Robust Backward Model Watermarking Method Based on Backdoor

doi:10.19678/j.issn.1000-3428.0067063

Abstract

Abstract:

The training cost of deep learning model is high; however, the stealing cost is low. This model is easy to copy and spread. The copyright owner of a model can embed a watermark in the model using a backdoor or another method. The copyright of the model is proven by verifying the embedded watermark. Watermark embedding strategies can be classified into forward and backward watermarking models. Forward model watermarking embeds watermarks from scratch, whereas backward model watermarking occurs after the original model training. Backward model watermarking requires fewer computations and is more flexible. However, unlike forward model watermarking, existing backward watermarking methods can be easily erased by fine-tuning, pruning, and other attacks. This study analyzes the reason for a weaker backward model watermarking compared to forward model watermarking. Based on this, a general method is proposed to enhance the robustness of backward model watermarking. This method introduces constraints on the middle-layer features and outputs of the model during the watermark embedding process. Experiments on CIFAR-10, CALTECH-101, GTSRB, and other datasets demonstrate that the proposed method can effectively improve the robustness of backward model watermarking against fine-tuning attacks, particularly on the CIFAR-10 dataset, improving the watermark success rate by an average of 24.2 percentage points compared to the baseline method. It also improves the robustness of backward model watermarking under pruning attacks.

Key words: deep learning model, copyright protection of the model, model watermarking, backdoor, robustness

摘要：

深度学习模型的训练成本高，但窃取成本低，容易被复制并扩散。模型的版权拥有者可以利用后门等方式在模型中嵌入水印，通过验证水印来证明模型版权。根据水印嵌入阶段的不同，模型水印又可分为前向模型水印和后向模型水印，前向模型水印在模型训练之初就嵌入水印，而后向模型水印的嵌入发生在模型原始任务训练完成后，计算量小，更为灵活。但是已有的后向模型水印方法鲁棒性较弱，不能抵抗微调、剪枝等水印擦除攻击。分析后向模型水印鲁棒性弱于前向模型水印的原因，在此基础上，提出一种通用的鲁棒后向模型水印方法，在水印嵌入时引入对模型中间层特征和模型输出的约束，减小水印任务对原始任务的影响，增强后向模型水印的鲁棒性。在CIFAR-10、CALTECH-101、GTSRB等数据集上的实验结果表明，该方法能有效提升后向模型水印在微调攻击下的鲁棒性，CIFAR-10数据集实验中的最优约束设置与后向模型水印基线相比，水印验证成功率平均提升24.2个百分点，同时，该方法也提升了后向模型水印在剪枝等攻击下的鲁棒性。

关键词: 深度学习模型, 模型版权保护, 模型水印, 后门, 鲁棒性

Jiaxin ZENG, Weiming ZHANG, Rong ZHANG. Robust Backward Model Watermarking Method Based on Backdoor[J]. Computer Engineering, 2024, 50(2): 132-139.

曾嘉忻, 张卫明, 张荣. 基于后门的鲁棒后向模型水印方法[J]. 计算机工程, 2024, 50(2): 132-139.

/ Recommend / Download Citations

URL: https://www.ecice06.com/EN/10.19678/j.issn.1000-3428.0067063

https://www.ecice06.com/EN/Y2024/V50/I2/132

Figures/Tables 8

References 27

1	WANG X G, YANG W, WEINREB J, et al. Searching for prostate cancer by fully automated magnetic resonance imaging classification: deep learning versus non-deep learning. Scientific Reports, 2017, 7, 1- 8. doi: 10.1038/s41598-016-0028-x
2	DENG Y, BAO F, KONG Y Y, et al. Deep direct reinforcement learning for financial signal representation and trading. IEEE Transactions on Neural Networks and Learning Systems, 2017, 28 (3): 653- 664. doi: 10.1109/TNNLS.2016.2522401
3	MASI I, WU Y, HASSNER T, et al. Deep face recognition: a survey[C]//Proceedings of the 31st SIBGRAPI Conference on Graphics, Patterns and Images. Washington D. C., USA: IEEE Press, 2018: 471-478.
4	HE Y, ZHAO N, YIN H X. Integrated networking, caching, and computing for connected vehicles: a deep reinforcement learning approach. IEEE Transactions on Vehicular Technology, 2018, 67 (1): 44- 55. doi: 10.1109/TVT.2017.2760281
5	张颖君, 陈恺, 周赓, 等. 神经网络水印技术研究进展. 计算机研究与发展, 2021, 58 (5): 964- 976. doi: 10.7544/issn1000-1239.2021.20200978
	ZHANG Y J, CHEN K, ZHOU G, et al. Research progress of neural networks watermarking technology. Journal of Computer Research and Development, 2021, 58 (5): 964- 976. doi: 10.7544/issn1000-1239.2021.20200978
6	BOENISCH F. A systematic review on model watermarking for neural networks. Frontiers in Big Data, 2021, 4, 729663. doi: 10.3389/fdata.2021.729663
7	UCHIDA Y, NAGAI Y, SAKAZAWA S, et al. Embedding watermarks into deep neural networks[C]//Proceedings of 2017 ACM International Conference on Multimedia Retrieval. New York, USA: ACM Press, 2017: 269-277.
8	ROUHANI B D, CHEN H L, KOUSHANFAR F. DeepSigns: an end-to-end watermarking framework for ownership protection of deep neural networks[C]//Proceedings of the 24th International Conference on Architectural Support for Programming Languages and Operating Systems. New York, USA: ACM Press, 2019: 485-497.
9	WANG T H, KERSCHBAUM F. RIGA: covert and robust white-box watermarking of deep neural networks[C]//Proceedings of 2021 Web Conference. New York, USA: ACM Press, 2021: 993-1004.
10	ADI Y, BAUM C, CISSE M, et al. Turning your weakness into a strength: watermarking deep neural networks by backdooring[C]//Proceedings of the 27th USENIX Conference on Security Symposium. New York, USA: ACM Press, 2018: 1615-1631.
11	ZHANG J L, GU Z S, JANG J, et al. Protecting intellectual property of deep neural networks with watermarking[C]//Proceedings of 2018 Asia Conference on Computer and Communications Security. New York, USA: ACM Press, 2018: 159-172.
12	CHEN H L, ROUHANI B D, KOUSHANFAR F. Blackmarks: blackbox multibit watermarking for deep neural networks[EB/OL]. [2023-01-02]. https://arxiv.org/abs/1904.00344.
13	NAMBA R, SAKUMA J. Robust watermarking of neural network with exponential weighting[C]//Proceedings of 2019 ACM Asia Conference on Computer and Communications Security. New York, USA: ACM Press, 2019: 228-240.
14	LE MERRER E, PÉREZ P, TRÉDAN G. Adversarial frontier stitching for remote neural network watermarking. Neural Computing and Applications, 2020, 32 (13): 9233- 9244. doi: 10.1007/s00521-019-04434-z
15	姜妍, 张立国. 面向深度学习模型的对抗攻击与防御方法综述. 计算机工程, 2021, 47 (1): 1- 11. doi: 10.3969/j.issn.1007-130X.2021.01.001
	JIANG Y, ZHANG L G. Survey of adversarial attacks and defense methods for deep learning model. Computer Engineering, 2021, 47 (1): 1- 11. doi: 10.3969/j.issn.1007-130X.2021.01.001
16	CHEN X Y, WANG W X, BENDER C, et al. REFIT: a unified watermark removal framework for deep learning systems with limited data[C]//Proceedings of 2021 ACM Asia Conference on Computer and Communications Security. New York, USA: ACM Press, 2021: 321-335.
17	HAN S, POOL J, TRAN J, et al. Learning both weights and connections for efficient neural networks[C]//Proceedings of the 28th International Conference on Neural Information Processing Systems. New York, USA: ACM Press, 2015: 1135-1143.
18	ZHANG Z Y, LYU L J, WANG W Q, et al. How to inject backdoors with better consistency: logit anchoring on clean data[EB/OL]. [2023-01-02]. https://arxiv.org/abs/2109.01300.
19	JIA H R, CHOQUETTE-CHOO C A, CHANDRASEKARAN V, et al. Entangled watermarks as a defense against model extraction[C]//Proceedings of the 30th USENIX Security Symposium. [S. l.]: USENIX, 2021: 1937-1954.
20	FROSST N, PAPERNOT N, HINTON G. Analyzing and improving representations with the soft nearest neighbor loss[C]//Proceedings of International Conference on Machine Learning. [S. l.]: PMLR, 2019: 2012-2020.
21	KRIZHEVSKY A, HINTON G. Learning multiple layers of features from tiny images. Handbook of Systemic Autoimmune Diseases, 2009, 1 (4): 1- 58.
22	STALLKAMP J, SCHLIPSING M, SALMEN J, et al. Man vs. computer: benchmarking machine learning algorithms for traffic sign recognition. Neural Networks, 2012, 32, 323- 332. doi: 10.1016/j.neunet.2012.02.016
23	LI F F, FERGUS R, PERONA P. One-shot learning of object categories. IEEE Transactions on Pattern Analysis and Machine Intelligence, 2006, 28 (4): 594- 611. doi: 10.1109/TPAMI.2006.79
24	HE K M, ZHANG X Y, REN S Q, et al. Deep residual learning for image recognition[C]//Proceedings of IEEE Conference on Computer Vision and Pattern Recognition. Washington D. C., USA: IEEE Press, 2016: 770-778.
25	GARG S, KUMAR A, GOEL V, et al. Can adversarial weight perturbations inject neural backdoors?[C]//Proceedings of the 29th ACM International Conference on Information and Knowledge Management. New York, USA: ACM Press, 2020: 2029-2032.
26	LIU K, DOLAN-GAVITT B, GARG S. Fine-pruning: defending against backdooring attacks on deep neural networks[C]//Proceedings of International Symposium on Research in Attacks, Intrusions, and Defenses. Berlin, Germany: Springer, 2018: 273-294.
27	王朕, 李豪, 严冬梅, 等. 基于改进YOLOv5的路面病害检测模型. 计算机工程, 2023, 49 (2): 15- 23. URL
	WANG Z, LI H, YAN D M, et al. Pavement disease detection model based on improved YOLOv5. Computer Engineering, 2023, 49 (2): 15- 23. URL

[1]	LI Weigang, LI Xuchang, TIAN Zhiqiang, LI Jinling. Research on Point Cloud Classification and Its Robustness Based on Self-Distillation Framework [J]. Computer Engineering, 2024, 50(9): 72-81.
[2]	ZHENG Qiumei, ZHAO Dan, NIU Weiwei, LIN Chao. Multiple Watermarking Algorithm for Color Images Based on Multi-Channel [J]. Computer Engineering, 2024, 50(9): 246-254.
[3]	GU Yonggen, GAO Lingxuan, WU Xiaohong, TAO Jie. Research on Data Sharing of Federated Semi-Supervised Learning with Non-IID [J]. Computer Engineering, 2024, 50(6): 188-196.
[4]	ZHANG Xuejun, XI Ayou, JIA Xiaohong, ZHANG Bin, LI Mei, DU Xiaogang, HUANG Haiyan. Study on Adversarial Sample Attacks on Deep Learning Based Fingerprinting Indoor Localization [J]. Computer Engineering, 2024, 50(10): 228-239.
[5]	WANG Shufen, ZHANG Zhe, MA Shiyao, CHEN Yuqiang, WU Yi. A Robust Semi-Supervised Federated Learning System [J]. Computer Engineering, 2022, 48(6): 107-114,123.
[6]	HU Bin, WANG Xiaojun, ZHANG Lei. A Semi-Supervised Adversarial Robust Model-Agnostic Meta-Learning Method [J]. Computer Engineering, 2022, 48(12): 112-118.
[7]	LIU Diyang, ZHANG Zhen, ZHANG Jin. Robustness Optimization Strategy Based on Community Structure for Complex Network [J]. Computer Engineering, 2021, 47(8): 84-92.
[8]	LIAO Junfan, GU Yijun, ZHANG Peijing, LIAO Qian. Comparative Research on Application of Adversarial Samples for End-to-End Speaker Identification [J]. Computer Engineering, 2021, 47(6): 132-141.
[9]	LI Hao, ZHANG Xiaoqiang. Anchor-Free Target Detection Model Based on Single Thread [J]. Computer Engineering, 2021, 47(5): 229-235,243.
[10]	TIAN Yujie, GUAN Youqing, GONG Rui. A Robust Deep Neural Network for Multi-Feature Point Cloud Classification and Segmentation [J]. Computer Engineering, 2021, 47(11): 234-240.
[11]	SHEN Zejun, DING Feifei, YANG Wenyuan. Video Tracking Method Using Multi-granularity Correlation Filters [J]. Computer Engineering, 2020, 46(5): 274-281.
[12]	PANG Zhihua, QI Chenkun. A Robust Monocular Visual Odometry Algorithm [J]. Computer Engineering, 2020, 46(12): 80-87.
[13]	WANG Wenbing, LIU Fenlin, GONG Daofu, LIU Shengli. False Alarm Problem Analysis of Watermarking Method Based on Singular Value Decomposition [J]. Computer Engineering, 2020, 46(11): 273-278.
[14]	SHAN Liyan, LI Xinwei. Video Fingerprinting Algorithm Based on Temporal and Spatial Information Feature Fusion [J]. Computer Engineering, 2019, 45(8): 260-265,274.
[15]	XUE Minglong,LI Yibo. Intelligent Environmental Activity Recognition Based on Improved Random Forest Algorithm [J]. Computer Engineering, 2019, 45(5): 149-154.

Please choose a citation manager

Content to export