DeepSigns: A Generic Watermarking Framework for IP Protection of Deep Learning Models

Abstract

Deep Learning (DL) models have caused a paradigm shift in our ability to comprehend raw data in various important fields, ranging from intelligence warfare and healthcare to autonomous transportation and automated manufacturing. A practical concern, in the rush to adopt DL models as a service, is protecting the models against Intellectual Property (IP) infringement. The DL models are commonly built by allocating significant computational resources that process vast amounts of proprietary training data. The resulting models are therefore considered to be the IP of the model builder and need to be protected to preserve the owner's competitive advantage. This paper proposes DeepSigns, a novel end-to-end IP protection framework that enables insertion of coherent digital watermarks in contemporary DL models. DeepSigns, for the first time, introduces a generic watermarking methodology that can be used for protecting DL owner's IP rights in both white-box and black-box settings, where the adversary may or may not have the knowledge of the model internals. The suggested methodology is based on embedding the owner's signature (watermark) in the probability density function (pdf) of the data abstraction obtained in different layers of a DL model. DeepSigns can demonstrably withstand various removal and transformation attacks, including model compression, model fine-tuning, and watermark overwriting. Proof-of-concept evaluations on MNIST, and CIFAR10 datasets, as well as a wide variety of neural network architectures including Wide Residual Networks, Convolution Neural Networks, and Multi-Layer Perceptrons corroborate DeepSigns' effectiveness and applicability.

Added new experiments and attacks

Cited by in corpus (24)

• Adversarial Frontier Stitching for Remote Neural Network Watermarking
• How to Prove Your Model Belongs to You: A Blind-Watermark based Framework to Protect Intellectual Property of DNN
• A Roadmap Towards Resilient Internet of Things for Cyber-Physical Systems
• A Systematic Review on Model Watermarking for Neural Networks
• Entangled Watermarks as a Defense against Model Extraction
• BlackMarks: Blackbox Multibit Watermarking for Deep Neural Networks
• Effectiveness of Distillation Attack and Countermeasure on Neural Network Watermarking
• Image and Model Transformation with Secret Key for Vision Transformer
• Performance Comparison of Contemporary DNN Watermarking Techniques
• Membership Leakage in Label-Only Exposures
• Data Hiding with Deep Learning: A Survey Unifying Digital Watermarking and Steganography
• Robust Watermarking of Neural Network with Exponential Weighting
• Towards Traitor Tracing in Black-and-White-Box DNN Watermarking with Tardos-based Codes
• Evolutionary Trigger Set Generation for DNN Black-Box Watermarking
• Digital Passport: A Novel Technological Strategy for Intellectual Property Protection of Convolutional Neural Networks
• Don't Forget to Sign the Gradients!
• SoK: How Robust is Image Classification Deep Neural Network Watermarking? (Extended Version)
• DeepPeep: Exploiting Design Ramifications to Decipher the Architecture of Compact DNNs
• Training DNN Model with Secret Key for Model Protection
• HufuNet: Embedding the Left Piece as Watermark and Keeping the Right Piece for Ownership Verification in Deep Neural Networks
• [Extended version] Rethinking Deep Neural Network Ownership Verification: Embedding Passports to Defeat Ambiguity Attacks
• Robust Membership Encoding: Inference Attacks and Copyright Protection for Deep Learning
• A Protection Method of Trained CNN Model Using Feature Maps Transformed With Secret Key From Unauthorized Access
• Protecting Intellectual Property of Generative Adversarial Networks from Ambiguity Attack