DAWN: Dynamic Adversarial Watermarking of Neural Networks

By Sebastian Szyller, Buse Gul Atli, Samuel Marchal, N. Asokan. 2019

241 citations recorded by the source corpus.

Training machine learning (ML) models is expensive in terms of computational power, amounts of labeled data and human expertise. Thus, ML models constitute business value for their owners. Embedding digital watermarks during model training allows a model owner to later identify their models in case of theft or misuse. However, model functionality can also be stolen via model extraction, where an adversary trains a surrogate model using results returned from a prediction API of the original model. Recent work has shown that model extraction is a realistic threat. Existing watermarking schemes are ineffective against model extraction since it is the adversary who trains the surrogate model. In this paper, we introduce DAWN (Dynamic Adversarial Watermarking of Neural Networks), the first approach to use watermarking to deter model extraction theft. Unlike prior watermarking schemes, DAWN does not impose changes to the training process but operates at the prediction API of the protected model, by dynamically changing the responses for a small subset of queries (e.g., 0.5%) from API clients. This set is a watermark that will be embedded in case a client uses its queries to train a surrogate model. We show that DAWN is resilient against two state-of-the-art model extraction attacks, effectively watermarking all extracted surrogate models, allowing model owners to reliably demonstrate ownership (with confidence greater than 1-2-64), incurring negligible loss of prediction accuracy (0.03-0.5%).

Subfields: Artificial Intelligence, Safety, Robustness & Interpretability, Signal Processing

How researchers see this paper

The researchers whose trusted networks rank it highest, strongest advocate first. Every researcher gets a different order.

In Artificial Intelligence

In Safety, Robustness & Interpretability

In Signal Processing

Citations in the corpus

The False Promise of Imitating Proprietary LLMs (2023, background): “…body of work in this direction, e.g., one can detect whether a particular model is trained via imitation (Krishna et al., 2020; Juuti et al., 2019; Szyller et al., 2019; Maini et al., 2021) or slow model stealing by sacrifing some performance (Wallace et al., 2020; Orekondy et al., 2020; Dziedzic…”
DNN Intellectual Property Protection: Taxonomy, Methods, Attack Resistance, and Evaluations (2020, methodology): “…IP protection methods and the evaluation metrics when the attacker takes active counterattacks, including: security [23, 29], unremovability [1, 27], unforgeability [1], non-ownership piracy [1, 27], ownership piracy [1, 27], verifiability [1], collusion resistance [27], and non-invertible…”
Thieves on Sesame Street! Model Extraction of BERT-based APIs (2019, background): “Another defense against extraction is watermarking (Szyller et al., 2019), in which a tiny fraction of queries are chosen at random and modified to return a wrong output.”
Increasing the Cost of Model Extraction with Calibrated Proof of Work (2022, background): “Watermarking allows a defender to embed some secret pattern in their model during training (Adi et al., 2018) or inference (Szyller et al., 2019).”
Imitation Attacks and Defenses for Black-box Machine Translation Systems (2020, background): “For example, watermarking strategies (Zhang et al., 2018; Szyller et al., 2019; Krishna et al., 2020) intentionally output incorrect responses for certain inputs and then tests if the suspected stolen model reproduces the mistakes.”