Watermarking Deep Neural Networks for Embedded Systems

By Jia Guo, Miodrag Potkonjak. 2018

191 citations recorded by the source corpus.

Deep neural networks (DNNs) have become an important tool for bringing intelligence to mobile and embedded devices. The increasingly wide deployment, sharing and potential commercialization of DNN models create a compelling need for intellectual property (IP) protection. Recently, DNN watermarking emerges as a plausible IP protection method. Enabling DNN watermarking on embedded devices in a practical setting requires a black-box approach. Existing DNN watermarking frameworks either fail to meet the black-box requirement or are susceptible to several forms of attacks. We propose a watermarking framework by incorporating the author's signature in the process of training DNNs. While functioning normally in regular cases, the resulting watermarked DNN behaves in a different, predefined pattern when given any signed inputs, thus proving the authorship. We demonstrate an example implementation of the framework on popular image classification datasets and show that strong watermarks can be embedded in the models.

Subfields: Computer Vision and Pattern Recognition, Hardware and Architecture, Signal Processing

How researchers see this paper

The researchers whose trusted networks rank it highest, strongest advocate first. Every researcher gets a different order.

In Computer Vision and Pattern Recognition

In Hardware and Architecture

In Signal Processing

Citations in the corpus

STRIP: a defence against trojan attacks on deep neural networks (2019, background): “There are works considering a backdoor as a watermark [6] to protect the intellectual property (IP) of a trained DNNmodel [1, 12, 36].”
DNN Intellectual Property Protection: Taxonomy, Methods, Attack Resistance, and Evaluations (2020, methodology): “Similarly, Guo and Potkonjak [15] proposed a black-box watermarking method for embedded applications.”
Adversarial frontier stitching for remote neural network watermarking (2017, unknown): “It is to be noted that if the suspected model is running on an embedded device [13], there is no cost in querying that model; if we target such an application, keys can then be of arbitrary length as far as their embedding preserve the accuracy of the model to be watermarked.”
Hardware-Assisted Intellectual Property Protection of Deep Learning Models (2020, methodology): “Though, in the former scenario, the DL model owner may still use watermarking techniques [7], [11], [19] to claim digital rights (if somehow she has obtained access privileges to the illegal cloud service), but in the latter attack scenario, the model owner won’t have any provision to remotely…”