SoK: How Robust is Image Classification Deep Neural Network Watermarking? (Extended Version)

V. Zantedeschi, M.-I. Nicolae, and A. Rawat, “Efficient defenses against adversarial attacks,” in Proceedings of the 10th ACM Workshop on Artificial Intelligence and Security , 2017, pp. 39–49

2017

Cited alongside, same era.

I. Hubara, M. Courbariaux, D. Soudry, R. El-Yaniv, and Y. Bengio, “Quantized neural networks: Training neural networks with low precision weights and activations,” The Journal of Machine Learning Research , vol. 18, no. 1, pp. 6869–6898, 2017

2017

Cited alongside, same era.

F. Tramèr, N. Papernot, I. Goodfellow, D. Boneh, and P. McDaniel, “The space of transferable adversarial examples,” arXiv preprint arXiv:1704.03453 , 2017

Original

2017

Cited alongside, same era.

G. Huang, Z. Liu, L. Van Der Maaten, and K. Q. Weinberger, “Densely connected convolutional networks,” in Proceedings of the IEEE conference on computer vision and pattern recognition , 2017, pp. 4700–4708

2017

Cited alongside, same era.

C. Coleman, D. Narayanan, D. Kang, T. Zhao, J. Zhang, L. Nardi, P. Bailis, K. Olukotun, C. Ré, and M. Zaharia, “Dawnbench: An end-to-end deep learning benchmark and competition,” Training , vol. 100, no. 101, p. 102, 2017

2017

Cited alongside, same era.

H. Wang, Y. Wang, Z. Zhou, X. Ji, D. Gong, J. Zhou, Z. Li, and W. Liu, “Cosface: Large margin cosine loss for deep face recognition,” in Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition , 2018, pp. 5265–5274

2018

Cited alongside, same era.

J. Devlin, M.-W. Chang, K. Lee, and K. Toutanova, “Bert: Pre-training of deep bidirectional transformers for language understanding,” arXiv preprint arXiv:1810.04805 , 2018

Original

2018

Cited alongside, same era.

B. Wang, Y. Yao, S. Shan, H. Li, B. Viswanath, H. Zheng, and B. Y. Zhao, “Neural cleanse: Identifying and mitigating backdoor attacks in neural networks,” in 2019 IEEE Symposium on Security and Privacy (SP) . IEEE, 2019, pp. 707–723

2019

Later among the works it cites.

T. Orekondy, B. Schiele, and M. Fritz, “Knockoff nets: Stealing functionality of black-box models,” in Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition , 2019, pp. 4954–4963

2019

Later among the works it cites.

J. Lin, C. Gan, and S. Han, “Defensive quantization: When efficiency meets robustness,” arXiv preprint arXiv:1904.08444 , 2019

Original

2019

Later among the works it cites.

W.-A. Lin, Y. Balaji, P. Samangouei, and R. Chellappa, “Invert and defend: Model-based approximate inversion of generative adversarial networks for secure inference,” arXiv preprint arXiv:1911.10291 , 2019

Original

2019

Later among the works it cites.

S. Kornblith, M. Norouzi, H. Lee, and G. Hinton, “Similarity of neural network representations revisited,” in International Conference on Machine Learning . PMLR, 2019, pp. 3519–3529

2019

Later among the works it cites.

A. Paszke, S. Gross, F. Massa, A. Lerer, J. Bradbury, G. Chanan, T. Killeen, Z. Lin, N. Gimelshein, L. Antiga, A. Desmaison, A. Kopf, E. Yang, Z. DeVito, M. Raison, A. Tejani, S. Chilamkurthy, B. Steiner, L. Fang, J. Bai, and S. Chintala, “Pytorch: An imperative style, high-performance deep learning library,” in Advances in Neural Information Processing Systems 32 , H. Wallach, H. Larochelle, A. Beygelzimer, F. d'Alché-Buc, E. Fox, and R. Garnett, Eds. Curran Associates, Inc., 2019, pp. 8024–8035. [Online]. Available: http://papers.neurips.cc/paper/9015-pytorch-an-imperative-style-high-performance-deep-learning-library.pdf

2019

Later among the works it cites.

A. Kolesnikov, L. Beyer, X. Zhai, J. Puigcerver, J. Yung, S. Gelly, and N. Houlsby, “Big transfer (bit): General visual representation learning,” arXiv preprint arXiv:1912.11370 , vol. 6, no. 2, p. 8, 2019

Original

2019

Later among the works it cites.

K. Krishna, G. S. Tomar, A. P. Parikh, N. Papernot, and M. Iyyer, “Thieves on sesame street! model extraction of bert-based apis,” 2020

2020

Later among the works it cites.

M. Jagielski, N. Carlini, D. Berthelot, A. Kurakin, and N. Papernot, “High accuracy and high fidelity extraction of neural networks,” in 29th { \{ USENIX } \} Security Symposium ( { \{ USENIX } \} Security 20) , 2020, pp. 1345–1362

2020

Later among the works it cites.

N. Carlini, M. Jagielski, and I. Mironov, “Cryptanalytic extraction of neural network models,” in Annual International Cryptology Conference . Springer, 2020, pp. 189–218

2020

Later among the works it cites.

B. G. Atli, S. Szyller, M. Juuti, S. Marchal, and N. Asokan, “Extraction of complex dnn models: Real threat or boogeyman?” in International Workshop on Engineering Dependable and Secure Machine Learning Systems . Springer, 2020, pp. 42–57

2020

Later among the works it cites.

X. Liu, F. Li, B. Wen, and Q. Li, “Removing backdoor-based watermarks in neural networks with limited data,” arXiv preprint arXiv:2008.00407 , 2020

Original

2020

Later among the works it cites.

E. Le Merrer, P. Perez, and G. Trédan, “Adversarial frontier stitching for remote neural network watermarking,” Neural Computing and Applications , vol. 32, no. 13, pp. 9233–9244, 2020

2020

Later among the works it cites.

W. Aiken, H. Kim, and S. Woo, “Neural network laundering: Removing black-box backdoor watermarks from deep neural networks,” arXiv preprint arXiv:2004.11368 , 2020

Original

2020

Later among the works it cites.

H. Jia, C. A. Choquette-Choo, and N. Papernot, “Entangled watermarks as a defense against model extraction,” 30th { \{ USENIX } \} Security Symposium ( { \{ USENIX } \} Security 21) (to appear) , 2021

2021

Closest in time.

N. Lukas, Y. Zhang, and F. Kerschbaum, “Deep neural network fingerprinting by conferrable adversarial examples,” International Conference on Learning Representations , 2021

2021

Closest in time.

N. Lukas, E. Jiang, X. Li, and F. Kerschbaum, “Sok: How robust is deep neural network image classification watermarking?” in IEEE Symposium on Security and Privacy , 2022

2022

Closest in time.