Self-supervised learning is an emerging machine learning paradigm. Compared to supervised learning which leverages high-quality labeled datasets, self-supervised learning relies on unlabeled datasets to pre-train powerful encoders which can then be treated as feature extractors for various downstream tasks. The huge amount of data and computational resources consumption makes the encoders themselves become the valuable intellectual property of the model owner. Recent research has shown that the machine learning model's copyright is threatened by model stealing attacks, which aim to train a surrogate model to mimic the behavior of a given model. We empirically show that pre-trained encoders are highly vulnerable to model stealing attacks. However, most of the current efforts of copyright protection algorithms such as watermarking concentrate on classifiers. Meanwhile, the intrinsic challenges of pre-trained encoder's copyright protection remain largely unstudied. We fill the gap by proposing SSLGuard, the first watermarking scheme for pre-trained encoders. Given a clean pre-trained encoder, SSLGuard injects a watermark into it and outputs a watermarked version. The shadow training technique is also applied to preserve the watermark under potential model stealing attacks. Our extensive evaluation shows that SSLGuard is effective in watermark injection and verification, and it is robust against model stealing and other watermark removal attacks such as input noising, output perturbing, overwriting, model pruning, and fine-tuning.
DRGW: Learning Disentangled Representations for Robust Graph Watermarking
Institute of Information Engineering, Chinese Academy of Sciences（中国科学院信息工程研究所）；School of Cyber Security, University of Chinese Academy of Sciences（中国科学院大学网络安全学院）；State Key Laboratory of Cyberspace Security Defense（网络空间安全防御国家重点实验室）
FreqMark: Invisible Image Watermarking via Frequency Based Optimization in Latent Space
University of California, Santa Cruz（加州大学圣克鲁兹分校）；The University of Hong Kong（香港大学）；University of Science and Technology of China（中国科学技术大学）；IEG, Tencent（腾讯IEG）；Fudan University（复旦大学）
SSL-WM: A Black-Box Watermarking Approach for Encoders Pre-trained by Self-supervised Learning
Institute of Information Engineering, Chinese Academy of Sciences（中国科学院信息工程研究所）；School of Cyber Security, University of Chinese Academy of Sciences（中国科学院大学网络空间安全学院）；Department of Computer Science, Metropolitan College, Boston University（波士顿大学大都会学院计算机科学系）
This paper proposes an oblivious watermarking algorithm with blind detection approach for high volume data hiding in image signals. We present a detection reliable signal adaptive embedding scheme for multiple messages in selective sub-bands of wavelet (DWT) coefficients using direct sequence spread spectrum (DS-SS) modulation technique. Here the impact of volumetric distortion sources is analyzed on the ability of analytical bounds in order to recover the watermark messages. In this context, the joint source-channel coding scheme has been employed to obtain the better control of the system ro…
Watermarking is an operation of embedding an information into an image in a way that allows to identify ownership of the image despite applying some distortions on it. In this paper, we presented a novel end-to-end solution for embedding and recovering the watermark in the digital image using convolutional neural networks. The method is based on spreading the message over the spatial domain of the image, hence reducing the "local bits per pixel" capacity. To obtain the model we used adversarial training and applied noiser layers between the encoder and the decoder. Moreover, we broadened the s…
Digital watermarking has been widely studied for the protection of intellectual property. Traditional watermarking schemes often design in a "wider" rule, which applies one general embedding mechanism to all images. But this will limit the scheme into a robustness-invisibility trade-off, where the improvements of robustness can only be achieved by the increase of embedding intensity thus causing the visual quality decay. However, a new scenario comes out at this stage that many businesses wish to give high level protection to specific valuable images, which requires high robustness and high vi…
As an efficient watermark attack method, geometric distortions destroy the synchronization between watermark encoder and decoder. And the local geometric distortion is a famous challenge in the watermark field. Although a lot of geometric distortions resilient watermarking schemes have been proposed, few of them perform well against local geometric distortion like random bending attack (RBA). To address this problem, this paper proposes a novel watermark synchronization process and the corresponding watermarking scheme. In our scheme, the watermark bits are represented by random patterns. The …
University of Science and Technology of China（中国科学技术大学）
Based on the powerful feature extraction ability of deep learning architecture, recently, deep-learning based watermarking algorithms have been widely studied. The basic framework of such algorithm is the auto-encoder like end-to-end architecture with an encoder, a noise layer and a decoder. The key to guarantee robustness is the adversarial training with the differential noise layer. However, we found that none of the existing framework can well ensure the robustness against JPEG compression, which is non-differential but is an essential and important image processing operation. To address su…
TriniMark: A Robust Generative Speech Watermarking Method for Trinity-Level Traceability
Huaqiao University（华侨大学）；East China Normal University（华东师范大学）；Shenzhen University（深圳大学）；French National Institute of Health and Medical Research（法国国家健康与医学研究院）
Tsinghua University（清华大学）；Shandong University（山东大学）；Wuhan University（武汉大学）；Zhongguancun Laboratory（中关村实验室）；Shandong Institute of Blockchain（山东省区块链研究院）；National Financial Cryptography Research Center（国家金融密码研究中心）
