Embedding Watermarks into Deep Neural Networks

Uchida, Yusuke; Nagai, Yuki; Sakazawa, Shigeyuki; Satoh, Shin’ichi

doi:10.1145/3078971.3078974

Cited by 475 publications

(613 citation statements)

References 22 publications

Supporting

Mentioning

570

Contrasting

Unclassified

Order By: Relevance

“…Given a model, the model owner can verify the watermark by checking the product. As attacks against watermark, Uchida et al [18] introduced model modification, which attempts to remove watermark from the model by modifying the parameters of the neural network using fine-tuning or pruning [7]. Similar attack methods have been considered in [12,14,20,21].…”

Section: Related Workmentioning

confidence: 99%

Robust Watermarking of Neural Network with Exponential Weighting

Namba

Sakuma

2019

Proceedings of the 2019 ACM Asia Conference on Computer and Communications Security

View full text Add to dashboard Cite

Deep learning has been achieving top performance in many tasks. Since training of a deep learning model requires a great deal of cost, we need to treat neural network models as valuable intellectual properties. One concern in such a situation is that some malicious user might redistribute the model or provide a prediction service using the model without permission. One promising solution is digital watermarking, to embed a mechanism into the model so that the owner of the model can verify the ownership of the model externally. In this study, we present a novel attack method against watermark, query modification, and demonstrate that all of the existing watermark methods are vulnerable to either of query modification or existing attack method (model modification). To overcome this vulnerability, we present a novel watermarking method, exponential weighting. We experimentally show that our watermarking method achieves high verification performance of watermark even under a malicious attempt of unauthorized service providers, such as model modification and query modification, without sacrificing the predictive performance of the neural network model.

show abstract

Section: Related Workmentioning

confidence: 99%

Robust Watermarking of Neural Network with Exponential Weighting

Namba

Sakuma

2019

Proceedings of the 2019 ACM Asia Conference on Computer and Communications Security

View full text Add to dashboard Cite

show abstract

“…Here, a watermark is applied to a neural network in such a way that it does not impact the network's accuracy, but can be used to confirm ownership from network outputs. Even if the party responsible for the theft attempts to prune or finetune the network, watermarks can be retained [62].…”

Section: Defending Edge Devices Running Neural Networkmentioning

confidence: 99%

Survey of Attacks and Defenses on Edge-Deployed Neural Networks

Isakov¹,

Gadepally

Gettings

et al. 2019

2019 IEEE High Performance Extreme Computing Conference (HPEC)

View full text Add to dashboard Cite

Deep Neural Network (DNN) workloads are quickly moving from datacenters onto edge devices, for latency, privacy, or energy reasons. While datacenter networks can be protected using conventional cybersecurity measures, edge neural networks bring a host of new security challenges. Unlike classic IoT applications, edge neural networks are typically very compute and memory intensive, their execution is data-independent, and they are robust to noise and faults. Neural network models may be very expensive to develop, and can potentially reveal information about the private data they were trained on, requiring special care in distribution. The hidden states and outputs of the network can also be used in reconstructing user inputs, potentially violating users' privacy. Furthermore, neural networks are vulnerable to adversarial attacks, which may cause misclassifications and violate the integrity of the output. These properties add challenges when securing edge-deployed DNNs, requiring new considerations, threat models, priorities, and approaches in securely and privately deploying DNNs to the edge. In this work, we cover the landscape of attacks on, and defenses, of neural networks deployed in edge devices and provide a taxonomy of attacks and defenses targeting edge DNNs.

show abstract

“…They selected a set of original samples as a watermark from the training set with label change. Although this approach is promising, it is as incapable of establishing a clear association between the model and the creator's identity as most of the existing methods [1,23,27].…”

Section: Related Workmentioning

confidence: 99%

How to prove your model belongs to you

Zheng

Zhang

et al. 2019

Proceedings of the 35th Annual Computer Security Applications Conference

108

View full text Add to dashboard Cite

Deep learning techniques have made tremendous progress in a variety of challenging tasks, such as image recognition and machine translation, during the past decade. Training deep neural networks is computationally expensive and requires both human and intellectual resources. Therefore, it is necessary to protect the intellectual property of the model and externally verify the ownership of the model. However, previous studies either fail to defend against the evasion attack or have not explicitly dealt with fraudulent claims of ownership by adversaries. Furthermore, they can not establish a clear association between the model and the creator's identity.To fill these gaps, in this paper, we propose a novel intellectual property protection (IPP) framework based on blind-watermark for watermarking deep neural networks that meet the requirements of security and feasibility. Our framework accepts ordinary samples and the exclusive logo as inputs, outputting newly generated samples as watermarks, which are almost indistinguishable from the origin, and infuses these watermarks into DNN models by assigning specific labels, leaving the backdoor as the basis for our copyright claim. We evaluated our IPP framework on two benchmark datasets and 15 popular deep learning models. The results show that our framework successfully verifies the ownership of all the models without a noticeable impact on their primary task. Most importantly, we are the first to successfully design and implement a blind-watermark based framework, which can achieve state-of-art * Corresponding author. performances on undetectability against evasion attack and unforgeability against fraudulent claims of ownership. Further, our framework shows remarkable robustness and establishes a clear association between the model and the author's identity. CCS CONCEPTS• Security and privacy → Software and application security; Systems security. KEYWORDSintellectual property protection, neural networks, blind watermark, security and privacy ACM Reference Format:

show abstract

Embedding Watermarks into Deep Neural Networks

Cited by 475 publications

References 22 publications

Robust Watermarking of Neural Network with Exponential Weighting

Robust Watermarking of Neural Network with Exponential Weighting

Survey of Attacks and Defenses on Edge-Deployed Neural Networks

How to prove your model belongs to you

Contact Info

Product

Resources

About