Abstract:As deep learning technology matures, it’s being widely deployed in fields like image classification and speech recognition. However, training a functional deep learning model requires vast computing power and a large training dataset, leading to the emergence of a new business model of selling pre-trained models. However, these models are highly susceptible to theft, which poses a threat to the interests of their creators. Moreover, the network topology and weight parameters are considered intellectual property. To address these challenges, a method that can tag trained models to claim ownership without affecting their performance is necessary. Therefore, we propose a novel neural network watermarking protocol. In this method, the trigger set is constructed differently from previous methods by using a key obtained from the authority to generate a scrambling sequence, followed by using the sequence to scramble the pixels and assign their original labels. Finally, the trigger set is put into the network training together with the original training set to complete the watermark embedding. Since Logistic chaos mapping is nonlinear, unpredictable, and sensitive to initial values, we use Logistic chaos mapping as the generation method of dislocation sequence. We involve a third-party copyright center in the embedding process to prevent forgery attacks. The third-party only needs to store the disruption key and timestamp for each owner, reducing their storage burden. Our experimental results demonstrate that the ResNet model exhibits a mere 0.05 percentage point decrease in accuracy when using fine-tuning for watermark embedding, and a mere 0.03 percentage point decrease when using the training-from-scratch method. On the other hand, when using the SENet model, embedding watermarks via fine-tuning resulted in a 1.35 percentage point decrease in classification accuracy, while embedding watermarks from training-from-scratch resulted in a 0.94 percentage point increase in classification accuracy. Furthermore, our model exhibited robustness against various attacks in the robustness experiments, including model fine-tuning, model compression, and watermark overlay.

SSLGuard: A Watermarking Scheme for Self-supervised Learning Pre-trained Encoders

Watermarking Pre-trained Encoders in Contrastive Learning

Leveraging Unlabeled Data for Watermark Removal of Deep Neural Networks

SSL-WM: A Black-Box Watermarking Approach for Encoders Pre-trained by Self-supervised Learning

SSL-Auth: An Authentication Framework by Fragile Watermarking for Pre-trained Encoders in Self-supervised Learning

Transferable Watermarking to Self-supervised Pre-trained Graph Encoders by Trigger Embeddings

Secure Federated Learning Model Verification - A Client-side Backdoor Triggered Watermarking Scheme.

Protecting IP of Deep Neural Networks with Watermarking Using Logistic Disorder Generation Trigger Sets

Pairwise Open-Sourced Dataset Protection Based on Adaptive Blind Watermarking

SSL-Cleanse: Trojan Detection and Mitigation in Self-Supervised Learning

AWEncoder: Adversarial Watermarking Pre-trained Encoders in Contrastive Learning

Unharmful Backdoor-based Client-side Watermarking in Federated Learning

GhostEncoder: Stealthy Backdoor Attacks with Dynamic Triggers to Pre-trained Encoders in Self-supervised Learning

Protecting the Ownership of Deep Learning Models with an End-to-End Watermarking Framework.

A Novel Two-stage Separable Deep Learning Framework for Practical Blind Watermarking

Watermarking in Secure Federated Learning: A Verification Framework Based on Client-Side Backdooring

Mitigating Backdoor Attacks in Pre-Trained Encoders via Self-Supervised Knowledge Distillation

Reliable Model Watermarking: Defending Against Theft without Compromising on Evasion

A Spatiotemporal Chaos Based Deep Learning Model Watermarking Scheme