Abstract:With the rapid development of deep learning technology, more and more researchers have paid attention to protecting the intellectual property rights of the deep neural network (DNN) model. So far, various methods have been proposed to construct black-box watermarking copyright protection based on trigger sets. Since extant black-box watermarking methods are backdoor-based, the watermark embedding process inevitably distorts the decision boundary of the DNN model, which leads to a decline in the performance of the DNN model. We propose a novel scheme for constructing black-box watermarking based on Singular Value Decomposition (SVD) to compensate for shortcomings. We select an appropriate number of image samples as watermark key samples in the training dataset by employing the Mersenne-Twister algorithm, which strengthens the relevance of the process watermarking embedding to the original classification task and extends the perceptual domain of the DNN model. Subsequently, the SVD algorithm extracts the primary feature information of the watermark key samples, thereby constructing more stable and covert watermark samples. Next, the classification labels corresponding to the watermark samples are specified as the classification labels of their corresponding watermark key samples, which is unlike most existing DNN watermarking schemes. It can effectively reduce the distortion of the DNN model decision boundary caused by watermarking during the embedding process. As such, the proposed scheme has a low impact on the performance of the DNN model and is highly robust. We have validated the proposed watermarking scheme on two benchmark datasets. The experimental results show that our scheme, besides meeting the functional requirements of watermarking, also does not affect the test accuracy of the DNN model. Moreover, the proposed watermarking is robust to the common watermarking attacks.

Data-Free Watermark for Deep Neural Networks by Truncated Adversarial Distillation.

Leveraging Unlabeled Data for Watermark Removal of Deep Neural Networks

REFIT: A UnifiedWatermark Removal Framework for Deep Learning Systems with Limited Data

Removing Backdoor-Based Watermarks in Neural Networks with Limited Data.

On Function-Coupled Watermarks for Deep Neural Networks

Neural Dehydration: Effective Erasure of Black-box Watermarks from DNNs with Limited Data

Deep Neural Network Watermarking Against Model Extraction Attack

Free Fine-tuning: A Plug-and-Play Watermarking Scheme for Deep Neural Networks

FreeMark: A Non-Invasive White-Box Watermarking for Deep Neural Networks

Protecting the Intellectual Property of Deep Neural Networks with Watermarking: The Frequency Domain Approach

TADW: Traceable and Anti-detection Dynamic Watermarking of Deep Neural Networks

On the Robustness of the Backdoor-based Watermarking in Deep Neural Networks

Rethinking the Vulnerability of DNN Watermarking

Digital watermarking for deep neural networks

Unambiguous and High-Fidelity Backdoor Watermarking for Deep Neural Networks

Have You Stolen My Model? Evasion Attacks Against Deep Neural Network Watermarking Techniques

A Game Between the Defender and the Attacker for Trigger-based Black-box Model Watermarking

Rethinking White-BoxWatermarks on Deep Learning Models under Neural Structural Obfuscation

SVD Mark: A Novel Black-Box Watermarking for Protecting Intellectual Property of Deep Neural Network Model

Subnetwork-Lossless Robust Watermarking for Hostile Theft Attacks in Deep Transfer Learning Models