Abstract:Recently, the research on protecting the intellectual properties (IP) of deep neural networks (DNN) has attracted serious concerns. A number of DNN copyright protection methods have been proposed. However, most of the existing watermarking methods focus on verifying the copyright of the model, which do not support the authentication and management of users' fingerprints, thus can not satisfy the requirements of commercial copyright protection. In addition, the query modification attack which was proposed recently can invalidate most of the existing backdoor-based watermarking methods. To address these challenges, in this paper, we propose a method to protect the intellectual properties of DNN models by using an additional class and steganographic images. Specifically, we use a set of watermark key samples to embed an additional class into the DNN, so that the watermarked DNN will classify the watermark key sample as the predefined additional class in the copyright verification stage. We adopt the least significant bit (LSB) image steganography to embed users' fingerprints into watermark key images. Each user will be assigned with a unique fingerprint image so that the user's identity can be authenticated later. Experimental results demonstrate that, the proposed method can protect the copyright of DNN models effectively. On Fashion-MNIST and CIFAR-10 datasets, the proposed method can obtain 100% watermark accuracy and 100% fingerprint authentication success rate. In addition, the proposed method is demonstrated to be robust to the model fine-tuning attack, model pruning attack, and the query modification attack. Compared with three existing watermarking methods (the logo-based, noise-based, and adversarial frontier stitching watermarking methods), the proposed method has better performance on watermark accuracy and robustness against the query modification attack.

Deep Neural Network Watermarking Against Model Extraction Attack

Leveraging Unlabeled Data for Watermark Removal of Deep Neural Networks

Ownership Verification of DNN Architectures Via Hardware Cache Side Channels.

Making Watermark Survive Model Extraction Attacks in Graph Neural Networks.

MEA-Defender: A Robust Watermark against Model Extraction Attack

Deep Model Intellectual Property Protection Via Deep Watermarking

Protecting the Intellectual Property of Deep Neural Networks with Watermarking: The Frequency Domain Approach

Semi-Fragile Neural Network Watermarking Based on Adversarial Examples

Reliable Model Watermarking: Defending Against Theft without Compromising on Evasion

DAWN: Dynamic Adversarial Watermarking of Neural Networks

On Function-Coupled Watermarks for Deep Neural Networks

Not Just Change the Labels, Learn the Features: Watermarking Deep Neural Networks with Multi-View Data

Watermarking in Deep Neural Networks Via Error Back-propagation

Rethinking White-BoxWatermarks on Deep Learning Models under Neural Structural Obfuscation

Deep neural networks watermark via universal deep hiding and metric learning

Persistent and Unforgeable Watermarks for Deep Neural Networks.

Subnetwork-Lossless Robust Watermarking for Hostile Theft Attacks in Deep Transfer Learning Models

On the Robustness of the Backdoor-based Watermarking in Deep Neural Networks

Exploring Structure Consistency for Deep Model Watermarking

Protecting the Intellectual Properties of Deep Neural Networks with an Additional Class and Steganographic Images

Embedding Watermarks into Deep Neural Networks