Protecting Intellectual Property of Deep Neural Networks with Watermarking

By Jialong Zhang, Zhongshu Gu, Jiyong Jang, Hui Wu, Marc Ph. Stoecklin, Heqing Huang, Ian M. Molloy. 2018

682 citations recorded by the source corpus.

Deep learning technologies, which are the key components of state-of-the-art Artificial Intelligence (AI) services, have shown great success in providing human-level capabilities for a variety of tasks, such as visual analysis, speech recognition, and natural language processing and etc. Building a production-level deep learning model is a non-trivial task, which requires a large amount of training data, powerful computing resources, and human expertises. Therefore, illegitimate reproducing, distribution, and the derivation of proprietary deep learning models can lead to copyright infringement and economic harm to model creators. Therefore, it is essential to devise a technique to protect the intellectual property of deep learning models and enable external verification of the model ownership. In this paper, we generalize the "digital watermarking'' concept from multimedia ownership verification to deep neural network (DNNs) models. We investigate three DNN-applicable watermark generation algorithms, propose a watermark implanting approach to infuse watermark into deep learning models, and design a remote verification mechanism to determine the model ownership. By extending the intrinsic generalization and memorization capabilities of deep neural networks, we enable the models to learn specially crafted watermarks at training and activate with pre-specified predictions when observing the watermark patterns at inference. We evaluate our approach with two image recognition benchmark datasets. Our framework accurately (100%) and quickly verifies the ownership of all the remotely deployed deep learning models without affecting the model accuracy for normal input data. In addition, the embedded watermarks in DNN models are robust and resilient to different counter-watermark mechanisms, such as fine-tuning, parameter pruning, and model inversion attacks.

Subfields: Artificial Intelligence, Hardware and Architecture, Privacy & Security, Signal Processing

How researchers see this paper

The researchers whose trusted networks rank it highest, strongest advocate first. Every researcher gets a different order.

In Artificial Intelligence

In Hardware and Architecture

In Privacy & Security

In Signal Processing

Citations in the corpus

The Gradient of Generative AI Release: Methods and Considerations (2023, neutral): “Research strives ensure these watermarks are invisible to the human-eye [107], do not affect output quality [46], and tamper-proof from model attacks and alterations like fine-tuning via methods such as embedding noise as watermarks [106].”
STRIP: a defence against trojan attacks on deep neural networks (2019, background): “There are works considering a backdoor as a watermark [28] to protect the intellectual property (IP) of the trained DNN model [29]–[31].”
Attributing Fake Images to GANs: Analyzing Fingerprints in Generated Images (2018, background): “It has been shown that machine learning models can be actively watermarked [31, 28].”
Non-Transferable Learning: A New Approach for Model Ownership Verification and Applicability Authorization (2021, background): “For instance, Zhang et al. (2018) and Li et al. (2019) train a neural network on the original datasets and the watermarked one assigned with a particular label, which makes the model behave abnormally when it encounters watermarked data.”
DNN Intellectual Property Protection: Taxonomy, Methods, Attack Resistance, and Evaluations (2020, methodology): “Usually only the APIs of the DNN models are available for watermark extraction and ownership verification [30].”
Hardware-Assisted Intellectual Property Protection of Deep Learning Models (2020, methodology): “But such leaked DL models can be reused privately by the adversary, thus bypassing ownership inspection by the aforementioned watermarking techniques [26].”
Cheetah: Optimizing and Accelerating Homomorphic Encryption for Private Inference (2020, background): “Cheetah focuses on improving users privacy while protecting the cloud’s models (considered IP today [72]) from model-stealing attacks [63].”
High Accuracy and High Fidelity Extraction of Neural Networks (2019, methodology): “Watermarking neural networks has been proposed [54, 55] to identify extracted models.”
DAWN: Dynamic Adversarial Watermarking of Neural Networks (2019, methodology): “EMENT In this section, we set out the goals and requirements for a watermarking techniques intended to deter model extraction attacks. Recall in this setting, unlike in prior watermarking schemes [3]–[5], [14], the defender does not control the training process of the watermarked (surrogate) model a”
A Systematic Review on Model Watermarking for Neural Networks (2020, background): “5 Watermark Removal As an ultimate solution to prevent successful watermark verification by a legitimate model owner, an attacker might also try to entirely remove the watermark from a stolen model (Zhang et al., 2018).”
MLCapsule: Guarded Offline Deployment of Machine Learning as a Service (2018, background): “Watermarking as a passive defense mechanism, where A model is trained to yield a particular output on a set of points [1], or to produce a specified output when meaningful content is added to samples [39].”
TrojanNet: Embedding Hidden Trojan Horse Models in Neural Networks (2020, background): “Training a neural network often requires signiﬁcant data and resources, and a corporation may wish to protect against the leakage of their proprietary models via watermarking – a procedure that embeds a secret token into the network as proof of ownership (Zhang et al., 2018).”
BlackMarks: Blackbox Multibit Watermarking for Deep Neural Networks (2018, methodology): “All of the existing zero-bit black-box watermarking papers [7], [14], [13] leverages ‘adversarial training’ for WM embedding to ensure that the marked model has a high classiﬁcation accuracy on the WM trigger set.”
High-Fidelity Extraction of Neural Network Models (2019, neutral): “Watermarking neural networks has been proposed [53, 54] to identify model extraction after-the-fact.”
Imitation Attacks and Defenses for Black-box Machine Translation Systems (2020, background): “For example, watermarking strategies (Zhang et al., 2018; Szyller et al., 2019; Krishna et al., 2020) intentionally output incorrect responses for certain inputs and then tests if the suspected stolen model reproduces the mistakes.”
Artificial Fingerprinting for Generative Models: Rooting Deepfake Attribution in Training Data (2020, background): “There are two categories of them: black-box trigger-set-based solutions [3, 58], and white-box feature-based solutions [47, 10, 44].”
Adversarial frontier stitching for remote neural network watermarking (2017, neutral): “Finally, we recall that the watermarking technique we proposed, as well as the ones from the related work [39,2, 13,28], make the assumption that the watermarked model leaked as a bit-level copy.”