{"about":{"site":"https://codewithpapers.app","non_affiliation":"Code with Papers and Syntology are not affiliated with, endorsed by, or sponsored by Papers with Code, Meta, or the pwc-archive mirror.","licence":"CC BY-SA 4.0","licence_url":"https://creativecommons.org/licenses/by-sa/4.0/legalcode","attribution":"https://codewithpapers.app/attribution","modified":"archive material modified by Syntology; see the attribution page"},"url":"/paper/refit-a-unified-watermark-removal-framework","title":"REFIT: A Unified Watermark Removal Framework For Deep Learning Systems With Limited Data","arxiv_id":"1911.07205","date":"2019-11-17","proceeding":null,"authors":["Xinyun Chen","Wenxiao Wang","Chris Bender","Yiming Ding","Ruoxi Jia","Bo Li","Dawn Song"],"abstract":"Training deep neural networks from scratch could be computationally expensive and requires a lot of training data. Recent work has explored different watermarking techniques to protect the pre-trained deep neural networks from potential copyright infringements. However, these techniques could be vulnerable to watermark removal attacks. In this work, we propose REFIT, a unified watermark removal framework based on fine-tuning, which does not rely on the knowledge of the watermarks, and is effective against a wide range of watermarking schemes. In particular, we conduct a comprehensive study of a realistic attack scenario where the adversary has limited training data, which has not been emphasized in prior work on attacks against watermarking schemes. To effectively remove the watermarks without compromising the model functionality under this weak threat model, we propose two techniques that are incorporated into our fine-tuning framework: (1) an adaption of the elastic weight consolidation (EWC) algorithm, which is originally proposed for mitigating the catastrophic forgetting phenomenon; and (2) unlabeled data augmentation (AU), where we leverage auxiliary unlabeled data from other sources. Our extensive evaluation shows the effectiveness of REFIT against diverse watermark embedding schemes. In particular, both EWC and AU significantly decrease the amount of labeled training data needed for effective watermark removal, and the unlabeled data samples used for AU do not necessarily need to be drawn from the same distribution as the benign data for model evaluation. The experimental results demonstrate that our fine-tuning based watermark removal attacks could pose real threats to the copyright of pre-trained models, and thus highlight the importance of further investigating the watermarking problem and proposing more robust watermark embedding schemes against the attacks.","url_abs":"https://arxiv.org/abs/1911.07205v3","url_pdf":"https://arxiv.org/pdf/1911.07205v3.pdf","source":{"archive":"pwc-archive (Hugging Face), CC BY-SA 4.0","snapshot":"2025-07-28","licence_url":"https://creativecommons.org/licenses/by-sa/4.0/legalcode","row_kind":"abstracts"},"code_links":[{"paper_slug":"refit-a-unified-watermark-removal-framework","repo_url":"https://github.com/sunblaze-ucb/REFIT","is_official":1,"mentioned_in_paper":0,"mentioned_in_github":1,"framework":"pytorch","reach":{"status":"ok","spdx":"MIT"}}],"tasks":[],"methods":[{"method_slug":"ewc","method_name":"EWC"}],"datasets_introduced":[],"methods_introduced":[],"results":[],"syntology":{"syntology_url":"https://syntology.ai/paper/1911.07205","atlas_url":"https://app.syntology.ai/?focus=1911.07205","mcp":{"get_harvested_code_for_paper":{"arxiv_id":"1911.07205"}},"developers":"https://syntology.ai/developers","read_at":"2026-09-25T09:33:49+00:00","read_at_is":"when the build read Syntology's graph, not when any sample ran","claim":"Per-sample execution status on synthesized fixtures; not a correctness claim about the paper. Samples come from repositories linked to the paper, official or community; repo_kind says which.","repos":[{"provenance":"external:paperswithcode_snapshot_2025-07-28","url":"https://github.com/sunblaze-ucb/REFIT","reach":{"status":"ok","spdx":"MIT"}}],"summary":{"ran_violates":1,"ran_draft_wrong":2,"ran":1,"unverified":9},"by_repo_kind":{"official":{"samples":13,"ran":4,"repositories":1}},"repo_kind_vocabulary":{"official":"The archive marks this repository official for the paper","named_in_paper":"The archive records that the paper mentions this repository; it is not marked official","listed":"In the archive's code links for this paper, not marked official and not recorded as mentioned in the paper","found_in_text":"Syntology found this repository in the paper's own text; whether it is the authors' implementation is not asserted","community":"Not in the archive's code links for this paper; a community repository Syntology harvested"},"n_pointer_only_for_licence":0,"samples":[{"code_sha256_prefix":"89c2cf3b97685684","entry":"is_image_file","repo":"sunblaze-ucb/REFIT","repo_kind":"official","path":"helpers/ImageFolderCustomClass.py","file_url":"https://github.com/sunblaze-ucb/REFIT/blob/HEAD/helpers/ImageFolderCustomClass.py","link_basis":"harvester_set","language":"python","status":"ran_violates","verification_level":2,"contract_check":"VIOLATES","metamorphic_tier":"deterministic","behaviour_fingerprint":false,"licence":"MIT","inline_ok":true,"mcp_get_code":{"code_sha256":"89c2cf3b97685684"}},{"code_sha256_prefix":"583f9780bdd00a45","entry":"conv3x3","repo":"sunblaze-ucb/REFIT","repo_kind":"official","path":"models/resnet.py","file_url":"https://github.com/sunblaze-ucb/REFIT/blob/HEAD/models/resnet.py","link_basis":"harvester_set","language":"python","status":"ran_draft_wrong","verification_level":1,"contract_check":"OUTPUT_MISDECLARED","metamorphic_tier":"deterministic","behaviour_fingerprint":false,"licence":"MIT","inline_ok":true,"mcp_get_code":{"code_sha256":"583f9780bdd00a45"}},{"code_sha256_prefix":"52d10a10fb72fb9f","entry":"find_classes","repo":"sunblaze-ucb/REFIT","repo_kind":"official","path":"helpers/ImageFolderCustomClass.py","file_url":"https://github.com/sunblaze-ucb/REFIT/blob/HEAD/helpers/ImageFolderCustomClass.py","link_basis":"harvester_set","language":"python","status":"ran","verification_level":1,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"MIT","inline_ok":true,"mcp_get_code":{"code_sha256":"52d10a10fb72fb9f"}},{"code_sha256_prefix":"eba3f5bcc6a06d36","entry":"make_layers","repo":"sunblaze-ucb/REFIT","repo_kind":"official","path":"models/vgg.py","file_url":"https://github.com/sunblaze-ucb/REFIT/blob/HEAD/models/vgg.py","link_basis":"harvester_set","language":"python","status":"ran_draft_wrong","verification_level":1,"contract_check":"OUTPUT_MISDECLARED","metamorphic_tier":"deterministic","behaviour_fingerprint":false,"licence":"MIT","inline_ok":true,"mcp_get_code":{"code_sha256":"eba3f5bcc6a06d36"}},{"code_sha256_prefix":"5be98d688bd61bb8","entry":"CrossEnt","repo":"sunblaze-ucb/REFIT","repo_kind":"official","path":"trainer.py","file_url":"https://github.com/sunblaze-ucb/REFIT/blob/HEAD/trainer.py","link_basis":"first_harvest_node","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"MIT","inline_ok":true,"mcp_get_code":{"code_sha256":"5be98d688bd61bb8"}},{"code_sha256_prefix":"71d1106f4fa83bbf","entry":"EW","repo":"sunblaze-ucb/REFIT","repo_kind":"official","path":"models/resnet_EW.py","file_url":"https://github.com/sunblaze-ucb/REFIT/blob/HEAD/models/resnet_EW.py","link_basis":"first_harvest_node","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"MIT","inline_ok":true,"mcp_get_code":{"code_sha256":"71d1106f4fa83bbf"}},{"code_sha256_prefix":"e7a01929bc0117b9","entry":"IsInside","repo":"sunblaze-ucb/REFIT","repo_kind":"official","path":"trainer.py","file_url":"https://github.com/sunblaze-ucb/REFIT/blob/HEAD/trainer.py","link_basis":"first_harvest_node","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"MIT","inline_ok":true,"mcp_get_code":{"code_sha256":"e7a01929bc0117b9"}},{"code_sha256_prefix":"69cbf822514eee69","entry":"RandomTransform","repo":"sunblaze-ucb/REFIT","repo_kind":"official","path":"trainer.py","file_url":"https://github.com/sunblaze-ucb/REFIT/blob/HEAD/trainer.py","link_basis":"first_harvest_node","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"MIT","inline_ok":true,"mcp_get_code":{"code_sha256":"69cbf822514eee69"}},{"code_sha256_prefix":"ecf0fac9b2121967","entry":"ResNet18","repo":"sunblaze-ucb/REFIT","repo_kind":"official","path":"models/resnet.py","file_url":"https://github.com/sunblaze-ucb/REFIT/blob/HEAD/models/resnet.py","link_basis":"first_harvest_node","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"MIT","inline_ok":true,"mcp_get_code":{"code_sha256":"ecf0fac9b2121967"}},{"code_sha256_prefix":"32995a3e11d321e9","entry":"ResNet18_Basic","repo":"sunblaze-ucb/REFIT","repo_kind":"official","path":"models/resnet.py","file_url":"https://github.com/sunblaze-ucb/REFIT/blob/HEAD/models/resnet.py","link_basis":"first_harvest_node","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"MIT","inline_ok":true,"mcp_get_code":{"code_sha256":"32995a3e11d321e9"}},{"code_sha256_prefix":"195faaace44890e8","entry":"make_dataset","repo":"sunblaze-ucb/REFIT","repo_kind":"official","path":"helpers/ImageFolderCustomClass.py","file_url":"https://github.com/sunblaze-ucb/REFIT/blob/HEAD/helpers/ImageFolderCustomClass.py","link_basis":"first_harvest_node","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"MIT","inline_ok":true,"mcp_get_code":{"code_sha256":"195faaace44890e8"}},{"code_sha256_prefix":"d3ce4f9536a5b7a7","entry":"unpickle","repo":"sunblaze-ucb/REFIT","repo_kind":"official","path":"datasets/imagenet32.py","file_url":"https://github.com/sunblaze-ucb/REFIT/blob/HEAD/datasets/imagenet32.py","link_basis":"first_harvest_node","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"MIT","inline_ok":true,"mcp_get_code":{"code_sha256":"d3ce4f9536a5b7a7"}},{"code_sha256_prefix":"03738bb3906b9d93","entry":"vgg16_bn","repo":"sunblaze-ucb/REFIT","repo_kind":"official","path":"models/vgg.py","file_url":"https://github.com/sunblaze-ucb/REFIT/blob/HEAD/models/vgg.py","link_basis":"first_harvest_node","language":"python","status":"unverified","verification_level":0,"contract_check":null,"metamorphic_tier":null,"behaviour_fingerprint":false,"licence":"MIT","inline_ok":true,"mcp_get_code":{"code_sha256":"03738bb3906b9d93"}}]},"arxiv_metadata":null,"syntology_extracted_results":null}