Embedding Watermarks into Deep Neural Networks

Abstract

Deep neural networks have recently achieved significant progress. Sharing trained models of these deep neural networks is very important in the rapid progress of researching or developing deep neural network systems. At the same time, it is necessary to protect the rights of shared trained models. To this end, we propose to use a digital watermarking technology to protect intellectual property or detect intellectual property infringement of trained models. Firstly, we formulate a new problem: embedding watermarks into deep neural networks. We also define requirements, embedding situations, and attack types for watermarking to deep neural networks. Secondly, we propose a general framework to embed a watermark into model parameters using a parameter regularizer. Our approach does not hurt the performance of networks into which a watermark is embedded. Finally, we perform comprehensive experiments to reveal the potential of watermarking to deep neural networks as a basis of this new problem. We show that our framework can embed a watermark in the situations of training a network from scratch, fine-tuning, and distilling without hurting the performance of a deep neural network. The embedded watermark does not disappear even after fine-tuning or parameter pruning; the watermark completely remains even after removing 65% of parameters were pruned. The implementation of this research is: https://github.com/yu4u/dnn-watermark

References in corpus (9)

• Very Deep Convolutional Networks for Large-Scale Image Recognition
• Distilling the Knowledge in a Neural Network
• TensorFlow: Large-Scale Machine Learning on Heterogeneous Distributed Systems
• Caffe: Convolutional Architecture for Fast Feature Embedding
• Wide Residual Networks
• The Loss Surfaces of Multilayer Networks
• Learning both Weights and Connections for Efficient Neural Networks
• Identifying and attacking the saddle point problem in high-dimensional non-convex optimization
• EIE: Efficient Inference Engine on Compressed Deep Neural Network

Cited by in corpus (92)

• A Survey on ChatGPT: AI-Generated Contents, Challenges, and Solutions
• Adversarial Frontier Stitching for Remote Neural Network Watermarking
• How to Prove Your Model Belongs to You: A Blind-Watermark based Framework to Protect Intellectual Property of DNN
• Digital Watermarking for Deep Neural Networks
• Turning Your Weakness Into a Strength: Watermarking Deep Neural Networks by Backdooring
• A Systematic Review on Model Watermarking for Neural Networks
• Intellectual Property Protection for Deep Learning Models: Taxonomy, Methods, Attacks, and Evaluations
• REFIT: A Unified Watermark Removal Framework For Deep Learning Systems With Limited Data
• DAWN: Dynamic Adversarial Watermarking of Neural Networks
• High Accuracy and High Fidelity Extraction of Neural Networks
• ModelDiff: Testing-Based DNN Similarity Comparison for Model Reuse Detection
• Reversible Watermarking in Deep Convolutional Neural Networks for Integrity Authentication
• DeepMarks: A Digital Fingerprinting Framework for Deep Neural Networks
• Watermarking Graph Neural Networks by Random Graphs
• AdvParams: An Active DNN Intellectual Property Protection Technique via Adversarial Perturbation Based Parameter Encryption
• BlackMarks: Blackbox Multibit Watermarking for Deep Neural Networks
• Attributing Fake Images to GANs: Learning and Analyzing GAN Fingerprints
• Identifying Appropriate Intellectual Property Protection Mechanisms for Machine Learning Models: A Systematization of Watermarking, Fingerprinting, Model Access, and Attacks
• Passport-aware Normalization for Deep Model Protection
• Deep Fidelity in DNN Watermarking: A Study of Backdoor Watermarking for Classification Models
• Ultrasensitive, Ultrafast and Gate-Tunable Two-Dimensional Photodetectors in Ternary Rhombohedral ZnIn2S4 for Optical Neural Networks
• Protecting the Intellectual Properties of Deep Neural Networks with an Additional Class and Steganographic Images
• Piracy Resistant Watermarks for Deep Neural Networks
• Effectiveness of Distillation Attack and Countermeasure on Neural Network Watermarking
• Deep Neural Network Fingerprinting by Conferrable Adversarial Examples
• Responsible Disclosure of Generative Models Using Scalable Fingerprinting
• DeepiSign: Invisible Fragile Watermark to Protect the Integrityand Authenticity of CNN
• Image and Model Transformation with Secret Key for Vision Transformer
• Removing Backdoor-Based Watermarks in Neural Networks with Limited Data
• Performance Comparison of Contemporary DNN Watermarking Techniques
• Robust Watermarking of Neural Network with Exponential Weighting
• Sequential Triggers for Watermarking of Deep Reinforcement Learning Policies
• RIGA: Covert and Robust White-Box Watermarking of Deep Neural Networks
• On the Effectiveness of Dataset Watermarking in Adversarial Settings
• Stealing Knowledge from Protected Deep Neural Networks Using Composite Unlabeled Data
• Towards Interpreting and Mitigating Shortcut Learning Behavior of NLU Models
• Preventing Unauthorized Use of Proprietary Data: Poisoning for Secure Dataset Release
• Detect and remove watermark in deep neural networks via generative adversarial networks
• Sleeper Agent: Scalable Hidden Trigger Backdoors for Neural Networks Trained from Scratch
• Towards Traitor Tracing in Black-and-White-Box DNN Watermarking with Tardos-based Codes
• ActiveGuard: An Active DNN IP Protection Technique via Adversarial Examples
• Deep Serial Number: Computational Watermarking for DNN Intellectual Property Protection
• Evolutionary Trigger Set Generation for DNN Black-Box Watermarking
• Speech Pattern based Black-box Model Watermarking for Automatic Speech Recognition
• Secure Watermark for Deep Neural Networks with Multi-task Learning
• Extraction of Complex DNN Models: Real Threat or Boogeyman?
• Protect the Intellectual Property of Dataset against Unauthorized Use
• Towards Practical Watermark for Deep Neural Networks in Federated Learning
• Decentralized Attribution of Generative Models
• InFIP: An Explainable DNN Intellectual Property Protection Method based on Intrinsic Features
• Neural Dehydration: Effective Erasure of Black-box Watermarks from DNNs with Limited Data
• You are caught stealing my winning lottery ticket! Making a lottery ticket claim its ownership
• SoK: How Robust is Image Classification Deep Neural Network Watermarking? (Extended Version)
• Training DNN Model with Secret Key for Model Protection
• Don't Forget to Sign the Gradients!
• HiDDeN: Hiding Data With Deep Networks
• Verifying Integrity of Deep Ensemble Models by Lossless Black-box Watermarking with Sensitive Samples
• Digital Passport: A Novel Technological Strategy for Intellectual Property Protection of Convolutional Neural Networks
• On Hiding Neural Networks Inside Neural Networks
• ChainMarks: Securing DNN Watermark with Cryptographic Chain
• SNNGX: Securing Spiking Neural Networks with Genetic XOR Encryption on RRAM-based Neuromorphic Accelerator
• Exploring Structure Consistency for Deep Model Watermarking
• Regulating Ownership Verification for Deep Neural Networks: Scenarios, Protocols, and Prospects
• Protect, Show, Attend and Tell: Empowering Image Captioning Models with Ownership Protection
• WAFFLE: Watermarking in Federated Learning
• Stealing Deep Reinforcement Learning Models for Fun and Profit
• Access Control Using Spatially Invariant Permutation of Feature Maps for Semantic Segmentation Models
• DLBC: A Deep Learning-Based Consensus in Blockchains for Deep Learning Services
• HufuNet: Embedding the Left Piece as Watermark and Keeping the Right Piece for Ownership Verification in Deep Neural Networks
• A novel method for identifying the deep neural network model with the Serial Number
• [Extended version] Rethinking Deep Neural Network Ownership Verification: Embedding Passports to Defeat Ambiguity Attacks
• A survey of deep neural network watermarking techniques
• Watermarking Graph Neural Networks based on Backdoor Attacks
• A Protection Method of Trained CNN Model Using Feature Maps Transformed With Secret Key From Unauthorized Access
• ShadowNet: A Secure and Efficient On-device Model Inference System for Convolutional Neural Networks
• Protecting Intellectual Property of Generative Adversarial Networks from Ambiguity Attack
• Robust Membership Encoding: Inference Attacks and Copyright Protection for Deep Learning
• PreGIP: Watermarking the Pretraining of Graph Neural Networks for Deep Intellectual Property Protection
• Hot-Swap MarkBoard: An Efficient Black-box Watermarking Approach for Large-scale Model Distribution
• Model Watermarking for Image Processing Networks
• FBI: Fingerprinting models with Benign Inputs
• Watermarking Recommender Systems
• Watermarking Neuromorphic Brains: Intellectual Property Protection in Spiking Neural Networks
• Access Control with Encrypted Feature Maps for Object Detection Models
• Dual-Locking Learned AI Models: A PIN-Based Sparse QIM Watermarking and Adaptive Index Permutation Approach
• T2S: A Rehearsal-Based Approach for Extraction-Resistant Model Watermarking
• Hiding Information in Big Data based on Deep Learning
• Keys in the Weights: Transformer Authentication Using Model-Bound Latent Representations
• Immunization of Pruning Attack in DNN Watermarking Using Constant Weight Code
• Protecting Semantic Segmentation Models by Using Block-wise Image Encryption with Secret Key from Unauthorized Access
• High-Robustness, Low-Transferability Fingerprinting of Neural Networks
• PPFL-RDSN: Privacy-Preserving Federated Learning-based Residual Dense Spatial Networks for Encrypted Lossy Image Reconstruction