Abstract:As deep learning technology matures, it’s being widely deployed in fields like image classification and speech recognition. However, training a functional deep learning model requires vast computing power and a large training dataset, leading to the emergence of a new business model of selling pre-trained models. However, these models are highly susceptible to theft, which poses a threat to the interests of their creators. Moreover, the network topology and weight parameters are considered intellectual property. To address these challenges, a method that can tag trained models to claim ownership without affecting their performance is necessary. Therefore, we propose a novel neural network watermarking protocol. In this method, the trigger set is constructed differently from previous methods by using a key obtained from the authority to generate a scrambling sequence, followed by using the sequence to scramble the pixels and assign their original labels. Finally, the trigger set is put into the network training together with the original training set to complete the watermark embedding. Since Logistic chaos mapping is nonlinear, unpredictable, and sensitive to initial values, we use Logistic chaos mapping as the generation method of dislocation sequence. We involve a third-party copyright center in the embedding process to prevent forgery attacks. The third-party only needs to store the disruption key and timestamp for each owner, reducing their storage burden. Our experimental results demonstrate that the ResNet model exhibits a mere 0.05 percentage point decrease in accuracy when using fine-tuning for watermark embedding, and a mere 0.03 percentage point decrease when using the training-from-scratch method. On the other hand, when using the SENet model, embedding watermarks via fine-tuning resulted in a 1.35 percentage point decrease in classification accuracy, while embedding watermarks from training-from-scratch resulted in a 0.94 percentage point increase in classification accuracy. Furthermore, our model exhibited robustness against various attacks in the robustness experiments, including model fine-tuning, model compression, and watermark overlay.

A Deep Learning Framework Supporting Model Ownership Protection and Traitor Tracing

Ownership Verification of DNN Architectures Via Hardware Cache Side Channels.

A Secure Fingerprinting Framework for Distributed Image Classification

How to Prove Your Model Belongs to You: A Blind-Watermark based Framework to Protect Intellectual Property of DNN

Watermarking Protocol for Deep Neural Network Ownership Regulation in Federated Learning

DeepTrace: A Secure Fingerprinting Framework for Intellectual Property Protection of Deep Neural Networks

DeepDIST: A Black-Box Anti-Collusion Framework for Secure Distribution of Deep Models

Deep Model Intellectual Property Protection Via Deep Watermarking

Protecting the Ownership of Deep Learning Models with an End-to-End Watermarking Framework.

Copy, Right? A Testing Framework for Copyright Protection of Deep Learning Models

Persistent and Unforgeable Watermarks for Deep Neural Networks.

Protecting IP of Deep Neural Networks with Watermarking Using Logistic Disorder Generation Trigger Sets

VeriDIP: Verifying Ownership of Deep Neural Networks through Privacy Leakage Fingerprints

Survey on Intellectual Property Protection for Deep Learning Model

Have You Stolen My Model? Evasion Attacks Against Deep Neural Network Watermarking Techniques

Who Leaked the Model? Tracking IP Infringers in Accountable Federated Learning

Watermarking Deep Neural Networks With Greedy Residuals

Provenance of Training Without Training Data: Towards Privacy-Preserving DNN Model Ownership Verification

MODA: Model Ownership Deprivation Attack in Asynchronous Federated Learning

DeepHider: A Covert NLP Watermarking Framework Based on Multi-task Learning

Chameleon DNN Watermarking: Dynamically Public Model Ownership Verification.