Visual Decoding of Hidden Watermark in Trained Deep Neural Network

Sakazawa, Shigeyuki; Myodo, Emi; Tasaka, Kazuyuki; Yanagihara, Hiromasa

doi:10.1109/mipr.2019.00073

Cited by 24 publications

(15 citation statements)

References 4 publications

Supporting

Mentioning

Contrasting

Order By: Relevance

“…To keep these trigger samples as close as possible to the original samples, an autoencoder is used whose discriminator is trained to distinguish between training and trigger samples with the watermarks. Sakazawa et al (2019) proposed a cumulative and visual decoding of watermarks in NNs, such that patterns embedded into the training data can become visual for an authentication by a third party.…”

Section: Categorizing Watermarking Methodsmentioning

confidence: 99%

A Systematic Review on Model Watermarking for Neural Networks

Boenisch

2021

Front. Big Data

View full text Add to dashboard Cite

Machine learning (ML) models are applied in an increasing variety of domains. The availability of large amounts of data and computational resources encourages the development of ever more complex and valuable models. These models are considered the intellectual property of the legitimate parties who have trained them, which makes their protection against stealing, illegitimate redistribution, and unauthorized application an urgent need. Digital watermarking presents a strong mechanism for marking model ownership and, thereby, offers protection against those threats. This work presents a taxonomy identifying and analyzing different classes of watermarking schemes for ML models. It introduces a unified threat model to allow structured reasoning on and comparison of the effectiveness of watermarking methods in different scenarios. Furthermore, it systematizes desired security requirements and attacks against ML model watermarking. Based on that framework, representative literature from the field is surveyed to illustrate the taxonomy. Finally, shortcomings and general limitations of existing approaches are discussed, and an outlook on future research directions is given.

show abstract

Section: Categorizing Watermarking Methodsmentioning

confidence: 99%

A Systematic Review on Model Watermarking for Neural Networks

Boenisch

2021

Front. Big Data

View full text Add to dashboard Cite

show abstract

“…However, both of them were not tested on ImageNet, and it is not feasible to train an ImageNet model from scratch. The other model watermarking methods such as [2][3][4][5][6][7][8][9] focus on ownership verification only when a stolen model is in question. Therefore, the embedded watermark is independent of model accuracy.…”

Section: Functional Comparison With State-of-the-art Methodsmentioning

confidence: 99%

Transfer Learning-Based Model Protection With Secret Key

MaungMaung

Kiya

2021

2021 IEEE International Conference on Image Processing (ICIP)

View full text Add to dashboard Cite

We propose a novel method for protecting trained models with a secret key so that unauthorized users without the correct key cannot get the correct inference. By taking advantage of transfer learning, the proposed method enables us to train a large protected model like a model trained with Im-ageNet by using a small subset of a training dataset. It utilizes a learnable encryption step with a secret key to generate learnable transformed images. Models with pre-trained weights are fine-tuned by using such transformed images. In experiments with the ImageNet dataset, it is shown that the performance of a protected model was close to that of a nonprotected model when the correct key was given, while the accuracy tremendously dropped when an incorrect key was used. The protected model was also demonstrated to be robust against key estimation attacks.

show abstract

“…Another study in [3] implanted a backdoor in a model so that a watermark can be triggered through the backdoor. Generally, in black-box approaches, a special set of training examples is used so that watermarks are extracted from the inference of a model [12,27,33,44]. Li et al pointed out that backdoor attack-based methods can be defeated by existing backdoor defenses (e.g.…”

Section: Related Work 21 Dnn Model Watermarkingmentioning

confidence: 99%

“…In this paper, we focus on ownership verification of DNN models. Researchers have proposed various model watermarking methods [3,12,27,31,33,41,44]. However, most of the existing DNN watermarking methods are not robust against piracy attacks as described in [25,43].…”

Section: Introductionmentioning

confidence: 99%

Piracy-Resistant DNN Watermarking by Block-Wise Image Transformation with Secret Key

AprilPyone¹,

Kiya²

2021

Preprint

View full text Add to dashboard Cite

In this paper, we propose a novel DNN watermarking method that utilizes a learnable image transformation method with a secret key. The proposed method embeds a watermark pattern in a model by using learnable transformed images and allows us to remotely verify the ownership of the model. As a result, it is piracy-resistant, so the original watermark cannot be overwritten by a pirated watermark, and adding a new watermark decreases the model accuracy unlike most of the existing DNN watermarking methods. In addition, it does not require a special pre-defined training set or trigger set. We empirically evaluated the proposed method on the CIFAR-10 dataset. The results show that it was resilient against fine-tuning and pruning attacks while maintaining a high watermark-detection accuracy.

show abstract

Visual Decoding of Hidden Watermark in Trained Deep Neural Network

Cited by 24 publications

References 4 publications

A Systematic Review on Model Watermarking for Neural Networks

A Systematic Review on Model Watermarking for Neural Networks

Transfer Learning-Based Model Protection With Secret Key

Piracy-Resistant DNN Watermarking by Block-Wise Image Transformation with Secret Key

Contact Info

Product

Resources

About