Watermarking Deep Neural Networks with Greedy Residuals

Hanwen Liu, Zhenyu Weng, Yuesheng Zhu
Proceedings of the 38th International Conference on Machine Learning, PMLR 139:6978-6988, 2021.

Abstract

Deep neural networks (DNNs) are considered as intellectual property of their corresponding owners and thus are in urgent need of ownership protection, due to the massive amount of time and resources invested in designing, tuning and training them. In this paper, we propose a novel watermark-based ownership protection method by using the residuals of important parameters. Different from other watermark-based ownership protection methods that rely on some specific neural network architectures and during verification require external data source, namely ownership indicators, our method does not explicitly use ownership indicators for verification to defeat various attacks against DNN watermarks. Specifically, we greedily select a few and important model parameters for embedding so that the impairment caused by the changed parameters can be reduced and the robustness against different attacks can be improved as the selected parameters can well preserve the model information. Also, without the external data sources for verification, the adversary can hardly cast doubts on ownership verification by forging counterfeit watermarks. The extensive experiments show that our method outperforms previous state-of-the-art methods in five tasks.

Cite this Paper

BibTeX
@InProceedings{pmlr-v139-liu21x, title = {Watermarking Deep Neural Networks with Greedy Residuals}, author = {Liu, Hanwen and Weng, Zhenyu and Zhu, Yuesheng}, booktitle = {Proceedings of the 38th International Conference on Machine Learning}, pages = {6978--6988}, year = {2021}, editor = {Meila, Marina and Zhang, Tong}, volume = {139}, series = {Proceedings of Machine Learning Research}, month = {18--24 Jul}, publisher = {PMLR}, pdf = {http://proceedings.mlr.press/v139/liu21x/liu21x.pdf}, url = {https://proceedings.mlr.press/v139/liu21x.html}, abstract = {Deep neural networks (DNNs) are considered as intellectual property of their corresponding owners and thus are in urgent need of ownership protection, due to the massive amount of time and resources invested in designing, tuning and training them. In this paper, we propose a novel watermark-based ownership protection method by using the residuals of important parameters. Different from other watermark-based ownership protection methods that rely on some specific neural network architectures and during verification require external data source, namely ownership indicators, our method does not explicitly use ownership indicators for verification to defeat various attacks against DNN watermarks. Specifically, we greedily select a few and important model parameters for embedding so that the impairment caused by the changed parameters can be reduced and the robustness against different attacks can be improved as the selected parameters can well preserve the model information. Also, without the external data sources for verification, the adversary can hardly cast doubts on ownership verification by forging counterfeit watermarks. The extensive experiments show that our method outperforms previous state-of-the-art methods in five tasks.} }
Endnote
%0 Conference Paper %T Watermarking Deep Neural Networks with Greedy Residuals %A Hanwen Liu %A Zhenyu Weng %A Yuesheng Zhu %B Proceedings of the 38th International Conference on Machine Learning %C Proceedings of Machine Learning Research %D 2021 %E Marina Meila %E Tong Zhang %F pmlr-v139-liu21x %I PMLR %P 6978--6988 %U https://proceedings.mlr.press/v139/liu21x.html %V 139 %X Deep neural networks (DNNs) are considered as intellectual property of their corresponding owners and thus are in urgent need of ownership protection, due to the massive amount of time and resources invested in designing, tuning and training them. In this paper, we propose a novel watermark-based ownership protection method by using the residuals of important parameters. Different from other watermark-based ownership protection methods that rely on some specific neural network architectures and during verification require external data source, namely ownership indicators, our method does not explicitly use ownership indicators for verification to defeat various attacks against DNN watermarks. Specifically, we greedily select a few and important model parameters for embedding so that the impairment caused by the changed parameters can be reduced and the robustness against different attacks can be improved as the selected parameters can well preserve the model information. Also, without the external data sources for verification, the adversary can hardly cast doubts on ownership verification by forging counterfeit watermarks. The extensive experiments show that our method outperforms previous state-of-the-art methods in five tasks.
APA
Liu, H., Weng, Z. & Zhu, Y.. (2021). Watermarking Deep Neural Networks with Greedy Residuals. Proceedings of the 38th International Conference on Machine Learning, in Proceedings of Machine Learning Research 139:6978-6988 Available from https://proceedings.mlr.press/v139/liu21x.html.

Related Material