Foundational generative models should be traceable to protect their owners
and facilitate safety regulation. To achieve this, traditional approaches embed
identifiers based on supervisory trigger-response signals, which are commonly
known as backdoor watermarks. They are prone to failure when the model is
fine-tuned with nontrigger data. Our experiments show that this vulnerability
is due to energetic changes in only a few 'busy' layers during fine-tuning.
This yields a novel arbitrary-in-arbitrary-out (AIAO) strategy that makes
watermarks resilient to fine-tuning-based removal. The trigger-response pairs
of AIAO samples across various neural network depths can be used to construct
watermarked subpaths, employing Monte Carlo sampling to achieve stable
verification results. In addition, unlike the existing methods of designing a
backdoor for the input/output space of diffusion models, in our method, we
propose to embed the backdoor into the feature space of sampled subpaths, where
a mask-controlled trigger function is proposed to preserve the generation
performance and ensure the invisibility of the embedded backdoor. Our empirical
studies on the MS-COCO, AFHQ, LSUN, CUB-200, and DreamBooth datasets confirm
the robustness of AIAO; while the verification rates of other trigger-based
methods fall from ~90% to ~70% after fine-tuning, those of our method remain
consistently above 90%.

发现基础生成模型应该可追溯，以保护其所有者并促进安全监管，本文提出了一种新的任意入任意出策略（AIAO）来使水印抵抗基于微调的删除，并使用蒙特卡洛采样来实现稳定的验证结果。通过在各种神经网络深度上使用 AIAO 样本的触发响应对构建带水印的子路径，将后门嵌入采样子路径的特征空间中，并提出了一个掩码控制的触发函数来保持生成性能和嵌入后门的隐形性，实证研究证实了 AIAO 的健壮性，验证率始终保持在 90% 以上。

利用懒惰层提升微调扩散模型的可追踪性

Lazy Layers to Make Fine-Tuned Diffusion Models More Traceable

Embedding as a Service (EaaS) has become a widely adopted solution, which
offers feature extraction capabilities for addressing various downstream tasks
in Natural Language Processing (NLP). Prior studies have shown that EaaS can be
prone to model extraction attacks; nevertheless, this concern could be
mitigated by adding backdoor watermarks to the text embeddings and subsequently
verifying the attack models post-publication. Through the analysis of the
recent watermarking strategy for EaaS, EmbMarker, we design a novel CSE
(Clustering, Selection, Elimination) attack that removes the backdoor watermark
while maintaining the high utility of embeddings, indicating that the previous
watermarking approach can be breached. In response to this new threat, we
propose a new protocol to make the removal of watermarks more challenging by
incorporating multiple possible watermark directions. Our defense approach,
WARDEN, notably increases the stealthiness of watermarks and empirically has
been shown effective against CSE attack.

Embedding as a Service (EaaS) 是一个被广泛采用的解决方案，它提供了用于处理自然语言处理（NLP）中各种下游任务的特征提取功能。然而，之前的研究表明 EaaS 可能容易受到模型提取攻击的影响，为了缓解这一问题，可以通过向文本嵌入添加后门水印，并在发布后验证攻击模型。通过对最近的 EaaS 水印策略 EmbMarker 的分析，我们设计了一种新的 CSE（聚类、选择、淘汰）攻击，它可以去除后门水印并保持嵌入的高效性，表明之前的水印方法可以被攻破。针对这一新的威胁，我们提出了一个新的协议，通过整合多个可能的水印方向，使水印的去除更加困难。我们的防御方法 WARDEN 显著增加了水印的隐蔽性，并经实证表明对抗 CSE 攻击有效。