A Systematic Review on Model Watermarking for Neural Networks

Abstract

Machine learning (ML) models are applied in an increasing variety of domains. The availability of large amounts of data and computational resources encourages the development of ever more complex and valuable models. These models are considered intellectual property of the legitimate parties who have trained them, which makes their protection against stealing, illegitimate redistribution, and unauthorized application an urgent need. Digital watermarking presents a strong mechanism for marking model ownership and, thereby, offers protection against those threats. This work presents a taxonomy identifying and analyzing different classes of watermarking schemes for ML models. It introduces a unified threat model to allow structured reasoning on and comparison of the effectiveness of watermarking methods in different scenarios. Furthermore, it systematizes desired security requirements and attacks against ML model watermarking. Based on that framework, representative literature from the field is surveyed to illustrate the taxonomy. Finally, shortcomings and general limitations of existing approaches are discussed, and an outlook on future research directions is given.

References in corpus (20)

• Distilling the Knowledge in a Neural Network
• Convolutional Neural Networks for Medical Image Analysis: Full Training or Fine Tuning?
• Pruning Convolutional Neural Networks for Resource Efficient Inference
• Stealing Machine Learning Models via Prediction APIs
• Embedding Watermarks into Deep Neural Networks
• Compressing Neural Networks with the Hashing Trick
• Adversarial Frontier Stitching for Remote Neural Network Watermarking
• A Survey on Methods and Theories of Quantized Neural Networks
• How to Prove Your Model Belongs to You: A Blind-Watermark based Framework to Protect Intellectual Property of DNN
• EIE: Efficient Inference Engine on Compressed Deep Neural Network
• DeepSigns: A Generic Watermarking Framework for IP Protection of Deep Learning Models
• REFIT: A Unified Watermark Removal Framework For Deep Learning Systems With Limited Data
• Prediction Poisoning: Towards Defenses Against DNN Model Stealing Attacks
• A Survey of Digital Watermarking Techniques and its Applications
• BlackMarks: Blackbox Multibit Watermarking for Deep Neural Networks
• Have You Stolen My Model? Evasion Attacks Against Deep Neural Network Watermarking Techniques
• Piracy Resistant Watermarks for Deep Neural Networks
• Effectiveness of Distillation Attack and Countermeasure on Neural Network Watermarking
• Sequential Triggers for Watermarking of Deep Reinforcement Learning Policies
• A novel method for identifying the deep neural network model with the Serial Number

Cited by in corpus (4)

• Explainable Artificial Intelligence (XAI) 2.0: A Manifesto of Open Challenges and Interdisciplinary Research Directions
• Identifying Appropriate Intellectual Property Protection Mechanisms for Machine Learning Models: A Systematization of Watermarking, Fingerprinting, Model Access, and Attacks
• ORL-AUDITOR: Dataset Auditing in Offline Deep Reinforcement Learning
• PPFL-RDSN: Privacy-Preserving Federated Learning-based Residual Dense Spatial Networks for Encrypted Lossy Image Reconstruction