Abstract:Deep learning techniques have made tremendous progress in a variety of challenging tasks, such as image recognition and machine translation, during the past decade. Training deep neural networks is computationally expensive and requires both human and intellectual resources. Therefore, it is necessary to protect the intellectual property of the model and externally verify the ownership of the model. However, previous studies either fail to defend against the evasion attack or have not explicitly dealt with fraudulent claims of ownership by adversaries. Furthermore, they can not establish a clear association between the model and the creator's identity. To fill these gaps, in this paper, we propose a novel intellectual property protection (IPP) framework based on blind-watermark for watermarking deep neural networks that meet the requirements of security and feasibility. Our framework accepts ordinary samples and the exclusive logo as inputs, outputting newly generated samples as watermarks, which are almost indistinguishable from the origin, and infuses these watermarks into DNN models by assigning specific labels, leaving the backdoor as the basis for our copyright claim. We evaluated our IPP framework on two benchmark datasets and 15 popular deep learning models. The results show that our framework successfully verifies the ownership of all the models without a noticeable impact on their primary task. Most importantly, we are the first to successfully design and implement a blind-watermark based framework, which can achieve state-of-art performances on undetectability against evasion attack and unforgeability against fraudulent claims of ownership. Further, our framework shows remarkable robustness and establishes a clear association between the model and the author's identity.

Provenance of Training Without Training Data: Towards Privacy-Preserving DNN Model Ownership Verification

Towards Understanding and Enhancing Security of Proof-of-Training for DNN Model Ownership Verification

Ownership Verification of DNN Architectures Via Hardware Cache Side Channels.

How to Prove Your Model Belongs to You: A Blind-Watermark based Framework to Protect Intellectual Property of DNN

Interesting Near-boundary Data: Inferring Model Ownership for DNNs.

VeriDIP: Verifying Ownership of Deep Neural Networks through Privacy Leakage Fingerprints

A Deep Learning Framework Supporting Model Ownership Protection and Traitor Tracing

Chameleon DNN Watermarking: Dynamically Public Model Ownership Verification.

OVLA: Neural Network Ownership Verification using Latent Watermarks

This paper is included in the Proceedings of the 33rd USENIX Security Symposium.

Regulating Ownership Verification for Deep Neural Networks: Scenarios, Protocols, and Prospects

MOVE: Effective and Harmless Ownership Verification via Embedded External Features

Watermarking Deep Neural Networks With Greedy Residuals

PCPT and ACPT: Copyright Protection and Traceability Scheme for DNN Models

False Claims against Model Ownership Resolution

Untargeted Backdoor Watermark: Towards Harmless and Stealthy Dataset Copyright Protection

PCPT and ACPT: Copyright Protection and Traceability Scheme for DNN Model

A Deep Model Intellectual Property Protection Method Supporting Public Verification

DeepStego: Protecting Intellectual Property of Deep Neural Networks by Steganography

Black-Box Dataset Ownership Verification via Backdoor Watermarking

Domain Watermark: Effective and Harmless Dataset Copyright Protection is Closed at Hand