How to Prove Your Model Belongs to You: A Blind-Watermark based Framework to Protect Intellectual Property of DNN

Abstract

Deep learning techniques have made tremendous progress in a variety of challenging tasks, such as image recognition and machine translation, during the past decade. Training deep neural networks is computationally expensive and requires both human and intellectual resources. Therefore, it is necessary to protect the intellectual property of the model and externally verify the ownership of the model. However, previous studies either fail to defend against the evasion attack or have not explicitly dealt with fraudulent claims of ownership by adversaries. Furthermore, they can not establish a clear association between the model and the creator's identity. To fill these gaps, in this paper, we propose a novel intellectual property protection (IPP) framework based on blind-watermark for watermarking deep neural networks that meet the requirements of security and feasibility. Our framework accepts ordinary samples and the exclusive logo as inputs, outputting newly generated samples as watermarks, which are almost indistinguishable from the origin, and infuses these watermarks into DNN models by assigning specific labels, leaving the backdoor as the basis for our copyright claim. We evaluated our IPP framework on two benchmark datasets and 15 popular deep learning models. The results show that our framework successfully verifies the ownership of all the models without a noticeable impact on their primary task. Most importantly, we are the first to successfully design and implement a blind-watermark based framework, which can achieve state-of-art performances on undetectability against evasion attack and unforgeability against fraudulent claims of ownership. Further, our framework shows remarkable robustness and establishes a clear association between the model and the author's identity.

arXiv commentTo be published in ACSAC'19

References in corpus (10)

• Distributed Representations of Words and Phrases and their Compositionality
• MobileNets: Efficient Convolutional Neural Networks for Mobile Vision Applications
• Google's Neural Machine Translation System: Bridging the Gap between Human and Machine Translation
• Natural Language Processing (almost) from Scratch
• Embedding Watermarks into Deep Neural Networks
• Achieving Human Parity in Conversational Speech Recognition
• DeepSigns: A Generic Watermarking Framework for IP Protection of Deep Learning Models
• Have You Stolen My Model? Evasion Attacks Against Deep Neural Network Watermarking Techniques
• Dual Path Networks
• Robust Watermarking of Neural Network with Exponential Weighting

Cited by in corpus (9)

• A Survey on ChatGPT: AI-Generated Contents, Challenges, and Solutions
• A Systematic Review on Model Watermarking for Neural Networks
• Intellectual Property Protection for Deep Learning Models: Taxonomy, Methods, Attacks, and Evaluations
• Identifying Appropriate Intellectual Property Protection Mechanisms for Machine Learning Models: A Systematization of Watermarking, Fingerprinting, Model Access, and Attacks
• Deep Fidelity in DNN Watermarking: A Study of Backdoor Watermarking for Classification Models
• On the Effectiveness of Dataset Watermarking in Adversarial Settings
• Speech Pattern based Black-box Model Watermarking for Automatic Speech Recognition
• Neural Dehydration: Effective Erasure of Black-box Watermarks from DNNs with Limited Data
• Watermarking Recommender Systems