Source-linked AI summary
Model Watermarking for Image Processing Networks
Jie Zhang, Dongdong Chen, Jing Liao, Han Fang, Weiming Zhang, Wenbo Zhou, Hao Cui, Nenghai Yu
TL;DR
Protecting valuable deep models from fine-tuning, pruning, and black-box imitation remains under-researched for image processing networks. The paper embeds unified invisible watermarks into target outputs so surrogate models learn them, using traditional and deep spatial watermarking mechanisms. Experiments show robustness across surrogate architectures and objective functions, with support for high-capacity image watermarks.
Problem
Image processing models lack established intellectual-property protection despite their commercial value and vulnerability to white-box and black-box attacks.
Method
The framework embeds a unified invisible watermark into target-model outputs and uses spatial watermarking, including a deep embedder-extractor system, so surrogate outputs retain an extractable watermark.
Results
The framework resists surrogate models trained with different network structures and loss functions and supports high-capacity image watermarks.
Takeaways & Limitations
The approach extends model watermarking beyond classification to image processing networks and can also protect valuable data and traditional image processing algorithms.
Abstract
from arXiv · showhide
Deep learning has achieved tremendous success in numerous industrial applications. As training a good model often needs massive high-quality data and computation resources, the learned models often have significant business values. However, these valuable deep models are exposed to a huge risk of infringements. For example, if the attacker has the full information of one target model including the network structure and weights, the model can be easily finetuned on new datasets. Even if the attacker can only access the output of the target model, he/she can still train another similar surrogate model by generating a large scale of input-output training pairs. How to protect the intellectual property of deep models is a very important but seriously under-researched problem. There are a few recent attempts at classification network protection only. In this paper, we propose the first model watermarking framework for protecting image processing models. To achieve this goal, we leverage the spatial invisible watermarking mechanism. Specifically, given a black-box target model, a unified and invisible watermark is hidden into its outputs, which can be regarded as a special task-agnostic barrier. In this way, when the attacker trains one surrogate model by using the input-output pairs of the target model, the hidden watermark will be learned and extracted afterward. To enable watermarks from binary bits to high-resolution images, both traditional and deep spatial invisible watermarking mechanism are considered. Experiments demonstrate the robustness of the proposed watermarking mechanism, which can resist surrogate models learned with different network structures and objective functions. Besides deep models, the proposed method is also easy to be extended to protect data and traditional image processing algorithms.
Introduction
The paper addresses the under-researched protection of valuable image processing models against white-box and black-box infringement. It proposes invisible output watermarking that survives surrogate-model training and supports robust, high-capacity watermarks.
- Motivation: Deep models require substantial labeled data and computation, making their learned parameters commercially valuable and vulnerable to infringement.Attackers may fine-tune or prune a fully exposed model, or imitate a black-box model using input-output pairs.
- Motivation: Existing deep watermarking methods mainly target classification, leaving image processing model protection seriously under-researched.The paper identifies image processing as a distinct protection setting with more complex and expensive training-data labeling.
- Framework: The proposed framework embeds a unified invisible watermark into target outputs while preserving their visual consistency, then extracts it from surrogate-model outputs.A target model M produces outputs in domain B; embedding H creates B′, and extractor R tests whether the watermark persists in surrogate outputs.
- Framework: Traditional spatial invisible watermarking is evaluated first, while a deep system uses embedding and extractor subnetworks to support high-capacity image watermarks and improved robustness.The deep system also constrains extraction on clean images and uses adversarial training to further strengthen robustness.
- Results: The framework resists surrogate models using different network structures and loss functions.The reported settings include ResNet and UNet structures with L1, L2, perceptual, and adversarial losses.
- Contributions: The paper contributes the first image-processing model watermarking framework and a deep invisible watermarking algorithm designed for robustness and capacity.The authors also report that the framework can be extended to protect valuable data and traditional image processing algorithms.
Related work
Prior watermarking research includes visible and invisible media watermarking, DNN-based image watermarking, and deep-model watermarking focused on classification. This paper extends spatial invisible watermarking to image processing networks and high-capacity image watermarks.
- Media watermarking: Traditional image watermarking methods include visible logos and invisible spatial watermarks, with invisible methods generally more secure and robust.Traditional methods typically have limited capacity, often hiding only several or tens of bits.
- DNN-based watermarking: DNN-based watermarking has used autoencoder architectures and simulated camera distortions to embed and extract watermarks.These methods address image watermarking rather than protection of the models performing image processing tasks.
- Model watermarking: Existing deep model watermarking methods focus on classification, whereas this paper targets higher-value image processing models.The paper identifies no prior work addressing watermarking for such image processing models.
- This paper: The proposed work leverages spatial invisible watermarking for image processing networks and introduces deep invisible watermarking for high-capacity watermarks such as logo images.Figure 2 presents the proposed deep watermarking framework based on spatial invisible watermarking algorithms.
Method
The method protects image-processing models by embedding a unified invisible watermark into outputs so surrogate models learn it, then extracting it from those surrogates. It combines spatial watermarking with embedding and extraction objectives and a two-stage training strategy to preserve visual quality and improve robustness.
- General framework: The framework embeds a unified watermark δ into every target-model output, forcing surrogate models to train on watermarked pairs and preserve δ in their outputs.The watermark acts as a barrier while keeping the watermarked outputs visually consistent with the original outputs.
- Traditional spatial invisible watermarking: Traditional spatial invisible watermarking spreads watermark bits across image blocks, trading redundancy for robustness against later image processing.The embedding intensity is α, and each spread block C_i represents a watermark bit w_i.
- Deep invisible watermarking: The proposed deep watermarking system uses an embedding sub-network H and extractor R to hide and recover higher-capacity watermarks such as logo images.Unlike traditional methods with low capacity, the deep system is designed for high-capacity watermarks and stronger resistance to surrogate models.
- Embedding loss: Embedding training combines pixel, perceptual, and adversarial consistency losses so watermarked outputs retain the visual quality and distribution of clean images.The adversarial loss trains H to make a discriminator unable to distinguish watermarked outputs from real watermark-free images.
- Extracting loss: The extractor R is trained to recover watermarks from watermarked images while producing a blank image for watermark-free inputs and maintaining extraction consistency.Its extraction objective combines watermark reconstruction, clean-output, and consistency terms.
- Adversarial training stage: A second adversarial stage trains R with outputs from a surrogate model SM, alongside clean and watermarked images, to improve extraction from noisy surrogate outputs.Figure 3 describes H and R initialization in the first stage, followed by SM-based adversarial enhancement of R.
Experiments
Experiments evaluate watermark capacity, robustness to surrogate-model choices, and the contribution of clean, consistent, and adversarial training losses. The framework is also tested in a task-specific setting against a conventional debone model.
- Experimental setup: Experiments cover image deraining and Chest X-ray deboning, with image-based watermarking evaluated quantitatively.The watermarking experiments use image-processing tasks and compare quantitative results for image watermarks.
- Robustness: The proposed deep watermarking framework resists surrogate models with different network structures and loss functions, whereas traditional methods handle only some surrogate models.Traditional methods also hide only 64-bit watermarks, while the proposed deep method supports image-based watermarks.
- Ablation study: Without clean loss, the extractor produces meaningless watermarks from watermark-free images, while consistent loss enables clear watermark extraction.The clean-loss failure is especially pronounced for domain B images, and removing consistent loss yields weak or absent extraction.
- Ablation study: Without adversarial training, resisting success is about 0% for surrogate models with different network structures under the default L2 loss.With different loss combinations, only some special surrogate models partially extract hidden watermarks without adversarial training.
- Task-specific watermarking: The task-specific watermarked debone model achieves PSNR 24.49 and SSIM 0.91, compared with PSNR 25.81 and SSIM 0.91 for the baseline.Here, the embedding sub-network simultaneously removes rib components and hides watermarks.
Conclusion
The paper introduces deep watermarking for image processing networks and proposes a framework using deep invisible watermarking for robust model protection. Experiments show resistance to surrogate models trained with different network structures and loss functions.
- Conclusion: The paper introduces the deep watermarking problem for image processing networks and proposes the first corresponding watermarking framework.The framework is inspired by traditional spatial invisible media watermarking.
- Conclusion: The proposed deep invisible watermarking technique supports image-based watermarks and robustness to different surrogate-model architectures and loss functions.The authors position deep watermarking for image processing as a seriously under-researched field.