Turning Your Weakness Into a Strength: Watermarking Deep Neural Networks by Backdooring

Abstract

Deep Neural Networks have recently gained lots of success after enabling several breakthroughs in notoriously challenging problems. Training these networks is computationally expensive and requires vast amounts of training data. Selling such pre-trained models can, therefore, be a lucrative business model. Unfortunately, once the models are sold they can be easily copied and redistributed. To avoid this, a tracking mechanism to identify models as the intellectual property of a particular vendor is necessary. In this work, we present an approach for watermarking Deep Neural Networks in a black-box way. Our scheme works for general classification tasks and can easily be combined with current learning algorithms. We show experimentally that such a watermark has no noticeable impact on the primary task that the model is designed for and evaluate the robustness of our proposal against a multitude of practical attacks. Moreover, we provide a theoretical analysis, relating our approach to previous work on backdooring.

References in corpus (8)

• Very Deep Convolutional Networks for Large-Scale Image Recognition
• DeepPose: Human Pose Estimation via Deep Neural Networks
• Understanding deep learning requires rethinking generalization
• Embedding Watermarks into Deep Neural Networks
• CNN Features off-the-shelf: an Astounding Baseline for Recognition
• Adversarial Frontier Stitching for Remote Neural Network Watermarking
• Blocking Transferability of Adversarial Examples in Black-Box Learning Systems
• Automatic measurement of vowel duration via structured prediction

Cited by in corpus (11)

• Spectral Signatures in Backdoor Attacks
• ModelDiff: Testing-Based DNN Similarity Comparison for Model Reuse Detection
• Entangled Watermarks as a Defense against Model Extraction
• Watermarking Graph Neural Networks by Random Graphs
• Have You Stolen My Model? Evasion Attacks Against Deep Neural Network Watermarking Techniques
• Image and Model Transformation with Secret Key for Vision Transformer
• Detect and remove watermark in deep neural networks via generative adversarial networks
• Extraction of Complex DNN Models: Real Threat or Boogeyman?
• A First Look at Deep Learning Apps on Smartphones
• PreGIP: Watermarking the Pretraining of Graph Neural Networks for Deep Intellectual Property Protection
• Access Control with Encrypted Feature Maps for Object Detection Models