{"id":"W3159603021","doi":"","title":"Entangled Watermarks as a Defense against Model Extraction","year":2021,"lang":"en","type":"article","venue":"USENIX Security Symposium","topic":"Adversarial Robustness in Machine Learning","field":"Computer Science","cited_by":50,"is_retracted":false,"has_abstract":true,"ca_institutions":"Vector Institute; University of Toronto","funders":"","keywords":"Computer science; Task (project management); Overfitting; Digital watermarking; Adversary; MNIST database; Outlier; Inference; Artificial intelligence; Crowdsourcing; Computer security; Machine learning; Data mining; Deep learning; Image (mathematics)","routes":{"ca_aff":true,"ca_fund":false,"ca_venue":false,"about_ca":false,"invisible_to_affiliation_only":false},"retraction":null,"screen":null,"direct_labels":[],"prediction":{"model_version":"metacan-v3-hybrid-931329e0061c","candidate_categories":[],"consensus_categories":[],"category_scores_codex":[0.005453815,0.00152903,0.001218955,0.001311428,0.0008753589,0.002387489,0.001870703,0.00250491,0.00245875],"category_scores_gemma":[0.02704308,0.001025554,0.001143351,0.001145353,0.003980209,0.008027429,0.00750038,0.004644182,0.0009183178],"about_ca_system_candidate":false,"about_ca_system_consensus":false,"about_ca_system_score_codex":0.0009273965,"about_ca_system_score_gemma":0.0008593832,"about_ca_topic_candidate":false,"about_ca_topic_consensus":false,"about_ca_topic_score_codex":0.0005064455,"about_ca_topic_score_gemma":0.0005065314,"domain_scores_codex":[0.995307,0.001592763,0.0002810032,0.0008372728,0.001539956,0.000441954],"domain_scores_gemma":[0.9737549,0.009875948,0.001958403,0.01329702,0.0007496634,0.0003640837],"domain_codex":null,"domain_gemma":null,"domain_candidate":null,"domain_consensus":null,"study_design_codex":"simulation_or_modeling","study_design_gemma":"simulation_or_modeling","study_design_scores_codex":[0.0008431692,0.0003380535,0.005288778,0.0002487633,0.0002786596,0.0005756026,0.0006274824,0.473057,0.04930586,0.2430001,0.005692915,0.2207437],"study_design_scores_gemma":[0.00003083656,0.0002073862,0.0005336323,0.00004416455,0.00003690639,0.0003334563,0.0000585126,0.879963,0.02317911,0.09194209,0.003630357,0.00004054263],"study_design_candidate":"simulation_or_modeling","study_design_consensus":"simulation_or_modeling","genre_codex":"methods","genre_gemma":"empirical","genre_scores_codex":[0.07343132,0.0005337223,0.9183449,0.00141239,0.0001189345,0.0001005923,0.0002028758,0.0019747,0.003880659],"genre_scores_gemma":[0.8797332,0.0003648719,0.1157125,0.0004325699,0.0001114722,0.0001086561,0.0003048813,0.0002382487,0.002993535],"genre_candidate":"empirical","genre_consensus":null,"teacher_disagreement_score":0.005453815,"threshold_uncertainty_score":0.02884287,"prediction_status":"machine_predicted_unvalidated"},"machine_scores":{"provisional":true,"baseline":true,"maturity_gate_passed":false,"score_opus":0.008388954721593844,"score_gpt":0.2574032386230892,"score_spread":0.2490142839014954,"validation_status":"score_only:v0-immature-baseline","note":"Baseline scores from an immature model (maturity gate not passed). Scores rank; they never assert a category."}}