Exploring Structure Consistency for Deep Model Watermarking

by   Jie Zhang, et al.

The intellectual property (IP) of Deep neural networks (DNNs) can be easily “stolen” by surrogate model attack. There has been significant progress in solutions to protect the IP of DNN models in classification tasks. However, little attention has been devoted to the protection of DNNs in image processing tasks. By utilizing consistent invisible spatial watermarks, one recent work first considered model watermarking for deep image processing networks and demonstrated its efficacy in many downstream tasks. Nevertheless, it highly depends on the hypothesis that the embedded watermarks in the network outputs are consistent. When the attacker uses some common data augmentation attacks (e.g., rotate, crop, and resize) during surrogate model training, it will totally fail because the underlying watermark consistency is destroyed. To mitigate this issue, we propose a new watermarking methodology, namely “structure consistency”, based on which a new deep structure-aligned model watermarking algorithm is designed. Specifically, the embedded watermarks are designed to be aligned with physically consistent image structures, such as edges or semantic regions. Experiments demonstrate that our method is much more robust than the baseline method in resisting data augmentation attacks for model IP protection. Besides that, we further test the generalization ability and robustness of our method to a broader range of circumvention attacks.


page 2

page 7

page 8


Deep Model Intellectual Property Protection via Deep Watermarking

Despite the tremendous success, deep neural networks are exposed to seri...

Model Watermarking for Image Processing Networks

Deep learning has achieved tremendous success in numerous industrial app...

Robust Black-box Watermarking for Deep NeuralNetwork using Inverse Document Frequency

Deep learning techniques are one of the most significant elements of any...

Augmentation-induced Consistency Regularization for Classification

Deep neural networks have become popular in many supervised learning tas...

Effective Ambiguity Attack Against Passport-based DNN Intellectual Property Protection Schemes through Fully Connected Layer Substitution

Since training a deep neural network (DNN) is costly, the well-trained d...

High-frequency Matters: An Overwriting Attack and defense for Image-processing Neural Network Watermarking

In recent years, there has been significant advancement in the field of ...

NNSplitter: An Active Defense Solution to DNN Model via Automated Weight Obfuscation

As a type of valuable intellectual property (IP), deep neural network (D...

Please sign up or login with your details

Forgot password? Click here to reset