{"id":"https://openalex.org/W2985954225","doi":"https://doi.org/10.1145/3433210.3453079","title":"REFIT: A Unified Watermark Removal Framework For Deep Learning Systems With Limited Data","display_name":"REFIT: A Unified Watermark Removal Framework For Deep Learning Systems With Limited Data","publication_year":2021,"publication_date":"2021-05-24","ids":{"openalex":"https://openalex.org/W2985954225","doi":"https://doi.org/10.1145/3433210.3453079","mag":"2985954225"},"language":"en","primary_location":{"id":"doi:10.1145/3433210.3453079","is_oa":true,"landing_page_url":"https://doi.org/10.1145/3433210.3453079","pdf_url":"https://dl.acm.org/doi/pdf/10.1145/3433210.3453079","source":null,"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Proceedings of the 2021 ACM Asia Conference on Computer and Communications Security","raw_type":"proceedings-article"},"type":"conference-paper","indexed_in":["arxiv","crossref"],"open_access":{"is_oa":true,"oa_status":"gold","oa_url":"https://dl.acm.org/doi/pdf/10.1145/3433210.3453079","any_repository_has_fulltext":true},"authorships":[{"author_position":"first","author":{"id":null,"display_name":"Xinyun Chen","orcid":null},"institutions":[{"id":"https://openalex.org/I95457486","display_name":"University of California, Berkeley","ror":"https://ror.org/01an7q238","country_code":"US","type":"education","lineage":["https://openalex.org/I95457486"]}],"countries":["US"],"is_corresponding":false,"raw_author_name":"Xinyun Chen","raw_affiliation_strings":["University of California, Berkeley, Berkeley, CA, USA"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"University of California, Berkeley, Berkeley, CA, USA","institution_ids":["https://openalex.org/I95457486"]}]},{"author_position":"middle","author":{"id":null,"display_name":"Wenxiao Wang","orcid":null},"institutions":[{"id":"https://openalex.org/I99065089","display_name":"Tsinghua University","ror":"https://ror.org/03cve4549","country_code":"CN","type":"education","lineage":["https://openalex.org/I99065089"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Wenxiao Wang","raw_affiliation_strings":["Tsinghua University, Beijing, China"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Tsinghua University, Beijing, China","institution_ids":["https://openalex.org/I99065089"]}]},{"author_position":"middle","author":{"id":null,"display_name":"Chris Bender","orcid":null},"institutions":[{"id":"https://openalex.org/I95457486","display_name":"University of California, Berkeley","ror":"https://ror.org/01an7q238","country_code":"US","type":"education","lineage":["https://openalex.org/I95457486"]}],"countries":["US"],"is_corresponding":false,"raw_author_name":"Chris Bender","raw_affiliation_strings":["University of California, Berkeley, Berkeley, CA, USA"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"University of California, Berkeley, Berkeley, CA, USA","institution_ids":["https://openalex.org/I95457486"]}]},{"author_position":"middle","author":{"id":null,"display_name":"Yiming Ding","orcid":null},"institutions":[{"id":"https://openalex.org/I95457486","display_name":"University of California, Berkeley","ror":"https://ror.org/01an7q238","country_code":"US","type":"education","lineage":["https://openalex.org/I95457486"]}],"countries":["US"],"is_corresponding":false,"raw_author_name":"Yiming Ding","raw_affiliation_strings":["University of California, Berkeley, Berkeley, CA, USA"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"University of California, Berkeley, Berkeley, CA, USA","institution_ids":["https://openalex.org/I95457486"]}]},{"author_position":"middle","author":{"id":null,"display_name":"Ruoxi Jia","orcid":null},"institutions":[{"id":"https://openalex.org/I859038795","display_name":"Virginia Tech","ror":"https://ror.org/02smfhw86","country_code":"US","type":"education","lineage":["https://openalex.org/I859038795"]}],"countries":["US"],"is_corresponding":false,"raw_author_name":"Ruoxi Jia","raw_affiliation_strings":["Virginia Tech, Blacksburg, VA, USA"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"Virginia Tech, Blacksburg, VA, USA","institution_ids":["https://openalex.org/I859038795"]}]},{"author_position":"middle","author":{"id":null,"display_name":"Bo Li","orcid":null},"institutions":[{"id":"https://openalex.org/I157725225","display_name":"University of Illinois Urbana-Champaign","ror":"https://ror.org/047426m28","country_code":"US","type":"education","lineage":["https://openalex.org/I157725225"]}],"countries":["US"],"is_corresponding":false,"raw_author_name":"Bo Li","raw_affiliation_strings":["University of Illinois at Urbana-Champaign, Champaign, IL, USA"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"University of Illinois at Urbana-Champaign, Champaign, IL, USA","institution_ids":["https://openalex.org/I157725225"]}]},{"author_position":"last","author":{"id":null,"display_name":"Dawn Song","orcid":null},"institutions":[{"id":"https://openalex.org/I95457486","display_name":"University of California, Berkeley","ror":"https://ror.org/01an7q238","country_code":"US","type":"education","lineage":["https://openalex.org/I95457486"]}],"countries":["US"],"is_corresponding":false,"raw_author_name":"Dawn Song","raw_affiliation_strings":["University of California, Berkeley, Berkeley, CA, USA"],"raw_orcid":null,"affiliations":[{"raw_affiliation_string":"University of California, Berkeley, Berkeley, CA, USA","institution_ids":["https://openalex.org/I95457486"]}]}],"institutions":[],"countries_distinct_count":2,"institutions_distinct_count":4,"corresponding_author_ids":[],"corresponding_institution_ids":[],"apc_list":null,"apc_paid":null,"fwci":6.888,"has_fulltext":true,"cited_by_count":65,"citation_normalized_percentile":{"value":0.97637166,"is_in_top_1_percent":false,"is_in_top_10_percent":true},"cited_by_percentile_year":{"min":98,"max":100},"biblio":{"volume":null,"issue":null,"first_page":"321","last_page":"335"},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T11689","display_name":"Adversarial Robustness in Machine Learning","score":0.9998000264167786,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T11689","display_name":"Adversarial Robustness in Machine Learning","score":0.9998000264167786,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T10764","display_name":"Privacy-Preserving Technologies in Data","score":0.996399998664856,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T10036","display_name":"Advanced Neural Network Applications","score":0.9952999949455261,"subfield":{"id":"https://openalex.org/subfields/1707","display_name":"Computer Vision and Pattern Recognition"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/watermark","display_name":"Watermark","score":0.8982999920845032},{"id":"https://openalex.org/keywords/digital-watermarking","display_name":"Digital watermarking","score":0.8701000213623047},{"id":"https://openalex.org/keywords/leverage","display_name":"Leverage (statistics)","score":0.7544000148773193},{"id":"https://openalex.org/keywords/deep-learning","display_name":"Deep learning","score":0.6710000038146973},{"id":"https://openalex.org/keywords/embedding","display_name":"Embedding","score":0.602400004863739},{"id":"https://openalex.org/keywords/forgetting","display_name":"Forgetting","score":0.5992000102996826},{"id":"https://openalex.org/keywords/deep-neural-networks","display_name":"Deep neural networks","score":0.5874999761581421}],"concepts":[{"id":"https://openalex.org/C164112704","wikidata":"https://www.wikidata.org/wiki/Q7974348","display_name":"Watermark","level":3,"score":0.8982999920845032},{"id":"https://openalex.org/C150817343","wikidata":"https://www.wikidata.org/wiki/Q875932","display_name":"Digital watermarking","level":3,"score":0.8701000213623047},{"id":"https://openalex.org/C153083717","wikidata":"https://www.wikidata.org/wiki/Q6535263","display_name":"Leverage (statistics)","level":2,"score":0.7544000148773193},{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.7342000007629395},{"id":"https://openalex.org/C108583219","wikidata":"https://www.wikidata.org/wiki/Q197536","display_name":"Deep learning","level":2,"score":0.6710000038146973},{"id":"https://openalex.org/C154945302","wikidata":"https://www.wikidata.org/wiki/Q11660","display_name":"Artificial intelligence","level":1,"score":0.6626999974250793},{"id":"https://openalex.org/C41608201","wikidata":"https://www.wikidata.org/wiki/Q980509","display_name":"Embedding","level":2,"score":0.602400004863739},{"id":"https://openalex.org/C7149132","wikidata":"https://www.wikidata.org/wiki/Q1377840","display_name":"Forgetting","level":2,"score":0.5992000102996826},{"id":"https://openalex.org/C2984842247","wikidata":"https://www.wikidata.org/wiki/Q197536","display_name":"Deep neural networks","level":3,"score":0.5874999761581421},{"id":"https://openalex.org/C50644808","wikidata":"https://www.wikidata.org/wiki/Q192776","display_name":"Artificial neural network","level":2,"score":0.5277000069618225},{"id":"https://openalex.org/C41065033","wikidata":"https://www.wikidata.org/wiki/Q2825412","display_name":"Adversary","level":2,"score":0.5242000222206116},{"id":"https://openalex.org/C119857082","wikidata":"https://www.wikidata.org/wiki/Q2539","display_name":"Machine learning","level":1,"score":0.42170000076293945},{"id":"https://openalex.org/C38652104","wikidata":"https://www.wikidata.org/wiki/Q3510521","display_name":"Computer security","level":1,"score":0.3409000039100647},{"id":"https://openalex.org/C51632099","wikidata":"https://www.wikidata.org/wiki/Q3985153","display_name":"Training set","level":2,"score":0.32839998602867126},{"id":"https://openalex.org/C2776145971","wikidata":"https://www.wikidata.org/wiki/Q30673951","display_name":"Labeled data","level":2,"score":0.32519999146461487},{"id":"https://openalex.org/C162307627","wikidata":"https://www.wikidata.org/wiki/Q204833","display_name":"Enhanced Data Rates for GSM Evolution","level":2,"score":0.29820001125335693},{"id":"https://openalex.org/C67186912","wikidata":"https://www.wikidata.org/wiki/Q367664","display_name":"Data modeling","level":2,"score":0.2897000014781952},{"id":"https://openalex.org/C204323151","wikidata":"https://www.wikidata.org/wiki/Q905424","display_name":"Range (aeronautics)","level":2,"score":0.2842999994754791},{"id":"https://openalex.org/C124101348","wikidata":"https://www.wikidata.org/wiki/Q172491","display_name":"Data mining","level":1,"score":0.2694000005722046}],"mesh":[],"locations_count":2,"locations":[{"id":"doi:10.1145/3433210.3453079","is_oa":true,"landing_page_url":"https://doi.org/10.1145/3433210.3453079","pdf_url":"https://dl.acm.org/doi/pdf/10.1145/3433210.3453079","source":null,"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Proceedings of the 2021 ACM Asia Conference on Computer and Communications Security","raw_type":"proceedings-article"},{"id":"pmh:oai:arXiv.org:1911.07205","is_oa":true,"landing_page_url":"http://arxiv.org/abs/1911.07205","pdf_url":"https://arxiv.org/pdf/1911.07205","source":{"id":"https://openalex.org/S4306400194","display_name":"arXiv (Cornell University)","issn_l":"2331-8422","issn":["2331-8422"],"is_oa":true,"is_in_doaj":false,"is_core":false,"host_organization":"https://openalex.org/I205783295","host_organization_name":"Cornell University","host_organization_lineage":["https://openalex.org/I205783295"],"host_organization_lineage_names":[],"type":"repository"},"license":null,"license_id":null,"version":"submittedVersion","is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"text"}],"best_oa_location":{"id":"doi:10.1145/3433210.3453079","is_oa":true,"landing_page_url":"https://doi.org/10.1145/3433210.3453079","pdf_url":"https://dl.acm.org/doi/pdf/10.1145/3433210.3453079","source":null,"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Proceedings of the 2021 ACM Asia Conference on Computer and Communications Security","raw_type":"proceedings-article"},"sustainable_development_goals":[],"awards":[{"id":"https://openalex.org/G1583218571","display_name":null,"funder_award_id":"FA8750-17-2-0091","funder_id":"https://openalex.org/F4320332180","funder_display_name":"Defense Advanced Research Projects Agency"},{"id":"https://openalex.org/G4713059963","display_name":null,"funder_award_id":"FA8750","funder_id":"https://openalex.org/F4320332180","funder_display_name":"Defense Advanced Research Projects Agency"},{"id":"https://openalex.org/G5510470933","display_name":"TWC: Medium: Collaborative: Aspire: Leveraging Automated Synthesis Technologies for Enhancing System Security","funder_award_id":"1409915","funder_id":"https://openalex.org/F4320306076","funder_display_name":"National Science Foundation"}],"funders":[{"id":"https://openalex.org/F4320306076","display_name":"National Science Foundation","ror":"https://ror.org/021nxhr62"},{"id":"https://openalex.org/F4320332180","display_name":"Defense Advanced Research Projects Agency","ror":"https://ror.org/02caytj08"}],"has_content":{"pdf":true,"grobid_xml":true},"content_urls":{"pdf":"https://content.openalex.org/works/W2985954225.pdf","grobid_xml":"https://content.openalex.org/works/W2985954225.grobid-xml"},"referenced_works_count":15,"referenced_works":["https://openalex.org/W1979631293","https://openalex.org/W2051267297","https://openalex.org/W2108598243","https://openalex.org/W2194775991","https://openalex.org/W2535690855","https://openalex.org/W2560647685","https://openalex.org/W2579318729","https://openalex.org/W2806082141","https://openalex.org/W2807363941","https://openalex.org/W2887995258","https://openalex.org/W2934843808","https://openalex.org/W2963857521","https://openalex.org/W2964082701","https://openalex.org/W3103836116","https://openalex.org/W6600424091"],"related_works":[],"abstract_inverted_index":{"Training":[0],"deep":[1,28],"neural":[2,29],"networks":[3,30],"from":[4,31,169,219],"scratch":[5],"could":[6,38,241],"be":[7,39,217],"computationally":[8],"expensive":[9],"and":[10,69,157,189,204,251,262],"requires":[11],"a":[12,51,73,83,87],"lot":[13],"of":[14,66,76,86,140,178,195,248,256],"training":[15,96,197],"data.":[16],"Recent":[17],"work":[18,105],"has":[19,94,99],"explored":[20],"different":[21],"watermarking":[22,77,109,260],"techniques":[23,37,129],"to":[24,41,216,245],"protect":[25],"the":[26,64,67,92,114,118,141,153,176,193,205,220,224,246,254,259,270],"pre-trained":[27,249],"potential":[32],"copyright":[33,247],"infringements.":[34],"However,":[35],"these":[36],"vulnerable":[40],"watermark":[42,53,182,202,238,266],"removal":[43,54,239],"attacks.":[44,271],"In":[45,79,185],"this":[46,122],"work,":[47],"we":[48,81,126,164],"propose":[49,127],"REFIT,":[50],"unified":[52],"framework":[55],"based":[56,237],"on":[57,63,106],"fine-tuning,":[58],"which":[59,98,147],"does":[60],"not":[61,100,213],"rely":[62],"knowledge":[65],"watermarks,":[68],"is":[70,148],"effective":[71,201],"against":[72,108,180,269],"wide":[74],"range":[75],"schemes.":[78,110,184],"particular,":[80,186],"conduct":[82],"comprehensive":[84],"study":[85],"realistic":[88],"attack":[89],"scenario":[90],"where":[91,163],"adversary":[93],"limited":[95],"data,":[97],"been":[101],"emphasized":[102],"in":[103],"prior":[104],"attacks":[107,240],"To":[111],"effectively":[112],"remove":[113],"watermarks":[115],"without":[116],"compromising":[117],"model":[119,228],"functionality":[120],"under":[121],"weak":[123],"threat":[124],"model,":[125],"two":[128],"that":[130,234],"are":[131],"incorporated":[132],"into":[133],"our":[134,235],"fine-tuning":[135,236],"framework:":[136],"(1)":[137],"an":[138],"adaption":[139],"elastic":[142],"weight":[143],"consolidation":[144],"(EWC)":[145],"algorithm,":[146],"originally":[149],"proposed":[150],"for":[151,200,210,227],"mitigating":[152],"catastrophic":[154],"forgetting":[155],"phenomenon;":[156],"(2)":[158],"unlabeled":[159,167,206],"data":[160,168,198,207,226],"augmentation":[161],"(AU),":[162],"leverage":[165],"auxiliary":[166],"other":[170],"sources.":[171],"Our":[172],"extensive":[173],"evaluation":[174],"shows":[175],"effectiveness":[177],"REFIT":[179],"diverse":[181],"embedding":[183,267],"both":[187],"EWC":[188],"AU":[190,211],"significantly":[191],"decrease":[192],"amount":[194],"labeled":[196],"needed":[199],"removal,":[203],"samples":[208],"used":[209],"do":[212],"necessarily":[214],"need":[215],"drawn":[218],"same":[221],"distribution":[222],"as":[223],"benign":[225],"evaluation.":[229],"The":[230],"experimental":[231],"results":[232],"demonstrate":[233],"pose":[242],"real":[243],"threats":[244],"models,":[250],"thus":[252],"highlight":[253],"importance":[255],"further":[257],"investigating":[258],"problem":[261],"proposing":[263],"more":[264],"robust":[265],"schemes":[268]},"counts_by_year":[{"year":2026,"cited_by_count":3},{"year":2025,"cited_by_count":15},{"year":2024,"cited_by_count":14},{"year":2023,"cited_by_count":13},{"year":2022,"cited_by_count":14},{"year":2021,"cited_by_count":6}],"updated_date":"2026-08-06T08:24:18.245995","created_date":"2019-11-22T00:00:00"}