Model Watermarking for Image Processing Networks

Abstract

Deep learning has achieved tremendous success in numerous industrial applications. As training a good model often needs massive high-quality data and computation resources, the learned models often have significant business values. However, these valuable deep models are exposed to a huge risk of infringements. For example, if the attacker has the full information of one target model including the network structure and weights, the model can be easily finetuned on new datasets. Even if the attacker can only access the output of the target model, he/she can still train another similar surrogate model by generating a large scale of input-output training pairs. How to protect the intellectual property of deep models is a very important but seriously under-researched problem. There are a few recent attempts at classification network protection only.In this paper, we propose the first model watermarking framework for protecting image processing models. To achieve this goal, we leverage the spatial invisible watermarking mechanism. Specifically, given a black-box target model, a unified and invisible watermark is hidden into its outputs, which can be regarded as a special task-agnostic barrier. In this way, when the attacker trains one surrogate model by using the input-output pairs of the target model, the hidden watermark will be learned and extracted afterward. To enable watermarks from binary bits to high-resolution images, both traditional and deep spatial invisible watermarking mechanism are considered. Experiments demonstrate the robustness of the proposed watermarking mechanism, which can resist surrogate models learned with different network structures and objective functions. Besides deep models, the proposed method is also easy to be extended to protect data and traditional image processing algorithms.

Multipurpose Watermarking Approach for Copyright and Integrity of Steganographic Autoencoder Models

“…In recent years, information hiding about DNN has become a popular research issue [18,27,[31][32][33][34][35][36][37]. Kandi et al [6] proposed an innovative learning-based autoencoder convolutional neural network (CNN) for nonblind watermarking, which adds an additional dimension to the use of CNNs for secrecy and outperforms methods using traditional transformations in terms of both agnosticism and robustness.…”

Poison Ink: Robust and Invisible Backdoor Attack

“…However, it is often difficult to explicitly define invisibility. As shown in existing information hiding methods [34,35,36,37], though L p Norm is not a perfect invisibility metric, it can serves as a good invisibility learning metric. So we utilize it as one invisibility loss:…”

Protecting Your NLG Models with Semantic and Robust Watermarks

“…introduces a passport-based ownership verification concerned with inference performance against ambiguity attacks. Data-embedding schemes take carefully crafted sample-label pairs as watermarks and embed their correlation into DL models (Adi et al, 2018;Le Merrer et al, 2020;Zhang et al, 2020). For example, Adi et al (2018) construct watermarks using backdoors that can preserve the functionality of watermarked models.…”