{"id":"W3159603021","doi":"","title":"Entangled Watermarks as a Defense against Model Extraction","year":2021,"lang":"en","type":"article","venue":"USENIX Security Symposium","topic":"Adversarial Robustness in Machine Learning","field":"Computer Science","cited_by":50,"is_retracted":false,"has_abstract":true,"ca_institutions":"Vector Institute; University of Toronto","funders":"","keywords":"Computer science; Task (project management); Overfitting; Digital watermarking; Adversary; MNIST database; Outlier; Inference; Artificial intelligence; Crowdsourcing; Computer security; Machine learning; Data mining; Deep learning; Image (mathematics)","routes":{"ca_aff":true,"ca_fund":false,"ca_venue":false,"about_ca":false,"invisible_to_affiliation_only":false},"retraction":null,"screen":null,"direct_labels":[],"prediction":{"model_version":"codex-gemma-dda1882f352a","candidate_categories":["metaepi_narrow"],"consensus_categories":[],"category_scores_codex":[0.0003414887,0.0002783593,0.0002755385,0.0001201631,0.0003105034,0.0003584878,0.0007110101,0.0001947418,0.00004410311],"category_scores_gemma":[0.0001562741,0.0002969735,0.0001779292,0.0004010076,0.00004747298,0.001085842,0.0006578093,0.0005915531,0.0001804457],"about_ca_system_candidate":false,"about_ca_system_consensus":false,"about_ca_system_score_codex":0.0001607691,"about_ca_system_score_gemma":0.0002419768,"about_ca_topic_candidate":false,"about_ca_topic_consensus":false,"about_ca_topic_score_codex":0.00004551179,"about_ca_topic_score_gemma":0.00003058354,"domain_scores_codex":[0.9975622,0.0002766974,0.0003582016,0.0007684316,0.0005221635,0.0005123323],"domain_scores_gemma":[0.9983523,0.0001414497,0.0001533509,0.0009506,0.0002036049,0.0001986343],"domain_codex":null,"domain_gemma":null,"domain_candidate":null,"domain_consensus":null,"study_design_codex":"simulation_or_modeling","study_design_gemma":"simulation_or_modeling","study_design_scores_codex":[0.0001494077,0.0009977296,0.00191857,0.0001918235,0.0002355969,0.004558678,0.03811941,0.4754418,0.3045215,0.1641478,0.003657404,0.006060213],"study_design_scores_gemma":[0.0006573573,0.00002889476,0.00003707164,0.0000337684,0.00002333469,0.0003056196,0.0001105908,0.9619048,0.02332564,0.008410684,0.004742907,0.000419354],"study_design_candidate":"simulation_or_modeling","study_design_consensus":"simulation_or_modeling","genre_codex":"methods","genre_gemma":"empirical","genre_scores_codex":[0.3660862,0.0001240094,0.5965093,0.005378765,0.001770178,0.0002819101,0.000007272648,0.0007922893,0.02905015],"genre_scores_gemma":[0.9725057,0.0000654367,0.02509472,0.001042888,0.0002119792,0.00001686615,0.00003370377,0.00003243893,0.000996234],"genre_candidate":"empirical","genre_consensus":null,"teacher_disagreement_score":0.6064196,"threshold_uncertainty_score":0.9999483,"prediction_status":"machine_predicted_unvalidated"},"machine_scores":{"provisional":true,"baseline":true,"maturity_gate_passed":false,"score_opus":0.008388954721593844,"score_gpt":0.2574032386230892,"score_spread":0.2490142839014954,"validation_status":"score_only:v0-immature-baseline","note":"Baseline scores from an immature model (maturity gate not passed). Scores rank; they never assert a category."}}