PaperlayerView exact revision on arXiv

Source-linked AI summary

On the Robustness of the Backdoor-based Watermarking in Deep Neural Networks

Masoumeh Shafieinejad, Jiaqi Wang, Nils Lukas, Xinda Li, Florian Kerschbaum

arXiv:1906.07745v2cs.LGcs.CRstat.ML

TL;DR

Producing deep neural networks requires costly computation and prepared data, while released models can be copied and redistributed. This paper presents attacks to remove backdoor-based watermarks and detect their presence; the white-box attack is up to seventeen times faster than the black-box attack without affecting accuracy, and black-box accuracy is close to the marked model.

  • Problem

    Producing DNNs requires substantial computation and prepared, labeled data, while released models can be copied and redistributed, motivating ownership protection.

    Source: §1 · p. 1

  • Method

    The paper proposes black-box and white-box attacks to remove backdoor-based watermarks and a property-inference attack to identify watermarked networks.

    Source: §1.1 · p. 2

  • Results

    The white-box attack is up to seventeen times faster without affecting accuracy, the black-box attack achieves accuracy close to the marked model, and property inference distinguishes watermarked from unmarked networks.

    Source: §1 · p. 2, §1.1 · p. 2

  • Takeaways & Limitations

    The studied backdoor-based schemes do not satisfy unremovability or undetectability, so different protections against these attacks are needed.

    Source: §1.1 · p. 2

    Non-overlapping training data limited MNIST and CIFAR-10 accuracy, while CIFAR-100 experiments allowed overlap after the constraint caused a 10% accuracy loss.

    Source: §4.3.1 · p. 11

Abstract

from arXiv · show

Obtaining the state of the art performance of deep learning models imposes a high cost to model generators, due to the tedious data preparation and the substantial processing requirements. To protect the model from unauthorized re-distribution, watermarking approaches have been introduced in the past couple of years. We investigate the robustness and reliability of state-of-the-art deep neural network watermarking schemes. We focus on backdoor-based watermarking and propose two -- a black-box and a white-box -- attacks that remove the watermark. Our black-box attack steals the model and removes the watermark with minimum requirements; it just relies on public unlabeled data and a black-box access to the classification label. It does not need classification confidences or access to the model's sensitive information such as the training data set, the trigger set or the model parameters. The white-box attack, proposes an efficient watermark removal when the parameters of the marked model are available; our white-box attack does not require access to the labeled data or the trigger set and improves the runtime of the black-box attack up to seventeen times. We as well prove the security inadequacy of the backdoor-based watermarking in keeping the watermark undetectable by proposing an attack that detects whether a model contains a watermark. Our attacks show that a recipient of a marked model can remove a backdoor-based watermark with significantly less effort than training a new model and some other techniques are needed to protect against re-distribution by a motivated attacker.

1 Introduction

Because producing deep neural networks requires costly computation and carefully prepared data, their redistribution motivates ownership protection. The paper examines backdoor-based watermarking and presents attacks to remove and detect these watermarks.

1. Introduction

  • DNN production requires substantial computation and prepared, labeled data, yet released models can be copied and redistributed; watermarking is proposed to protect ownership.Source: §1 · p. 1
  • The black-box attack steals model functionality using similar-distribution queries and final labels, without labeled training data, trigger access, confidence vectors, or model parameters.Source: §1 · p. 2, §1.1 · p. 2

1.1 Our Contributions

  • The white-box attack runs up to seventeen times faster without affecting accuracy, while the black-box attack achieves accuracy close to the marked model.Source: §1 · p. 2
  • The authors add a property-inference attack that distinguishes watermarked from unmarked networks, alongside black-box and white-box watermark-removal attacks.Source: §1.1 · p. 2

1.2 Paper Organization

  • The paper proceeds from formal definitions and security vulnerabilities to watermark-removal and detection attacks, experiments, and related work.Source: §1.2 · p. 2

2 Backdoor-based Watermarking

Backdoor-based watermarking uses learned trigger-to-label behavior to verify ownership, with several trigger designs described here. The section formalizes the learning and watermarking process, then reviews security claims and the attacks that challenge them.

2 Backdoor-based Watermarking

  • Backdoor watermarking uses learned trigger patterns and their predefined labels as keys for ownership verification.The schemes discussed use embedded content, fixed noise, or abstract images as triggers.Source: §2 · pp. 2–3

2.1 Definitions and Models

  • The learning model trains against an oracle for ground-truth labels, then classifies unseen inputs; ε-accuracy bounds its error on inputs with defined labels.The formalization represents inputs as binary strings and labels in a label set with an undefined-label symbol.Source: §2.1 · p. 3

2.2 Backdoor-based Watermarking in DNNs

  • A backdoor model maps trigger-set inputs to specified incorrect labels while retaining correct outputs elsewhere.Watermarking first trains the original model, generates marking and verification keys from a backdoor, then embeds it; verification accounts for random label matches.Source: §2.2 · pp. 3–4

2.3 Backdoor-based Watermarking Schemes

  • The reviewed schemes use content markers, fixed Gaussian noise, or abstract images; abstract-image schemes can assign different trigger subsets to different classes.For abstract images, the watermark test set is the same fixed input-and-label set used for training.Source: §2.3 · p. 4

2.4 Backdoor-based Watermarking - Security

  • The authors challenge claims that backdoors are hard to remove without trigger knowledge, reporting successful removal without that knowledge.They also report stealing a ResNet-32 with 0.46 million parameters using 50,000 prediction-API queries without probability-vector access.Source: §2.4 · p. 4
  • The black-box attack uses model-oracle access and public inputs; the white-box attack uses model parameters and public inputs, and neither requires labeled data.Both attacks are described as preserving model functionality; the white-box attack uses fewer computational resources.Source: §2.4 · p. 5

3 Attacks on Backdoor-Based Watermarking

The section presents black-box and white-box methods for removing backdoor watermarks, based on treating watermark inputs as outliers from the main input distribution. It also proposes property inference to detect whether a model contains a watermark.

3 Attacks on Backdoor-Based Watermarking

  • The attacks exploit the separation between correctly classified main-distribution inputs and deliberately misclassified watermark inputs, defining full removal as retaining close test accuracy while reducing trigger agreement to near random assignment.The section also contrasts this with a weaker removal condition based on misclassifying more than a negligible fraction of trigger inputs.Source: §3 · p. 5

3.1 Black-box Attack

  • The black-box attack trains a derived model on public, same-domain inputs labeled by querying the marked model, without its parameters, training data, trigger set, or confidence scores.The inputs are distinct from the marked model’s training data; the attack aims to preserve its accuracy while removing the watermark.Source: §3.1 · p. 5

3.2 White-Box Attack

  • The white-box attack uses direct access to marked-model parameters, regularizes all layers to remove the watermark, then fine-tunes on an unmarked set to compensate for reduced test accuracy.It uses random domain inputs labeled by querying the marked model and does not require the ground-truth function or trigger set.Source: §3.2 · p. 6

3.3 Property Inference Attack

  • The property-inference attack detects watermark presence by training a binary classifier on features extracted from non-watermarked and watermarked models, and can check whether model stealing removed a watermark.The attack assumes access to a watermark-embedding algorithm and oracle, plus the ability to generate sufficiently different high-accuracy models.Source: §3.3 · pp. 6–7

4. Output FM,F ˆM

The property-inference attack generates training and test data for a binary classifier and uses its test error as a stopping condition.

4. Output FM,F ˆM

  • Each PIData invocation requires generating a new high-accuracy model on a task.PIAttack uses generated training and test data for its classifier.Source: §4 · p. 7
  • PIAttack generates both training and testing data for the binary classifier.The passage does not specify further details about the data in this step.Source: §4 · p. 7
  • Classifier training stops when testing accuracy is sufficiently high.The stated criterion is testing error at most ε.Source: §4 · p. 7

4. Output ˆMg

The property-inference method extracts features from models and trains a set-based binary classifier to identify watermark presence.

4. Output ˆMg

  • The attacker has white-box access to the marked model, which helps approximate its function and dataset for selecting a similar dataset in PIData.The target function need not be known exactly.Source: §4 · p. 7
  • Activations from the last convolution layer were selected as the most effective features for watermark detection among the features investigated.Source: §4 · p. 7
  • The method forms sets from those activations and uses DeepSets to train a binary classifier that detects watermark presence.The approach is inspired by prior property-inference work on fully connected networks.Source: §4 · p. 7

4 Experiments

The experiments report successful watermark removal by the black-box and white-box attacks and then present property-inference results.

4 Experiments

  • Experiments apply the black-box and white-box attacks to the backdoor-based watermarking scheme described in Section 2.3.Source: §4 · p. 7
  • The reported results confirm that both watermark-removal attacks successfully remove watermarks.Source: §4 · p. 7
  • The paper proceeds to report results for the property-inference attack.Source: §4 · p. 7

4.1 Experiment Setup

The experiments simulate both the model owner and attacker, then assess watermark removal and watermark detection across datasets, models, and attack settings.

4.1 Experiment Setup

  • The experiments simulate both challenger and attacker according to the full watermark-removal games and their specified algorithms.The generated models and watermark sets are used in the subsequent evaluations.Source: §4.1 · p. 7

4.1.1 Data Sets and Models

  • Experiments use MNIST with LeNet, CIFAR-10 with VGG-16, and CIFAR-100 with ResNet-32, with dataset-specific training and test splits.MNIST and CIFAR-10 use non-overlapping halves of the training data for owner and attacker; CIFAR-100 uses overlapping data.Source: §4.1.1 · p. 7

4.1.2 Original and Watermarked Model Generation

  • MModel generates the original and watermarked models plus watermark inputs and labels, then trains the marked model using watermark and remaining training data.The watermark and watermark-test sets coincide for Abstract Images, but not for Embedded Content or Pre-specified Noise.Source: §4.1.2 · pp. 7–8

4.1.3 Attack Algorithm A and Generating ˜M

  • Both removal attacks train a replacement model from public-domain inputs labeled by the marked model, targeting original-model test accuracy and watermark retention of 1/|L|.The white-box attack initializes from marked-model parameters, then regularizes and fine-tunes with public data labeled by that model.Source: §4.1.3 · p. 8

4.1.4 Attack Algorithm PIAttack and Generating ˆMg

  • PIAttack trains a binary classifier on features from marked and unmarked models, using grouped last-convolution-layer activations and a DeepSets classifier.The experiment combines 10 marked and 10 unmarked models; the classifier uses an encoder and a classifier network.Source: §4.1.4 · p. 8

4.1.5 Security and Performance Evaluation

  • Evaluation measures test accuracy, watermark retention, and runtime, comparing attacked-model accuracy with the target and counting marked inputs assigned their predefined labels.Runtime is used rather than epoch count because epoch duration varies by training phase and dataset size.Source: §4.1.5 · p. 8

4.2 Results

The experiments find that both attacks remove backdoor-based watermarks while retaining comparable test accuracy, and that property inference can detect watermark presence. They evaluate removal across three watermark schemes and detection across CIFAR datasets.

4.2.1 Watermark Removal

  • Watermark-removal experiments cover Embedded Content, Pre-specified Noise, and Abstract Images schemes on MNIST and CIFAR-10, plus Abstract Images on CIFAR-100.Figures distinguish black-box and white-box results for the schemes and datasets.Source: §4.2.1 · p. 8, Figure 8 · p. 9, Figure 9 · p. 9
  • The white-box and black-box attacks remove watermarks with comparable test accuracy, while the white-box attack is significantly faster.Longer white-box fine-tuning can yield higher accuracy than the black-box attack.Source: Table 2 · p. 10, Table 4 · p. 10, Table 6 · p. 10

4.2.2 Property Inference Attack

  • 74% average success (range 60%–87%) enabled PIAttack to detect Abstract Images watermarks across CIFAR-10 and CIFAR-100 training/testing evaluations.The evaluation includes CIFAR-10 models tested on CIFAR-100 and the reverse, with CIFAR-100 restricted to 10 classes for comparable data.Source: §4.2.2 · p. 10

4.3 Discussion

The discussion relates watermark removal to data access, model choice, and the accuracy–resilience trade-off. It also examines when black-box stealing succeeds and how the experiments’ data split limits accuracy.

4.3 Discussion

  • The discussion argues that a model cannot maintain both a resilient backdoor and high classification accuracy.The claim frames a trade-off between watermark resilience and main-task performance.Source: §4.3 · p. 11

4.3.1 Not the Highest Accuracy

  • Using non-overlapping owner and attacker data leaves each with half the training set, limiting MNIST and CIFAR-10 accuracy; CIFAR-100 incurs 10% accuracy loss, so the experiment permits overlap.Despite the limitation, the attacks still remove the embedded watermarks.Source: §4.3.1 · p. 11

4.3.2 Model Selection

  • The attacker uses the owner’s model architecture, balancing the accuracy cost of lower capacity against the resource cost of higher capacity.The authors also select the same architecture because model resemblance may increase backdoor transfer, treating this as the attacker’s worst case for watermark retention.Source: §4.3.2 · p. 11

4.3.3 Comparison with Watermark Removal Attacks

  • Compared with prior removal approaches, the attacks require neither labeled data nor multiple models, and produce a clean model that can be redistributed.The ensemble attack uses multiple stolen models, while Chen et al.’s fine-tuning attack uses labeled and unlabeled data.Source: §4.3.3 · p. 11

4.3.4 Watermark Retention and Test Accuracy

  • Black-box watermark retention is lower when the marked model has higher test accuracy; the authors attribute retained watermark bias to inaccuracies, especially underfitting.For Content Embedded on MNIST, watermark samples make up 10% of training data and map to a fixed class, increasing that class’s total share to 20% under balanced remaining labels.Source: §4.3.4 · p. 12

5 Related Work

Related work spans white-box and black-box watermarking, backdoor defenses, model extraction, and watermark-removal attacks. The paper positions its attacks as avoiding labeled data, multiple models, and watermark-verification evasion.

5.1 White-box Watermarking Schemes

  • White-box watermarking embeds information in model parameters or weight distributions, but these schemes can face statistical attacks and require parameter access.The passage cites parameter embedding [45], DeepMarks [4], and statistical detection and overwriting.Source: §5.1 · p. 12

5.2 Black-box Watermarking Schemes

  • Black-box watermarking includes activation-based and adversarial-example schemes, alongside backdoor triggers paired with predefined labels [1] [26] [32].Some adversarial-example approaches require limiting transferability across networks.Source: §5.2 · p. 12

5.3 Backdoor Removal

  • Neural Cleanse detects and mitigates backdoors through consistent small input modifications, but applies only to relatively small-patch backdoors; Fine-Pruning can reduce accuracy.Some other defenses operate alongside a model to block active use of a backdoor, which does not fit the watermark setting described here.Source: §5.3 · p. 12

5.4 Model Extraction

  • Model-extraction work ranges from attacks assuming architecture and training details to functionality stealing from queries; the authors use an approach similar to Orekondy et al. [34].Prior methods also extract models for adversarial-example generation or steal parameters and properties.Source: §5.4 · pp. 12–13

5.5 Removing Backdoor-based watermarks

  • Prior watermark-removal approaches include ensemble and evasion attacks [22] and fine-tuning with labeled and unlabeled data; this paper’s attacks need none of those three resources or tactics.The three avoided requirements are labeled data, multiple models, and evading queries used for watermark verification.Source: §5.5 · p. 13

6 Conclusion

The paper presents black-box and white-box watermark-removal attacks and a property-inference attack for detecting watermarked models. The removal attacks use publicly available inputs and achieve negligible accuracy loss, while the property-inference attack can help confirm full removal and set a stopping point.

6 Conclusion

  • Using 20,000–50,000 publicly available inputs, the removal attacks successfully remove watermarks with negligible classification-accuracy loss.The inputs come from the marked model’s publicly known domain.Source: §6 · p. 13
  • The black-box and white-box removal attacks require neither labeled data nor access to the trigger set or ground-truth function.The black-box attack uses classification labels; access to model parameters enables the more efficient and accurate white-box attack.Source: §6 · p. 13
  • Property inference distinguishes watermarked from unmarked models and can confirm full removal to help set an efficient stopping point.The authors caution that even minuscule retention of a malicious backdoor could be critical.Source: §6 · p. 13
Loading 1906.07745v2…