Simple attack bypasses state-of-the-art DNN watermarking.
problem Protecting DNN models from watermark removal attacks.
method Combining imperceptible pattern embedding and spatial-level transformations for a simple yet effective watermark removal.
result Our attack bypasses state-of-the-art watermarking solutions with high success rates.
Algorithm removes backdoor watermarks from neural networks robustly.
problem Protecting neural networks from backdoor attacks.
method Neural network laundering algorithm.
result Effective removal of backdoor watermarks with high test accuracy.
Obtaining the state of the art performance of deep learning models imposes a high cost to model generators, due to the tedious data preparation and the substantial processing requirements. To protect the model from unauthorized re-distribution, watermarking approaches have been introduced in the past couple of years. W…
As companies continue to invest heavily in larger, more accurate and more robust deep learning models, they are exploring approaches to monetize their models while protecting their intellectual property. Model licensing is promising, but requires a robust tool for owners to claim ownership of models, i.e. a watermark. …
Machine learning involves expensive data collection and training procedures. Model owners may be concerned that valuable intellectual property can be leaked if adversaries mount model extraction attacks. As it is difficult to defend against model extraction without sacrificing significant prediction accuracy, watermark…
Adaptive testing segments watermarked text from LLMs.
problem Distinguishing LLM-generated text from human-written content.
method Generalized likelihood-based detection method adapted to inverse transform sampling, removing prompt estimation sensitivity.
result Effective and robust method for segmenting watermarked text.
NTL protects AI models by restricting their generalization ability to specific domains.
problem Protecting AI models as intellectual property in a secure and robust manner.
method Non-Transferable Learning (NTL) captures exclusive data representation and restricts model generalization ability.
result NTL provides robust resistance to watermark removal and data-centric protection for usage authorization.
Watermarking of deep neural networks (DNN) can enable their tracing once released by a data owner. In this paper, we generalize white-box watermarking algorithms for DNNs, where the data owner needs white-box access to the model to extract the watermark. White-box watermarking algorithms have the advantage that they do…
Improved Gumbel watermark detection method.
problem Detecting Gumbel watermarking with high accuracy.
method A near-optimal model-agnostic detection mechanism.
result Demonstrates near-optimal performance under i.i.d. assumptions.
Combining watermark and non-watermark detectors improves LLM detection.
problem Challenges in detecting watermarked language models due to limited entropy.
method Investigates hybrid schemes combining watermark and non-watermark detectors.
result Hybrid schemes outperform either class of detector under various conditions.
Study evaluates Tree-Ring Watermarking in rectified flow-based models, revealing detection and separability limitations.
problem Detecting and separating Tree-Ring Watermarks in rectified flow-based models.
method Extensive experimentation comparing SD 2.1 and FLUX.1-dev models with various text guidance configurations and augmentation attacks.
result Inversion limitations affect watermark recovery and statistical separation.
Unified framework for online LLM watermark detection using e-processes.
problem Detecting AI-generated text from human-written content in online settings.
method Unified framework based on e-processes for anytime-valid hypothesis testing on independence.
result Proposed methods achieve competitive performance in watermark detection.
Estimates watermarked content proportions in mixed-source texts.
problem Optimally estimating the proportion of watermarked content in texts with mixed sources.
method Casting the problem as estimating a proportion parameter in a mixture model based on pivotal statistics.
result Proposes efficient estimators for watermark proportion and shows their accuracy through evaluations.
Global watermark for diffusion language models decouples detection from local contexts.
problem Watermarking in diffusion language models is challenging due to joint sampling of distributions over many unresolved positions.
method Proposes a global vector-valued sketch representation to control watermarking in masked diffusion language models.
result The method decouples detection from local contexts, resulting in an order-agnostic statistic and robustness.
WISER detects watermarked segments in text via epidemic change-point analysis.
problem Identifying watermarked segments in mixed-source texts.
method Epidemic change-point perspective, WISER algorithm.
result WISER outperforms state-of-the-art methods in accuracy and speed.
The paper optimizes watermarking of LLMs, improving detection ability.
problem Optimizing watermarking of large language models (LLMs) while balancing model distortion and detection ability.
method Formulated as a constrained optimization problem, developed an online dual gradient ascent algorithm proving asymptotic Pareto optimality.
result Guarantees an increased green list probability and detection ability.
A new watermarking method corrects bias in language models using maximal coupling.
problem Correcting bias in language model token distributions.
method Maximal coupling to balance bias correction and text quality.
result Outperforms prior techniques in preserving text quality and detectability.
Method detects if text is generated by a language model with watermarks.
problem Detecting if text is generated by a language model with watermarks.
method Randomization tests and change point detection techniques.
result Method ensures Type I and Type II error control and accurately identifies watermarked sub-strings.
Develops a power-calibrated framework for LLM watermarking, optimizing tradeoffs between detectability and distortion.
problem The trade-off between detectability and semantic distortion in logit-based watermarking.
method Power-calibrated statistical framework for watermark hyperparameters, establishing explicit relationships.
result Derives practical parameter selection procedures achieving optimal tradeoffs under constraints.
ADD embeds a 48-bit message into images, achieving high accuracy and speed.
problem Embedding high-fidelity messages into images to detect authenticity and source.
method Two-stage process: linear combination and addition of watermark to image, followed by decoding.
result ADD achieves 100% decoding accuracy for 48-bit watermarking, with minimal performance drop under various distortions.
Paper introduces a statistical framework for watermarking LLM-generated text.
problem Detecting LLM-generated text from human-written text with statistical signals.
method Hypothesis testing formulation, pivotal statistic selection, secret key, closed-form expression of false negative rate, minimax optimization.
result Derives optimal detection rules for LLM-generated text, demonstrating higher power than existing methods.
Proposes a general deep neural network method for digital watermarking.
problem Protecting intellectual content in a massive, IoT-acquired image dataset.
method Train a neural network on an image set and use it to protect distinct test images in bulk.
result Demonstrates the robustness and practicality of the proposed method.
Study on estimating Gumbel--Max watermark proportions in edited documents.
problem Estimating the proportion of a document generated from a watermarked LLM.
method Comparison of full observation and pivotal reduction observation regimes; development of estimators and information-theoretic lower bounds.
result Full observation yields a substantially smaller sample complexity compared to pivotal reduction.
FaceSigns embeds a secret watermark in images to authenticate and detect deepfakes.
problem Realistic image and video manipulation threats, especially deepfakes.
method Semi-fragile watermarking using neural networks, robust to face-swapping but fragile to deepfake manipulations.
result FaceSigns can reliably detect deepfake content with high accuracy.
New framework improves text watermark detection under imperfect pseudorandomness.
problem Structured dependence in generated text from language models causes Type I error control issues.
method Hierarchical two-layer partition, minimal units, non-asymptotic efficiency measure, minimax hypothesis testing.
result Closed-form optimal rules for watermark detection under imperfect pseudorandomness.
Training machine learning (ML) models is expensive in terms of computational power, amounts of labeled data and human expertise. Thus, ML models constitute intellectual property (IP) and business value for their owners. Embedding digital watermarks during model training allows a model owner to later identify their mode…
Estimates proportions of LLM-generated text in mixed documents.
problem Estimating the proportion of text generated by a pre-specified LLM in mixed documents.
method Developed estimators for two observation regimes: full observation and pivotal reduction, and established sample complexity bounds.
result Full observation estimators require fewer samples than pivotal reduction estimators.
We formulate statistical watermarking as hypothesis testing and establish near-optimal bounds.
problem Statistical watermarking in the context of hypothesis testing.
method Formulated as a hypothesis testing problem, using coupling of output tokens and rejection regions.
result Established nearly matching upper and lower bounds on the number of i.i.d. tokens required for small Type I and Type II errors.
New method detects watermarks in LLM-generated text with human edits.
problem Dilution of watermark signals by human edits on LLM-generated text.
method Truncated goodness-of-fit test (Tr-GoF) for robust detection.
result Tr-GoF achieves optimality in robust detection of Gumbel-max watermark.
This paper proposes a novel scheme for the watermarking of Deep Reinforcement Learning (DRL) policies. This scheme provides a mechanism for the integration of a unique identifier within the policy in the form of its response to a designated sequence of state transitions, while incurring minimal impact on the nominal pe…
WAFFLE embeds watermarks in federated learning models without access to training data.
problem Model theft in federated learning due to lack of centralized control.
method Retraining step at server after model aggregation, generating backdoor as watermark.
result Efficient embedding of resilient watermark with negligible accuracy loss.
Due to the rapid growth of machine learning tools and specifically deep networks in various computer vision and image processing areas, application of Convolutional Neural Networks for watermarking have recently emerged. In this paper, we propose a deep end-to-end diffusion watermarking framework (ReDMark) which can be…
Paper develops a new watermarking framework for LLMs.
problem Efficiently distinguishing machine-generated from human text.
method Develops Anchored E-Watermarking framework for anytime-valid inference.
result Framework enables valid, anytime-inference with reduced sample efficiency.
The commercialization of deep learning creates a compelling need for intellectual property (IP) protection. Deep neural network (DNN) watermarking has been proposed as a promising tool to help model owners prove ownership and fight piracy. A popular approach of watermarking is to train a DNN to recognize images with ce…
Ideal attribution mechanisms track model interactions for faithful watermarks.
problem Ensuring models provide transparent and fair attribution decisions.
method Introducing ideal attribution mechanisms and a ledger for tracking model interactions.
result A unified framework for evaluating watermarking schemes, clarifying attainable guarantees.
Researchers analyze backdoor data poisoning attacks and identify a memorization capacity parameter.
problem Understanding and mitigating backdoor data poisoning attacks in machine learning models.
method Formal theoretical framework, statistical and computational analysis, explicit constructions, and algorithm design.
result Identified a memorization capacity parameter to assess vulnerability to backdoor attacks and developed algorithms to detect and mitigate them.
Paper tackles source attribution for LLM-generated texts.
problem Identify the data provider of synthetic texts generated by LLMs.
method Watermarking to embed information about data providers in synthetic texts.
result Proposes and evaluates a source attribution framework that achieves effective source attribution.
The paper tackles data misappropriation in LLMs by embedding watermarks and testing for their presence.
problem Detecting data misappropriation in LLMs trained on copyrighted data.
method Embedding watermarks, formulating as hypothesis testing, developing statistical framework, constructing test statistics, determining optimal thresholds, controlling errors, establishing asymptotic optimality.
result The proposed statistical testing framework effectively detects data misappropriation in LLMs.
New model generates data on constrained sets without losing tractability.
problem Generating data on constrained sets without losing tractability.
method Mirror Diffusion Models (MDM) learn diffusion processes in a dual space constructed from a mirror map.
result MDM generates data on convex constrained sets without losing tractability.
This paper aims to make a new contribution to the study of lifetime ruin problem by considering investment in two hedge funds with high-watermark fees and drift uncertainty. Due to multi-dimensional performance fees that are charged whenever each fund profit exceeds its historical maximum, the value function is expecte…
SPECTRE defends against backdoor attacks by amplifying corrupted data's spectral signature.
problem Backdoor attacks that change model behavior with specific triggers.
method Robust covariance estimation to amplify spectral signature of poisoned data.
result Clean model is completely removed from backdoor, even in hard-to-detect cases.
FCDD explains deep anomaly detection by mapping anomalies away and providing heatmap explanations.
problem Deep one-class classification's non-linear transformation makes it hard to interpret.
method FCDD learns a mapping that concentrates nominal samples, maps anomalies away, and provides heatmap explanations.
result FCDD sets a new state of the art in unsupervised anomaly detection on MVTec-AD.
New approach prevents model collapse in language generation.
problem Model collapse risk in large language models.
method Introduces a replay adversary to study language generation.
result Replay limits generation in certain ways but not all.
Paper presents first model extraction attack against DRL models.
problem Stealing DRL models from interaction with environment.
method Imitation learning approach to recover DRL models from predicted actions.
result Successfully recovers DRL models with high fidelity and accuracy.
Quantifying the importance of each training point to a learning task is a fundamental problem in machine learning and the estimated importance scores have been leveraged to guide a range of data workflows such as data summarization and domain adaption. One simple idea is to use the leave-one-out error of each training …
Data taggants verify dataset ownership without harming models or requiring model internals.
problem Verifying dataset ownership without harming models or requiring model internals.
method Using pairs of out-of-distribution samples and random labels as secret keys, subtly altering a dataset to detect models trained on it.
result Data taggants reliably detect models trained on the protected dataset with high confidence, without compromising validation accuracy.
Dataset inference defends against model stealing by identifying stolen training data.
problem Model stealing through machine learning models trained on proprietary data.
method Combines statistical testing with decision boundary estimation to identify stolen training data.
result Model owners can claim with high confidence that their model was stolen, even with limited stolen data.
Good data stewardship requires removal of data at the request of the data's owner. This raises the question if and how a trained machine-learning model, which implicitly stores information about its training data, should be affected by such a removal request. Is it possible to "remove" data from a machine-learning mode…