Abstract: Model intellectual property protection has become an issue that cannot be ignored in model security. Watermarking technology, as the core means of model traceability, provides technical support for copyright verification by embedding special identifiers into model parameters or generated content. However, the trained watermarked models are very easy to be copied and spread, which enables attackers to destroy or remove the watermarks embedded in DNN models through specific technical means such as fine-tuning, pruning, or adversarial sample attacks, making it impossible to verify the model ownership. To gain a deeper understanding of model watermarking attack methods, this paper first introduces model watermarking attacks, then classifies the model watermarking attack methods into two categories: white-box watermarking attacks and black-box watermarking attacks, based on the attacker's access rights and information acquisition capabilities to the target model. It also sorts out and analyzes the motives, hazards, attack principles, and specific implementation methods of DNN model watermarking attacks. Meanwhile, it compares and summarizes the existing research on model watermarking attacks from the aspects of attacker capabilities and performance impacts. Finally, it further explores the potential positive role of neural network model watermarking attacks in future research and provides suggestions for in-depth research in the fields of model security and intellectual property protection.

摘要： 模型知识产权保护已成为模型安全中不可忽视的问题，水印技术作为模型溯源的核心手段，通过将特殊标识嵌入模型参数或生成内容中，为版权验证提供技术支撑。然而，训练完成的含水印模型非常容易被复制并扩散，这使得攻击者能够通过微调、剪枝或对抗样本攻击等特定技术手段，破坏或去除DNN模型中嵌入的水印，使得模型所有权无法验证。为了更深入地了解模型水印攻击方法，首先对模型水印攻击进行介绍，其次对模型水印攻击方法进行分类，根据攻击者对目标模型的访问权限和信息获取能力，分为白盒水印攻击和黑盒水印攻击两类，对DNN模型水印攻击的动因、危害、攻击原理和具体实施手段梳理和分析，同时对现有模型水印攻击研究从攻击者能力以及性能影响等方面进行比较与总结。最后，进一步探讨了神经网络模型水印攻击在未来研究中的潜在积极作用，为模型安全和知识产权保护领域的深入研究提供建议。