{"id":"https://openalex.org/W4387846550","doi":"https://doi.org/10.1145/3583780.3615211","title":"Exposing Model Theft: A Robust and Transferable Watermark for Thwarting Model Extraction Attacks","display_name":"Exposing Model Theft: A Robust and Transferable Watermark for Thwarting Model Extraction Attacks","publication_year":2023,"publication_date":"2023-10-21","ids":{"openalex":"https://openalex.org/W4387846550","doi":"https://doi.org/10.1145/3583780.3615211"},"language":"en","primary_location":{"id":"doi:10.1145/3583780.3615211","is_oa":false,"landing_page_url":"https://doi.org/10.1145/3583780.3615211","pdf_url":null,"source":null,"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Proceedings of the 32nd ACM International Conference on Information and Knowledge Management","raw_type":"proceedings-article"},"type":"conference-paper","indexed_in":["crossref"],"open_access":{"is_oa":false,"oa_status":"closed","oa_url":null,"any_repository_has_fulltext":false},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5101660251","display_name":"Ruixiang Tang","orcid":"https://orcid.org/0000-0001-6476-2336"},"institutions":[{"id":"https://openalex.org/I74775410","display_name":"Rice University","ror":"https://ror.org/008zs3103","country_code":"US","type":"education","lineage":["https://openalex.org/I74775410"]}],"countries":["US"],"is_corresponding":false,"raw_author_name":"Ruixiang Tang","raw_affiliation_strings":["Rice University, Houston, USA"],"raw_orcid":"https://orcid.org/0000-0001-6476-2336","affiliations":[{"raw_affiliation_string":"Rice University, Houston, USA","institution_ids":["https://openalex.org/I74775410"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5063597595","display_name":"Hongye Jin","orcid":"https://orcid.org/0009-0009-7920-632X"},"institutions":[{"id":"https://openalex.org/I91045830","display_name":"Texas A&M University","ror":"https://ror.org/01f5ytq51","country_code":"US","type":"education","lineage":["https://openalex.org/I91045830"]}],"countries":["US"],"is_corresponding":false,"raw_author_name":"Hongye Jin","raw_affiliation_strings":["Texas A&M Univeristy, College Station, TX, USA"],"raw_orcid":"https://orcid.org/0009-0009-7920-632X","affiliations":[{"raw_affiliation_string":"Texas A&M Univeristy, College Station, TX, USA","institution_ids":["https://openalex.org/I91045830"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5072191151","display_name":"Mengnan Du","orcid":"https://orcid.org/0000-0002-1614-6069"},"institutions":[{"id":"https://openalex.org/I118118575","display_name":"New Jersey Institute of Technology","ror":"https://ror.org/05e74xb87","country_code":"US","type":"education","lineage":["https://openalex.org/I118118575"]}],"countries":["US"],"is_corresponding":false,"raw_author_name":"Mengnan Du","raw_affiliation_strings":["New Jersey Institute of Technology, Newark, USA"],"raw_orcid":"https://orcid.org/0000-0002-1614-6069","affiliations":[{"raw_affiliation_string":"New Jersey Institute of Technology, Newark, USA","institution_ids":["https://openalex.org/I118118575"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5060359867","display_name":"Curtis Wigington","orcid":"https://orcid.org/0009-0002-2051-0043"},"institutions":[{"id":"https://openalex.org/I1306409833","display_name":"Adobe Systems (United States)","ror":"https://ror.org/059tvcg64","country_code":"US","type":"company","lineage":["https://openalex.org/I1306409833"]}],"countries":["US"],"is_corresponding":false,"raw_author_name":"Curtis Wigington","raw_affiliation_strings":["Adobe, San Francisco, USA"],"raw_orcid":"https://orcid.org/0009-0002-2051-0043","affiliations":[{"raw_affiliation_string":"Adobe, San Francisco, USA","institution_ids":["https://openalex.org/I1306409833"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5075098193","display_name":"R. Jain","orcid":"https://orcid.org/0000-0002-8305-2206"},"institutions":[{"id":"https://openalex.org/I1306409833","display_name":"Adobe Systems (United States)","ror":"https://ror.org/059tvcg64","country_code":"US","type":"company","lineage":["https://openalex.org/I1306409833"]}],"countries":["US"],"is_corresponding":false,"raw_author_name":"Rajiv Jain","raw_affiliation_strings":["Adobe, San Francisco, USA"],"raw_orcid":"https://orcid.org/0000-0002-8305-2206","affiliations":[{"raw_affiliation_string":"Adobe, San Francisco, USA","institution_ids":["https://openalex.org/I1306409833"]}]},{"author_position":"last","author":{"id":"https://openalex.org/A5068477431","display_name":"Xia Hu","orcid":"https://orcid.org/0000-0003-2234-3226"},"institutions":[{"id":"https://openalex.org/I74775410","display_name":"Rice University","ror":"https://ror.org/008zs3103","country_code":"US","type":"education","lineage":["https://openalex.org/I74775410"]}],"countries":["US"],"is_corresponding":false,"raw_author_name":"Xia Hu","raw_affiliation_strings":["Rice Univeristy, Houston, USA"],"raw_orcid":"https://orcid.org/0000-0003-2234-3226","affiliations":[{"raw_affiliation_string":"Rice Univeristy, Houston, USA","institution_ids":["https://openalex.org/I74775410"]}]}],"institutions":[],"countries_distinct_count":1,"institutions_distinct_count":4,"corresponding_author_ids":[],"corresponding_institution_ids":[],"apc_list":null,"apc_paid":null,"fwci":null,"has_fulltext":false,"cited_by_count":7,"citation_normalized_percentile":null,"cited_by_percentile_year":null,"biblio":{"volume":null,"issue":null,"first_page":"4315","last_page":"4319"},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T11689","display_name":"Adversarial Robustness in Machine Learning","score":0.9998999834060669,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T11689","display_name":"Adversarial Robustness in Machine Learning","score":0.9998999834060669,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T10764","display_name":"Privacy-Preserving Technologies in Data","score":0.988099992275238,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T10036","display_name":"Advanced Neural Network Applications","score":0.9708999991416931,"subfield":{"id":"https://openalex.org/subfields/1707","display_name":"Computer Vision and Pattern Recognition"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/watermark","display_name":"Watermark","score":0.874121904373169},{"id":"https://openalex.org/keywords/digital-watermarking","display_name":"Digital watermarking","score":0.8430906534194946},{"id":"https://openalex.org/keywords/computer-science","display_name":"Computer science","score":0.8175440430641174},{"id":"https://openalex.org/keywords/embedding","display_name":"Embedding","score":0.6243700385093689},{"id":"https://openalex.org/keywords/computer-security","display_name":"Computer security","score":0.5904685854911804},{"id":"https://openalex.org/keywords/transferability","display_name":"Transferability","score":0.5701427459716797},{"id":"https://openalex.org/keywords/artificial-intelligence","display_name":"Artificial intelligence","score":0.44457584619522095},{"id":"https://openalex.org/keywords/memorization","display_name":"Memorization","score":0.41787800192832947},{"id":"https://openalex.org/keywords/data-mining","display_name":"Data mining","score":0.36790788173675537},{"id":"https://openalex.org/keywords/machine-learning","display_name":"Machine learning","score":0.332328200340271},{"id":"https://openalex.org/keywords/image","display_name":"Image (mathematics)","score":0.09750860929489136}],"concepts":[{"id":"https://openalex.org/C164112704","wikidata":"https://www.wikidata.org/wiki/Q7974348","display_name":"Watermark","level":3,"score":0.874121904373169},{"id":"https://openalex.org/C150817343","wikidata":"https://www.wikidata.org/wiki/Q875932","display_name":"Digital watermarking","level":3,"score":0.8430906534194946},{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.8175440430641174},{"id":"https://openalex.org/C41608201","wikidata":"https://www.wikidata.org/wiki/Q980509","display_name":"Embedding","level":2,"score":0.6243700385093689},{"id":"https://openalex.org/C38652104","wikidata":"https://www.wikidata.org/wiki/Q3510521","display_name":"Computer security","level":1,"score":0.5904685854911804},{"id":"https://openalex.org/C61272859","wikidata":"https://www.wikidata.org/wiki/Q7834031","display_name":"Transferability","level":3,"score":0.5701427459716797},{"id":"https://openalex.org/C154945302","wikidata":"https://www.wikidata.org/wiki/Q11660","display_name":"Artificial intelligence","level":1,"score":0.44457584619522095},{"id":"https://openalex.org/C30038468","wikidata":"https://www.wikidata.org/wiki/Q4354775","display_name":"Memorization","level":2,"score":0.41787800192832947},{"id":"https://openalex.org/C124101348","wikidata":"https://www.wikidata.org/wiki/Q172491","display_name":"Data mining","level":1,"score":0.36790788173675537},{"id":"https://openalex.org/C119857082","wikidata":"https://www.wikidata.org/wiki/Q2539","display_name":"Machine learning","level":1,"score":0.332328200340271},{"id":"https://openalex.org/C115961682","wikidata":"https://www.wikidata.org/wiki/Q860623","display_name":"Image (mathematics)","level":2,"score":0.09750860929489136},{"id":"https://openalex.org/C33923547","wikidata":"https://www.wikidata.org/wiki/Q395","display_name":"Mathematics","level":0,"score":0.0},{"id":"https://openalex.org/C145420912","wikidata":"https://www.wikidata.org/wiki/Q853077","display_name":"Mathematics education","level":1,"score":0.0},{"id":"https://openalex.org/C140331021","wikidata":"https://www.wikidata.org/wiki/Q1868104","display_name":"Logit","level":2,"score":0.0}],"mesh":[],"locations_count":1,"locations":[{"id":"doi:10.1145/3583780.3615211","is_oa":false,"landing_page_url":"https://doi.org/10.1145/3583780.3615211","pdf_url":null,"source":null,"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"Proceedings of the 32nd ACM International Conference on Information and Knowledge Management","raw_type":"proceedings-article"}],"best_oa_location":null,"sustainable_development_goals":[{"id":"https://metadata.un.org/sdg/16","score":0.5,"display_name":"Peace, Justice and strong institutions"}],"awards":[{"id":"https://openalex.org/G2160449544","display_name":null,"funder_award_id":"CNS-1816497","funder_id":"https://openalex.org/F4320306076","funder_display_name":"National Science Foundation"},{"id":"https://openalex.org/G235902017","display_name":null,"funder_award_id":"NS-1816497,IIS-1849085,IS-2224843","funder_id":"https://openalex.org/F4320306076","funder_display_name":"National Science Foundation"},{"id":"https://openalex.org/G2693525634","display_name":"S&AS: INT: Autonomous Experimentation Platform for Accelerating Manufacturing of Advanced Materials","funder_award_id":"1849085","funder_id":"https://openalex.org/F4320306076","funder_display_name":"National Science Foundation"},{"id":"https://openalex.org/G5560190241","display_name":null,"funder_award_id":"IIS-1849085","funder_id":"https://openalex.org/F4320306076","funder_display_name":"National Science Foundation"},{"id":"https://openalex.org/G5757292629","display_name":"SaTC: CORE: Small: Adversarial Learning via Modeling Interpretation","funder_award_id":"1816497","funder_id":"https://openalex.org/F4320306076","funder_display_name":"National Science Foundation"},{"id":"https://openalex.org/G8272762023","display_name":"CAREER: Human-Centric Big Network Embedding","funder_award_id":"2224843","funder_id":"https://openalex.org/F4320306076","funder_display_name":"National Science Foundation"}],"funders":[{"id":"https://openalex.org/F4320306076","display_name":"National Science Foundation","ror":"https://ror.org/021nxhr62"}],"has_content":{"pdf":false,"grobid_xml":false},"content_urls":null,"referenced_works_count":7,"referenced_works":["https://openalex.org/W2294710185","https://openalex.org/W2807363941","https://openalex.org/W2942091739","https://openalex.org/W2963303354","https://openalex.org/W3081178496","https://openalex.org/W4313555702","https://openalex.org/W4383199672"],"related_works":["https://openalex.org/W2137394636","https://openalex.org/W2358993821","https://openalex.org/W1516446231","https://openalex.org/W1559740347","https://openalex.org/W2098152888","https://openalex.org/W2040356834","https://openalex.org/W2385289568","https://openalex.org/W2381486749","https://openalex.org/W1514507288","https://openalex.org/W2183032046"],"abstract_inverted_index":{"The":[0],"increasing":[1],"prevalence":[2],"of":[3,26,42,76,141],"Deep":[4],"Neural":[5],"Networks":[6],"(DNNs)":[7],"in":[8,131],"cloud-based":[9],"services":[10],"has":[11],"led":[12],"to":[13,30,37,59,79,96,106,118,126],"their":[14,158],"widespread":[15],"use":[16],"through":[17],"various":[18],"APIs.":[19,82],"However,":[20],"recent":[21],"studies":[22],"reveal":[23],"the":[24,43,74,89,101,104,124,128,132,139],"susceptibility":[25],"these":[27],"public":[28],"APIs":[29,154],"model":[31,45,94,125],"extraction":[32],"attacks,":[33],"where":[34],"adversaries":[35],"attempt":[36],"create":[38],"a":[39,86,113],"local":[40],"duplicate":[41],"private":[44],"using":[46],"data":[47],"and":[48],"API-generated":[49],"predictions.":[50],"Existing":[51],"defense":[52],"methods":[53],"often":[54],"involve":[55],"perturbing":[56],"prediction":[57],"distributions":[58],"hinder":[60],"an":[61],"attacker's":[62],"training":[63],"goals,":[64],"inadvertently":[65],"affecting":[66],"API":[67],"utility.":[68,159],"In":[69],"this":[70],"study,":[71],"we":[72,136],"extend":[73],"concept":[75],"digital":[77],"watermarking":[78],"protect":[80],"DNNs'":[81],"We":[83,111],"suggest":[84],"embedding":[85],"watermark":[87,120],"into":[88],"safeguarded":[90],"APIs;":[91],"thus,":[92],"any":[93,108],"attempting":[95],"copy":[97],"will":[98],"inherently":[99],"carry":[100],"watermark,":[102],"allowing":[103],"defender":[105],"verify":[107],"suspicious":[109],"models.":[110],"propose":[112],"simple":[114],"yet":[115],"effective":[116],"framework":[117,149],"increase":[119],"transferability.":[121],"By":[122],"requiring":[123],"memorize":[127],"preset":[129],"watermarks":[130,153],"final":[133],"decision":[134],"layers,":[135],"significantly":[137],"enhance":[138],"transferability":[140],"watermarks.":[142],"Comprehensive":[143],"experiments":[144],"show":[145],"that":[146],"our":[147],"proposed":[148],"not":[150],"only":[151],"successfully":[152],"but":[155],"also":[156],"maintains":[157]},"counts_by_year":[{"year":2026,"cited_by_count":1},{"year":2025,"cited_by_count":4},{"year":2024,"cited_by_count":2}],"updated_date":"2026-07-14T23:27:15.235271","created_date":"2025-10-10T00:00:00"}