使用附加类和隐写图像保护深度神经网络的知识产权
Protecting the Intellectual Properties of Deep Neural Networks with an Additional Class and Steganographic Images
摘要：
近年来，深度神经网络（DNN）知识产权保护的研究引起了广泛关注。DNN的版权保护方法有很多种。然而，现有的数字水印方法大多侧重于模型的版权验证，不支持用户指纹的认证和管理，不能满足商业版权保护的要求。此外，最近提出的查询修改攻击可以使大多数现有的基于后门的水印方法失效。为了应对这些挑战，在本文中，我们提出了一种通过使用额外的类和隐写图像来保护DNN模型的知识产权的方法。具体来说，我们使用一组水印密钥样本将附加类嵌入到DNN中，以便带水印的DNN在版权验证阶段将水印密钥样本分类为预定义的附加类。我们采用最低有效位（LSB）图像隐写术将用户指纹嵌入到水印密钥图像中。每个用户都将被分配一个独特的指纹图像，以便稍后可以验证用户的身份。实验结果表明，该方法能有效地保护DNN模型的版权。在Fashion-MNIST和CIFAR-10数据集上，该方法可以获得100%的水印准确率和100%的指纹认证成功率。此外，该方法被证明是鲁棒的模型微调攻击，模型修剪攻击，和查询修改攻击。与现有的三种水印方法（基于标识、基于噪声和对抗性前沿拼接水印方法）相比，该方法在水印准确性和对查询修改攻击的鲁棒性方面具有更好的性能。
英文摘要：
Recently, the research on protecting the intellectual properties (IP) of deep neural networks (DNN) has attracted serious concerns. A number of DNN copyright protection methods have been proposed. However, most of the existing watermarking methods focus on verifying the copyright of the model, which do not support the authentication and management of users' fingerprints, thus can not satisfy the requirements of commercial copyright protection. In addition, the query modification attack which was proposed recently can invalidate most of the existing backdoor-based watermarking methods. To address these challenges, in this paper, we propose a method to protect the intellectual properties of DNN models by using an additional class and steganographic images. Specifically, we use a set of watermark key samples to embed an additional class into the DNN, so that the watermarked DNN will classify the watermark key sample as the predefined additional class in the copyright verification stage. We adopt the least significant bit (LSB) image steganography to embed users' fingerprints into watermark key images. Each user will be assigned with a unique fingerprint image so that the user's identity can be authenticated later. Experimental results demonstrate that, the proposed method can protect the copyright of DNN models effectively. On Fashion-MNIST and CIFAR-10 datasets, the proposed method can obtain 100% watermark accuracy and 100% fingerprint authentication success rate. In addition, the proposed method is demonstrated to be robust to the model fine-tuning attack, model pruning attack, and the query modification attack. Compared with three existing watermarking methods (the logo-based, noise-based, and adversarial frontier stitching watermarking methods), the proposed method has better performance on watermark accuracy and robustness against the query modification attack.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
