Have You Stolen My Model? Evasion Attacks Against Deep Neural Network Watermarking Techniques

Abstract

Deep neural networks have had enormous impact on various domains of computer science, considerably outperforming previous state of the art machine learning techniques. To achieve this performance, neural networks need large quantities of data and huge computational resources, which heavily increases their construction costs. The increased cost of building a good deep neural network model gives rise to a need for protecting this investment from potential copyright infringements. Legitimate owners of a machine learning model want to be able to reliably track and detect a malicious adversary that tries to steal the intellectual property related to the model. Recently, this problem was tackled by introducing in deep neural networks the concept of watermarking, which allows a legitimate owner to embed some secret information(watermark) in a given model. The watermark allows the legitimate owner to detect copyright infringements of his model. This paper focuses on verifying the robustness and reliability of state-of- the-art deep neural network watermarking schemes. We show that, a malicious adversary, even in scenarios where the watermark is difficult to remove, can still evade the verification by the legitimate owners, thus avoiding the detection of model theft.

arXiv comment7 pages, 4 figures, 1 table

References in corpus (8)

• Very Deep Convolutional Networks for Large-Scale Image Recognition
• Playing Atari with Deep Reinforcement Learning
• BadNets: Identifying Vulnerabilities in the Machine Learning Model Supply Chain
• Stealing Machine Learning Models via Prediction APIs
• Visualizing and Understanding Convolutional Networks
• Adversarial Frontier Stitching for Remote Neural Network Watermarking
• Turning Your Weakness Into a Strength: Watermarking Deep Neural Networks by Backdooring
• Teaching Deep Convolutional Neural Networks to Play Go

Cited by in corpus (10)

• How to Prove Your Model Belongs to You: A Blind-Watermark based Framework to Protect Intellectual Property of DNN
• A Systematic Review on Model Watermarking for Neural Networks
• Intellectual Property Protection for Deep Learning Models: Taxonomy, Methods, Attacks, and Evaluations
• Watermarking Graph Neural Networks by Random Graphs
• Deep Neural Network Fingerprinting by Conferrable Adversarial Examples
• Removing Backdoor-Based Watermarks in Neural Networks with Limited Data
• Deep Serial Number: Computational Watermarking for DNN Intellectual Property Protection
• Developing Future Human-Centered Smart Cities: Critical Analysis of Smart City Security, Interpretability, and Ethical Challenges
• MimosaNet: An Unrobust Neural Network Preventing Model Stealing
• HufuNet: Embedding the Left Piece as Watermark and Keeping the Right Piece for Ownership Verification in Deep Neural Networks