AWEncoder: Adversarial Watermarking Pre-Trained Encoders in Contrastive Learning

Round 1

Reviewer 1 Report

In this paper, authors have suggested  an adversarial method for watermarking the pre-trained encoder in contrastive learning. The paper is interesting and can be a good contribution. 

1.  The abstract needs revision by including the experimental outcomes.

2. The objective of the work need to clearly stated. I woud suggest a separate paragraph to discuss the present issues and 

3. The proposed work should consider some recent and related works. Also, how the given work is comparable with its merits and issues with the work suggested in: https://doi.org/10.1007/s12652-021-03365-9

4. The watermark generation and retrival process needs to be discussed more clearly with illustration.

5. I would suggest to discuss the results of the approach by considering somemore approaches, such as sensitivity, f-score etc. 

6. Revise the conclusion by considering future scope and implications of the suggested work.

Author Response

Please see the attachment.

Author Response File: Author Response.pdf

Reviewer 2 Report

The authors present AWEncoder, which is an adversarial approach for watermarking the pre-trained encoder in contrastive learning. As an adversarial perturbation, the watermark is first generated by causing the training samples to be tagged in a manner that deviates from their respective locations and surrounds a randomly picked key picture in the embedding space. The watermark is then integrated within the pre-trained encoder by refining a joint loss function further. As a result, the watermarked encoder not only works exceptionally well for downstream tasks but also enables authentication of its ownership by examining the disparity between the encoder's white-box and black-box outputs. Numerous studies confirm the superiority and application of the presented work by demonstrating that it is quite effective and robust across a variety of contrastive learning algorithms and downstream tasks. The following queries must be answered and included in the revised manuscript before resubmission--

1. Figure 1 depicts the overall structure of the proposed method. The symbols used in the text are not shown in the figure. Please include the symbols in the figure. 

2. To achieve this goal, the authors minimized the loss during perturbation optimization. Please explain in detail.

3. What is \alpha? Why the value of \alpha is 40?

4. How does the mathematical formula affect the outcome? I cannot connect the two.

5. Please compare the algorithm with the existing methods.

 

 

Author Response

Please see the attachment

Author Response File: Author Response.pdf