{"about":{"site":"https://codewithpapers.app","non_affiliation":"Code with Papers and Syntology are not affiliated with, endorsed by, or sponsored by Papers with Code, Meta, or the pwc-archive mirror.","licence":"CC BY-SA 4.0","licence_url":"https://creativecommons.org/licenses/by-sa/4.0/legalcode","attribution":"https://codewithpapers.app/attribution","modified":"archive material modified by Syntology; see the attribution page"},"url":"/paper/certified-neural-network-watermarks-with","title":"Certified Neural Network Watermarks with Randomized Smoothing","arxiv_id":"2207.07972","date":"2022-07-16","proceeding":null,"authors":["Arpit Bansal","Ping-Yeh Chiang","Michael Curry","Rajiv Jain","Curtis Wigington","Varun Manjunatha","John P Dickerson","Tom Goldstein"],"abstract":"Watermarking is a commonly used strategy to protect creators' rights to digital images, videos and audio. Recently, watermarking methods have been extended to deep learning models -- in principle, the watermark should be preserved when an adversary tries to copy the model. However, in practice, watermarks can often be removed by an intelligent adversary. Several papers have proposed watermarking methods that claim to be empirically resistant to different types of removal attacks, but these new techniques often fail in the face of new or better-tuned adversaries. In this paper, we propose a certifiable watermarking method. Using the randomized smoothing technique proposed in Chiang et al., we show that our watermark is guaranteed to be unremovable unless the model parameters are changed by more than a certain l2 threshold. In addition to being certifiable, our watermark is also empirically more robust compared to previous watermarking methods. Our experiments can be reproduced with code at https://github.com/arpitbansal297/Certified_Watermarks","url_abs":"https://arxiv.org/abs/2207.07972v1","url_pdf":"https://arxiv.org/pdf/2207.07972v1.pdf","source":{"archive":"pwc-archive (Hugging Face), CC BY-SA 4.0","snapshot":"2025-07-28","licence_url":"https://creativecommons.org/licenses/by-sa/4.0/legalcode","row_kind":"abstracts"},"code_links":[{"paper_slug":"certified-neural-network-watermarks-with","repo_url":"https://github.com/arpitbansal297/certified_watermarks","is_official":1,"mentioned_in_paper":1,"mentioned_in_github":0,"framework":"pytorch","reach":null}],"tasks":[],"methods":[{"method_slug":"randomized-smoothing","method_name":"Randomized Smoothing"}],"datasets_introduced":[],"methods_introduced":[],"results":[],"syntology":{"atlas_url":"https://app.syntology.ai/?focus=2207.07972","mcp":{"get_harvested_code_for_paper":{"arxiv_id":"2207.07972"}},"developers":"https://syntology.ai/developers","read_at":"2026-09-24T18:15:14+00:00","read_at_is":"when the build read Syntology's graph, not when any sample ran","claim":"Per-sample execution status on synthesized fixtures; not a correctness claim about the paper. Samples come from repositories linked to the paper, official or community; repo_kind says which.","repos":[{"provenance":"external:paperswithcode_snapshot_2025-07-28","url":"https://github.com/arpitbansal297/certified_watermarks","reach":null}],"summary":{"ran_fixture":1,"unverified":3},"by_repo_kind":{"official":{"samples":4,"ran":1,"repositories":1}},"repo_kind_vocabulary":{"official":"The archive marks this repository official for the paper","named_in_paper":"The archive records that the paper mentions this repository; it is not marked official","listed":"In the archive's code links for this paper, not marked official and not recorded as mentioned in the paper","found_in_text":"Syntology found this repository in the paper's own text; whether it is the authors' implementation is not asserted","community":"Not in the archive's code links for this paper; a community repository Syntology harvested"},"n_pointer_only_for_licence":4,"samples":[{"code_sha256_prefix":"c065f29237558c1a","entry":"test","repo":"arpitbansal297/certified_watermarks","repo_kind":"official","path":"cifar10.py","file_url":"https://github.com/arpitbansal297/certified_watermarks/blob/HEAD/cifar10.py","link_basis":"first_harvest_node","language":"python","status":"ran_fixture","verification_level":1,"contract_check":"RAISES","metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"NONE","inline_ok":false,"mcp_get_code":{"code_sha256":"c065f29237558c1a"}},{"code_sha256_prefix":"f747f44e1bfe0ab8","entry":"certify","repo":"arpitbansal297/certified_watermarks","repo_kind":"official","path":"cifar10_certify.py","file_url":"https://github.com/arpitbansal297/certified_watermarks/blob/HEAD/cifar10_certify.py","link_basis":"first_harvest_node","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"NONE","inline_ok":false,"mcp_get_code":{"code_sha256":"f747f44e1bfe0ab8"}},{"code_sha256_prefix":"c941e2cba771fba3","entry":"train","repo":"arpitbansal297/certified_watermarks","repo_kind":"official","path":"cifar10.py","file_url":"https://github.com/arpitbansal297/certified_watermarks/blob/HEAD/cifar10.py","link_basis":"first_harvest_node","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"NONE","inline_ok":false,"mcp_get_code":{"code_sha256":"c941e2cba771fba3"}},{"code_sha256_prefix":"e0ec4ac28744d6c7","entry":"train_robust","repo":"arpitbansal297/certified_watermarks","repo_kind":"official","path":"cifar10.py","file_url":"https://github.com/arpitbansal297/certified_watermarks/blob/HEAD/cifar10.py","link_basis":"first_harvest_node","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"NONE","inline_ok":false,"mcp_get_code":{"code_sha256":"e0ec4ac28744d6c7"}}]},"arxiv_metadata":null,"syntology_extracted_results":null}