Source-linked AI summary
Turning Your Weakness Into a Strength: Watermarking Deep Neural Networks by Backdooring
Yossi Adi, Carsten Baum, Moustapha Cisse, Benny Pinkas, Joseph Keshet
TL;DR
The paper addresses the need to authenticate and protect neural networks distributed through machine-learning services. It proposes black-box watermarking by embedding backdoors, reports preserved primary-task accuracy and robustness to attacks, and connects the approach theoretically to backdooring.
Problem
Machine-learning service providers need a robust way to authenticate neural networks because customers may redistribute or resell models beyond their licenses.
Method
The approach uses neural-network over-parameterization to embed a backdoor as a watermark, with a commitment to the backdoor serving as a verification key for private verification.
Results
The watermark preserves roughly the same test accuracy while achieving 100% trigger-set accuracy, and the study reports robustness to black-box and grey-box attacks.
Takeaways & Limitations
Backdooring, treated as a security weakness, can be repurposed as a practical mechanism for watermarking neural networks and supporting ownership claims.
Takeaways & Limitations
The private-verification scheme reveals the marking key after verification, allowing an adversary to retrain the model on the trigger set.
Abstract
from arXiv · showhide
Deep Neural Networks have recently gained lots of success after enabling several breakthroughs in notoriously challenging problems. Training these networks is computationally expensive and requires vast amounts of training data. Selling such pre-trained models can, therefore, be a lucrative business model. Unfortunately, once the models are sold they can be easily copied and redistributed. To avoid this, a tracking mechanism to identify models as the intellectual property of a particular vendor is necessary. In this work, we present an approach for watermarking Deep Neural Networks in a black-box way. Our scheme works for general classification tasks and can easily be combined with current learning algorithms. We show experimentally that such a watermark has no noticeable impact on the primary task that the model is designed for and evaluate the robustness of our proposal against a multitude of practical attacks. Moreover, we provide a theoretical analysis, relating our approach to previous work on backdooring.
1 Introduction
The paper addresses the risk that purchased or service-provided neural networks can be redistributed, and develops watermarking by turning backdooring from a weakness into a security mechanism.
- Motivation: MLaaS lowers the cost of obtaining customized neural networks, while customers may further fine-tune models or transfer their features to related tasks.
- Motivation: Model providers need robust authentication because customers may redistribute or resell networks beyond license terms.
- Problem: Existing digital-watermarking techniques do not directly fit neural networks because fine-tuning can change parameters while preserving test accuracy.
- Contribution: The proposed method exploits over-parameterization by reducing neural-network watermarking to designing a backdoor that assigns chosen labels to selected inputs.
- Contribution: The work combines an empirical evaluation of watermark robustness with a cryptographic analysis connecting watermarking to backdooring.
- Related Work: Prior approaches added loss regularization or used adversarial examples, but their constructions had limitations including fraudulent ownership claims or dependence on adversarial examples.
2 Definitions and Models
The paper formalizes learning, backdoors, and strong backdoors, then introduces sampling and removal properties needed to build watermarking schemes from backdooring algorithms.
- 2.1 Machine Learning: Machine learning is modeled with Train and Classify algorithms that learn and use an approximation of a ground-truth labeling function.
- 2.1 Machine Learning: Inputs with undefined ground-truth labels are excluded from accuracy measurement, while such inputs receive random labels during the formal model’s treatment.
- 2.2 Backdoors in Neural Networks: A backdoor consists of a trigger set and wrong-labeling function, causing a modified model to remain correct outside the trigger set while reliably misclassifying triggers.
- 2.2 Backdoors in Neural Networks: Backdoors can be implanted into pre-trained models or created by training a new model from scratch.
- 2.2 Backdoors in Neural Networks: SampleBackdoor algorithmically generates backdoors from access to the ground-truth oracle for use with training and classification.
- 2.3 Strong Backdoors: Strong backdoors require minimally sized, nearly non-overlapping trigger sets and persistency against removal unless the trigger set is known.
- 2.3 Strong Backdoors: The persistence model excludes useless low-accuracy submissions and recognizes that unlimited computation and unlimited oracle access permit retraining from scratch.
3 Defining Watermarking
The paper defines a watermarking scheme through key generation, model marking, and watermark verification, then specifies correctness and security properties. These properties cover functionality preservation, resistance to removal and forgery, and non-trivial ownership, while noting additional practical verification and piracy considerations.
- Scheme definition: A watermarking scheme consists of KeyGen, Mark, and Verify, which generate keys, embed a watermark into a model, and output a verification bit.KeyGen outputs (mk,vk); Mark takes M and mk to produce M̂; Verify takes mk, vk, and a model M.
- Correctness: Correctness requires that these three algorithms work together so an honestly watermarked model is verified as such.
- Security properties: The scheme must preserve model functionality, meaning a watermarked model remains as accurate as an unwatermarked model.
- Security properties: Unremovability requires adversaries to be unable to remove the watermark even when they know its existence and embedding algorithm.
- Security properties: Unforgeability prevents an adversary who knows vk but not mk from convincing a third party that the adversary owns the model.
- Ownership and verification: Non-trivial ownership prevents attackers from generating keys in advance that verify ownership of arbitrary unknown models, while piracy and public verifiability remain separate practical concerns.Ownership Piracy concerns implanting a watermark into an already watermarked model; public verifiability would require an interactive PVerify protocol.
4 Watermarking From Backdooring
The construction turns a strong backdoor into a privately verifiable watermark: the backdoor is the marking key, while a commitment to it is the verification key. Under a commitment scheme and strong backdooring assumptions, the resulting scheme supports correctness, functionality preservation, non-trivial ownership, unremovability, and unforgeability.
- Construction: The scheme embeds a backdoor into a model and uses the backdoor as the marking key, with a commitment to it serving as the verification key.The construction applies to both existing models and models trained from scratch.
- Security properties: Correctness holds because the marked model agrees with the backdoor on at least (1 − ε)|T| trigger elements, so Verify accepts when disagreement is at most ε|T|.The construction also preserves accuracy outside the trigger set.
- Security properties: Functionality preservation bounds the marked model’s total error by ε′ = ε + n/|D|, which is negligibly close to ε when |D| is superpolynomial in n.The additional error comes from the trigger set’s contribution to the overall domain.
- Security properties: Non-trivial ownership follows from random trigger-set selection and commitment binding, while unforgeability relies on hiding and would otherwise yield an opening of a statistically hiding commitment.An adversary cannot fix a competing trigger set and labels in advance with non-negligible success.
- Security properties: Unremovability is reduced to the persistence of strong backdoors: efficiently removing the watermark would produce an ε-accurate model from an arbitrary input faster than assumed possible.A hybrid argument makes the adversary’s behavior effectively independent of the verification key.
5 A Direct Construction of Watermarking
The construction embeds a randomly labeled trigger set alongside ordinary training data, aiming to preserve task accuracy while making the watermark persistent under model modification. Experiments across CIFAR-10, CIFAR-100, STL-10, and ImageNet evaluate functionality preservation, robustness, ownership piracy, and transfer.
- Construction: The watermark uses a trigger set as a marking key and optimizes the model on both ordinary training data and trigger-set images.Models are trained either from a pretrained checkpoint or from scratch, with trigger images appended to each batch and Negative Log Likelihood optimized on both sets.
- Non-Trivial Ownership: The trigger set contains 100 abstract images with independently random target classes, making examples uncorrelated and limiting information revealed by partial disclosure.The sampling procedure is intended to support public verifiability and make backpropagation-based attacks difficult.
- Functionality-Preserving: 100% trigger-set accuracy is achieved by both FROMSCRATCH and PRETRAINED models, while their test-set accuracies remain roughly equal to the NO-WM models.For NO-WM models, trigger-set accuracy is 7.0% on CIFAR-10 and 1.0% on CIFAR-100 because labels are random.
- Unremovability: The ownership criterion requires ε-accuracy on both the original test set and trigger set, while the question of how much model modification preserves ownership remains open.The paper leaves alternative methods and a theoretical definition of this boundary for future work.
- Unremovability: FROMSCRATCH models retain roughly the same test-set and trigger-set accuracy across fine-tuning methods and are generally superior or equal to PRETRAINED models.On CIFAR-100, the trigger set appears easier to remove from PRETRAINED models; subsequent experiments therefore report FROMSCRATCH models.
- Ownership Piracy: After ownership-piracy fine-tuning, TS-ORIG remains embedded and can even improve in accuracy, whereas accuracy on the newly embedded TS-NEW drops significantly.The authors interpret the persistence of TS-ORIG as consistent with embedding near the training-data distribution.
- ImageNet: On ImageNet, watermarked and unwatermarked models achieve roughly the same Prec@1 and Prec@5, while trigger-set accuracy is 100% only for the watermarked model.After fine-tuning on ImageNet, trigger-set results remain very high; transferring to CIFAR-10 causes a drop in Prec@1 and Prec@5.
6 Conclusion and Future Work
The paper analyzes watermarking neural networks with random training instances and labels, evaluates black-box and grey-box attacks, and connects the approach theoretically to backdooring. Future work includes ownership-change boundaries and efficient zero-knowledge proofs for public verification.
- The paper analyzes watermarking neural networks using random training instances and random labels.
- The approach is evaluated against black-box and grey-box attacks, with the authors reporting robustness to them.
- The work establishes a theoretical connection between its watermarking approach and backdooring neural networks.
- Future Work: Future work will characterize how much a model must change before ownership can be claimed and construct an efficient zero-knowledge proof for public verification.
A Supplementary Material
The supplementary material introduces notation for public verifiability, including bit-vector index sets, verification-key selection, and a cryptographic hash function.
- For a bit vector e, e|0 and e|1 denote the indices where e contains zeroes and ones, respectively.
- The notation defines selecting verification-key elements according to the bit vector e.
- The public-verifiability construction assumes a cryptographic hash function H mapping p(n)-bit strings to n-bit strings.
A.1 From Private to Public Verifiability
This section introduces zero-knowledge arguments as the cryptographic basis for public verifiability. It characterizes interactive proofs through completeness, soundness, and computational zero-knowledge.
- A zero-knowledge argument lets a prover convince a verifier that a public statement is true without revealing further information.
- An interactive proof system uses interactive Turing machines, an NP language, and its associated relation of valid statement–witness pairs.
- Completeness requires the verifier to accept valid statements with probability negligibly close to one.
- Soundness requires acceptance probability to be negligible for every string when the statement lacks a valid witness.
- Computational zero-knowledge requires a polynomial-time simulator to reproduce what any probabilistic polynomial-time verifier can learn without the witness.
A.1.1 Outlining the Idea
The initial public-verification idea converts the verification algorithm into an NP relation, but a ground-truth-dependent backdoor test makes that approach impractical. The alternative embeds a proof in the verification key and uses zero-knowledge verification.
- Outlining the Idea: The proposed initial design converts Verify(mk,vk,M) into an NP relation and applies a zero-knowledge argument system.
- Outlining the Idea: The design fails because verifying whether the key contains a backdoor requires access to the ground-truth function and reveals the backdoor elements.
- Outlining the Idea: The alternative scheme embeds a proof in vk that most verification-key elements form a backdoor, then bases verification on a zero-knowledge argument system.
A.1.2 A Convincing Argument that most Committed Values are Wrongly Classified
The protocol uses cut-and-choose to convince a verifier that most committed backdoor values are wrongly classified. A backdoor of size ℓ > n, instantiated as ℓ = 4n in the analysis, makes cheating detectable with high probability.
- Cut-and-choose: Cut-and-choose lets the verifier open a chosen subset of committed inputs and labels to test whether the backdoor contains wrongly labeled values.The verifier selects which committed elements are revealed.
- Protocol setup: The backdoor must contain ℓ > n elements; the analysis uses ℓ = 4n, although other sizes are possible.
- Detection guarantee: If exactly one backdoor element is chosen wrongly, cut-and-choose reveals it to an honest verifier with probability 1/2.
- Detection guarantee: A cheating prover can place at most n nonbackdooring inputs in the checked subset except with probability negligible in n.
- Detection guarantee: When the check passes for ℓ = 4n, at least half of the checked values are backdoor values except with negligible probability.
- Non-interactive verification: The interactive argument can be made non-interactive and publicly verifiable by deriving the challenge e as H(vk) using the Fiat-Shamir transform.The hash-generated challenge is intended to behave like an honest verifier's random choice.
A.1.3 Constructing the Public Verification Algorithm
The public verification algorithm recomputes a hash challenge, checks committed values, and uses a zero-knowledge argument to verify watermarking conditions. Its analysis shows that successful verification yields a correct backdoor with an approximately 2ε guarantee.
- Verification algorithm: Public verification recomputes the challenge e, checks the verification key, and tests watermarking conditions using a private subset of the marking key.
- Circuit construction: A circuit C outputs 1 when the prover supplies the correct private key subset and enough openings satisfy the model's classification condition.
- Verification algorithm: The verifier aborts if the recomputed challenge does not match the challenge committed in the verification key.
- Zero-knowledge verification: The prover and verifier use a zero-knowledge argument in which the private key subset is the prover's witness, and acceptance requires the argument to succeed.
- Guarantee: Successful verification makes the model classify at least (1 − ε)|e|0 ≈ (1 − ε)2n backdoor values to their committed values.
- Guarantee: The resulting correct-backdoor guarantee is 2ε, and increasing the backdoor size can achieve arbitrary values.