Abstract:Given the substantial value and considerable training costs associated with deep neural network models, the field of deep neural network model watermarking has come to the forefront. While black-box model watermarking has made commendable strides, the current methodology for constructing poisoned images in the existing literature is simplistic and susceptible to forgery. Notably, there is a scarcity of black-box model watermarking techniques capable of discerning a unique user in a multi-user model distribution setting. For this reason, this paper proposes a novel black-box model watermarking method for unique identity identification, which is denoted as the ID watermarking of neural networks (IDwNet). Specifically, to enhance the distinguishability of deep neural network models in multi-user scenarios and mitigate the likelihood of poisoned image counterfeiting, this study develops a discrete cosine transform (DCT) and singular value decomposition (SVD)-based symmetrical embedding method to form the poisoned image. As this ID embedding method leads to indistinguishable deep features, the study constructs a poisoned adversary training strategy by simultaneously inputting clean images, poisoned images with the correct ID, and poisoned adversary images with incorrect IDs to train a deep neural network. Extensive simulation experiments show that the proposed scheme achieves excellent invisibility for the concealed ID, surpassing remarkably the state-of-the-art. In addition, the proposed scheme obtains a validation success rate exceeding 99% for the poisoned images at the cost of a marginal classification accuracy reduction of less than 0.5%. Moreover, even though there is only a 1-bit discrepancy between IDs, the proposed scheme still results in an accurate validation of user copyright. These results indicate that the proposed scheme is promising.

Fragile Neural Network Watermarking with Trigger Image Set

Leveraging Unlabeled Data for Watermark Removal of Deep Neural Networks

REFIT: A UnifiedWatermark Removal Framework for Deep Learning Systems with Limited Data

Neural network fragile watermarking with no model performance degradation

FTG: Score-based Black-Box Watermarking by Fragile Trigger Generation for Deep Model Integrity Verification

Semi-Fragile Neural Network Watermarking Based on Adversarial Examples

Fragile Model Watermark for integrity protection: leveraging boundary volatility and sensitive sample-pairing

Deep Neural Network Watermarking Against Model Extraction Attack

Semi-fragile Neural Network Watermarking for Content Authentication and Tampering Localization

Protecting the Intellectual Property of Deep Neural Networks with Watermarking: The Frequency Domain Approach

Trigger-Based Fragile Model Watermarking for Image Transformation Networks

Adaptive White-Box Watermarking with Self-Mutual Check Parameters in Deep Neural Networks

Adaptive watermarking with self-mutual check parameters in deep neural networks

Probabilistically Robust Watermarking of Neural Networks

Free Fine-tuning: A Plug-and-Play Watermarking Scheme for Deep Neural Networks

Removing Backdoor-Based Watermarks in Neural Networks with Limited Data.

Not Just Change the Labels, Learn the Features: Watermarking Deep Neural Networks with Multi-View Data

Reliable Model Watermarking: Defending Against Theft without Compromising on Evasion

Clean-Label Backdoor Watermarking for Dataset Copyright Protection via Trigger Optimization

On Function-Coupled Watermarks for Deep Neural Networks

A Unique Identification-Oriented Black-Box Watermarking Scheme for Deep Classification Neural Networks