基于后门的鲁棒后向模型水印方法

doi:10.19678/j.issn.1000-3428.0067063

摘要/Abstract

摘要：

深度学习模型的训练成本高，但窃取成本低，容易被复制并扩散。模型的版权拥有者可以利用后门等方式在模型中嵌入水印，通过验证水印来证明模型版权。根据水印嵌入阶段的不同，模型水印又可分为前向模型水印和后向模型水印，前向模型水印在模型训练之初就嵌入水印，而后向模型水印的嵌入发生在模型原始任务训练完成后，计算量小，更为灵活。但是已有的后向模型水印方法鲁棒性较弱，不能抵抗微调、剪枝等水印擦除攻击。分析后向模型水印鲁棒性弱于前向模型水印的原因，在此基础上，提出一种通用的鲁棒后向模型水印方法，在水印嵌入时引入对模型中间层特征和模型输出的约束，减小水印任务对原始任务的影响，增强后向模型水印的鲁棒性。在CIFAR-10、CALTECH-101、GTSRB等数据集上的实验结果表明，该方法能有效提升后向模型水印在微调攻击下的鲁棒性，CIFAR-10数据集实验中的最优约束设置与后向模型水印基线相比，水印验证成功率平均提升24.2个百分点，同时，该方法也提升了后向模型水印在剪枝等攻击下的鲁棒性。

关键词: 深度学习模型, 模型版权保护, 模型水印, 后门, 鲁棒性

Abstract:

The training cost of deep learning model is high; however, the stealing cost is low. This model is easy to copy and spread. The copyright owner of a model can embed a watermark in the model using a backdoor or another method. The copyright of the model is proven by verifying the embedded watermark. Watermark embedding strategies can be classified into forward and backward watermarking models. Forward model watermarking embeds watermarks from scratch, whereas backward model watermarking occurs after the original model training. Backward model watermarking requires fewer computations and is more flexible. However, unlike forward model watermarking, existing backward watermarking methods can be easily erased by fine-tuning, pruning, and other attacks. This study analyzes the reason for a weaker backward model watermarking compared to forward model watermarking. Based on this, a general method is proposed to enhance the robustness of backward model watermarking. This method introduces constraints on the middle-layer features and outputs of the model during the watermark embedding process. Experiments on CIFAR-10, CALTECH-101, GTSRB, and other datasets demonstrate that the proposed method can effectively improve the robustness of backward model watermarking against fine-tuning attacks, particularly on the CIFAR-10 dataset, improving the watermark success rate by an average of 24.2 percentage points compared to the baseline method. It also improves the robustness of backward model watermarking under pruning attacks.

Key words: deep learning model, copyright protection of the model, model watermarking, backdoor, robustness

曾嘉忻, 张卫明, 张荣. 基于后门的鲁棒后向模型水印方法[J]. 计算机工程, 2024, 50(2): 132-139.

Jiaxin ZENG, Weiming ZHANG, Rong ZHANG. Robust Backward Model Watermarking Method Based on Backdoor[J]. Computer Engineering, 2024, 50(2): 132-139.

http://www.ecice06.com/CN/Y2024/V50/I2/132

图/表 8

图1 鲁棒的后向模型水印嵌入流程

Fig.1 Robust backward model watermarking embedding process

图2 不同设置的内容型后向水印在剪枝攻击下的性能

Fig.2 Performance of content-type backward watermarking with different settings under pruning attack

图3 不同设置的抽象型后向水印在微调-剪枝攻击下的性能

Fig.3 Performance of abstract-type backward watermarking with different settings under fine-pruning attack

参考文献 27

1	WANG X G, YANG W, WEINREB J, et al. Searching for prostate cancer by fully automated magnetic resonance imaging classification: deep learning versus non-deep learning. Scientific Reports, 2017, 7, 1- 8. doi: 10.1038/s41598-016-0028-x
2	DENG Y, BAO F, KONG Y Y, et al. Deep direct reinforcement learning for financial signal representation and trading. IEEE Transactions on Neural Networks and Learning Systems, 2017, 28 (3): 653- 664. doi: 10.1109/TNNLS.2016.2522401
3	MASI I, WU Y, HASSNER T, et al. Deep face recognition: a survey[C]//Proceedings of the 31st SIBGRAPI Conference on Graphics, Patterns and Images. Washington D. C., USA: IEEE Press, 2018: 471-478.
4	HE Y, ZHAO N, YIN H X. Integrated networking, caching, and computing for connected vehicles: a deep reinforcement learning approach. IEEE Transactions on Vehicular Technology, 2018, 67 (1): 44- 55. doi: 10.1109/TVT.2017.2760281
5	张颖君, 陈恺, 周赓, 等. 神经网络水印技术研究进展. 计算机研究与发展, 2021, 58 (5): 964- 976. doi: 10.7544/issn1000-1239.2021.20200978
	ZHANG Y J, CHEN K, ZHOU G, et al. Research progress of neural networks watermarking technology. Journal of Computer Research and Development, 2021, 58 (5): 964- 976. doi: 10.7544/issn1000-1239.2021.20200978
6	BOENISCH F. A systematic review on model watermarking for neural networks. Frontiers in Big Data, 2021, 4, 729663. doi: 10.3389/fdata.2021.729663
7	UCHIDA Y, NAGAI Y, SAKAZAWA S, et al. Embedding watermarks into deep neural networks[C]//Proceedings of 2017 ACM International Conference on Multimedia Retrieval. New York, USA: ACM Press, 2017: 269-277.
8	ROUHANI B D, CHEN H L, KOUSHANFAR F. DeepSigns: an end-to-end watermarking framework for ownership protection of deep neural networks[C]//Proceedings of the 24th International Conference on Architectural Support for Programming Languages and Operating Systems. New York, USA: ACM Press, 2019: 485-497.
9	WANG T H, KERSCHBAUM F. RIGA: covert and robust white-box watermarking of deep neural networks[C]//Proceedings of 2021 Web Conference. New York, USA: ACM Press, 2021: 993-1004.
10	ADI Y, BAUM C, CISSE M, et al. Turning your weakness into a strength: watermarking deep neural networks by backdooring[C]//Proceedings of the 27th USENIX Conference on Security Symposium. New York, USA: ACM Press, 2018: 1615-1631.
11	ZHANG J L, GU Z S, JANG J, et al. Protecting intellectual property of deep neural networks with watermarking[C]//Proceedings of 2018 Asia Conference on Computer and Communications Security. New York, USA: ACM Press, 2018: 159-172.
12	CHEN H L, ROUHANI B D, KOUSHANFAR F. Blackmarks: blackbox multibit watermarking for deep neural networks[EB/OL]. [2023-01-02]. https://arxiv.org/abs/1904.00344.
13	NAMBA R, SAKUMA J. Robust watermarking of neural network with exponential weighting[C]//Proceedings of 2019 ACM Asia Conference on Computer and Communications Security. New York, USA: ACM Press, 2019: 228-240.
14	LE MERRER E, PÉREZ P, TRÉDAN G. Adversarial frontier stitching for remote neural network watermarking. Neural Computing and Applications, 2020, 32 (13): 9233- 9244. doi: 10.1007/s00521-019-04434-z
15	姜妍, 张立国. 面向深度学习模型的对抗攻击与防御方法综述. 计算机工程, 2021, 47 (1): 1- 11. doi: 10.3969/j.issn.1007-130X.2021.01.001
	JIANG Y, ZHANG L G. Survey of adversarial attacks and defense methods for deep learning model. Computer Engineering, 2021, 47 (1): 1- 11. doi: 10.3969/j.issn.1007-130X.2021.01.001
16	CHEN X Y, WANG W X, BENDER C, et al. REFIT: a unified watermark removal framework for deep learning systems with limited data[C]//Proceedings of 2021 ACM Asia Conference on Computer and Communications Security. New York, USA: ACM Press, 2021: 321-335.
17	HAN S, POOL J, TRAN J, et al. Learning both weights and connections for efficient neural networks[C]//Proceedings of the 28th International Conference on Neural Information Processing Systems. New York, USA: ACM Press, 2015: 1135-1143.
18	ZHANG Z Y, LYU L J, WANG W Q, et al. How to inject backdoors with better consistency: logit anchoring on clean data[EB/OL]. [2023-01-02]. https://arxiv.org/abs/2109.01300.
19	JIA H R, CHOQUETTE-CHOO C A, CHANDRASEKARAN V, et al. Entangled watermarks as a defense against model extraction[C]//Proceedings of the 30th USENIX Security Symposium. [S. l.]: USENIX, 2021: 1937-1954.
20	FROSST N, PAPERNOT N, HINTON G. Analyzing and improving representations with the soft nearest neighbor loss[C]//Proceedings of International Conference on Machine Learning. [S. l.]: PMLR, 2019: 2012-2020.
21	KRIZHEVSKY A, HINTON G. Learning multiple layers of features from tiny images. Handbook of Systemic Autoimmune Diseases, 2009, 1 (4): 1- 58.
22	STALLKAMP J, SCHLIPSING M, SALMEN J, et al. Man vs. computer: benchmarking machine learning algorithms for traffic sign recognition. Neural Networks, 2012, 32, 323- 332. doi: 10.1016/j.neunet.2012.02.016
23	LI F F, FERGUS R, PERONA P. One-shot learning of object categories. IEEE Transactions on Pattern Analysis and Machine Intelligence, 2006, 28 (4): 594- 611. doi: 10.1109/TPAMI.2006.79
24	HE K M, ZHANG X Y, REN S Q, et al. Deep residual learning for image recognition[C]//Proceedings of IEEE Conference on Computer Vision and Pattern Recognition. Washington D. C., USA: IEEE Press, 2016: 770-778.
25	GARG S, KUMAR A, GOEL V, et al. Can adversarial weight perturbations inject neural backdoors?[C]//Proceedings of the 29th ACM International Conference on Information and Knowledge Management. New York, USA: ACM Press, 2020: 2029-2032.
26	LIU K, DOLAN-GAVITT B, GARG S. Fine-pruning: defending against backdooring attacks on deep neural networks[C]//Proceedings of International Symposium on Research in Attacks, Intrusions, and Defenses. Berlin, Germany: Springer, 2018: 273-294.
27	王朕, 李豪, 严冬梅, 等. 基于改进YOLOv5的路面病害检测模型. 计算机工程, 2023, 49 (2): 15- 23. URL
	WANG Z, LI H, YAN D M, et al. Pavement disease detection model based on improved YOLOv5. Computer Engineering, 2023, 49 (2): 15- 23. URL

[1]	王树芬, 张哲, 马士尧, 陈俞强, 伍一. 一种鲁棒的半监督联邦学习系统[J]. 计算机工程, 2022, 48(6): 107-114,123.
[2]	胡彬, 王晓军, 张雷. 一种半监督对抗鲁棒模型无关元学习方法[J]. 计算机工程, 2022, 48(12): 112-118.
[3]	刘迪洋, 张震, 张进. 基于社区结构的复杂网络鲁棒性优化策略[J]. 计算机工程, 2021, 47(8): 84-92.
[4]	廖俊帆, 顾益军, 张培晶, 廖茜. 端到端说话人辨认的对抗样本应用比较研究[J]. 计算机工程, 2021, 47(6): 132-141.
[5]	李浩, 张晓强. 基于单线程的无锚点目标检测模型[J]. 计算机工程, 2021, 47(5): 229-235,243.
[6]	田钰杰, 管有庆, 龚锐. 一种鲁棒的多特征点云分类分割深度神经网络[J]. 计算机工程, 2021, 47(11): 234-240.
[7]	沈泽君, 丁飞飞, 杨文元. 多粒度相关滤波视频跟踪方法[J]. 计算机工程, 2020, 46(5): 274-281.
[8]	庞智华, 齐臣坤. 一种鲁棒的单目视觉里程计算法[J]. 计算机工程, 2020, 46(12): 80-87.
[9]	王文冰, 刘粉林, 巩道福, 刘胜利. 基于奇异值分解的水印方法虚警问题分析[J]. 计算机工程, 2020, 46(11): 273-278.
[10]	单礼岩, 李新伟. 基于时空信息特征融合的视频指纹算法[J]. 计算机工程, 2019, 45(8): 260-265,274.
[11]	薛铭龙,李一博. 基于改进随机森林算法的智能环境活动识别[J]. 计算机工程, 2019, 45(5): 149-154.
[12]	王楠,李智,程欣宇,陈怡,罗昊. 基于均值比例与压缩感知的视频双水印算法[J]. 计算机工程, 2019, 45(3): 250-255,261.
[13]	李玲霞,王羽,吴金君,王沙沙. 基于改进型多维卷积神经网络的微动手势识别方法[J]. 计算机工程, 2018, 44(9): 243-249.
[14]	李静,周亮,杨飞. 基于扩展结构相似性的特征匹配方法[J]. 计算机工程, 2018, 44(4): 305-309,316.
[15]	郭晓成,马润年,王刚. 指挥控制网络级联失效建模与仿真[J]. 计算机工程, 2018, 44(2): 294-297.

选择文件类型/文献管理软件名称

选择包含的内容