Source-linked AI summary
Adversarial Frontier Stitching for Remote Neural Network Watermarking
Erwan Le Merrer, Patrick Perez, Gilles Trédan
TL;DR
The paper addresses the limitation that conventional neural-network watermarks require local access to model weights, proposing remote zero-bit watermark extraction through APIs. Frontier stitching modifies decision frontiers around adversarial key inputs while preserving model behavior, and experiments evaluate the approach on MNIST classifiers; the paper also identifies vulnerability to approximate model leaks and transfer-learning attacks.
Problem
Conventional neural-network watermark extraction requires local access to model weights, whereas the paper targets zero-bit identification of models accessible only through remote APIs.
Method
Frontier stitching embeds a zero-bit watermark by fine-tuning a model around adversarial inputs near its decision frontiers, enabling extraction through a small query key.
Results
The approach was experimentally evaluated on three neural-network types for MNIST image classification, with remote extraction using key-size-dependent error thresholds.
Takeaways & Limitations
The technique provides a practical route to assessing suspected reuse of a marked model through an online service without direct parameter access.
Takeaways & Limitations
The watermarking technique assumes the leaked model is copied at the bit level and may not survive model approximation or transfer learning.
Abstract
from arXiv · showhide
The state of the art performance of deep learning models comes at a high cost for companies and institutions, due to the tedious data collection and the heavy processing requirements. Recently, [35, 22] proposed to watermark convolutional neural networks for image classification, by embedding information into their weights. While this is a clear progress towards model protection, this technique solely allows for extracting the watermark from a network that one accesses locally and entirely. Instead, we aim at allowing the extraction of the watermark from a neural network (or any other machine learning model) that is operated remotely, and available through a service API. To this end, we propose to mark the model's action itself, tweaking slightly its decision frontiers so that a set of specific queries convey the desired information. In the present paper, we formally introduce the problem and propose a novel zero-bit watermarking algorithm that makes use of adversarial model examples. While limiting the loss of performance of the protected model, this algorithm allows subsequent extraction of the watermark using only few queries. We experimented the approach on three neural networks designed for image classification, in the context of MNIST digit recognition task.
1 Introduction
The paper addresses the gap between local, weight-based watermark extraction and remote identification of models exposed through APIs. It proposes zero-bit watermarking by slightly modifying decision frontiers around adversarially crafted key inputs.
- Existing neural-network watermarking embeds information in model weights but requires direct white-box access for extraction.
- The proposed black-box approach enables remote watermark extraction through API requests without accessing model parameters.
- The watermark is embedded by slightly modifying decision frontiers around specific key inputs, whose remote-model answers are compared with marked-model answers.
- Adversarial perturbations provide key inputs near decision frontiers, aiming to preserve performance and reduce false positives across models.
- The paper formalizes remote zero-bit watermarking, introduces frontier stitching and statistical extraction, and evaluates it on three neural-network types using MNIST.
2 Watermarking for Remote Extraction
The paper formulates zero-bit watermarking for generic classifiers whose marks are extracted remotely through API queries. It defines requirements for loyalty, efficiency, effectiveness, robustness, and security, while recognizing tensions between them.
- The target scenario embeds a watermark before deployment and tests a suspected remote service for reuse of a bit-level leaked model.
- Remote extraction consists of querying key inputs and comparing the answers with those expected from the marked model.
- The framework applies to generic classifiers, including neural networks and other models, with a key K specifying the inputs used for watermarking and extraction.
- An ideal watermarked model is loyal to the original, efficient through a short key, effective for identifying the marked model, robust to small modifications, and secure against unauthorized detection.
- Effectiveness and robustness can conflict, so the framework measures matching on K rather than requiring exact functional identity everywhere.
3 The Frontier Stitching Algorithm
Frontier stitching constructs a key from adversarial perturbations near decision frontiers, fine-tunes the model to classify those inputs as intended, and extracts the mark statistically through remote queries. The method tolerates deviations using a null-model and key-size-dependent error threshold.
- Key construction and embedding: Adversarial inputs lie near decision frontiers, making them model-dependent while allowing frontier changes that are intended to remain harmless.
- Key construction and embedding: False adversaries constrain frontier changes and characterize frontier shapes, supporting robustness in statistical watermark extraction.
- Statistical extraction: Extraction queries the remote model on K, counts mismatches with recorded labels, and declares success when the count is below a threshold θ.
- Statistical extraction: Under the null-model, mismatches follow a binomial distribution B(|K|, 1/2), enabling p-value-based extraction decisions.
- Key construction and embedding: The algorithm selects true and false adversaries from training examples, constructs a key, and fine-tunes the model to classify all key inputs in their intended classes.
- Statistical extraction: For p-value 0.05, key sizes |K| = 100 and |K| = 20 tolerate θ = 42 and 6 errors, respectively.
4 Experiments
Experiments on three MNIST networks evaluate fidelity, extraction effectiveness, and robustness of adversarial frontier stitching. The watermark generally preserves accuracy, false positives disappear at ε = 0.5, and most tested compression and overwriting attacks fail to remove it.
- Experimental setup: Experiments use MNIST and three publicly available Keras networks—MLP, CNN, and IRNN—with standard training and 30 independent markings per network.The models begin with reported accuracies of 0.984% for MLP, 0.993% for CNN, and 0.9918% for IRNN; experiments use 60,000 training and 10,000 test images.
- Experimental setup: The key combines 50% true adversaries with 50% false adversaries, while ε controls perturbation intensity and must provide enough examples of each kind.Adversaries are generated with the fast gradient sign method, and test images used to craft them are removed from evaluation to avoid biased results.
- Fidelity: IRNN exhibits nearly no accuracy degradation, while MLP loses on average 0.4% with |K| = 20 and 0.8% with |K| = 100.The accuracy distributions after embedding are reported for all three networks and both key sizes.
- Fidelity: CNN accuracy drops 0.23%, 0.22%, and 0.14% for ℓ1, ℓ2, and ℓ∞ adversaries respectively, with no significant degradation difference across norms.The experiment uses |K| = 20 and ten independent runs for each norm.
- Effectiveness: False positives occur for ε = 0.025 and 0.1 in some scenarios but disappear for ε = 0.5 when extracting from non-watermarked and retrained networks.The study uses |K| = 100 and evaluates several ε values on remote models.
- Robustness: Pruning and SVD compression generally preserve watermark extraction, while overwriting with 1,000 new adversaries yields perfect extraction for CNN and MLP but some IRNN failures.Only 50% pruning of IRNN prevents successful extraction among the plausible pruning attacks; CNN extraction remains unaffected by tested SVD compression.
- Robustness: The key must remain secret because knowing it could enable an overwriting procedure that reverses the local decision-frontier deformations.The method relies on adversarial examples near decision frontiers, whose generalization across models is intended to limit false positives.
5 Related Work
Prior work established watermarking for multimedia and neural-network weights, while newer black-box methods retrieve watermarks through carefully chosen model inputs and remote APIs.
- Watermarking research spans multimedia content and neural networks used to insert invisible watermarks.
- Uchida et al. embed watermark information in learned neural-network weights, requiring local access to convolution-kernel parameters for extraction.
- Remote black-box watermarking methods use model outputs on carefully chosen inputs to retrieve embedded information.
- One approach trains protected models on crafted inputs that trigger a specific target label, enabling watermark verification through outputs.
- API-based research also extracts remote models, infers architecture or hyperparameters, induces erroneous outputs, and detects deployed-model tampering through queries.
6 Conclusion and perspectives
The paper presents frontier stitching for remotely extracting zero-bit watermarks, while identifying scope boundaries and several directions for strengthening the method. Future work includes broader task coverage, architecture-specific robustness analysis, richer query information, and resistance to model approximation attacks.
- The frontier stitching algorithm extracts previously embedded zero-bit watermarks from leaked models exposed through remote online services.
- The demonstrated scope is image classification, while regression and semantic segmentation remain future extensions.
- The IRNN model is prone to compression attacks with a pruning rate of 50% of parameters, motivating deeper architecture-specific characterization.
- The authors identify transfer learning as a possible watermark-removal attack because learned adversaries might not survive transfer to another task.
- Using classification outputs or scores, rather than only binary query answers, may embed more information with the same watermark size.
- The proposed technique assumes the watermarked model is leaked as a bit-level copy, leaving resistance to model approximation attacks as an important open problem.