AIME: Watermarking AI Models by Leveraging Errors

Mehta, Dhwani; Mondol, Nurun; Farahmandi, Farimah; Tehranipoor, Mark

doi:10.23919/date54114.2022.9774656

Cited by 4 publications

(1 citation statement)

References 12 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…We systematize the existing DNN watermarking schemes into parameter-embedding and data-poisoning watermarking schemes based on whether the owner needs to access the suspicious model in ownership verification. Parameter-embedding watermarking scheme embeds watermarks into the target model's parameters [18,38] or the activations of hidden layers [30,36]. Uchida et al [38] proposed embedding watermarks into the model parameters by using a parameter regularizer with a designed embedding loss.…”

Section: Related Work 21 Dnn Watermarkingmentioning

confidence: 99%

Free Fine-tuning: A Plug-and-Play Watermarking Scheme for Deep Neural Networks

Wang¹,

Ren²,

Li³

et al. 2022

Preprint

View full text Add to dashboard Cite

Watermarking has been widely adopted for protecting the intellectual property (IP) of Deep Neural Networks (DNN) to defend the unauthorized distribution. Unfortunately, the popular datapoisoning DNN watermarking scheme relies on target model finetuning to embed watermarks, which limits its practical applications in tackling real-world tasks. Specifically, the learning of watermarks via tedious model fine-tuning on a poisoned dataset (carefullycrafted sample-label pairs) is not efficient in tackling the tasks on challenging datasets and production-level DNN model protection.To address the aforementioned limitations, in this paper, we propose a plug-and-play watermarking scheme for DNN models by injecting an independent proprietary model into the target model to serve the watermark embedding and ownership verification. In contrast to the prior studies, our proposed method by incorporating a proprietary model is free of target model fine-tuning without involving any parameters update of the target model, thus the fidelity is well preserved. Furthermore, our method is scaleable to challenging datasets, large production-level models, and diverse tasks (e.g., speaker recognition). Experimental results on real-world challenging datasets (e.g., ImageNet) and real-world DNN models demonstrated its effectiveness, fidelity w.r.t. the functionality preserving of the target model, robustness against popular watermark removal attacks (i.e., fine-tuning attack, pruning, input preprocessing), and the plug-and-play deployment. Our proposed watermarking scheme also outperforms the two competitive baselines in terms of fidelity preserving and robustness against watermark removal attacks. Our research findings reveal that model fine-tuning with poisoned data is not prepared for the IP protection of DNN models deployed in real-world tasks and poses a new research direction toward a more thorough understanding and investigation of adopting the proprietary model for DNN watermarking. The source code and models are available at https://github.com/AntigoneRandy/PTYNet. CCS CONCEPTS• Security and privacy → Human and societal aspects of security and privacy; • Computing methodologies → Artificial intelligence.

show abstract