Protecting Intellectual Property of Deep Neural Networks with Watermarking

Zhang, Jialong; Gu, Zhongshu; Jang, Jiyong; Wu, Hui; Stoecklin, Marc Ph.; Huang, Heqing; Molloy, Ian

doi:10.1145/3196494.3196550

Cited by 417 publications

(518 citation statements)

References 27 publications

Supporting

Mentioning

514

Contrasting

Unclassified

Order By: Relevance

“…Figure 3 shows examples of key samples created from CIFAR-10 dataset. Figure 3 (a) are two examples of original images; Figure 3 (b)-(h) are key samples generated by methods proposed in [1,10,23,31]. Figure 3 (j) are two key samples generated by our blind-watermark based IPP framework.…”

Section: Resultsmentioning

confidence: 99%

“…They selected a pair of random images and random labels as the watermark, which is also called key samples. Zhang et al [31] proposed a similar watermarking method while they employed other multiple types of watermarks. Adi et al [1] chosen a set of abstract images with pre-defined labels as a watermark.…”

Section: Related Workmentioning

confidence: 99%

“…Once the detector decides the queried instance is a possible key sample, the stolen model would return a random label from its output space. However, all the existing watermark methods [1,10,23,31] are susceptible to the above form of attack. The distribution of the key samples and the original samples varies greatly, once the model owner issues prediction of these key samples, Eve can easily detect the watermarks by utilizing a sample detector.…”

Section: Security: Evasion Attackmentioning

confidence: 99%

“…Essentially, the binary classification is supervised learning. They can generate the same amount of key samples according to the proposed methods in [1,10,23,31] and our framework, then get the training set for detector build-up. We typically design a simple detector based on 3 fully-connected layers, which are composed of 512, 256 and 1 neural unit followed by sigmoid activation.…”

Section: Securitymentioning

confidence: 99%

See 3 more Smart Citations

How to prove your model belongs to you

Zheng

Zhang

et al. 2019

Proceedings of the 35th Annual Computer Security Applications Conference

108

View full text Add to dashboard Cite

Deep learning techniques have made tremendous progress in a variety of challenging tasks, such as image recognition and machine translation, during the past decade. Training deep neural networks is computationally expensive and requires both human and intellectual resources. Therefore, it is necessary to protect the intellectual property of the model and externally verify the ownership of the model. However, previous studies either fail to defend against the evasion attack or have not explicitly dealt with fraudulent claims of ownership by adversaries. Furthermore, they can not establish a clear association between the model and the creator's identity.To fill these gaps, in this paper, we propose a novel intellectual property protection (IPP) framework based on blind-watermark for watermarking deep neural networks that meet the requirements of security and feasibility. Our framework accepts ordinary samples and the exclusive logo as inputs, outputting newly generated samples as watermarks, which are almost indistinguishable from the origin, and infuses these watermarks into DNN models by assigning specific labels, leaving the backdoor as the basis for our copyright claim. We evaluated our IPP framework on two benchmark datasets and 15 popular deep learning models. The results show that our framework successfully verifies the ownership of all the models without a noticeable impact on their primary task. Most importantly, we are the first to successfully design and implement a blind-watermark based framework, which can achieve state-of-art * Corresponding author. performances on undetectability against evasion attack and unforgeability against fraudulent claims of ownership. Further, our framework shows remarkable robustness and establishes a clear association between the model and the author's identity. CCS CONCEPTS• Security and privacy → Software and application security; Systems security. KEYWORDSintellectual property protection, neural networks, blind watermark, security and privacy ACM Reference Format:

show abstract

Section: Resultsmentioning

confidence: 99%

Section: Related Workmentioning

confidence: 99%

Section: Security: Evasion Attackmentioning

confidence: 99%

Section: Securitymentioning

confidence: 99%

See 2 more Smart Citations

How to prove your model belongs to you

Zheng

Zhang

et al. 2019

Proceedings of the 35th Annual Computer Security Applications Conference

108

View full text Add to dashboard Cite

show abstract

“…As attacks against watermark, Uchida et al [18] introduced model modification, which attempts to remove watermark from the model by modifying the parameters of the neural network using fine-tuning or pruning [7]. Similar attack methods have been considered in [12,14,20,21]. They experimentally show that verification of watermark works successfully even when the unauthorized service provider attempts to invalidate the verification by fine-tuning or pruning of the model.…”

Section: Related Workmentioning

confidence: 99%

Robust Watermarking of Neural Network with Exponential Weighting

Namba

Sakuma

2019

Proceedings of the 2019 ACM Asia Conference on Computer and Communications Security

View full text Add to dashboard Cite

Deep learning has been achieving top performance in many tasks. Since training of a deep learning model requires a great deal of cost, we need to treat neural network models as valuable intellectual properties. One concern in such a situation is that some malicious user might redistribute the model or provide a prediction service using the model without permission. One promising solution is digital watermarking, to embed a mechanism into the model so that the owner of the model can verify the ownership of the model externally. In this study, we present a novel attack method against watermark, query modification, and demonstrate that all of the existing watermark methods are vulnerable to either of query modification or existing attack method (model modification). To overcome this vulnerability, we present a novel watermarking method, exponential weighting. We experimentally show that our watermarking method achieves high verification performance of watermark even under a malicious attempt of unauthorized service providers, such as model modification and query modification, without sacrificing the predictive performance of the neural network model.

show abstract

Digital Investigative Model in IoT: Forensic View

Ray

Bhatia

2022

Digital Forensics and Internet of Things

View full text Add to dashboard Cite

Protecting Intellectual Property of Deep Neural Networks with Watermarking

Cited by 417 publications

References 27 publications

How to prove your model belongs to you

How to prove your model belongs to you

Robust Watermarking of Neural Network with Exponential Weighting

Digital Investigative Model in IoT: Forensic View

Contact Info

Product

Resources

About