Adversarial frontier stitching for remote neural network watermarking

By Erwan Le Merrer, Patrick Pérez, Gilles Trédan. Neural computing & applications (Print), 2017

398 citations recorded by the source corpus.

The state-of-the-art performance of deep learning models comes at a high cost for companies and institutions, due to the tedious data collection and the heavy processing requirements. Recently, Nagai et al. (Int J Multimed Inf Retr 7(1):3–16, 2018), Uchida et al. (Embedding watermarks into deep neural networks, ICMR, 2017) proposed to watermark convolutional neural networks for image classification, by embedding information into their weights. While this is a clear progress toward model protection, this technique solely allows for extracting the watermark from a network that one accesses locally and entirely. Instead, we aim at allowing the extraction of the watermark from a neural network (or any other machine learning model) that is operated remotely, and available through a service API. To this end, we propose to mark the model’s action itself, tweaking slightly its decision frontiers so that a set of specific queries convey the desired information. In the present paper, we formally introduce the problem and propose a novel zero-bit watermarking algorithm that makes use of adversarial model examples. While limiting the loss of performance of the protected model, this algorithm allows subsequent extraction of the watermark using only few queries. We experimented the approach on three neural networks designed for image classification, in the context of MNIST digit recognition task.

Subfields: Artificial Intelligence, Computer Vision and Pattern Recognition

View Paper: https://www.semanticscholar.org/paper/8a8403ebbab83b83d32759a7e56d3cf9f002ba95

How researchers see this paper

The researchers whose trusted networks rank it highest, strongest advocate first. Every researcher gets a different order.

In Artificial Intelligence

In Computer Vision and Pattern Recognition

Citations in the corpus

DNN Intellectual Property Protection: Taxonomy, Methods, Attack Resistance, and Evaluations (2020, methodology): “To this end, they use the adversarial perturbations of the training instances to produce new instances which are very close to the boundary of the model [20].”
Safe Distillation Box (2021, methodology): “For example, the network watermarking (Merrer, Pérez, and Trédan 2019; Zhang et al. 2018b) aims to verify and protect network intel- ar X iv :2 11 2.”
DAWN: Dynamic Adversarial Watermarking of Neural Networks (2019, methodology): “Prior work evaluated the unremovability of backoor-based watermark after a watermarked model is trained [3]–[5].”
DeepAttest: An End-to-End Attestation Framework for Deep Neural Networks (2019, methodology): “[1, 34] require DNN inference of multiple inputs on the local device and TEE-supported WM checking, which is prohibitively costly.”
Non-Transferable Learning: A New Approach for Model Ownership Verification and Applicability Authorization (2021, methodology): “For ownership veriﬁcation, prior works proposed approaches such as embedding watermarks into network parameters (Song et al., 2017), learning special behaviors for pre-deﬁned triggers (Fan et al., 2019), and extracting ﬁngerprints from the model (Le Merrer et al., 2020).”
BlackMarks: Blackbox Multibit Watermarking for Deep Neural Networks (2018, methodology): “All of the existing zero-bit black-box watermarking papers [7], [14], [13] leverages ‘adversarial training’ for WM embedding to ensure that the marked model has a high classiﬁcation accuracy on the WM trigger set.”
DeepSigns: An End-to-End Watermarking Framework for Ownership Protection of Deep Neural Networks (2019, methodology): “There are two prior works targeting watermarking the output layer [13, 14].”
Turning Your Weakness Into a Strength: Watermarking Deep Neural Networks by Backdooring (2018, background): “In [31] the authors suggested to use adversarial examples together with adversarial training to watermark neural networks.”
Hardware-Assisted Intellectual Property Protection of Deep Learning Models (2020, methodology): “Watermarking strategies for DL models have been proposed in recent literature [7], [11], [13], [17], [19] which help to claim the ownership of stolen models by embedding identiﬁcation information into them.”