Advancements in deep generative models have made it possible to synthesize images, videos and audio signals that are hard to distinguish from natural signals, creating opportunities for potential abuse of these capabilities. This motivates the problem of tracking the provenance of signals, i.e., being able to determine the original source of a signal. Watermarking the signal at the time of signal creation is a potential solution, but current techniques are brittle and watermark detection mechanisms can easily be bypassed by doing some post-processing (cropping images, shifting pitch in the audio etc.). In this paper, we introduce ReSWAT (Resilient Signal Watermarking via Adversarial Training), a framework for learning transformation-resilient watermark detectors that are able to detect a watermark even after a signal has been through several post-processing transformations. Our detection method can be applied to domains with continuous data representations such as images, videos or sound signals. Experiments on watermarking image and audio signals show that our method can reliably detect the provenance of a synthetic signal, even if the signal has been through several post-processing transformations, and improve upon related work in this setting. Furthermore, we show that for specific kinds of transformations (perturbations bounded in the 2 norm), we can even get formal guarantees on the ability of our model to detect the watermark. We provide qualitative examples of watermarked image and audio samples in the anonymous code submission link.
The paper proposes a watermark design algorithm that is based on an adversarial training paradigm where a watermark detector and a watermark generator are jointly trained to maximize the likelihood of watermark detection while bounding the manipulation of individual pixels. 
I have several concerns about the clarity of the paper, its applicability to the motivating problem, and the completeness of the results that motivate my "reject" recommendation.
The description does not make it clear how the detector and watermark mechanism are jointly obtained in (1) - intuitively, a detector should know the type of watermark to be observed in order to pose a feasible detection model. The discussion focuses on "fixed detector" and "fixed watermark" cases only, but it is not clear how an iterative optimization would be initialized, and no discussion of how to set up the problem appears in the manuscript. 
The motivation for the paper is also unclear. The authors discuss the need to be able to detect deep fakes, which is a relevant and meritorious problem. However, it seems that the application of the proposed approach in this setting would require deep fake creators to add watermarks to their creations, which would be a naive assumption. Watermarks are used to demonstrate provenance, but deep fake creators would not want to have such provenance verified.
The watermark transferability premise seems to rely on the random initialization of the underlying deep learning watermark detector. One could posit that if a third party is interested in creating false positives, they could train the deep learning network using a database of watermarked and non-watermarked images. Another concern here is that the formulation provided in (3) would potentially lead to low transferability for the specific classifiers provided there, but one does not know which classifier an adversary would construct - or why an adversary would construct an adversary that does not have knowledge of the specific watermark being used, or of samples of the watermark. It would have been interesting to see if it is possible to construct a good watermark detector this way (given enough training data being available). It would also be good to have some intuition as to why this robustness formulation also improves "certified robustness".
Finally, the performance comparison only considers a 10-year old watermarking algorithm; some discussion as to why this is sufficient should have been included.
Minor comments
The norm infinity subindex is missing from the minimization conditions in (1).
Figure 3 caption: watermark's -> watermarks
It is not clear why no numerical results were given for Section 4.2.4.