DeepTrigger: A Watermarking Scheme of Deep Learning Models Based on Chaotic Automatic Data Annotation

Abstract

With the rapid development of artificial intelligence, the intellectual property protection of deep learning models appeals widespread concerns of scientists and engineers. The black-box watermarking protection scheme has been favored by many scholars due to its many advantages. The trigger set containing data content and data annotation is the key of black-box watermarking technology. However, most of the trigger sets in literates were constructed by comprehensible features, such as Gaussian noise and badges on original data content. Then, the attacks based on machine learning can obtain the watermarking features and generate fake trigger set. Therefore, fraudulent ownership claim attacks may occur. In this paper, we turn our attention to data annotation and propose a black-box watermarking scheme based on chaotic automatic data annotation. Chaos has superior features, such as the sensitivity of initial value, aperiodic behavior and unpredictability of the chaotic sequence. We applies these chaotic features on data annotation so as to against the fraudulent ownership claim attacks. Firstly, this scheme applies chaotic automatic data annotation, which is time-saving and non-manual labeling. Secondly, chaotic sequences are unpredictable for long-terms, which can break the principle of empirical or statistical machine learning based attacks when chaotic labeling the trigger samples. Thirdly, the initial value and parameters in chaos offer a large range of key space, which can facilitate the commercialization of the intelligent models. The key formulation also guarantees the separation of the secret key and the trigger set. In addition, experiments and simulations show that the scheme is effective, secure and robust. It can resist fine-tuning attacks, compression attacks, fraudulent ownership claim attacks and overwriting attacks. INDEX TERMS Black-box watermarking; trigger-set; chaos; automatic annotation; non-generalization; intellectual property protection.

[Retracted] Mode Optimization and Rule Management of Intellectual Property Rights Protection of Educational Resource Data Based on Machine Learning Algorithm

“…Unstructured data refer to data with variable length and no fixed format. Data expression and products of educational resources based on machine learning are usually protected by copyright in the early days, but copyright protects the expression form of ideas, the data expression and the selection, arrangement, system, and structure of the work, rather than the protection of the data itself [9]. And if the data are provided in the form of public dissemination, it will inevitably be exposed to and obtained by an unspecified Complexity number of people, and the service provider cannot guarantee that its application purpose must comply with the rules, which creates the risk of copyright infringement.…”

Method for copyright protection of deep neural networks using digital watermarking

“…Например, существует схема встраивания, которая основана на присвоении каждому триггеру случайной метки [10,11]. В [12] набор триггеров состоит из абстрактных изображений.…”

A Novel Hash Function Based on a Chaotic Sponge and DNA Sequence

“…Due to these features, there has been a rise in research attempting to embed digital chaos into cryptography. Various cryptographic applications have adopted digital chaos in their designs such as image encryption [1]- [6], S-box [7], [8], image watermarking [9], [10], pseudo-random number generators [11], [12], security protocols [13], [14], and hash function [15]- [17]. There are also other chaos-based applications that have been proposed such as secure speech encryption based on chaotic map [18], image encryption [19], and chaos-based compressive sensing encryption [20].…”