别忘了签同意书！
Don't Forget to Sign the Gradients!
摘要：
设计一流的深度学习模型是一个昂贵的过程，涉及收集数据，雇用具有机器学习专业知识的人力资源，并提供高计算资源。因此，深度学习模型被认为是模型供应商的宝贵知识产权（IP）。为了确保深度学习模型的可靠商业化，开发保护模型供应商免受知识产权侵犯的技术至关重要。其中一种技术，最近已经显示出很大的希望是数字水印。然而，目前的水印方法可以嵌入非常有限的信息量，并且容易受到水印去除攻击。在本文中，我们提出了GradSigns，一种新的水印框架，深度神经网络（DNN）。GradSigns将所有者的签名嵌入到交叉熵成本函数相对于模型输入的梯度中。我们的方法对受保护模型的性能影响可以忽略不计，它允许模型供应商通过预测API远程验证水印。我们使用CIFAR-10、SVHN和YTF数据集在针对不同图像分类任务训练的DNN上评估GradSigns。实验结果表明，GradSigns对所有已知的反水印攻击具有鲁棒性，并且可以将大量信息嵌入DNN中。
英文摘要：
Engineering a top-notch deep learning model is an expensive procedure that involves collecting data, hiring human resources with expertise in machine learning, and providing high computational resources. For that reason, deep learning models are considered as valuable Intellectual Properties (IPs) of the model vendors. To ensure reliable commercialization of deep learning models, it is crucial to develop techniques to protect model vendors against IP infringements. One of such techniques that recently has shown great promise is digital watermarking. However, current watermarking approaches can embed very limited amount of information and are vulnerable against watermark removal attacks. In this paper, we present GradSigns, a novel watermarking framework for deep neural networks (DNNs). GradSigns embeds the owner's signature into the gradient of the cross-entropy cost function with respect to inputs to the model. Our approach has a negligible impact on the performance of the protected model and it allows model vendors to remotely verify the watermark through prediction APIs. We evaluate GradSigns on DNNs trained for different image classification tasks using CIFAR-10, SVHN, and YTF datasets. Experimental results show that GradSigns is robust against all known counter-watermark attacks and can embed a large amount of information into DNNs.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
