1. KeyNet: An Asymmetric Key-Style Framework for Watermarking Deep Learning Models
- Author
-
Najeeb Moharram Jebreel, Josep Domingo-Ferrer, Alberto Blanco-Justicia, and David Sánchez
- Subjects
Computer science ,Data_MISCELLANEOUS ,ownership ,Sample (statistics) ,ComputingMilieux_LEGALASPECTSOFCOMPUTING ,02 engineering and technology ,Machine learning ,computer.software_genre ,private model ,lcsh:Technology ,030218 nuclear medicine & medical imaging ,Task (project management) ,lcsh:Chemistry ,Public-key cryptography ,03 medical and health sciences ,0302 clinical medicine ,Robustness (computer science) ,0202 electrical engineering, electronic engineering, information engineering ,Leverage (statistics) ,General Materials Science ,Set (psychology) ,lcsh:QH301-705.5 ,Instrumentation ,Digital watermarking ,Fluid Flow and Transfer Processes ,lcsh:T ,business.industry ,Process Chemistry and Technology ,Deep learning ,watermarking ,General Engineering ,security and privacy ,intellectual property ,lcsh:QC1-999 ,Computer Science Applications ,deep learning models ,lcsh:Biology (General) ,lcsh:QD1-999 ,lcsh:TA1-2040 ,020201 artificial intelligence & image processing ,Artificial intelligence ,lcsh:Engineering (General). Civil engineering (General) ,business ,computer ,lcsh:Physics - Abstract
Many organizations devote significant resources to building high-fidelity deep learning (DL) models. Therefore, they have a great interest in making sure the models they have trained are not appropriated by others. Embedding watermarks (WMs) in DL models is a useful means to protect the intellectual property (IP) of their owners. In this paper, we propose KeyNet, a novel watermarking framework that satisfies the main requirements for an effective and robust watermarking. In KeyNet, any sample in a WM carrier set can take more than one label based on where the owner signs it. The signature is the hashed value of the owner&rsquo, s information and her model. We leverage multi-task learning (MTL) to learn the original classification task and the watermarking task together. Another model (called the private model) is added to the original one, so that it acts as a private key. The two models are trained together to embed the WM while preserving the accuracy of the original task. To extract a WM from a marked model, we pass the predictions of the marked model on a signed sample to the private model. Then, the private model can provide the position of the signature. We perform an extensive evaluation of KeyNet&rsquo, s performance on the CIFAR10 and FMNIST5 data sets and prove its effectiveness and robustness. Empirical results show that KeyNet preserves the utility of the original task and embeds a robust WM.
- Published
- 2021
- Full Text
- View/download PDF