Robust Watermarking of Neural Network with Exponential Weighting

Namba, Ryota; Sakuma, Jun

doi:10.1145/3321705.3329808

Cited by 97 publications

(83 citation statements)

References 14 publications

Supporting

Mentioning

Contrasting

Unclassified

Order By: Relevance

“…These methods are white-box watermarking schemes. Although they all have good performance to the protection of intelligent models, the white-box watermarking schemes are vulnerable to statistical attacks [9]. Besides, the extraction of the watermark has the limitation that it can only be successfully extracted when a complete model is obtained locally.…”

Section: A Related Workmentioning

confidence: 99%

“…Guo et al [5] proposed to add the message mark associated with the signature to part of the original images as a watermark. For the watermarking schemes that changed the original images as the key trigger samples, Namba et al [9] proposed a query modification attack. It can make the verification of the trigger set invalid.…”

Section: A Related Workmentioning

confidence: 99%

“…Although the white-box watermarking can carry more information, its application scenarios are limited. It cannot resist statistical attacks [9]. The black-box watermarking is more practical because it works remotely by trigger sets.…”

Section: A Related Workmentioning

confidence: 99%

See 2 more Smart Citations

DeepTrigger: A Watermarking Scheme of Deep Learning Models Based on Chaotic Automatic Data Annotation

et al. 2020

View full text Add to dashboard Cite

With the rapid development of artificial intelligence, the intellectual property protection of deep learning models appeals widespread concerns of scientists and engineers. The black-box watermarking protection scheme has been favored by many scholars due to its many advantages. The trigger set containing data content and data annotation is the key of black-box watermarking technology. However, most of the trigger sets in literates were constructed by comprehensible features, such as Gaussian noise and badges on original data content. Then, the attacks based on machine learning can obtain the watermarking features and generate fake trigger set. Therefore, fraudulent ownership claim attacks may occur. In this paper, we turn our attention to data annotation and propose a black-box watermarking scheme based on chaotic automatic data annotation. Chaos has superior features, such as the sensitivity of initial value, aperiodic behavior and unpredictability of the chaotic sequence. We applies these chaotic features on data annotation so as to against the fraudulent ownership claim attacks. Firstly, this scheme applies chaotic automatic data annotation, which is time-saving and non-manual labeling. Secondly, chaotic sequences are unpredictable for long-terms, which can break the principle of empirical or statistical machine learning based attacks when chaotic labeling the trigger samples. Thirdly, the initial value and parameters in chaos offer a large range of key space, which can facilitate the commercialization of the intelligent models. The key formulation also guarantees the separation of the secret key and the trigger set. In addition, experiments and simulations show that the scheme is effective, secure and robust. It can resist fine-tuning attacks, compression attacks, fraudulent ownership claim attacks and overwriting attacks. INDEX TERMS Black-box watermarking; trigger-set; chaos; automatic annotation; non-generalization; intellectual property protection.

show abstract

Section: A Related Workmentioning

confidence: 99%

Section: A Related Workmentioning

confidence: 99%

See 1 more Smart Citation

DeepTrigger: A Watermarking Scheme of Deep Learning Models Based on Chaotic Automatic Data Annotation

et al. 2020

View full text Add to dashboard Cite

show abstract

“…Namba et al [20] proposed a watermarking method that can defend against evasion attacks. They selected a set of original samples as a watermark from the training set with label change.…”

Section: Related Workmentioning

confidence: 99%

How to prove your model belongs to you

Zheng

Zhang

et al. 2019

Proceedings of the 35th Annual Computer Security Applications Conference

108

View full text Add to dashboard Cite

Deep learning techniques have made tremendous progress in a variety of challenging tasks, such as image recognition and machine translation, during the past decade. Training deep neural networks is computationally expensive and requires both human and intellectual resources. Therefore, it is necessary to protect the intellectual property of the model and externally verify the ownership of the model. However, previous studies either fail to defend against the evasion attack or have not explicitly dealt with fraudulent claims of ownership by adversaries. Furthermore, they can not establish a clear association between the model and the creator's identity.To fill these gaps, in this paper, we propose a novel intellectual property protection (IPP) framework based on blind-watermark for watermarking deep neural networks that meet the requirements of security and feasibility. Our framework accepts ordinary samples and the exclusive logo as inputs, outputting newly generated samples as watermarks, which are almost indistinguishable from the origin, and infuses these watermarks into DNN models by assigning specific labels, leaving the backdoor as the basis for our copyright claim. We evaluated our IPP framework on two benchmark datasets and 15 popular deep learning models. The results show that our framework successfully verifies the ownership of all the models without a noticeable impact on their primary task. Most importantly, we are the first to successfully design and implement a blind-watermark based framework, which can achieve state-of-art * Corresponding author. performances on undetectability against evasion attack and unforgeability against fraudulent claims of ownership. Further, our framework shows remarkable robustness and establishes a clear association between the model and the author's identity. CCS CONCEPTS• Security and privacy → Software and application security; Systems security. KEYWORDSintellectual property protection, neural networks, blind watermark, security and privacy ACM Reference Format:

show abstract

“…The inserted watermark does not vanish even after parameter pruning or fine-tuning; the watermark image remains entire even after 65% of parameters are clipped. Ryota Namba and Jun Sakuma [15] presented a novel watermarking method, exponential weighting. Their results prove that their watermarking method achieves the highest performance of watermark even under a malicious attempt of unauthorized service providers, such as query and model modification, without sacrificing the predictive concert of the neural network model.…”

Section: Introductionmentioning

confidence: 99%

Multiple Watermarking for Images using Back-Propagation Neural Network and DWT

Ananth¹,

Karthikeyan²,

Mohananthini³

et al. 2019

IJEAT

View full text Add to dashboard Cite

An effective multiple watermarking technique supported on neural network into the wavelet transform can be proposed. The wavelet coefficients has been preferred by Human Visual System. In the proposed work focus on Discrete Wavelet Transform based segmented image watermarking techniques using Back-Propagation neural networks. Using improved BPNN, the multiple watermarks are embedded into the original image, which can advance the pace of the learn, reduce the error and the qualified neural networks are extricate multiple watermarks as of the embedded images. The planned strategy achieves a excellent visual effect scheduled the watermarked images as well as high robustness on extracted multiple watermarks.

show abstract

Robust Watermarking of Neural Network with Exponential Weighting

Cited by 97 publications

References 14 publications

DeepTrigger: A Watermarking Scheme of Deep Learning Models Based on Chaotic Automatic Data Annotation

DeepTrigger: A Watermarking Scheme of Deep Learning Models Based on Chaotic Automatic Data Annotation

How to prove your model belongs to you

Multiple Watermarking for Images using Back-Propagation Neural Network and DWT

Contact Info

Product

Resources

About