{"id":"347e34f1-79f1-4041-8787-178b4d5da4d1","arxiv_id":"2411.13047","paper_version":2,"verdict":"CONDITIONAL","confidence":"MODERATE","novelty_score":6.0,"correctness_risk":"medium","formal_verification":"none","parameter_count":5,"one_line_summary":"A backdoor watermarking scheme for object detectors that poisons bounding-box coordinates in API responses, enabling near-perfect detection of extracted models in several settings.","lead":"This paper proposes a watermarking defense that subtly distorts the bounding boxes returned by an object-detection API for a secret trigger class, so that any model trained on those responses inherits a detectable signature. The owner can later query a suspect model and, by measuring its bounding-box distortions, determine whether it was copied.","discovery_kind":"new_application","skeptic_critique":{"model":"deepseek-v4-flash","headline":"The 100% AUROC claim is conditional on uncontrolled overlap between the trigger cluster and the attacker's substitute data; the paper's own non-i.i.d. run at p=1% gives AUROC 4%, so the method fails when substitute data is not in-distribution.","rationale":"This concern is load-bearing because the entire watermark is carried by poisoned responses entering the attacker's training data; if no trigger objects appear in the substitute set, the suspiciousness score of Eq. (6) has nothing to separate. The paper's non-i.i.d. result is direct evidence that the method is not robust to the degree of overlap: at p=1% with COCO substitutes, actual poisoning was only 0.60% and AUROC fell to 4.0%, far below the headline 100%. The paper honestly acknowledges the failure mode in Sec 7.2 and lists data-free MEAs as future work, but the acknowledgement does not remove the load: the defender cannot observe or control the attacker's substitute distribution at deployment time, so the operating point of the defense is unverifiable. Within the stated threat model (attacker with in-domain substitute data), the method is well supported: 30 models per configuration, multiple datasets, and robustness checks against pruning and finetuning are credible evidence. The reader's weakest_assumption identifies the same dependency, and I agree with that choice. A secondary issue, the absence of a deployment threshold, is real but less fundamental: a threshold can be calibrated if one is willing to simulate attacks, whereas the trigger-overlap dependency cannot be repaired by calibration. Therefore the verdict remains CONDITIONAL: the method is plausible and empirically validated for in-distribution extraction, but the scope of the 100% claim must be narrowed or stated as conditional on sufficient trigger-cluster overlap in the substitute data.","tokens_in":16005,"tokens_out":13943,"duration_ms":150028,"concrete_test":"Run a controlled non-i.i.d. sweep with a fixed target (VOC07, delta=1.1) and several substitute sets at increasing feature-space distance from the trigger cluster, e.g., COCO minitrain, an OpenImages subset, and a disjoint synthetic set. For each set, compute the actual poisoning ratio (fraction of substitute-training objects whose target-model features fall inside the trigger epsilon-balls) and the verification AUROC at p=1%, 2%, and 3%. If AUROC drops below the reported 100% whenever the actual poisoning ratio is below about 1%, the central claim is conditional on a quantity the defender cannot control, and the paper must state this dependency explicitly.","verdict_should_be":"UNCHANGED","load_bearing_attack":"The central mechanism only works if poisoned responses enter the attacker's substitute training set. The trigger is a DBSCAN cluster on the defender's training-set features (Sec 5.3, Alg. 1), so whether any attacker query is poisoned is determined by the overlap between that cluster and the attacker's substitute data, which the defender does not control and cannot observe. The paper's own non-i.i.d. experiment (Sec 7.2) quantifies the fragility: with a VOC07 target and COCO minitrain substitute, the actual poisoning ratio at nominal p=1% is 0.60% and verification AUROC is 4.0%, worse than random; p=3% and p=5% reach 100% only because the actual ratios rise to 0.63% and 2.72%. Sec 7.2 concedes that with no overlap, 'no query responses will be poisoned,' so BBW fails entirely. Thus the abstract's '100% accuracy in a wide variety of experimental scenarios' is not a property of BBW itself; it is conditional on a distributional overlap parameter that is never measured or bounded in the threat model. Unless the defender can guarantee or estimate that the attacker's substitute data contains trigger-cluster objects above some threshold, the central security claim is unsupported for general MEAs.","agreement_with_reader":"agree"},"referee_report":{"model":"deepseek-v4-flash","summary":"The paper proposes BBW, a backdoor-based watermarking defense against model extraction attacks (MEAs) on object detectors. The defender poisons API responses by distorting bounding boxes (BBs) of objects that fall into a trigger cluster, defined via DBSCAN on features of the defender's training data. Extracted models trained on poisoned responses learn to output distorted BBs only for trigger objects. Verification computes a suspiciousness score S (Eq. (6)) as the ratio of mean prediction inconsistency on trigger vs. nontrigger paired objects, and the model is judged extracted if S is sufficiently large. Experiments on VOC07, TrafficSigns, and CityPersons with YOLOv8 report AUROC up to 100% in numerous configurations, plus ablations comparing compact vs. random trigger clusters and robustness to pruning, finetuning, and an adaptive attacker that filters odd BBs.","tokens_in":16283,"tokens_out":2907,"duration_ms":31823,"significance":"If the central claim holds, BBW would be the first backdoor-based watermarking defense that is practical, stealthy, and functionality-preserving for object-detection APIs. The work covers three datasets, six poisoning magnitudes, and three poisoning ratios, and includes quantitative verification results, visual evidence of the watermark, and robustness studies against common countermeasures. The experimental breadth is a strength, as is the explicit analysis of the compact trigger cluster and the honest reporting of failure cases such as the non-i.i.d. transferability experiment in Sec. 7.2. The significance is, however, conditional on a distributional overlap assumption between the defender's trigger cluster and the attacker's substitute data; the paper acknowledges this but does not integrate it into the formal claim or the abstract.","major_comments":[{"comment":"The verifiability condition in Eq. (2) is stated as S(fw(Dkey)) > S(fn(Dkey)) for all fw, fn in the function space, but the paper's own Sec. 7.2 shows a setting where this fails: with VOC07 target and COCO minitrain substitute data at nominal p=1% (actual poisoning ratio 0.60%), the verification AUROC is 4.0%, worse than random. This directly contradicts the universal quantifier in Eq. (2). The formal claim must be restricted to models that arise under a specified overlap condition, or the condition must be rephrased as a probabilistic statement with an explicit dependence on the actual poisoning ratio.","section":"§4, Eq. (2)"},{"comment":"The trigger cluster is defined on the defender's training-set features, while the poisoning effect depends on whether the attacker's substitute data contains objects whose features fall in the trigger cluster. The defender neither controls nor observes this overlap, yet the threat model in Sec. 4 only says the attacker 'can collect substitute data of the target domain' without quantifying what that implies. The paper should either state and defend a precise distributional-overlap assumption, or provide an estimator/bound for the actual poisoning ratio from observable query statistics. Without this, the abstract's '100% accuracy in a wide variety of experimental scenarios' overstates what is established; the non-i.i.d. result at p=1% is a concrete counterexample.","section":"§5.3 and §7.2"},{"comment":"All AUROC values are reported as point estimates from 30 benign and 30 extracted models per configuration, with no confidence intervals or significance tests. The 100.0% values are especially sensitive to this because a single misordered score would lower the estimate. Please report exact binomial/Wilcoxon intervals or at least the number of misordered pairs, so that 'complete verification' is statistically grounded rather than a point estimate.","section":"§6.2, Table 2"},{"comment":"The Faster R-CNN transferability experiment is reported only as three AUROC numbers, with the CityPersons failure attributed to poor extracted-model performance (mAP50 11.74%). This is reasonable, but the claim that BBW 'is expected to work effectively even against strong MEAs' needs more support: a stronger extracted model can also learn to ignore a subtle BB distortion, especially if the substitute data distribution differs from the defender's. At minimum, the experiment should be interpreted with the same distributional-overlap caveat applied to the YOLOv8 experiments.","section":"§7.2"}],"minor_comments":[{"comment":"The scale-based inconsistency metric uses sgn(δw−1) and sgn(δh−1) as exponents; when δw and δh differ, the metric mixes multiplication and inversion in a way that is not intuitively explained. A brief justification of this choice would improve readability.","section":"§5.2, Eq. (8)"},{"comment":"The column labeled '1.0' in Table 2 reports results for baseline models that were trained on unpoisoned responses, not on poisoned responses with magnitude 1.0. Renaming the column to 'baseline' or adding a footnote would avoid confusion.","section":"§6.1, Table 2"},{"comment":"The compact-vs-random ablation adjusts epsilon so that the union of balls contains approximately n_sub × p objects in the substitute set, but Table C.3 shows that the actual poisoning ratio can deviate from the nominal p (e.g., CityPersons 5% nominal vs. 3.55% actual). Stating the actual poisoning ratios used in the random-cluster condition would strengthen the comparison.","section":"§7.1, Table 3"},{"comment":"The text says key-sets 'do not need to be annotated,' but Eq. (5) requires pairing objects between the target and suspicious model outputs using labels and IoU. The intended meaning is that ground-truth human annotations are not needed; please clarify to avoid ambiguity.","section":"Appendix A.2"}],"recommendation":"major_revision","confidential_remarks":"The core idea is original and the experiments are broad, but the paper's headline claim is stronger than what the evidence supports. The non-i.i.d. experiment in Sec. 7.2 is the key weakness; it is honestly reported but should be elevated to a first-class condition in the formal statement and abstract. If the authors can specify the overlap assumption or provide a conservative bound on the actual poisoning ratio, the contribution would be substantially more convincing. I would not recommend rejection because the failure mode is identified and the method is clearly applicable in the in-distribution case; the fix is a reframing plus additional analysis rather than a new method."},"author_rebuttal":null,"desk_editor":{"model":"deepseek-v4-flash","letter":"First thing you should know: this is a genuine first — applying response-poisoning backdoor watermarking to object detectors as a guard against model extraction. The core trick is simple and believable: the API slightly expands or shrinks bounding boxes only on objects that fall into a compact trigger cluster, so an extracted model trained on those poisoned responses inherits the distortion, while benign models don't. The verification score compares prediction inconsistency on trigger vs. non-trigger objects. It works convincingly in the in-distribution regime.\n\nThe paper earns its place. Experiments span three datasets, six poisoning magnitudes, three ratios, and 30 seeds per condition. They include an ablation showing the compact DBSCAN cluster beats a random one, and robustness checks against pruning, finetuning, and an adaptive attacker with an 'odd BB detector.' The histograms in Fig. 3 match the intended mechanism, and the non-i.i.d. experiment in Sec. 7.2 is an honest stress test. Credit where due: the authors state plainly that if the substitute data and training data do not overlap, BBW fails because no poisoned responses reach the attacker.\n\nThe soft spots are real but not disqualifying. The main one is the headline claim. '100% accuracy in a wide variety of experimental scenarios' is true only when the attacker's substitute data contains enough trigger-cluster objects. The defender does not control or observe that overlap, and the paper never measures or bounds it. Their own non-i.i.d. run shows AUROC dropping to 4% at p=1% because the actual poisoning ratio was 0.60%. That is a conditional result, not a property of the method, and the abstract overstates it. Also, AUROCs are reported without confidence intervals, and there is no explicit decision threshold for the suspiciousness score — you get a rank metric, not a deployable rule. Eq. (2) claims universal verifiability across all models, but the support is empirical, not formal.\n\nWho is this for? Security researchers working on model extraction defenses and OD watermarking. It deserves a serious referee. I would accept with major revision: add CIs, give a concrete threshold, and rewrite the abstract and conclusion to make the distributional-overlap condition part of the threat model rather than a caveat. The mechanism is sound enough to build on.","headline":"The first backdoor watermarking defense for object detectors, with solid experiments and a real but openly acknowledged fragility when the attacker's substitute data sits outside the defender's training distribution.","tokens_in":16790,"tokens_out":2573,"would_cite":true,"duration_ms":24293,"reading_group":"yes","serious_thinker":"yes","would_accept_peer_review":true},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":{"msc":[],"pacs":[],"model":"deepseek-v4-flash","headline":"The paper proposes bounding-box watermarking (BBW), which injects a backdoor into extracted object detectors by subtly resizing the bounding boxes of trigger objects in API responses, and reports that this watermark reliably identifies…","keywords":["model extraction attack","backdoor watermarking","object detection","bounding-box poisoning","API response poisoning","trigger cluster","model ownership verification","deep learning security"],"falsifier":"Train an extracted model on substitute data whose object features lie entirely outside the defender's trigger cluster, for instance using COCO images when the target was trained on VOC07, and compute the suspiciousness score from Eq. (6); the paper reports verification AUROC collapsing to 4.0% at a 1% nominal poisoning ratio in exactly this non-i.i.d. setting. A systematic sweep that maps verification AUROC as a function of distribution overlap between trigger cluster and substitute data would settle the conditions under which the verifiability condition Eq. (2) actually holds.","tokens_in":15778,"feed_emoji":"🎯","tokens_out":6771,"duration_ms":63350,"temperature":0.7,"pith_summary":"The paper is trying to establish that model extraction attacks on object detectors can be detected after the fact using a backdoor-based watermark that is practical, stealthy, and functionality-preserving. It proposes bounding-box watermarking (BBW), which alters only the geometry of bounding boxes in API responses for a small, compact class of trigger objects. If the attacker trains a copy on those responses, the copy learns to output distorted boxes on trigger objects, and a ratio-based suspiciousness score can pick it out. The reported experiments show perfect or near-perfect verification accuracy across a wide range of poisoning ratios and box-rescaling magnitudes on three datasets. The significance is that ownership of a stolen detector can be demonstrated through its public API without degrading detection accuracy.","feed_headline":"Tiny bounding-box edits expose copied object detectors","feed_subtitle":"By resizing boxes on just 2% of API responses, the defense identifies extracted models with 100% AUROC in tests.","key_machinery":"The central object is the bounding-box watermark itself: a poisoner that rescales the width and height of predicted boxes on trigger objects by a factor δ, a trigger indicator defined as membership in a compact density-based cluster of object feature vectors, and the suspiciousness score S that compares prediction inconsistency on trigger versus non-trigger objects. The mechanism works by making the backdoor a geometric bias on a semantically coherent object class: any model trained on poisoned responses inherits the bias, while non-extracted models do not.","core_discovery":"The paper claims that a defender operating an object-detection API can watermark any model extracted from it by silently resizing the predicted bounding boxes of a predefined set of trigger objects, while leaving labels and all other boxes unchanged. Because the attacker trains the extracted model on these poisoned API responses, the extracted model inherits a backdoor: it outputs slightly distorted boxes only on trigger objects. During verification, the defender queries both the original and the suspicious model with a key-set containing trigger and non-trigger objects, pairs up detections by category and IoU overlap, and computes the suspiciousness score S in Eq. (6): the average prediction inconsistency on trigger objects divided by the same average on non-trigger objects. A watermarked model scores well above 1, while a non-watermarked model scores close to 1. The paper reports AUROC of 100% in many configurations on VOC07, TrafficSigns, and CityPersons, including a case where only 2% of API responses are poisoned with a 1.05x box expansion.","pith_inferences":["Because BBW poisons only the geometry of the output, the same recipe should transfer to other structured-prediction APIs, such as segmentation masks, keypoints, or tracking boxes, where a small geometric distortion on a compact trigger class can act as a watermark.","The compact-trigger-cluster principle suggests a general rule for response-poisoning watermarks: the more semantically coherent the poisoned subspace, the easier it is for any trained copy to learn the backdoor; this could be tested by varying cluster compactness while holding the poisoning ratio fixed.","The distribution-overlap dependency points to an arms race: an attacker who can estimate the defender's trigger subspace and avoid it in substitute queries could suppress the backdoor, so a practical extension would be an adaptive trigger that tracks the substitute distribution."],"forward_implications":["Watermark verification requires only API access to the suspicious model; no internal weights or training data are needed.","Because the poison changes only box dimensions, legitimate users keep functionally correct detections; the paper reports watermarked models' mAP50 stays close to the baseline.","The watermark survives common countermeasures: weight pruning and finetuning remove it only when the extracted model's detection capability also collapses.","The trigger design is transferable across model architectures; BBW verified extracted Faster R-CNN models on VOC07 and TrafficSigns with 100% AUROC in tested configurations.","The verification logic is robust to imperfect adaptive attackers: when an odd-box detector removes 80% of poisoned responses, a weaker backdoor still remains and partially preserves the watermark signal."],"supporting_citations":[{"why":"Defines model extraction attacks via prediction APIs, the threat BBW defends against.","marker":"[24]"},{"why":"Establishes backdoor-based DNN watermarking, the foundation BBW adapts to object detection.","marker":"[3]"},{"why":"Introduces response-poisoning watermarking against model extraction and supplies the threat model BBW extends from classification to detection.","marker":"[22]"},{"why":"Provides the density-based clustering algorithm used to select the compact trigger cluster.","marker":"[9]"},{"why":"Describes BadDet, an existing backdoor attack on object detectors that BBW contrasts with on practicality, stealth, and functionality preservation.","marker":"[5]"},{"why":"Introduces fine-pruning, the backdoor-removal countermeasure BBW is evaluated against.","marker":"[14]"},{"why":"Demonstrates finetuning-based backdoor mitigation, another countermeasure BBW is tested against.","marker":"[20]"},{"why":"Cites data-free model extraction as the threat BBW does not yet cover.","marker":"[25]"}],"fun_headline_variants":["Bounding-box tweaks watermark stolen object detectors","Silent box resizes fingerprint extracted object detectors","Object detector watermarking via subtle box changes","Box resizing backdoors expose model thieves"],"cache_read_input_tokens":3200,"weakest_assumption_plain":"The defender's trigger objects must actually appear in the data the attacker uses to train the extracted model; if the attacker's substitute data does not overlap the trigger cluster, no poisoned response ever reaches the extracted model and the watermark cannot form.","fun_headline_variants_meta":{"raw":{"variants":["Bounding-box tweaks watermark stolen object detectors","Silent box resizes fingerprint extracted object detectors","Object detector watermarking via subtle box changes","Box resizing backdoors expose model thieves"]},"model":"deepseek-v4-flash","effort":"low","cost_usd":0.000166,"raw_usage":{"total_tokens":1261,"prompt_tokens":958,"completion_tokens":303,"prompt_tokens_details":{"cached_tokens":384},"prompt_cache_hit_tokens":384,"prompt_cache_miss_tokens":574,"completion_tokens_details":{"reasoning_tokens":246}},"tokens_in":574,"tokens_out":303,"duration_ms":3369,"temperature":1.0,"reasoning_tokens":246,"cache_read_input_tokens":384,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-08-12T16:53:38.753393+00:00","model_set":{"reader":"deepseek-v4-flash"},"falsifier":"Train an extracted model on substitute data whose object features lie entirely outside the defender's trigger cluster, for instance using COCO images when the target was trained on VOC07, and compute the suspiciousness score from Eq. (6); the paper reports verification AUROC collapsing to 4.0% at a 1% nominal poisoning ratio in exactly this non-i.i.d. setting. A systematic sweep that maps verification AUROC as a function of distribution overlap between trigger cluster and substitute data would settle the conditions under which the verifiability condition Eq. (2) actually holds.","supporting_citations":[{"cited_title":"Reiter, and Thomas Ristenpart","cited_arxiv_id":null,"evidence_quote":"Defines model extraction attacks via prediction APIs, the threat BBW defends against."},{"cited_title":"Turning your weakness into a strength: Watermarking deep neural networks by backdooring","cited_arxiv_id":null,"evidence_quote":"Establishes backdoor-based DNN watermarking, the foundation BBW adapts to object detection."},{"cited_title":null,"cited_arxiv_id":null,"evidence_quote":"Introduces response-poisoning watermarking against model extraction and supplies the threat model BBW extends from classification to detection."},{"cited_title":"A density-based algorithm for discovering clusters in large spatial databases with noise","cited_arxiv_id":null,"evidence_quote":"Provides the density-based clustering algorithm used to select the compact trigger cluster."},{"cited_title":"Baddet: Backdoor attacks on object detection","cited_arxiv_id":null,"evidence_quote":"Describes BadDet, an existing backdoor attack on object detectors that BBW contrasts with on practicality, stealth, and functionality preservation."},{"cited_title":"Fine- pruning: Defending against backdooring attacks on deep neural networks","cited_arxiv_id":null,"evidence_quote":"Introduces fine-pruning, the backdoor-removal countermeasure BBW is evaluated against."},{"cited_title":"Walls, and Nicolas Papernot","cited_arxiv_id":null,"evidence_quote":"Cites data-free model extraction as the threat BBW does not yet cover."}],"review_version":1}