{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,2,22]],"date-time":"2026-02-22T07:01:17Z","timestamp":1771743677158,"version":"3.50.1"},"publisher-location":"Singapore","reference-count":41,"publisher":"Springer Nature Singapore","isbn-type":[{"value":"9789819570805","type":"print"},{"value":"9789819570812","type":"electronic"}],"license":[{"start":{"date-parts":[[2026,1,1]],"date-time":"2026-01-01T00:00:00Z","timestamp":1767225600000},"content-version":"tdm","delay-in-days":0,"URL":"https:\/\/www.springernature.com\/gp\/researchers\/text-and-data-mining"},{"start":{"date-parts":[[2026,1,1]],"date-time":"2026-01-01T00:00:00Z","timestamp":1767225600000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/www.springernature.com\/gp\/researchers\/text-and-data-mining"}],"content-domain":{"domain":["link.springer.com"],"crossmark-restriction":false},"short-container-title":[],"published-print":{"date-parts":[[2026]]},"DOI":"10.1007\/978-981-95-7081-2_4","type":"book-chapter","created":{"date-parts":[[2026,2,22]],"date-time":"2026-02-22T06:46:21Z","timestamp":1771742781000},"page":"51-67","update-policy":"https:\/\/doi.org\/10.1007\/springer_crossmark_policy","source":"Crossref","is-referenced-by-count":0,"title":["Watermarking Counterfactual Explanations"],"prefix":"10.1007","author":[{"ORCID":"https:\/\/orcid.org\/0009-0000-6277-9003","authenticated-orcid":false,"given":"Hangzhi","family":"Guo","sequence":"first","affiliation":[]},{"ORCID":"https:\/\/orcid.org\/0009-0006-3043-6309","authenticated-orcid":false,"given":"Firdaus Ahmed","family":"Choudhury","sequence":"additional","affiliation":[]},{"ORCID":"https:\/\/orcid.org\/0000-0002-6152-3804","authenticated-orcid":false,"given":"Tinghua","family":"Chen","sequence":"additional","affiliation":[]},{"ORCID":"https:\/\/orcid.org\/0009-0005-4638-9140","authenticated-orcid":false,"given":"Amulya","family":"Yadav","sequence":"additional","affiliation":[]}],"member":"297","published-online":{"date-parts":[[2026,2,23]]},"reference":[{"key":"4_CR1","unstructured":"A\u00efvodji, U., Bolot, A., Gambs, S.: Model extraction from counterfactual explanations. arXiv preprint arXiv:2009.01884 (2020)"},{"key":"4_CR2","unstructured":"Ash, R.B.: Information Theory. Courier Corporation (2012)"},{"key":"4_CR3","doi-asserted-by":"crossref","unstructured":"Bhatt, U., et al.: Explainable machine learning in deployment. In: Proceedings of the 2020 conference on fairness, accountability, and transparency. pp. 648\u2013657 (2020)","DOI":"10.1145\/3351095.3375624"},{"key":"4_CR4","unstructured":"Chandrasekaran, V., Chaudhuri, K., Giacomelli, I., Jha, S., Yan, S.: Exploring connections between active learning and model extraction. In: 29th USENIX Security Symposium (USENIX Security 20). pp. 1309\u20131326 (2020)"},{"key":"4_CR5","doi-asserted-by":"publisher","unstructured":"Chen, T., Guestrin, C.: Xgboost: A scalable tree boosting system. In: Proceedings of the 22nd ACM SIGKDD International Conference on Knowledge Discovery and Data Mining. p. 785\u2013794. KDD \u201916, Association for Computing Machinery, New York, NY, USA (2016). https:\/\/doi.org\/10.1145\/2939672.2939785, https:\/\/doi.org\/10.1145\/2939672.2939785","DOI":"10.1145\/2939672.2939785"},{"key":"4_CR6","unstructured":"Dua, D., Graff, C.: UCI machine learning repository (2017). http:\/\/archive.ics.uci.edu\/ml"},{"key":"4_CR7","unstructured":"FICO: Explainable machine learning challenge. https:\/\/community.fico.com\/s\/explainable-machine-learning-challenge (2018)"},{"key":"4_CR8","unstructured":"Finn, C., Abbeel, P., Levine, S.: Model-agnostic meta-learning for fast adaptation of deep networks. In: International conference on machine learning. pp. 1126\u20131135. PMLR (2017)"},{"issue":"5","key":"4_CR9","doi-asserted-by":"publisher","first-page":"1","DOI":"10.1145\/3608482","volume":"14","author":"S Goethals","year":"2023","unstructured":"Goethals, S., S\u00f6rensen, K., Martens, D.: The privacy issue of counterfactual explanations: explanation linkage attacks. ACM Trans. Intell. Sys. Tech. 14(5), 1\u201324 (2023)","journal-title":"ACM Trans. Intell. Sys. Tech."},{"key":"4_CR10","doi-asserted-by":"publisher","unstructured":"Guo, H., Jia, F., Chen, J., Squicciarini, A., Yadav, A.: Rocoursenet: Robust training of a prediction aware recourse model. In: Proceedings of the 32nd ACM International Conference on Information and Knowledge Management. p. 619\u2013628. CIKM \u201923, Association for Computing Machinery, New York, NY, USA (2023). https:\/\/doi.org\/10.1145\/3583780.3615040, https:\/\/doi.org\/10.1145\/3583780.3615040","DOI":"10.1145\/3583780.3615040"},{"key":"4_CR11","doi-asserted-by":"publisher","unstructured":"Guo, H., Nguyen, T.H., Yadav, A.: Counternet: End-to-end training of prediction aware counterfactual explanations. In: Proceedings of the 29th ACM SIGKDD Conference on Knowledge Discovery and Data Mining. p. 577\u2013589. KDD \u201923, Association for Computing Machinery, New York, NY, USA (2023). https:\/\/doi.org\/10.1145\/3580305.3599290, https:\/\/doi.org\/10.1145\/3580305.3599290","DOI":"10.1145\/3580305.3599290"},{"key":"4_CR12","first-page":"12080","volume":"33","author":"WR Huang","year":"2020","unstructured":"Huang, W.R., Geiping, J., Fowl, L., Taylor, G., Goldstein, T.: Metapoison: practical general-purpose clean-label data poisoning. Adv. Neural. Inf. Process. Syst. 33, 12080\u201312091 (2020)","journal-title":"Adv. Neural. Inf. Process. Syst."},{"key":"4_CR13","unstructured":"Jagielski, M., Carlini, N., Berthelot, D., Kurakin, A., Papernot, N.: High accuracy and high fidelity extraction of neural networks. In: 29th USENIX security symposium (USENIX Security 20). pp. 1345\u20131362 (2020)"},{"key":"4_CR14","unstructured":"Jia, H., Choquette-Choo, C.A., Chandrasekaran, V., Papernot, N.: Entangled watermarks as a defense against model extraction. In: 30th USENIX security symposium (USENIX Security 21). pp. 1937\u20131954 (2021)"},{"key":"4_CR15","doi-asserted-by":"crossref","unstructured":"Juuti, M., Szyller, S., Marchal, S., Asokan, N.: Prada: protecting against dnn model stealing attacks. In: 2019 IEEE European Symposium on Security and Privacy (EuroS&P). pp. 512\u2013527. IEEE (2019)","DOI":"10.1109\/EuroSP.2019.00044"},{"key":"4_CR16","doi-asserted-by":"crossref","unstructured":"Karimi, A.H., Sch\u00f6lkopf, B., Valera, I.: Algorithmic recourse: from counterfactual explanations to interventions. In: Proceedings of the 2021 ACM Conference on Fairness, Accountability, and Transparency. pp. 353\u2013362 (2021)","DOI":"10.1145\/3442188.3445899"},{"key":"4_CR17","unstructured":"Kirchenbauer, J., Geiping, J., Wen, Y., Katz, J., Miers, I., Goldstein, T.: A watermark for large language models. In: International Conference on Machine Learning. pp. 17061\u201317084. PMLR (2023)"},{"key":"4_CR18","doi-asserted-by":"crossref","unstructured":"Laugel, T., Lesot, M.J., Marsala, C., Renard, X., Detyniecki, M.: Inverse classification for comparison-based interpretability in machine learning. arXiv preprint arXiv:1712.08443 (2017)","DOI":"10.1007\/978-3-319-91473-2_9"},{"key":"4_CR19","doi-asserted-by":"crossref","unstructured":"Li, M., Mickel, A., Taylor, S.: \u201cshould this loan be approved or denied?\u201d: alarge dataset with class assignment guidelines. J. Statis. Edu. 26(1), 55\u201366 (2018)","DOI":"10.1080\/10691898.2018.1434342"},{"key":"4_CR20","first-page":"13238","volume":"35","author":"Y Li","year":"2022","unstructured":"Li, Y., Bai, Y., Jiang, Y., Yang, Y., Xia, S.T., Li, B.: Untargeted backdoor watermark: Towards harmless and stealthy dataset copyright protection. Adv. Neural. Inf. Process. Syst. 35, 13238\u201313250 (2022)","journal-title":"Adv. Neural. Inf. Process. Syst."},{"key":"4_CR21","doi-asserted-by":"publisher","unstructured":"Liu, K., Dolan-Gavitt, B., Garg, S.: Fine-pruning: Defending against backdooring attacks on deep neural networks. In: Bailey, M., Holz, T., Stamatogiannakis, M., Ioannidis, S. (eds.) International symposium on research in attacks, intrusions, and defenses. Vol. 11050, pp. 273\u2013294. Springer, Cham (2018). https:\/\/doi.org\/10.1007\/978-3-030-00470-5_13","DOI":"10.1007\/978-3-030-00470-5_13"},{"key":"4_CR22","doi-asserted-by":"crossref","unstructured":"Liu, Y., Xie, Y., Srivastava, A.: Neural trojans. In: 2017 IEEE International Conference on Computer Design (ICCD). pp. 45\u201348. IEEE (2017)","DOI":"10.1109\/ICCD.2017.16"},{"key":"4_CR23","doi-asserted-by":"crossref","unstructured":"Mothilal, R.K., Sharma, A., Tan, C.: Explaining machine learning classifiers through diverse counterfactual explanations. In: Proceedings of the 2020 Conference on Fairness, Accountability, and Transparency. pp. 607\u2013617 (2020)","DOI":"10.1145\/3351095.3372850"},{"key":"4_CR24","doi-asserted-by":"crossref","unstructured":"Pawelczyk, M., Broelemann, K., Kasneci, G.: Learning model-agnostic counterfactual explanations for tabular data. In: Proceedings of The Web Conference 2020. pp. 3126\u20133132 (2020)","DOI":"10.1145\/3366423.3380087"},{"key":"4_CR25","unstructured":"Pawelczyk, M., Lakkaraju, H., Neel, S.: On the privacy risks of algorithmic recourse. In: International Conference on Artificial Intelligence and Statistics. pp. 9680\u20139696. PMLR (2023)"},{"issue":"7","key":"4_CR26","first-page":"579","volume":"8","author":"MC Popescu","year":"2009","unstructured":"Popescu, M.C., Balas, V.E., Perescu-Popescu, L., Mastorakis, N.: Multilayer perceptron and neural networks. WSEAS Trans. Cir. and Sys. 8(7), 579\u2013588 (2009)","journal-title":"WSEAS Trans. Cir. and Sys."},{"key":"4_CR27","unstructured":"Shaban, A., Cheng, C.A., Hatch, N., Boots, B.: Truncated back-propagation for bilevel optimization. In: The 22nd International Conference on Artificial Intelligence and Statistics. pp. 1723\u20131732. PMLR (2019)"},{"key":"4_CR28","doi-asserted-by":"crossref","unstructured":"Shokri, R., Strobel, M., Zick, Y.: On the privacy risks of model explanations. In: Proceedings of the 2021 AAAI\/ACM Conference on AI, Ethics, and Society. pp. 231\u2013241 (2021)","DOI":"10.1145\/3461702.3462533"},{"key":"4_CR29","unstructured":"Sokol, K., Flach, P.: Counterfactual explanations of machine learning predictions: opportunities and challenges for ai safety. In: 2019 AAAI Workshop on Artificial Intelligence Safety, SafeAI 2019. CEUR Workshop Proceedings (2019)"},{"key":"4_CR30","doi-asserted-by":"crossref","unstructured":"Song, C., Ristenpart, T., Shmatikov, V.: Machine learning models that remember too much. In: Proceedings of the 2017 ACM SIGSAC Conference on computer and communications security. pp. 587\u2013601 (2017)","DOI":"10.1145\/3133956.3134077"},{"key":"4_CR31","doi-asserted-by":"crossref","unstructured":"Szyller, S., Atli, B.G., Marchal, S., Asokan, N.: Dawn: Dynamic adversarial watermarking of neural networks. In: Proceedings of the 29th ACM International Conference on Multimedia. pp. 4417\u20134425 (2021)","DOI":"10.1145\/3474085.3475591"},{"key":"4_CR32","unstructured":"Tang, M., et al.: Modelguard: Information-theoretic defense against model extraction attacks. In: 33rd USENIX Security Symposium (Security 2024) (2024)"},{"key":"4_CR33","unstructured":"Tram\u00e8r, F., Zhang, F., Juels, A., Reiter, M.K., Ristenpart, T.: Stealing machine learning models via prediction $$\\{$$APIs$$\\}$$. In: 25th USENIX security symposium (USENIX Security 16). pp. 601\u2013618 (2016)"},{"key":"4_CR34","doi-asserted-by":"crossref","unstructured":"Ustun, B., Spangher, A., Liu, Y.: Actionable recourse in linear classification. In: Proceedings of the Conference on Fairness, Accountability, and Transparency. pp. 10\u201319 (2019)","DOI":"10.1145\/3287560.3287566"},{"key":"4_CR35","unstructured":"Verma, S., Dickerson, J., Hines, K.: Counterfactual explanations for machine learning: A review. arXiv preprint arXiv:2010.10596 (2020)"},{"key":"4_CR36","doi-asserted-by":"crossref","unstructured":"Vo, V., et al.: Feature-based learning for diverse and privacy-preserving counterfactual explanations. In: Proceedings of the 29th ACM SIGKDD Conference on Knowledge Discovery and Data Mining. pp. 2211\u20132222 (2023)","DOI":"10.1145\/3580305.3599343"},{"key":"4_CR37","first-page":"841","volume":"31","author":"S Wachter","year":"2017","unstructured":"Wachter, S., Mittelstadt, B., Russell, C.: Counterfactual explanations without opening the black box: automated decisions and the gdpr. Harv. JL & Tech. 31, 841 (2017)","journal-title":"Harv. JL & Tech."},{"key":"4_CR38","doi-asserted-by":"crossref","unstructured":"Wang, Y., Qian, H., Miao, C.: Dualcf: Efficient model extraction attack from counterfactual explanations. In: Proceedings of the 2022 ACM Conference on Fairness, Accountability, and Transparency. pp. 1318\u20131329 (2022)","DOI":"10.1145\/3531146.3533188"},{"key":"4_CR39","first-page":"16913","volume":"34","author":"D Wu","year":"2021","unstructured":"Wu, D., Wang, Y.: Adversarial neuron pruning purifies backdoored deep models. Adv. Neural. Inf. Process. Syst. 34, 16913\u201316925 (2021)","journal-title":"Adv. Neural. Inf. Process. Syst."},{"key":"4_CR40","unstructured":"Yang, F., Feng, Q., Zhou, K., Chen, J., Hu, X.: Differentially private counterfactuals via functional mechanism. arXiv preprint arXiv:2208.02878 (2022)"},{"key":"4_CR41","doi-asserted-by":"crossref","unstructured":"Yeh, I.C., Lien, C.: The comparisons of data mining techniques for the predictive accuracy of probability of default of credit card clients. Expert Sys. Appl. 36(2), 2473\u20132480 (2009)","DOI":"10.1016\/j.eswa.2007.12.020"}],"container-title":["Lecture Notes in Computer Science","PRICAI 2025: Trends in Artificial Intelligence"],"original-title":[],"language":"en","link":[{"URL":"https:\/\/link.springer.com\/content\/pdf\/10.1007\/978-981-95-7081-2_4","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2026,2,22]],"date-time":"2026-02-22T06:46:32Z","timestamp":1771742792000},"score":1,"resource":{"primary":{"URL":"https:\/\/link.springer.com\/10.1007\/978-981-95-7081-2_4"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2026]]},"ISBN":["9789819570805","9789819570812"],"references-count":41,"URL":"https:\/\/doi.org\/10.1007\/978-981-95-7081-2_4","relation":{},"ISSN":["0302-9743","1611-3349"],"issn-type":[{"value":"0302-9743","type":"print"},{"value":"1611-3349","type":"electronic"}],"subject":[],"published":{"date-parts":[[2026]]},"assertion":[{"value":"23 February 2026","order":1,"name":"first_online","label":"First Online","group":{"name":"ChapterHistory","label":"Chapter History"}},{"value":"PRICAI","order":1,"name":"conference_acronym","label":"Conference Acronym","group":{"name":"ConferenceInfo","label":"Conference Information"}},{"value":"Pacific Rim International Conference on Artificial Intelligence","order":2,"name":"conference_name","label":"Conference Name","group":{"name":"ConferenceInfo","label":"Conference Information"}},{"value":"Wellington","order":3,"name":"conference_city","label":"Conference City","group":{"name":"ConferenceInfo","label":"Conference Information"}},{"value":"New Zealand","order":4,"name":"conference_country","label":"Conference Country","group":{"name":"ConferenceInfo","label":"Conference Information"}},{"value":"2025","order":5,"name":"conference_year","label":"Conference Year","group":{"name":"ConferenceInfo","label":"Conference Information"}},{"value":"17 November 2025","order":7,"name":"conference_start_date","label":"Conference Start Date","group":{"name":"ConferenceInfo","label":"Conference Information"}},{"value":"21 November 2025","order":8,"name":"conference_end_date","label":"Conference End Date","group":{"name":"ConferenceInfo","label":"Conference Information"}},{"value":"22","order":9,"name":"conference_number","label":"Conference Number","group":{"name":"ConferenceInfo","label":"Conference Information"}},{"value":"pricai2025","order":10,"name":"conference_id","label":"Conference ID","group":{"name":"ConferenceInfo","label":"Conference Information"}},{"value":"https:\/\/www.pricai.org\/2025\/","order":11,"name":"conference_url","label":"Conference URL","group":{"name":"ConferenceInfo","label":"Conference Information"}}]}}