Reliable Model Watermarking: Defending Against Theft without Compromising on Evasion

Hongyu Zhu,Sichu Liang,Wentao Hu,Fangqi Li,Ju Jia,Shilin Wang

2024-04-21

Abstract:With the rise of Machine Learning as a Service (MLaaS) platforms,safeguarding the intellectual property of deep learning models is becoming paramount. Among various protective measures, trigger set watermarking has emerged as a flexible and effective strategy for preventing unauthorized model distribution. However, this paper identifies an inherent flaw in the current paradigm of trigger set watermarking: evasion adversaries can readily exploit the shortcuts created by models memorizing watermark samples that deviate from the main task distribution, significantly impairing their generalization in adversarial settings. To counteract this, we leverage diffusion models to synthesize unrestricted adversarial examples as trigger sets. By learning the model to accurately recognize them, unique watermark behaviors are promoted through knowledge injection rather than error memorization, thus avoiding exploitable shortcuts. Furthermore, we uncover that the resistance of current trigger set watermarking against removal attacks primarily relies on significantly damaging the decision boundaries during embedding, intertwining unremovability with adverse impacts. By optimizing the knowledge transfer properties of protected models, our approach conveys watermark behaviors to extraction surrogates without aggressively decision boundary perturbation. Experimental results on CIFAR-10/100 and Imagenette datasets demonstrate the effectiveness of our method, showing not only improved robustness against evasion adversaries but also superior resistance to watermark removal attacks compared to state-of-the-art solutions.

Cryptography and Security,Artificial Intelligence

What problem does this paper attempt to address?

### Problems Addressed by the Paper

The paper aims to address several key issues in the watermarking techniques of machine learning models, particularly the vulnerabilities that arise when protecting model intellectual property. Specifically:

1. **Shortcut Problem Introduced by Trigger Set Watermarking**:
- Current trigger set watermarking methods embed shortcuts in the model that can be easily exploited by attackers, leading to significant performance degradation in adversarial environments.
- The paper reveals that all poisoning-style watermarking methods introduce these shortcuts and thoroughly evaluates the vulnerability to evasion attacks caused by these shortcuts.

2. **Contradiction Between Watermark Removal and Robustness**:
- Current watermarking methods significantly perturb the decision boundary to increase the watermark's unremovability, but this mechanism also negatively impacts generalization ability.
- The paper points out that existing watermarking methods enhance the unremovability of the watermark at the expense of the model's generalization ability, resulting in poorer performance in adversarial scenarios.

### Solutions

To address the above issues, the paper proposes the following solutions:

1. **Harmless Watermark Generation**:
- Utilize diffusion models to generate Unrestricted Adversarial Examples (UAEs) as the trigger set, promoting unique watermark behavior through knowledge injection rather than erroneous memorization.
- This method avoids the shortcut problem in traditional trigger set watermarking and enhances the model's robustness.

2. **Improved Watermark Embedding Process**:
- Optimize the knowledge transfer characteristics of the watermark model, embedding the watermark behavior into the extraction proxy model without relying on decision boundary perturbation.
- This improvement ensures that the watermark remains robust under adversarial attacks without significantly harming the model's generalization ability.

Experimental results show that this method performs excellently on the CIFAR-10/100 and Imagenette datasets, not only improving the ability to withstand adversarial evasion attacks but also outperforming existing methods in terms of watermark unremovability.