Abstract:As deep learning technology matures, it’s being widely deployed in fields like image classification and speech recognition. However, training a functional deep learning model requires vast computing power and a large training dataset, leading to the emergence of a new business model of selling pre-trained models. However, these models are highly susceptible to theft, which poses a threat to the interests of their creators. Moreover, the network topology and weight parameters are considered intellectual property. To address these challenges, a method that can tag trained models to claim ownership without affecting their performance is necessary. Therefore, we propose a novel neural network watermarking protocol. In this method, the trigger set is constructed differently from previous methods by using a key obtained from the authority to generate a scrambling sequence, followed by using the sequence to scramble the pixels and assign their original labels. Finally, the trigger set is put into the network training together with the original training set to complete the watermark embedding. Since Logistic chaos mapping is nonlinear, unpredictable, and sensitive to initial values, we use Logistic chaos mapping as the generation method of dislocation sequence. We involve a third-party copyright center in the embedding process to prevent forgery attacks. The third-party only needs to store the disruption key and timestamp for each owner, reducing their storage burden. Our experimental results demonstrate that the ResNet model exhibits a mere 0.05 percentage point decrease in accuracy when using fine-tuning for watermark embedding, and a mere 0.03 percentage point decrease when using the training-from-scratch method. On the other hand, when using the SENet model, embedding watermarks via fine-tuning resulted in a 1.35 percentage point decrease in classification accuracy, while embedding watermarks from training-from-scratch resulted in a 0.94 percentage point increase in classification accuracy. Furthermore, our model exhibited robustness against various attacks in the robustness experiments, including model fine-tuning, model compression, and watermark overlay.

Transferable Watermarking to Self-supervised Pre-trained Graph Encoders by Trigger Embeddings

Watermarking Pre-trained Encoders in Contrastive Learning

Leveraging Unlabeled Data for Watermark Removal of Deep Neural Networks

SSLGuard: A Watermarking Scheme for Self-supervised Learning Pre-trained Encoders

Watermarking Graph Neural Networks by Random Graphs

SSL-WM: A Black-Box Watermarking Approach for Encoders Pre-trained by Self-supervised Learning

SSL-Auth: An Authentication Framework by Fragile Watermarking for Pre-trained Encoders in Self-supervised Learning

Making Watermark Survive Model Extraction Attacks in Graph Neural Networks.

PreGIP: Watermarking the Pretraining of Graph Neural Networks for Deep Intellectual Property Protection

GhostEncoder: Stealthy Backdoor Attacks with Dynamic Triggers to Pre-trained Encoders in Self-supervised Learning

Protecting IP of Deep Neural Networks with Watermarking Using Logistic Disorder Generation Trigger Sets

Persistent Watermark for Image Classification Neural Networks by Penetrating the Autoencoder.

Unified High-binding Watermark for Unconditional Image Generation Models

Reliable Model Watermarking: Defending Against Theft without Compromising on Evasion

Graph Watermarks

Watermarking Images in Self-Supervised Latent Spaces

AWEncoder: Adversarial Watermarking Pre-trained Encoders in Contrastive Learning

Clean-Label Backdoor Watermarking for Dataset Copyright Protection via Trigger Optimization

StegGuard: Fingerprinting Self-supervised Pre-trained Encoders via Secrets Embeder and Extractor