection accuracy.

Original: Human evaluation.
Revised: Human evaluation.

Original: Here, we conduct human evaluation of watermark perceptibility using both mean opinion score (MOS) and A/B tests.
Revised: Here, we conduct human evaluation of watermark perceptibility using both mean opinion score (MOS) and A/B tests.

Original: MOS (Streijl et al., 2016) is a commonly used measure for audio quality; it is expressed as a single rational number, typically in the range 1–5, where 1 is lowest perceived quality, and 5 is the highest perceived quality.
Revised: MOS (Streijl et al., 2016) is a commonly used measure for audio quality; it is expressed as a single rational number, typically in the range 1–5, where 1 is lowest perceived quality, and 5 is the highest perceived quality.

Original: The MOS is calculated as the arithmetic mean over single ratings performed by human subjects.
Revised: The MOS is calculated as the arithmetic mean over single ratings performed by human subjects.

Original: Due to the large number of audio samples used in the study, we use a single rating per audio sample.
Revised: Due to the large number of audio samples used in the study, we use a single rating per audio sample.

Original: Our dataset consisted of 2000 watermarked and non-watermarked audio samples, that were all correctly classiﬁed by the watermark detector model under transformations listed in table 2.
Revised: Our dataset consisted of 2000 watermarked and non-watermarked audio samples, that were all correctly classiﬁed by the water- mark detector model under transformations listed in table 2.

Original: The average rating of non-watermarked content was 4.595 ± 0.576, and the average rating of watermarked content (at (cid:15) = 

Revised: The average rating of non-watermarked content was 4.595 ± 0.576, and the average rating of watermarked content (at (cid:15) =

Original: × 10 − 4 ) was 4.530 ± 0.530.
Revised: × 10 − 4 ) was 4.530 ± 0.530.

Original: Clearly, human participants did not perceive the watermarked audio as signiﬁcantly worse or degraded.
Revised: Clearly, human participants did not perceive the watermarked audio as signiﬁcantly worse or degraded.

Original: For A/B tests we took a subset of 660 watermarked and non-watermarked audio samples.
Revised: For A/B tests we took a subset of 660 watermarked and non-watermarked audio samples.

Original: We played both the non-watermarked and watermarked audio sample to participants and asked if the watermarked audio sample was worse or better than the original.
Revised: We played both the non-watermarked and watermarked audio sample to participants and asked if the watermarked audio sample was worse or better than the original.

Original: Results are shown in ﬁg. 5; over 80% of human participants rated the quality of watermarked audio samples as the same as non-watermarked audio samples.
Revised: Results are shown in ﬁg. 5; over 80% of human participants rated the quality of watermarked audio samples as the same as non-watermarked audio samples.

Original:  C ONCLUSION
Revised:  C ONCLUSION

Original: We presented a general solution, that leverages imperceptible watermark, to the problem of detecting the provenance of a signal.
Revised: We presented a general solution, that leverages imperceptible watermark, to the problem of detecting the provenance of a signal.

Original: In a departure from related work, our watermarking schemes attempts to learn constructions of watermarks that are resilient to adversarial transformations.
Revised: In a departure from related work, our watermarking schemes attempts to learn constructions of watermarks that are resilient to adversarial transformations.

Original: Our solution can be applied in numerous environments such as in image, audio and video domains.
Revised: Our solution can be applied in numerous environments such as in image, audio and video domains.

Original: Results presented both on images and audio suggest that it is possible to construct watermarks that simultaneously maintain a high level of signal ﬁdelity and are resilient to adversarial transformations, with a minimal false positive rate.
Revised: Results presented both on images and audio suggest that it is possible to construct watermarks that simultaneously maintain a high level of signal ﬁdelity, and are resilient to adversarial transformations, with a minimal false positive rate.

Original: A E VALUATION ON C IFAR 10 & F URTHER EVALUATION ON I MAGE N ET AND TEXT - TO - SPEECH DATA
Revised: A E VALUATION ON C IFAR 10 & F URTHER EVALUATION ON I MAGE N ET AND TEXT - TO - SPEECH DATA

Original: Cifar10 (Krizhevsky et al.).
Revised: Cifar10 (Krizhevsky et al.).

Original: We use a wide ResNet classiﬁer (He et al.
Revised: We use a wide ResNet classiﬁer (He et al.

Original: for the watermark detector.
Revised: for the watermark detector.

Original: We replace batch normalization with instance normalization (Ulyanov et al.
Revised: We replace batch normalization with instance normalization (Ulyanov et al.

Original: We trained with a mini-batch size of 32 for 60,000 steps, with an initial learning rate of 0.01 and decaying this by a factor of 10 every 20,000 steps.
Revised: We trained with a mini-batch size of 32 for 60,000 steps, with an initial learning rate of 0.01 and decaying this by a factor of 10 every 20,000 steps.

Original: All images are normalized into the range [0,1].
Revised: All images are normalized into the range [0,1].

Original: We set the maximum size of the watermark perturbation, (cid:15) , to 20 / 255 , and the watermark perturbation is constructed with ﬁve PGD steps at each iteration during training.
Revised: We set the maximum size of the watermark perturbation, (cid:15) , to 20 / 255 , and the watermark perturbation is constructed with ﬁve PGD steps at each iteration during training.

Original: With respect to the set of transformations, we set σ to 0.5, r to π / 2 , c h and c w to 2, and b to 0.25.
Revised: With respect to the set of transformations, we set σ to 0.5, r to π / 2 , c h and c w to 2, and b to 0.25.

Original: We trained two classiﬁers under these hyperparameters, one where at each step we randomly sample a single transformation, and another classiﬁer where we apply a composition of all transformations, which shall be denoted by f 1 CIFAR and f 2 CIFAR , respectively.
Revised: We trained two classiﬁers under these hyperparameters, one where at each step we randomly sample a single transformation, and another classiﬁer where we apply a composition of all transformations, which shall be denoted by f 1 CIFAR and f 2 CIFAR , respectively.

Original: Both classiﬁers achieved 100% test set accuracy, where the test set consists of 10,000 non-watermarked images and 10,000 watermarked images.
Revised: Both classiﬁers achieved 100% test set accuracy, where the test set consists of 10,000 non-watermarked images and 10,000 watermarked images.

Original: Given a transformation function t θ : X → X , parameterized by θ which encodes some randomness, and an input s ∈ X with class y ∈ { 0 , 1 } , we create n copies of this input under t θ , s i , i ∈ { 1 , ..., n } .
Revised: Given a transformation function t θ : X → X , parameterized by θ which encodes some randomness, and an input s ∈ X with class y ∈ { 0 , 1 } , we create n copies of this input under t θ , s i , i ∈ { 1 , ..., n } .

Original: We then measure both the SSIM of the watermarked images and SSIM of both transformed watermarked and transformed non-watermarked images as a function of the attack success over these n inputs.
Revised: We then measure both the SSIM of the watermarked images and SSIM of both transformed watermarked and transformed non-watermarked images as a function of the attack success over these n inputs.

Original: Figure 6 shows the results of a transformation attack: for each of 2,000 Cifar10 test set images (1,000 non-watermarked and 1,000 watermarked) we create 1000 new images under a transformation; each marker in the ﬁgure is the average attack success over 1 million test images.
Revised: Figure 6 shows the results of a transformation attack: for each of 2,000 Cifar10 test set images (1,000 non-watermarked and 1,000 watermarked) we create 1000 new images under a transformation; each marker in the ﬁgure is the average attack success over 1 million test images.

Original: We evaluate the attack success for a number of different watermarking (cid:15) values.
Revised: We evaluate the attack success for a number of different watermarking (cid:15) values.

Original: Large (cid:15) increase the perceptibility of the watermark, and so correspondingly decrease the SSIM score.
Revised: Large (cid:15) increase the perceptibility of the watermark, and so correspondingly decrease the SSIM score.

Original: Note, attacking non-watermarked content is unaffected by the (cid:15) value chosen for watermarking.
Revised: Note, attacking non-watermarked content is unaffected by the (cid:15) value chosen for watermarking.

Original: For (cid:15) = 1 / 255 , the SSIM score of watermarked content is ≈ 0 . 99 , and thus the watermark is highly imperceptible.
Revised: For (cid:15) = 1 / 255 , the SSIM score of watermarked content is ≈ 0 . 99 , and thus the watermark is highly imperceptible.

Original: However, a number of attacks on watermark content succeed with high SSIM score, such as for example transformations that modify the brightness of an image.
Revised: However, a number of attacks on watermark content succeed with high SSIM score, such as for example transformations that modify the brightness of an image.

Original: Slightly increasing the perceptibly of the watermark to (cid:15) = 12 / 255 , reduces the attack success of nearly all transformations to
Revised: Slightly increasing the perceptibly of the watermark to (cid:15) = 12 / 255 , reduces the attack success of nearly all transformations to

Original: [Table]
Revised: [Table]

Original: [Figure]
Revised: [Figure]

Original: [Table]
Revised: [Table]

Original: [Figure]
Revised: [Figure]

Original: 1.0 SSIM 0.
Revised: 1.0 SSIM 0.

Original: A tt a c k s u cc e ss (g) f (cid:15) 10 comp , (cid:15) = 1 /0.0 0.2 0.4 0.6 0.8 1.0 SSIM 0.
Revised: A tt a c k s u cc e ss (g) f (cid:15) 10 comp , (cid:15) = 1 /0.0 0.2 0.4 0.6 0.8 1.0 SSIM 0.

Original: A tt a c k s u cc e ss (h) f (cid:15) 10 comp , (cid:15) = 12 /
Revised: A tt a c k s u cc e ss (h) f (cid:15) 10 comp , (cid:15) = 12 /

Original: [Figure]
Revised: [Figure]

Original: zero.
Revised: zero.

Original: Overall, the classiﬁer trained on a composition of transformations is more robust to attacks on non-watermarked content.
Revised: Overall, the classiﬁer trained on a composition of transformations is more robust to attacks on non-watermarked content.

Original: Similar effects can be observed on ImageNet shown in ﬁg. 7, and the propriety audio dataset in ﬁg. 8.
Revised: Similar effects can be observed on ImageNet shown in ﬁg. 7, and the propriety audio dataset in ﬁg. 8.

Original: Interestingly, watermark classiﬁers on ImageNet seem to be more robust at smaller (cid:15) values than on
Revised: Interestingly, watermark classiﬁers on ImageNet seem to be more robust at smaller (cid:15) values than on

Original: Cifar10, we conjecture this is because there is a larger space in which to distribute the watermark.
Revised: Cifar10, we conjecture this is because there is a larger space in which to distribute the watermark.

Original: B F URTHER C OMPARISON WITH B ROKEN A RROWS
Revised: B F URTHER C OMPARISON WITH B ROKEN A RROWS

Original: [Figure]
Revised: [Figure]

Original: [Figure]
Revised: [Figure]

Original: Figure 9 gives analogous plots to ﬁg. 1 when the measure of distortion introduced by both the watermark and a transformation is Peak-Signal-to-Noise ratio (PSNR).
Revised: Figure 9 gives analogous plots to ﬁg. 1 when the measure of distortion introduced by both the watermark and a transformation is Peak-Signal-to-Noise ratio (PSNR).

Original: As one may expect, results exhibited here mirror those of ﬁg. 1, ReSWAT and BA are comparable under Gaussian noise transformations, while ReSWAT is substantially better than BA under rotation and cropping transformations
Revised: As one may expect, results exhibited here mirror those of ﬁg. 1, ReSWAT and BA are comparable under Gaussian noise transformations, while ReSWAT is substantially better than BA under rotation and cropping transformations

Original: [Figure]
Revised: [Figure]

Original: C M EASURING HOW THE NUMBER OF SAMPLES FROM THE TRANSFORMATION DISTRIBUTION USED DURING TRAINING AFFECTS RESILIENCE TO ATTACKS
Revised: C M EASURING HOW THE NUMBER OF SAMPLES FROM THE TRANSFORMATION DISTRIBUTION USED DURING TRAINING AFFECTS RESILIENCE TO ATTACKS

Original: Here, we evaluate the increase in resilience to transformations when we optimize ReSWAT using eq.
Revised: Here, we evaluate the increase in resilience to transformations when we optimize ReSWAT using eq.

Original: (1) with 25 samples from the transformation distribution at each step of training, as opposed to a single sample.
Revised: (1) with 25 samples from the transformation distribution at each step of training, as opposed to a single sample.

Original: Figure 10 shows the resilience improvements of ReSWAT against a Gaussian noise transformation on the Cifar10 dataset.
Revised: Figure 10 shows the resilience improvements of ReSWAT against a Gaussian noise transformation on the Cifar10 dataset.

Original: We evaluate test accuracy on 50,000 watermarked and non-watermarked images with various levels of Gaussian noise applied.
Revised: We evaluate test accuracy on 50,000 watermarked and non-watermarked images with various levels of Gaussian noise applied.

Original: However, the improvement in resilience was at the expense of approximately a 5 × increase in training time.
Revised: However, the improvement in resilience was at the expense of approximately a 5 × increase in training time.