Source-linked AI summary
Deep Model Intellectual Property Protection via Deep Watermarking
Jie Zhang, Dongdong Chen, Jing Liao, Weiming Zhang, Huamin Feng, Gang Hua, Nenghai Yu
TL;DR
Deep models face IP theft through fine-tuning and surrogate learning, while protection remains under-researched for image-processing networks. The paper adds an invisible watermarking barrier after the target model, designs a deep mechanism for high-capacity watermarks, and reports robustness across surrogate architectures and losses. Joint training can absorb the barrier into the target model, although preprocessing such as cropping and resizing remains insufficiently robust.
Problem
Deep model IP protection remains under-researched despite white-box theft and black-box surrogate attacks, especially for image-processing networks.
Method
The framework adds a barrier that embeds a unified invisible watermark into target outputs, with deep embedding and extraction networks for high-capacity image watermarks.
Results
The framework resists surrogate attacks using different network structures and loss functions, and joint training can make the target model self-watermarked.
Takeaways & Limitations
Watermarking can protect image-processing model outputs against surrogate-model attacks while supporting multiple and self-watermark configurations.
Takeaways & Limitations
The method is not robust enough to surrogate attacks involving random cropping and resizing because these operations destroy the relied-on consistency.
Abstract
from arXiv · showhide
Despite the tremendous success, deep neural networks are exposed to serious IP infringement risks. Given a target deep model, if the attacker knows its full information, it can be easily stolen by fine-tuning. Even if only its output is accessible, a surrogate model can be trained through student-teacher learning by generating many input-output training pairs. Therefore, deep model IP protection is important and necessary. However, it is still seriously under-researched. In this work, we propose a new model watermarking framework for protecting deep networks trained for low-level computer vision or image processing tasks. Specifically, a special task-agnostic barrier is added after the target model, which embeds a unified and invisible watermark into its outputs. When the attacker trains one surrogate model by using the input-output pairs of the barrier target model, the hidden watermark will be learned and extracted afterwards. To enable watermarks from binary bits to high-resolution images, a deep invisible watermarking mechanism is designed. By jointly training the target model and watermark embedding, the extra barrier can even be absorbed into the target model. Through extensive experiments, we demonstrate the robustness of the proposed framework, which can resist attacks with different network structures and objective functions.
1 INTRODUCTION
Deep model IP protection is needed because models can be stolen through white-box fine-tuning or black-box surrogate training. The paper proposes invisible output watermarking and reports robustness across surrogate architectures, losses, watermark settings, and deployment variants.
- Motivation: Deep models have substantial business value, making their IP protection important and essential.Training requires specialized architectures, high-quality labeled data, and large computational resources.
- Threats: White-box attackers can fine-tune or prune a known target model, while black-box attackers can train surrogates from input-output pairs.Student-teacher training treats target outputs as ground-truth labels.
- Framework: The framework hides a unified invisible watermark in target outputs so that a surrogate trained on those outputs learns a watermark recoverable by an extractor.The watermarking barrier is placed after the target model and preserves visual consistency with unwatermarked outputs.
- Framework: The deep watermarking system uses embedding and extraction subnetworks, constrains extraction on clean images, and supports high-capacity image watermarks.It is designed to overcome the limited capacity and model-specific robustness of traditional spatial watermarking.
- Results: The framework resists surrogate attacks across network structures and loss functions, supports multiple and self-watermarks, and can absorb the barrier into the target model.Verification uses normalized correlation and a watermark classifier; joint training can make the target model self-watermarked.
2 RELATED WORK
Prior watermarking protects media through visible or invisible schemes, while deep-model watermarking remains less developed and largely classification-focused. This paper targets image-processing models and surrogate attacks with spatial invisible watermarking.
- Media Copyright Protection: Traditional media watermarking includes visible and invisible methods, with invisible watermarks embedded in spatial or transform domains.These methods have been studied for media copyright protection for decades.
- Media Copyright Protection: Traditional watermarking methods generally hide only several or tens of bits, limiting their ability to embed logo images.The paper states that transform-domain algorithms fail for this task, while only spatial methods work to some extent.
- Media Copyright Protection: Deep neural watermarking has enabled image-based embedding and extraction, including schemes resilient to camera shooting distortions.These methods remain part of media watermarking rather than model IP protection.
- Deep Model IP Protection: Existing deep-model IP methods use weight regularization, indicator inputs, backdoors, or passport layers, but can require model details, alter architecture, or degrade performance.The cited methods primarily address classification and white-box attacks.
- Image-to-image Translation: The paper focuses on paired image-to-image translation models because their training data is expensive and their watermarking had not previously been considered.Examples of image-processing tasks include style transfer, deraining, and X-ray image deboning.
3 METHOD
The method section defines the surrogate-model threat, analyzes spatial invisible watermarking for model protection, and develops watermarking and verification procedures. It culminates in a deep invisible watermarking framework for image-processing models.
- Method Overview: The method section first formalizes the target problem, then analyzes spatial invisible watermarking before presenting traditional and deep watermarking frameworks.It also covers watermark verification methods and experimental evaluation.
3.1 Problem Definition
The paper focuses on surrogate-model attacks where only a target model’s outputs are accessible, and proposes extracting a predefined watermark from the surrogate’s outputs for forensics.
- The attacker can train a surrogate model by treating outputs generated by the target model as ground-truth labels.
- Forensics must therefore rely on the suspected model’s outputs when its internal information is inaccessible.
- The proposed mechanism extracts a predefined watermark pattern from the surrogate model’s output as forensic evidence.
3.2 Theoretical Pre-analysis.
The framework adds a barrier that watermarks target outputs before they reach the attacker, so surrogate training learns the watermark and enables its later extraction.
- The watermark can subsequently be extracted from the trained surrogate’s output using a corresponding extractor.
- A surrogate can minimize its objective by adding the unified watermark δ to the target model’s output through a skip connection.
- Because the loss is computed against watermarked outputs, a good surrogate is theoretically driven to learn δ rather than omit it.
- Training on watermarked pairs changes the surrogate’s learning target from original outputs to barrier-generated outputs.
3.3 Traditional Spatial Invisible Watermarking.
Traditional spatial invisible watermarking embeds information into image coefficients, but its robustness-oriented redundancy limits capacity and restricts practical watermark choices.
- Additive embedding spreads watermark information into image coefficients using an embedding intensity and bit-specific spread blocks.
- The embedded watermark is extracted by detecting the distribution of the corresponding coefficients.
- Spread-spectrum redundancy provides error-correction ability and supports watermark robustness.
- Traditional schemes have limited embedding capacity because robustness requires many redundant bits.
- Embedding high-capacity images such as logos is nearly infeasible, and experiments show resistance only to some surrogate-model types.
3.4 Deep Invisible Watermarking.
The deep invisible watermarking system uses embedding and extraction networks, clean-image constraints, and adversarial surrogate-model training to make watermark extraction robust. The framework also supports multiple watermarks and can absorb embedding into the target model itself.
- Extractor training: R is trained to recover the target watermark from watermarked outputs while producing a blank image for watermark-free inputs.This clean-input constraint prevents R from outputting the watermark indiscriminately.
- Overview: The system trains an embedding network H and extractor R, then uses a surrogate model SM adversarially to improve R’s extraction ability.The two-stage strategy first trains H and R, then incorporates surrogate-model outputs to improve generalization.
- Embedding loss: The embedding loss combines pixel, perceptual, and adversarial terms to preserve visual quality and reduce the domain gap between watermarked and original images.The adversarial term trains H so a discriminator cannot distinguish watermarked outputs from real watermark-free images.
- Extracting loss: The extracting loss combines watermark reconstruction, clean-output, and consistency objectives, with Lext defined as their weighted sum.The reconstruction term targets the watermark, the clean term targets a blank watermark, and the consistency term encourages stable extraction across watermarked images.
- Forensics: Forensics verifies suspected model theft by comparing extracted watermarks with normalized correlation or a jointly trained binary classifier.The classifier labels outputs as watermarked or watermark-free and is designed to be more robust to noisy extracted regions.
- Extensions: The framework supports multiple watermarks through random watermark selection and multiclass verification, while embedding functionality can be absorbed into the target model during joint training.Self-watermarking removes the need for an extra embedding barrier when the target model’s training process is controllable.
4 EXPERIMENTS
Experiments evaluate invisible watermark quality, extraction, attack robustness, ablations, and watermark-size generalization across deraining and debone tasks. The method preserves visual quality while maintaining strong extraction and robustness under varied surrogate models, losses, and training conditions.
- Experimental scope: The experiments cover image deraining and Chest X-ray debone, assessing visual quality, extraction, surrogate-model robustness, comparisons, overwriting, and ablations.The watermarking algorithm is evaluated quantitatively and qualitatively, including different surrogate structures and loss functions.
- Watermark quality: The method embeds grayscale, QR-code, and complex color watermarks imperceptibly, including textured “Peppers” and “Lena” images.The embedding and extraction subnetworks preserve watermarked-image quality while extracting the target watermark.
- Watermark quality: Average NC exceeds 0.99 with 100% success under both NC and classifier metrics, while PSNR and SSIM remain very high.These measurements compare watermarked images with their watermark-free counterparts and assess extraction through the extractor and classifier.
- Attack robustness: The framework resists surrogate models with different network structures and loss combinations, achieving very high extraction success rates despite adversarial training using only UNet with L2 loss.The reported robustness includes both white-box and black-box attacks.
- Comparisons: Compared with traditional and HiDDeN watermarking, the proposed method has stronger embedding, extraction, and surrogate-attack robustness, while alternatives fail or cannot support high-capacity logo watermarks.DFT- and DWT-based methods achieve 0% success in the cited comparison, and HiDDeN is described as fragile to surrogate attacks.
- Overwriting robustness: Watermark overwriting degrades extraction and surrogate performance, but the original watermark remains extractable; ambiguity remains because an attacker’s watermark may also be extracted.The authors state that a watermarking protocol is still needed to resolve this ambiguity.
- Ablation study: Removing adversarial training reduces extraction success to about 0% for varied surrogate structures, while removing consistent loss yields weak or absent extraction.Adversarial training helps generalize from UNet degradation to other networks, and consistency preserves unified watermark information.
- Ablation study: As surrogate PSNR rises from 20.77 to 23.55, extraction success increases from 3% to 99% by NC and from 18% to 100% by classifier.The method fails to extract the watermark only when the surrogate model completely fails at the debone task.
5 EXTENSIONS
The extensions support multiple watermarks and absorb watermark embedding into the protected model itself. They also examine broader applicability to traditional image-processing algorithms and private-data protection.
- Multiple watermarks: A single embedding and extractor network can support multiple different watermarks, although PSNR decreases from 47.76 to 41.87 while remaining above 40.The comparison uses ten logo images and contrasts the multiple-watermark setting with the default per-watermark-per-network setting.
- Multiple watermarks: The multiple-watermark setting is evaluated against per-watermark-per-network robustness using surrogate models with varied structures and loss combinations.The comparison is summarized in the success-rate table for Debone-IEEE and Derain-Flower-style attack settings.
- Self-watermarked model: Absorbing the embedding network into the target model creates a self-watermarked model without an extra barrier network.The embedding and task functionality are jointly learned within one image-processing network.
- Self-watermarked model: The self-watermarked deraining model remains close to the original, with PSNR 32.13 versus 32.49 and SSIM 0.93 for both, while hiding watermarks at 0.9999 NC.The same extension is reported as robust to surrogate attacks with different network structures and loss functions.
- Broader applicability: The framework is also applied to traditional non-CNN image-processing protection, where the embedding preserves visual quality and extraction reaches a 100% success rate.The cited example uses the structure-aware texture smoothing method RTV and evaluates a Res9 surrogate with L1 + Ladv.
6 CONCLUSION AND DISCUSSION
The paper presents a deep spatial watermarking framework that protects models against surrogate-model attacks and can absorb watermark embedding into the target model. It also identifies vulnerability to preprocessing attacks and calls for more robust consistency mechanisms.
- The framework protects deep models against surrogate models trained with different network structures and loss functions.
- Jointly training the target model and watermark embedding can self-watermark the target without an extra embedding sub-network.
- The approach is presented as potentially applicable to data protection and traditional algorithm protection beyond deep models.
- Random cropping and resizing can destroy the consistency required by the method, making it insufficiently robust to these surrogate-model preprocessing attacks.
- Future work should design consistency mechanisms intrinsically robust to preprocessing while investigating the implicit watermark hidden by adversarial training.