mlsanityData to 7 Oct 2026

Certified Neural Network Watermarks with Randomized Smoothing

arXiv 2207.07972 ↗First posted 16 Jul 2022cs.LG cs.CRcited by 39

Not on the map. Why?

Abstract (arXiv)

Watermarking is a commonly used strategy to protect creators' rights to digital images, videos and audio. Recently, watermarking methods have been extended to deep learning models -- in principle, the watermark should be preserved when an adversary tries to copy the model. However, in practice, watermarks can often be removed by an intelligent adversary. Several papers have proposed watermarking methods that claim to be empirically resistant to different types of removal attacks, but these new techniques often fail in the face of new or better-tuned adversaries. In this paper, we propose a certifiable watermarking method. Using the randomized smoothing technique proposed in Chiang et al., we show that our watermark is guaranteed to be unremovable unless the model parameters are changed by more than a certain l2 threshold. In addition to being certifiable, our watermark is also empirically more robust compared to previous watermarking methods. Our experiments can be reproduced with code at https://github.com/arpitbansal297/Certified_Watermarks

Key facts. Cited by 39 papers in the map (data through 7 Oct 2026). Builds on 22 of its 34 references that are in the map. First posted on arXiv 16 Jul 2022.

Builds on

22 of 34 references.

References · 22

  1. 2020Language Models are Few-Shot Learnerscited by 32,199
  2. 2017Towards Deep Learning Models Resistant to Adversarial Attackscited by 6,326
  3. 2019Certified Adversarial Robustness via Randomized Smoothingcited by 1,324
  4. 2017Provable defenses against adversarial examples via the convex outer adversarial polytopecited by 564
  5. 2018Certified Robustness to Adversarial Examples with Differential Privacycited by 462
  6. 2019On Evaluating Adversarial Robustnesscited by 442
  7. 2018Turning Your Weakness Into a Strength: Watermarking Deep Neural Networks by Backdooringcited by 334
  8. 2018On the Effectiveness of Interval Bound Propagation for Training Verifiably Robust Modelscited by 322
  9. 2018Towards Fast Computation of Certified Robustness for ReLU Networkscited by 254
  10. 2017Embedding Watermarks into Deep Neural Networkscited by 227
  11. 2019Towards Stable and Efficient Training of Verifiably Robust Neural Networkscited by 204
  12. 2020Certified Defenses for Adversarial Patchescited by 100
10 more
  1. 2019DAWN: Dynamic Adversarial Watermarking of Neural Networkscited by 94
  2. 2019Deep Neural Network Fingerprinting by Conferrable Adversarial Examplescited by 90
  3. 2017Robust Physical-World Attacks on Deep Learning Modelscited by 70
  4. 2021SoK: How Robust is Image Classification Deep Neural Network Watermarking? (Extended Version)cited by 67
  5. 2019Robustness Certificates for Sparse Adversarial Attacks by Randomized Ablationcited by 59
  6. 2019Instance adaptive adversarial training: Improved accuracy tradeoffs in neural netscited by 55
  7. 2020Detection as Regression: Certified Object Detection by Median Smoothingcited by 47
  8. 2020Neural Network Laundering: Removing Black-Box Backdoor Watermarks from Deep Neural Networkscited by 24
  9. 2019RIGA: Covert and Robust White-Box Watermarking of Deep Neural Networkscited by 9
  10. 2019Piracy Resistant Watermarks for Deep Neural Networkscited by 7

Built on by

Cited by year (2026 to 7 Oct)

Citing papers per year: 2022: 3; 2023: 7; 2024: 14; 2025: 10; 2026: 5.

39 papers.

Sort:

By area:

  1. 2023Tree-Ring Watermarks: Fingerprints for Diffusion Images that are Invisible and Robustcited by 179
  2. 2024RingID: Rethinking Tree-Ring Watermarking for Enhanced Multi-Key Identificationcited by 87
  3. 2023Watermarks in the Sand: Impossibility of Strong Watermarking for Generative Modelscited by 77
  4. 2023Leveraging Optimization for Adaptive Attacks on Image Watermarkscited by 50
  5. 2022FedTracker: Furnishing Ownership Verification and Traceability for Federated Learning Modelcited by 25
  6. 2024Provably Unlearnable Data Examplescited by 18
  7. 2023Next Steps for Human-Centered Generative AI: A Technical Perspectivecited by 13
  8. 2023What can Discriminator do? Towards Box-free Ownership Verification of Generative Adversarial Networkcited by 10
  9. 2023Towards Robust Model Watermark via Reducing Parametric Vulnerabilitycited by 10
  10. 2024Reliable Model Watermarking: Defending Against Theft without Compromising on Evasioncited by 9
  11. 2024Probabilistically Robust Watermarking of Neural Networkscited by 7
  12. 2024DeepEclipse: How to Break White-Box DNN-Watermarking Schemescited by 4
27 more
  1. 2024Certifiably Robust Image Watermarkcited by 3
  2. 2025Watermarking Graph Neural Networks via Explanations for Ownership Protectioncited by 3
  3. 2026Cert-LAS: Toward Certified Model Ownership Verification for Text-to-Image Diffusion Models via Layer-Adaptive Smoothingcited by 3
  4. 2022Multi-head Ensemble of Smoothed Classifiers for Certified Robustnesscited by 2
  5. 2024PreGIP: Watermarking the Pretraining of Graph Neural Networks for Deep Intellectual Property Protectioncited by 2
  6. 2024Not Just Change the Labels, Learn the Features: Watermarking Deep Neural Networks with Multi-View Datacited by 2
  7. 2024Lazy Layers to Make Fine-Tuned Diffusion Models More Traceablecited by 2
  8. 2024Revisiting Black-Box Model Ownership Verification through Information Theorycited by 2
  9. 2024Are You Using Reliable Graph Prompts? Trojan Prompt Attacks on Graph Neural Networkscited by 2
  10. 2024Combining Machine Learning Defenses without Conflictscited by 2
  11. 2025Persistence of Backdoor-based Watermarks for Neural Networks: A Comprehensive Evaluationcited by 2
  12. 2025Towards the Resistance of Neural Network Watermarking to Fine-tuningcited by 2
  13. 2025DSSmoothing: Toward Certified Dataset Ownership Verification for Pre-trained Language Models via Dual-Space Smoothingcited by 2
  14. 2022Convolutional Neural Network-Based Image Watermarking using Discrete Wavelet Transformcited by 1
  15. 2023On Function-Coupled Watermarks for Deep Neural Networkscited by 1
  16. 2024Effects of Exponential Gaussian Distribution on (Double Sampling) Randomized Smoothingcited by 1
  17. 2024BlockDoor: Blocking Backdoor Based Watermarks in Deep Neural Networkscited by 1
  18. 2025ChainMarks: Securing DNN Watermark with Cryptographic Chaincited by 1
  19. 2025Cryptographic Backdoor for Neural Networks: Boon and Banecited by 1
  20. 2025CertDW: Towards Certified Dataset Ownership Verification via Conformal Calibrationcited by 0
  21. 2025Robust GNN Watermarking via Implicit Perception of Topological Invariantscited by 0
  22. 2025Watermarking Large Language Models in Europe: Interpreting the AI Act in Light of Technologycited by 0
  23. 2025Class-feature Watermark: A Resilient Black-box Watermark Against Model Extraction Attackscited by 0
  24. 2026Collaborative Threshold Watermarkingcited by 0
  25. 2026Contract And Conquer: How to Provably Compute Adversarial Examples for a Black-Box Model?cited by 0
  26. 2026RandMark: On Random Watermarking of Visual Foundation Modelscited by 0
  27. 2026Steal the Knowledge, Inherit the Mark: TwinMark for Distillation Watermarking via Second Moments and Class Multiplexingcited by 0