DeepSigns: An End-to-End Watermarking Framework for Ownership Protection of Deep Neural Networks

By Bita Darvish Rouhani, Huili Chen, Farinaz Koushanfar. International Conference on Architectural Support for Programming Languages and Operating Systems, 2019

331 citations recorded by the source corpus.

Deep Learning (DL) models have created a paradigm shift in our ability to comprehend raw data in various important fields, ranging from intelligence warfare and healthcare to autonomous transportation and automated manufacturing. A practical concern, in the rush to adopt DL models as a service, is protecting the models against Intellectual Property (IP) infringement. DL models are commonly built by allocating substantial computational resources that process vast amounts of proprietary training data. The resulting models are therefore considered to be an IP of the model builder and need to be protected to preserve the owner's competitive advantage. We propose DeepSigns, the first end-to-end IP protection framework that enables developers to systematically insert digital watermarks in the target DL model before distributing the model. DeepSigns is encapsulated as a high-level wrapper that can be leveraged within common deep learning frameworks including TensorFlow and PyTorch. The libraries in DeepSigns work by dynamically learning the Probability Density Function (pdf) of activation maps obtained in different layers of a DL model. DeepSigns uses the low probabilistic regions within the model to gradually embed the owner's signature (watermark) during DL training while minimally affecting the overall accuracy and training overhead. DeepSigns can demonstrably withstand various removal and transformation attacks, including model pruning, model fine-tuning, and watermark overwriting. We evaluate DeepSigns performance on a wide variety of DL architectures including wide residual convolution neural networks, multi-layer perceptrons, and long short-term memory models. Our extensive evaluations corroborate DeepSigns' effectiveness and applicability. We further provide a highly-optimized accompanying API to facilitate training watermarked neural networks with a training overhead as low as 2.2%.

Subfields: Artificial Intelligence, Computer Vision and Pattern Recognition

View Paper: https://www.semanticscholar.org/paper/8c66adc178ad2a4cca93762edfe596fc9ccf14e1

How researchers see this paper

The researchers whose trusted networks rank it highest, strongest advocate first. Every researcher gets a different order.

In Artificial Intelligence

In Computer Vision and Pattern Recognition

Citations in the corpus

DAWN: Dynamic Adversarial Watermarking of Neural Networks (2019, methodology): “reswhite-boxaccesstothemodelinordertoanalyzetheweights. A limitation of this approach is that the watermark can be easily removed by minimally retraining the watermarked model. Alternative approaches [1, 10, 31, 48] that are more robust have been proposed, where the watermark can be verified in a bl”
DNN Intellectual Property Protection: Taxonomy, Methods, Attack Resistance, and Evaluations (2020, methodology): “5) Watermark/fingerprint overwriting [6, 7, 23]: If an attacker knows the method used to embed the watermark in the model (but does not know the owner’s private watermark information), he may want to overwrite the original watermark by embedding a new watermark in the deep learning network, so as…”
Hardware-Assisted Intellectual Property Protection of Deep Learning Models (2020, methodology): “This is a reasonable assumption as DL model owners keep such information private to maintain a competitive edge in business [19], [22].”
NN-Lock: A Lightweight Authorization to Prevent IP Threats of Deep Learning Models (2022, methodology): “Protection against Model Extraction ๏ Model Watermarking • Embedding identification information into a given DNN model for establishing ownership[1][2][3] • Cannot prevent its illegal usage as an adversary can privately use the model ๏ Model Obfuscation • Obfuscate the model structures[4] • A more c”