Rethinking the Vulnerability of DNN Watermarking

Wang, Run; Li, Haoxuan; Mu, Lingzhou; Ren, Jixing; Guo, Shangwei; Liu, Li; Fang, Liming; Chen, Jing; Wang, Lina

doi:10.1145/3503161.3548390

Cited by 4 publications

(1 citation statement)

References 22 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…Notably, the essential attribute of these schemes is their invasive nature, where the model content or training process is modified after watermark embedding. Recent studies have shown that such modifications can severely compromise the utility of DNN models or introduce additional vulnerabilities [25,26].…”

Section: Introductionmentioning

confidence: 99%

A Privacy-Preserving Testing Framework for Copyright Protection of Deep Learning Models

Wei,

Wang,

Wang

et al. 2023

Electronics

View full text Add to dashboard Cite

Deep learning is widely utilized to acquire predictive models for mobile crowdsensing systems (MCSs). These models significantly improve the availability and performance of MCSs in real-world scenarios. However, training these models requires substantial data resources, rendering them valuable to their owners. Numerous protection schemes have been proposed to mitigate potential economic loss arising from legal issues pertaining to model copyright. Although capable of providing copyright verification, these schemes either compromise the model utility or prove ineffective against adversarial attacks. Additionally, the privacy concern surrounding copyright verification is noteworthy, given the increasing privacy concerns among model owners. This paper introduces a privacy-preserving testing framework for copyright protection (PTFCP) comprising multiple protocols. Our protocols adhere to the two-cloud server model, where the owner and the suspect transmit their model output to non-colluding servers for evaluating model similarity through the public-key cryptosystem with distributed decryption (PCDD) and garbled circuits. Additionally, we have developed novel techniques to enable secure differentiation for absolute values. Our experiments in real-world datasets demonstrate that our protocols in the PTFCP successfully operate under numerous copyright violation scenarios, such as finetuning, pruning, and extraction.

show abstract

Section: Introductionmentioning

confidence: 99%