Trapdoor Normalization with Irreversible Ownership Verification

Hanwen Liu, Zhenyu Weng, Yuesheng Zhu, Yadong Mu
Proceedings of the 40th International Conference on Machine Learning, PMLR 202:22177-22187, 2023.

Abstract

This paper introduces a deep model watermark with an irreversible ownership verification scheme: Trapdoor Normalization (TdN), inspired by the trapdoor function in traditional cryptography. To protect intellectual property within deep models, the proposed method is able to embed ownership information into normalization layers during training. We argue and empirically validate that relevant methods are vulnerable to ambiguity attacks, where the forged watermarks can cast ambiguity over the ownership verification. The primary trait that distinguishes this work from previous ones, is its design of a bidirectional connection between watermarks and deep models. Thereby, TdN enables an irreversible ownership verification scheme that is difficult for the adversary to compromise. In this way, the proposed TdN can effectively defeat ambiguity attacks. Extensive experiments demonstrate that the proposed method is not only superior to previous state-of-the-art methods in robustness, but also has better efficiency.

Cite this Paper

BibTeX
@InProceedings{pmlr-v202-liu23an, title = {Trapdoor Normalization with Irreversible Ownership Verification}, author = {Liu, Hanwen and Weng, Zhenyu and Zhu, Yuesheng and Mu, Yadong}, booktitle = {Proceedings of the 40th International Conference on Machine Learning}, pages = {22177--22187}, year = {2023}, editor = {Krause, Andreas and Brunskill, Emma and Cho, Kyunghyun and Engelhardt, Barbara and Sabato, Sivan and Scarlett, Jonathan}, volume = {202}, series = {Proceedings of Machine Learning Research}, month = {23--29 Jul}, publisher = {PMLR}, pdf = {https://proceedings.mlr.press/v202/liu23an/liu23an.pdf}, url = {https://proceedings.mlr.press/v202/liu23an.html}, abstract = {This paper introduces a deep model watermark with an irreversible ownership verification scheme: Trapdoor Normalization (TdN), inspired by the trapdoor function in traditional cryptography. To protect intellectual property within deep models, the proposed method is able to embed ownership information into normalization layers during training. We argue and empirically validate that relevant methods are vulnerable to ambiguity attacks, where the forged watermarks can cast ambiguity over the ownership verification. The primary trait that distinguishes this work from previous ones, is its design of a bidirectional connection between watermarks and deep models. Thereby, TdN enables an irreversible ownership verification scheme that is difficult for the adversary to compromise. In this way, the proposed TdN can effectively defeat ambiguity attacks. Extensive experiments demonstrate that the proposed method is not only superior to previous state-of-the-art methods in robustness, but also has better efficiency.} }
Endnote
%0 Conference Paper %T Trapdoor Normalization with Irreversible Ownership Verification %A Hanwen Liu %A Zhenyu Weng %A Yuesheng Zhu %A Yadong Mu %B Proceedings of the 40th International Conference on Machine Learning %C Proceedings of Machine Learning Research %D 2023 %E Andreas Krause %E Emma Brunskill %E Kyunghyun Cho %E Barbara Engelhardt %E Sivan Sabato %E Jonathan Scarlett %F pmlr-v202-liu23an %I PMLR %P 22177--22187 %U https://proceedings.mlr.press/v202/liu23an.html %V 202 %X This paper introduces a deep model watermark with an irreversible ownership verification scheme: Trapdoor Normalization (TdN), inspired by the trapdoor function in traditional cryptography. To protect intellectual property within deep models, the proposed method is able to embed ownership information into normalization layers during training. We argue and empirically validate that relevant methods are vulnerable to ambiguity attacks, where the forged watermarks can cast ambiguity over the ownership verification. The primary trait that distinguishes this work from previous ones, is its design of a bidirectional connection between watermarks and deep models. Thereby, TdN enables an irreversible ownership verification scheme that is difficult for the adversary to compromise. In this way, the proposed TdN can effectively defeat ambiguity attacks. Extensive experiments demonstrate that the proposed method is not only superior to previous state-of-the-art methods in robustness, but also has better efficiency.
APA
Liu, H., Weng, Z., Zhu, Y. & Mu, Y.. (2023). Trapdoor Normalization with Irreversible Ownership Verification. Proceedings of the 40th International Conference on Machine Learning, in Proceedings of Machine Learning Research 202:22177-22187 Available from https://proceedings.mlr.press/v202/liu23an.html.

Related Material