Machine learning involves expensive data collection and training procedures. Model owners may be concerned that valuable intellectual property can be leaked if adversaries mount model extraction attacks. As it is difficult to defend against model extraction without sacrificing significant prediction accuracy, watermarking instead leverages unused model capacity to have the model overfit to outlier input-output pairs. Such pairs are watermarks, which are not sampled from the task distribution and are only known to the defender. The defender then demonstrates knowledge of the input-output pairs to claim ownership of the model at inference. The effectiveness of watermarks remains limited because they are distinct from the task distribution and can thus be easily removed through compression or other forms of knowledge transfer.
We introduce Entangled Watermarking Embeddings (EWE). Our approach encourages the model to learn features for classifying data that is sampled from the task distribution and data that encodes watermarks. An adversary attempting to remove watermarks that are entangled with legitimate data is also forced to sacrifice performance on legitimate data. Experiments on MNIST, Fashion-MNIST, CIFAR-10, and Speech Commands validate that the defender can claim model ownership with 95\% confidence with less than 100 queries to the stolen copy, at a modest cost below 0.81 percentage points on average in the defended model's performance.
In recent years, there has been significant advancement in the field of model watermarking techniques. However, the protection of image-processing neural networks remains a challenge, with only a limited number of methods being developed. The objective of these techniques is to embed a watermark in the output images of the target generative network, so that the watermark signal can be detected in the output of a surrogate model obtained through model extraction attacks. This promising technique, however, has certain limits. Analysis of the frequency domain reveals that the watermark signal is …
DualGuard: Dual-stream Large Language Model Watermarking Defense against Paraphrase and Spoofing Attack
Institute of Information Engineering, Chinese Academy of Sciences（信息工程研究所，中国科学院）；School of Cyber Security, University of Chinese Academy of Sciences（中国科学院大学网络与信息安全学院）；Institute of Computing Technology, Chinese Academy of Sciences（计算技术研究所，中国科学院）
From Essence to Defense: Adaptive Semantic-aware Watermarking for Embedding-as-a-Service Copyright Protection
Institute of Information Engineering, Chinese Academy of Sciences（中国科学院信息工程研究所）；School of Cyber Security, University of Chinese Academy of Sciences（中国科学院大学网络安全学院）
Learning to Evade: Adaptive Attacks on Audio Watermarking
University of Missouri-Kansas City（密苏里大学堪萨斯城分校）；University of Hawaii at Manoa（夏威夷大学马诺阿分校）；University of South Florida（南佛罗里达大学）；Michigan State University（密歇根州立大学）；University of Miami（迈阿密大学）
Identifying Appropriate Intellectual Property Protection Mechanisms for Machine Learning Models: A Systematization of Watermarking, Fingerprinting, Model Access, and Attacks
SBA Research（SBA研究中心）；Vienna University of Technology（维也纳工业大学）
Blind PRNG Hijacking: An Undetectable Integrity-Preserving Attack Against LLM Watermarking
Fujian Provincial Key Laboratory of Automotive Electronics and Electric Drive（福建省汽车电子与电力驱动重点实验室）；School of Electronic, Electrical and Physics（电子、电气与物理学院）；Fujian University of Technology（福建理工大学）；School of Humanities（人文学院）；Institute of Applied Physics and Materials Engineering（应用物理与材料工程学院）；University of Macau（澳门大学）
Removing Watermarks with Partial Regeneration using Semantic Information
International Computer Science Institute（国际计算机科学研究所）；School of Computing and Augmented Intelligence（计算与增强智能学院）；Lawrence Berkeley National Laboratory（劳伦斯伯克利国家实验室）；Department of Statistics（统计学系）；University of California at Berkeley（加州大学伯克利分校）
WMCopier: Forging Invisible Image Watermarks on Arbitrary Images
The State Key Laboratory of Blockchain and Data Security, Zhejiang University（区块链与数据安全国家重点实验室，浙江大学）；Hangzhou High-Tech Zone (Binjiang) Institute of Blockchain and Data Security（杭州高新技术区（滨江）区块链与数据安全研究院）
CISPA Helmholtz Center for Information Security（CISPA亥姆霍兹信息安全中心）
Recent advances in natural language generation have introduced powerful language models with high-quality output text. However, this raises concerns about the potential misuse of such models for malicious purposes. In this paper, we study natural language watermarking as a defense to help better mark and trace the provenance of text. We introduce the Adversarial Watermarking Transformer (AWT) with a jointly trained encoder-decoder and adversarial training that, given an input text and a binary message, generates an output text that is unobtrusively encoded with the given message. We further st…
DRGW: Learning Disentangled Representations for Robust Graph Watermarking
Institute of Information Engineering, Chinese Academy of Sciences（中国科学院信息工程研究所）；School of Cyber Security, University of Chinese Academy of Sciences（中国科学院大学网络安全学院）；State Key Laboratory of Cyberspace Security Defense（网络空间安全防御国家重点实验室）
Tsinghua University（清华大学）；Shandong University（山东大学）；Wuhan University（武汉大学）；Zhongguancun Laboratory（中关村实验室）；Shandong Institute of Blockchain（山东省区块链研究院）；National Financial Cryptography Research Center（国家金融密码研究中心）
SemBind: Binding Diffusion Watermarks to Semantics Against Black-Box Forgery Attacks
School of Cyber Science and Technology, University of Science and Technology of China, Anhui, China（中国科学技术大学网络安全学院）；Anhui Province Key Laboratory of Digital Security, Anhui, China（安徽省数字安全重点实验室）
MARCO: The Radioactive Watermark for Protein Generative Models
Faculty of Data Science, City University of Macau（澳门城市大学数据科学学院）；CSIRO（澳大利亚联邦科学与工业研究组织）；Responsible AI Research (RAIR) Centre, Adelaide University（阿德莱德大学负责任人工智能研究（RAIR）中心）
We study the problem of model extraction in natural language processing, in which an adversary with only query access to a victim model attempts to reconstruct a local copy of that model. Assuming that both the adversary and victim model fine-tune a large pretrained language model such as BERT (Devlin et al. 2019), we show that the adversary does not need any real training data to successfully mount the attack. In fact, the attacker need not even use grammatical or semantically meaningful queries: we show that random sequences of words coupled with task-specific heuristics form effective queri…
