BlindSpot: Watermarking Through Fairness

Abstract

With the increasing development of machine learning models in daily businesses, a strong need for intellectual property protection arised. For this purpose, current works suggest to leverage backdoor techniques to embed a watermark into the model, by overfitting to a set of particularly crafted and secret input-output pairs called triggers. By sending verification queries containing triggers, the model owner can analyse the behavior of any suspect model on the queries to claim its ownership. However, when it comes to scenarios where frequent monitoring is needed, the computational overhead of these verification queries in terms of volume demonstrates that backdoor-based watermarking appears to be too sensitive to outlier detection attacks and cannot guarantee the secrecy of the triggers.To solve this issue, we introduce BlindSpot, to watermark machine learning models through fairness. Our trigger-less approach is compatible with a high number of verification queries while being robust to outlier detection attacks. We show on Fashion-MNIST and CIFAR-10 datasets that BlindSpot is efficiently watermarking models while robust to outlier detection attacks, at a performance cost on the accuracy of 2%. CCS CONCEPTS• Security and privacy; • Theory of computation → Design and analysis of algorithms;

When Federated Learning Meets Watermarking: A Comprehensive Overview of Techniques for Intellectual Property Protection

“…Pruning Attack: Setting the less useful weights of the model to zero. [15,[59][60][61][62][63][64][64][65][66][67][68][69][70][71] and Black-Box [65,[72][73][74][75][76][77][78][79][80][81][82][83][84][85] watermarking. Each technique is defined by the type of access to the model parameters during the verification process.…”