Turning Your Weakness Into a Strength: Watermarking Deep Neural Networks by Backdooring

By Yossi Adi, Carsten Baum, Moustapha Cissé, Benny Pinkas, Joseph Keshet. 2018

872 citations recorded by the source corpus.

Deep Neural Networks have recently gained lots of success after enabling several breakthroughs in notoriously challenging problems. Training these networks is computationally expensive and requires vast amounts of training data. Selling such pre-trained models can, therefore, be a lucrative business model. Unfortunately, once the models are sold they can be easily copied and redistributed. To avoid this, a tracking mechanism to identify models as the intellectual property of a particular vendor is necessary. In this work, we present an approach for watermarking Deep Neural Networks in a black-box way. Our scheme works for general classification tasks and can easily be combined with current learning algorithms. We show experimentally that such a watermark has no noticeable impact on the primary task that the model is designed for. Moreover, we evaluate the robustness of our proposal against a multitude of practical attacks.

Subfields: Artificial Intelligence, Computer Vision and Pattern Recognition, Signal Processing

How researchers see this paper

The researchers whose trusted networks rank it highest, strongest advocate first. Every researcher gets a different order.

In Artificial Intelligence

In Computer Vision and Pattern Recognition

In Signal Processing

Citations in the corpus

STRIP: a defence against trojan attacks on deep neural networks (2019, background): “There are works considering a backdoor as a watermark [34] to protect the intellectual property (IP) of a trained DNN model [35]–[37].”
Radioactive data: tracing through training (2020, positive): “A few works (Adi et al., 2018; Yeom et al., 2018) focus on watermarking deep learning models: these works modify the parameters of a neural network so that any downstream use of the network can be verified.”
Towards Probabilistic Verification of Machine Unlearning (2020, methodology): “used backdoor attacks to watermark deep learning models [57].”
NN-Lock: A Lightweight Authorization to Prevent IP Threats of Deep Learning Models (2022, background): “Amazon AWS, BigML Cloud-based MLaaS Adversary tries to steal classified and highly efficient decision boundaries of DNN models • Adversary avoids the cost of expensive model training • Immense economic loss for the service provider Model stealing is possible even in a black-box scenario through pred”
Fooling Neural Network Interpretations via Adversarial Model Manipulation (2019, background): “, [40, 41], would be another fruitful direction to pursue.”
Poison Attacks against Text Datasets with Conditional Adversarially Regularized Autoencoder (2020, background): “These work either inject poison into images by directly replacing the pixel value in the image with small poison signatures (Gu et al., 2017; Adi et al., 2018) or overlay fullsized poison signatures onto images (Chen et al.”
TABOR: A Highly Accurate Approach to Inspecting and Restoring Trojan Backdoors in AI Systems (2019, background): “In other words, we do not consider triggers with irregular shape ( e.g., watermark trojans [1]).”
Dataset Inference: Ownership Resolution in Machine Learning (2021, background): “Since Uchida et al. (2017) embedded watermarks into neural networks and Adi et al. (2018) used them as signatures to claim possession, watermarks have been widely adopted as a way to resolve ownership claims.”
Survey of Attacks and Defenses on Edge-Deployed Neural Networks (2019, neutral): “of establishing ownership of neural networks [61]–[63].”
MLCapsule: Guarded Offline Deployment of Machine Learning as a Service (2018, background): “Watermarking as a passive defense mechanism, where A model is trained to yield a particular output on a set of points [1], or to produce a specified output when meaningful content is added to samples [39].”
DeepAttest: An End-to-End Attestation Framework for Deep Neural Networks (2019, methodology): “The code-vector is then extracted by the inverse linear mapping ci j = 1 2 (bi j + 1), resulting in c ′ = [0, 0, 1, 0, 1, 1, 1].”
Non-Transferable Learning: A New Approach for Model Ownership Verification and Applicability Authorization (2021, methodology): “Moreover, with extensive experiments, we also demonstrate that state-of-art model watermark removal methods, e.g., FTAL and RTAL (Adi et al., 2018), EWC and AU (Chen et al., 2019), watermark overwriting and model pruning (Rouhani et al., 2018) are not effective to NTL-based veriﬁcation.”
DNN Intellectual Property Protection: Taxonomy, Methods, Attack Resistance, and Evaluations (2020, methodology): “Yossi et al. [1] proposed to use a backdoor as the watermark key image, and use over parameterization of the neural network to design the watermark scheme.”
Increasing the Cost of Model Extraction with Calibrated Proof of Work (2022, background): “Watermarking allows a defender to embed some secret pattern in their model during training (Adi et al., 2018) or inference (Szyller et al., 2019).”
Artificial Fingerprinting for Generative Models: Rooting Deepfake Attribution in Training Data (2020, background): “There are two categories of them: black-box trigger-set-based solutions [3, 54], and white-box feature-based solutions [43, 9, 41].”
A Watermark for Large Language Models (2023, neutral): “3 , the average PPL of attacked sequences increases by 3 × in addition to requiring more model calls.”
DAWN: Dynamic Adversarial Watermarking of Neural Networks (2019, methodology): “to model pruning and adversarial fine tuning [1, 31, 48].”