How to Prove Your Model Belongs to You: A Blind-Watermark based Framework to Protect Intellectual Property of DNN

Zheng Li; Chengyu Hu; Yang Zhang; Shanqing Guo

Source-linked AI summary

How to Prove Your Model Belongs to You: A Blind-Watermark based Framework to Protect Intellectual Property of DNN

Zheng Li, Chengyu Hu, Yang Zhang, Shanqing Guo

arXiv:1903.01743v4Mar 5, 2019cs.CRcs.LGcs.MM

TL;DR

Deep neural networks are costly to develop, yet prior watermarking methods leave gaps in evasion resistance, protection against fraudulent ownership claims, and creator identification. This paper proposes a blind-watermark IPP framework that generates inconspicuous key samples and embeds them into DNN models. Evaluations on two benchmark datasets and 15 models report ownership verification without noticeable primary-task impact, strong attack resistance, robustness, and creator association.

Problem
Deep neural networks require substantial resources, while prior watermarking methods may fail against evasion or fraudulent ownership claims and do not clearly associate models with creators.
Method
The framework uses blind-watermark-generated key samples with an exclusive logo and embeds them into DNN models through assigned labels.
Results
The framework verifies ownership without significant primary-task side effects and achieves state-of-art undetectability, unforgeability, and robustness across two benchmark datasets and 15 models.
Takeaways & Limitations
The framework establishes a clear association between the protected model and the actual creator’s identity.
Takeaways & Limitations
The evaluation covers image datasets and classification DNN models, with speech recognition and other deep learning forms left for future work.

Abstract

from arXiv · show

Deep learning techniques have made tremendous progress in a variety of challenging tasks, such as image recognition and machine translation, during the past decade. Training deep neural networks is computationally expensive and requires both human and intellectual resources. Therefore, it is necessary to protect the intellectual property of the model and externally verify the ownership of the model. However, previous studies either fail to defend against the evasion attack or have not explicitly dealt with fraudulent claims of ownership by adversaries. Furthermore, they can not establish a clear association between the model and the creator's identity. To fill these gaps, in this paper, we propose a novel intellectual property protection (IPP) framework based on blind-watermark for watermarking deep neural networks that meet the requirements of security and feasibility. Our framework accepts ordinary samples and the exclusive logo as inputs, outputting newly generated samples as watermarks, which are almost indistinguishable from the origin, and infuses these watermarks into DNN models by assigning specific labels, leaving the backdoor as the basis for our copyright claim. We evaluated our IPP framework on two benchmark datasets and 15 popular deep learning models. The results show that our framework successfully verifies the ownership of all the models without a noticeable impact on their primary task. Most importantly, we are the first to successfully design and implement a blind-watermark based framework, which can achieve state-of-art performances on undetectability against evasion attack and unforgeability against fraudulent claims of ownership. Further, our framework shows remarkable robustness and establishes a clear association between the model and the author's identity.

1 INTRODUCTION

Deep neural networks require substantial resources to build, making model ownership protection important. Existing watermarking approaches leave gaps in security, legality, and creator association that this blind-watermark IPP framework addresses.

Building production-level deep learning models requires extensive computing power, large datasets, and human expertise.
Model ownership protection is necessary to preserve the creator’s competitive advantage and support technical verification of ownership.
Existing model-watermarking methods do not simultaneously satisfy fidelity, effectiveness, integrity, security, legality, and feasibility requirements.
Prior methods include white-box watermarking, random or abstract key samples, and image perturbations, but remote deployment limits parameter access and creator association remains unclear.
The proposed blind-watermark IPP framework generates key samples resembling original samples, evaluates them on two benchmark image datasets and 15 classification DNN models, and targets ownership verification with limited primary-task side effects.

2 BACKGROUND

Deep neural networks are broadly used but costly to develop, motivating digital watermarking for protecting embedded identification information. Blind watermarking is imperceptible and is proposed here to address weaknesses in prior watermark methods.

Deep neural networks support artificial intelligence services across visual analysis, speech recognition, and natural language processing.
Production-level models require large labeled datasets, substantial computing power, long-term parameter updates, and domain and engineering expertise.
2.2 Digital Watermark: Digital watermarking embeds identification information into digital carriers without affecting their original characteristics.
2.2 Digital Watermark: Blind watermarks are usually invisible or imperceptible, unlike non-blind watermarks perceived by the human visual system.
2.2 Digital Watermark: Prior watermark methods can fail against evasion attacks or fraudulent ownership claims because their key-sample feature distributions differ substantially from training samples.

3 MOTIVATION

The framework is motivated by two threats: evasion of ownership verification and fraudulent ownership claims. Existing methods expose detectable or reproducible watermark patterns, while the proposed approach assumes confidential encoder settings.

3 MOTIVATION: Eve may steal a model or resell it without authorization, prompting the owner to verify ownership through prediction queries on key samples.
3.1 Security: Evasion Attack: Existing watermark methods expose key samples whose distributions differ from original samples, allowing attackers to detect them and return random labels.
3.1 Security: Evasion Attack: The framework targets state-of-art undetectability against evasion attacks through blind-watermark key samples.
3.2 Legality: Fraudulent Claims of Ownership: Counterfeiters can design fake key samples that induce abnormal behavior in a licensed model, undermining exclusive ownership claims.
3.2 Legality: Fraudulent Claims of Ownership: Visible perturbations and broad abstract or random image spaces make prior watermarks reproducible, while intercepted key samples provide another route to counterfeiting.
3.2 Legality: Fraudulent Claims of Ownership: The method assumes the encoder’s training hyper-parameters, parameters, and architecture are confidential, but reports unforgeability even when this assumption is relaxed.

4 WATERMARKING NEURAL NETWORK

The IPP framework generates visually indistinguishable key samples from ordinary samples and an exclusive logo, embeds them into a host DNN, and verifies ownership through predefined predictions. Its encoder–discriminator training balances similarity to ordinary samples with a watermark backdoor while preserving the host model’s primary task.

Ownership verification: Ownership verification queries a remote model with generated key samples and accepts the claim when prediction accuracy exceeds a threshold close to 1.The owner evaluates predictions against predefined labels using acc_g > T_acc.
Framework overview: The framework has three components—encoder, discriminator, and host DNN—that generate, distinguish, and embed watermark key samples.The workflow uses the encoder and discriminator to produce key samples, then trains the host model to assign them a predefined label.
Key-sample generation: The encoder maps ordinary samples and an exclusive logo to key samples whose distribution is intended to approximate ordinary samples.The paper denotes this mapping as θe(x,l) = xkey with xkey → x.
Security–effectiveness trade-off: The method deliberately allows a small difference between key and ordinary samples, trading stronger evasion resistance against stronger watermark effectiveness.Perfect reconstruction is not required: smaller fluctuations favor security, whereas larger fluctuations improve effectiveness.
Adversarial training: The discriminator classifies ordinary and key samples, while adversarial iterative training drives key-sample distributions toward indistinguishability from the training distribution.The discriminator outputs the probability that an input is an original sample, and the encoder is trained to make its classification mistaken.
Watermark embedding: The host DNN preserves correct predictions for ordinary samples while assigning key samples to a predefined label, creating the watermark backdoor.The paper uses the difference between nearly matching ordinary and key-sample distributions to induce the target behavior.

5 IMPLEMENTATION

The framework was evaluated on MNIST and CIFAR-10 using 15 host DNNs, with iterative encoder–discriminator training and simultaneous host-model optimization. Generated CIFAR-10 key samples were reported as visually indistinguishable from ordinary images, unlike several existing methods.

Datasets and DNNs: The evaluation covers two benchmark datasets, MNIST and CIFAR-10, and 15 host DNN classification models.MNIST contains grayscale handwritten digits, while CIFAR-10 contains normalized 32 × 32 color images across 10 classes.
Training setup: The framework uses 1% of training samples for key generation and randomly selects a target label for each image.The encoder and discriminator are trained iteratively with Adam, while host DNNs use stochastic gradient descent with mixed original and key-sample batches.
Visual comparison: CIFAR-10 key samples generated by the framework were so similar to original images that their differences were too small for humans to see.The paper contrasts these examples with visibly striking key samples produced by several existing methods.

6 EVALUATION

The evaluation measures fidelity, ownership verification, security, robustness, and identity association across the proposed IPP framework. Results indicate minimal primary-task impact, accurate ownership verification, resistance to evasion and transfer attacks, robustness to fine-tuning, and logo-linked authorship.

The framework evaluates fidelity, effectiveness, integrity, security, legality, and feasibility, including primary-task side effects, ownership verification, evasion resistance, modification robustness, and creator association.These criteria define the evaluation scope for the host DNN watermarking framework.
6.1 Fidelity: A maximum average accuracy drop of 0.66% preserves primary-task performance, with the best case dropping only 0.14%.All watermarked models retain the same accuracy level as unwatermarked models, according to the evaluation.
6.2 Effectiveness and Integrity: Watermarked models exceed 90% accuracy on key samples, reaching 100% in the best case, while unwatermarked models remain at 9%—13%.The comparison uses 1% of the dataset and supports ownership verification without falsely attributing authorship to unwatermarked models.
6.3 Security: A 3-layer detector achieves AUC 0.5 against the framework, close to random guessing, whereas previous methods exceed AUC 0.94.The detector is evaluated using ROC curves under an attacker assumption of access to 10% of training samples.
6.4 Legality: Key samples transfer only along the matching encoder–host-model diagonal, indicating that different initialization seeds prevent effective transfer.The experiment uses five MobileNetV2 models and encoders trained with different seeds; reproducing the same setup is described as nearly impossible for an attacker.
6.5 Feasibility: After 100 fine-tuning epochs, watermark accuracy drops by at most 9.50%, while the framework associates the model with the exclusive logo used during training.The fine-tuning experiment excludes modifications causing significant primary-task side effects; logo association relies on over-fitting of the encoder and host model.

7 CONCLUSION AND FUTURE WORK

The framework is presented as a blind-watermark IPP system that protects model ownership while preserving primary-task performance. Future work will extend IP protection to speech recognition and other deep-learning forms.

Conclusion: The proposed blind-watermark IPP framework generates key samples similar to original samples and associates models with creators’ identities.It is described as the first framework of this kind.
Conclusion: The framework was implemented and evaluated on two benchmark datasets and 15 popular deep-learning models.Experiments assessed ownership verification, primary-task effects, evasion undetectability, fraudulent-claim unforgeability, and robustness to model modification.
Conclusion: The authors report ownership verification without significant primary-task side effects, strong performance against evasion and fraudulent claims, and robustness to model modification.The framework also considers logo usage to establish a clear association between the model and its creator.
Future Work: Future work will protect the intellectual property of speech-recognition models and expand the approach to other deep-learning forms, including recurrent neural networks.The speech-recognition extension is explicitly identified as future work.

A THE ARCHITECTURES OF ENCODER AND DISCRIMINATOR

The appendix defines the main encoder and discriminator building blocks and provides implementation details for reproducibility.

Architecture Definitions: Conv2d, ConvTranspose2d, Batch Normalization, and LeakyReLU are abbreviated as Conv, ConvT, BN, and LReLU.These abbreviations are used to describe the architectures.
Architecture Definitions: The UnetSkipConnectionBlock adapts the U-net architecture with a 4 × 4 kernel, stride 2, and padding 1.The block is defined as part of the architecture description.
Reproducibility: The authors make their code publicly available to support reproducibility.The passage provides a GitHub repository containing the implementation.

A.1 Encoder

The encoder combines an ordinary image sample with an exclusive logo and transforms them into a key sample intended to resemble the ordinary sample.

Encoder: The encoder accepts an ordinary training sample and an exclusive logo as inputs to generate a key sample.The key sample is designed to be indistinguishable from ordinary samples.
Encoder: Separate preprocessing blocks produce feature maps for the ordinary sample and logo before concatenation.Each input is processed by two ConvT-BN-LReLU blocks with 3×3 kernels, stride 1, padding 1, and three output filters.
Encoder: The processed feature maps are concatenated into a 6 × H ×W tensor before deeper encoder processing.The logo feature map is dispersed throughout the ordinary-sample feature representation.
Encoder: After concatenation, the encoder applies five UnetSkipConnectionBlocks with progressively specified channel counts.The passage lists 64, 128, and 256 among the block channel counts.

A.2 Discriminator

The discriminator distinguishes ordinary samples from encoder-generated key samples through a binary classification output.

Discriminator: The discriminator receives ordinary samples and key samples as inputs for separate classification.Its purpose is to distinguish the two sample types.
Discriminator: Two LinearBlocks with 64 and 32 output filters process the discriminator inputs.Each LinearBlock consists of a fully connected layer and LReLU.
Discriminator: A fully connected layer followed by Sigmoid produces a binary classification p for each image.The output indicates whether the image is ordinary or a key sample.