Timezone: »

 
Poster
Certified Neural Network Watermarks with Randomized Smoothing
Arpit Bansal · Ping-yeh Chiang · Michael Curry · Rajiv Jain · Curtis Wigington · Varun Manjunatha · John P Dickerson · Tom Goldstein

Wed Jul 20 03:30 PM -- 05:30 PM (PDT) @ Hall E #414
in Poster Session 2 »
Watermarking is a commonly used strategy to protect creators' rights to digital images, videos and audio. Recently, watermarking methods have been extended to deep learning models -- in principle, the watermark should be preserved when an adversary tries to copy the model. However, in practice, watermarks can often be removed by an intelligent adversary. Several papers have proposed watermarking methods that claim to be empirically resistant to different types of removal attacks, but these new techniques often fail in the face of new or better-tuned adversaries. In this paper, we propose the first \emph{certifiable} watermarking method. Using the randomized smoothing technique, we show that our watermark is guaranteed to be unremovable unless the model parameters are changed by more than a certain $\ell_2$ threshold. In addition to being certifiable, our watermark is also empirically more robust compared to previous watermarking methods.
Keywords: Deep Learning · DL: Robustness

Author Information

Arpit Bansal (University of Maryland, College Park)
Ping-yeh Chiang (University of Maryland, College Park)
Michael Curry (University of Maryland College Park)
Rajiv Jain (Adobe Research)
Curtis Wigington (Adobe Research)
Varun Manjunatha (Adobe Research)
John P Dickerson (Arthur AI & Univ. of Maryland)
Tom Goldstein (University of Maryland)

Related Events (a corresponding poster, oral, or spotlight)

More from the Same Authors