Watermarking has become a plausible candidate for ownership verification and intellectual property protection of deep neural networks. Regarding image classification neural networks, current watermarking schemes uniformly resort to backdoor triggers. However, injecting a backdoor into a neural network requires knowledge of the training dataset, which is usually unavailable in the real-world commercialization. Meanwhile, established watermarking schemes oversight the potential damage of exposed evidence during ownership verification and the watermarking algorithms themselves. Those concerns decline current watermarking schemes from industrial applications. To confront these challenges, we propose a knowledge-free black-box watermarking scheme for image classification neural networks. The image generator obtained from a data-free distillation process is leveraged to stabilize the network's performance during the backdoor injection. A delicate encoding and verification protocol is designed to ensure the scheme's security against knowledgable adversaries. We also give a pioneering analysis of the capacity of the watermarking scheme. Experiment results proved the functionality-preserving capability and security of the proposed watermarking scheme.
School of Control and Computer Engineering（控制与计算机工程学院）；North China Electric Power University（华北电力大学）；Research Institute（研究院）；China Unicom（中国联合网络通信集团）；Technical Department（技术部）
The rapid advancement of deep neural networks (DNNs) heavily relies on large-scale, high-quality datasets. However, unauthorized commercial use of these datasets severely violates the intellectual property rights of dataset owners. Existing backdoor-based dataset ownership verification methods suffer from inherent limitations: poison-label watermarks are easily detectable due to label inconsistencies, while clean-label watermarks face high technical complexity and failure on high-resolution images. Moreover, both approaches employ static watermark patterns that are vulnerable to detection and …
Deep Neural Networks (DNN) are gaining higher commercial values in computer vision applications, e.g., image classification, video analytics, etc. This calls for urgent demands of the intellectual property (IP) protection of DNN models. In this paper, we present a novel watermarking scheme to achieve the ownership verification of DNN architectures. Existing works all embedded watermarks into the model parameters while treating the architecture as public property. These solutions were proven to be vulnerable by an adversary to detect or remove the watermarks. In contrast, we claim the model arc…
Cloud computing opportunities have presented service options for users that are both economical and flexible to use requirements. However, the risk analysis for the user identifies vulnerabilities for intellectual property ownership and vulnerabilities for the identification of rightful property owners when cloud services are used. It is common for image owners to embed watermarks and other security mechanisms into their property so that the rightful ownership may be identified. In this paper we present a design that overcomes many of the current limitations in cloud watermarking uses and prop…
Watermarking helps in ensuring originality, ownership and copyrights of a digital image. This paper aims at embedding a Watermark in an image using Wave Atom Transform. Preference of Wave Atoms on other transformations has been due to its sparser expansion, adaptability to the direction of local pattern, and sharp frequency localization. In this scheme, we had tried to spread the watermark in an image so that the information at one place is very small and undetectable. In order to extract the watermark and verify ownership of an image, one would have the advantage of prior knowledge of embedde…
Recently, a significant amount of interest has been developed in motivating physicians to use e-health technology (especially Electronic Medical Records (EMR) systems). An important utility of such EMR systems is: a next generation of Clinical Decision Support Systems (CDSS) will extract knowledge from these electronic medical records to enable physicians to do accurate and effective diagnosis. It is anticipated that in future such medical records will be shared through cloud among different physicians to improve the quality of health care. Therefore, right protection of medical records is imp…
Institute of Information Engineering, Chinese Academy of Sciences（中国科学院信息工程研究所）；University of Chinese Academy of Sciences（中国科学院大学）；Boston University（波士顿大学）；University of Oregon（俄勒冈大学）
Due to the wide use of highly-valuable and large-scale deep neural networks (DNNs), it becomes crucial to protect the intellectual property of DNNs so that the ownership of disputed or stolen DNNs can be verified. Most existing solutions embed backdoors in DNN model training such that DNN ownership can be verified by triggering distinguishable model behaviors with a set of secret inputs. However, such solutions are vulnerable to model fine-tuning and pruning. They also suffer from fraudulent ownership claim as attackers can discover adversarial samples and use them as secret inputs to trigger …
With the broad application of deep neural networks, the necessity of protecting them as intellectual properties has become evident. Numerous watermarking schemes have been proposed to identify the owner of a deep neural network and verify the ownership. However, most of them focused on the watermark embedding rather than the protocol for provable verification. To bridge the gap between those proposals and real-world demands, we study the deep learning model intellectual property protection in three scenarios: the ownership proof, the federated learning, and the intellectual property transfer. …
Although the protection of ownership and the prevention of unauthorized manipulation of digital images becomes an important concern, there is also a big issue of image source origin authentication. This paper proposes a procedure for the identification of the image source and content by using the Public Key Cryptography Signature (PKCS). The procedure is based on the PKCS watermarking of the images captured with numerous automatic observing cameras in the Trap View cloud system. Watermark is created based on 32-bit PKCS serial number and embedded into the captured image. Watermark detection on…
Explanation as a Watermark: Towards Harmless and Multi-bit Model Ownership Verification via Watermarking Feature Attribution
Zhejiang University（浙江大学）；Hangzhou High-Tech Zone (Binjiang) Institute of Blockchain and Data Security（杭州高新区（滨江）区块链与数据安全研究院）；Nanyang Technological University（南洋理工大学）
Cert-LAS: Toward Certified Model Ownership Verification for Text-to-Image Diffusion Models via Layer-Adaptive Smoothing
Generative AI Lab, College of Computing；Data Science, Nanyang Technological University, Singapore；Department of Computer Science；Engineering, Texas A\&M University, USA
Shandong University（山东大学）；CISPA Helmholtz Center for Information Security（CISPA亥姆霍兹信息安全中心）
Deep learning techniques have made tremendous progress in a variety of challenging tasks, such as image recognition and machine translation, during the past decade. Training deep neural networks is computationally expensive and requires both human and intellectual resources. Therefore, it is necessary to protect the intellectual property of the model and externally verify the ownership of the model. However, previous studies either fail to defend against the evasion attack or have not explicitly dealt with fraudulent claims of ownership by adversaries. Furthermore, they can not establish a cle…
One of the effective methods for the preservation of copyright ownership of digital media is watermarking. Different watermarking techniques try to set a tradeoff between robustness and transparency of the process. In this research work, we have used color space conversion and frequency transform to achieve high robustness and transparency. Due to the distribution of image information in the RGB domain, we use the YUV color space, which concentrates the visual information in the Y channel. Embedding of the watermark is performed in the DCT coefficients of the specific wavelet subbands. Experim…
Trigger set-based watermarking schemes have gained emerging attention as they provide a means to prove ownership for deep neural network model owners. In this paper, we argue that state-of-the-art trigger set-based watermarking algorithms do not achieve their designed goal of proving ownership. We posit that this impaired capability stems from two common experimental flaws that the existing research practice has committed when evaluating the robustness of watermarking algorithms: (1) incomplete adversarial evaluation and (2) overlooked adaptive attacks. We conduct a comprehensive adversarial e…
With the wide application of deep neural networks, it is important to verify a host's possession over a deep neural network model and protect the model. To meet this goal, various mechanisms have been designed. By embedding extra information into a network and revealing it afterward, the watermark becomes a competitive candidate in proving integrity for deep learning systems. However, concurrent watermarking schemes can hardly be adopted for emerging distributed learning paradigms that raise extra requirements during the ownership verification. A spearheading distributed learning paradigm is f…
With substantial amount of time, resources and human (team) efforts invested to explore and develop successful deep neural networks (DNN), there emerges an urgent need to protect these inventions from being illegally copied, redistributed, or abused without respecting the intellectual properties of legitimate owners. Following recent progresses along this line, we investigate a number of watermark-based DNN ownership verification methods in the face of ambiguity attacks, which aim to cast doubts on the ownership verification by forging counterfeit watermarks. It is shown that ambiguity attacks…
With the rise of data-driven methods for traffic forecasting, accident prediction, and profiling driving behavior, personal GPS trajectory data has become an essential asset for businesses and emerging data markets. However, as personal data, GPS trajectories require protection. Especially by data breaches, verification of GPS data ownership is a challenging problem. Watermarking facilitates data ownership verification by encoding provenance information into the data. GPS trajectory watermarking is particularly challenging due to the spatio-temporal data properties and easiness of data modific…
Delft University of Technology（代尔夫特理工大学）；Radboud University（拉德堡德大学）
Graph Neural Networks (GNNs) have achieved promising performance in various real-world applications. Building a powerful GNN model is not a trivial task, as it requires a large amount of training data, powerful computing resources, and human expertise in fine-tuning the model. Moreover, with the development of adversarial attacks, e.g., model stealing attacks, GNNs raise challenges to model authentication. To avoid copyright infringement on GNNs, verifying the ownership of the GNN models is necessary. This paper presents a watermarking framework for GNNs for both graph and node classification …
Aalto University（阿尔托大学）；University of Waterloo（滑铁卢大学）
In a data-driven world, datasets constitute a significant economic value. Dataset owners who spend time and money to collect and curate the data are incentivized to ensure that their datasets are not used in ways that they did not authorize. When such misuse occurs, dataset owners need technical mechanisms for demonstrating their ownership of the dataset in question. Dataset watermarking provides one approach for ownership demonstration which can, in turn, deter unauthorized use. In this paper, we investigate a recently proposed data provenance method, radioactive data, to assess if it can be …
The commercialization of deep learning creates a compelling need for intellectual property (IP) protection. Deep neural network (DNN) watermarking has been proposed as a promising tool to help model owners prove ownership and fight piracy. A popular approach of watermarking is to train a DNN to recognize images with certain \textit{trigger} patterns. In this paper, we propose a novel evolutionary algorithm-based method to generate and optimize trigger patterns. Our method brings a siginificant reduction in false positive rates, leading to compelling proof of ownership. At the same time, it mai…
With the explosive growth of internet technology, easy transfer of digital multimedia is feasible. However, this kind of convenience with which authorized users can access information, turns out to be a mixed blessing due to information piracy. The emerging field of Digital Rights Management (DRM) systems addresses issues related to the intellectual property rights of digital content. In this paper, an object-oriented (OO) DRM system, called "Imaging System with Watermarking and Attack Resilience" (ISWAR), is presented that generates and authenticates color images with embedded mechanisms for …
As there are increasing needs of sharing data for machine learning, there is growing attention for the owners of the data to claim the ownership. Visible watermarking has been an effective way to claim the ownership of visual data, yet the visibly watermarked images are not regarded as a primary source for learning visual recognition models due to the lost visual information by in the watermark and the possibility of an attack to remove the watermarks. To make the watermarked images better suited for machine learning with less risk of removal, we propose DeepStamp, a watermarking framework tha…
PointNCBW: Towards Dataset Ownership Verification for Point Clouds via Negative Clean-label Backdoor Watermark
State Key Laboratory of Blockchain and Data Security, Zhejiang University（浙江大学区块链与数据安全国家重点实验室）；Hangzhou High-Tech Zone (Binjiang) Institute of Blockchain and Data Security（杭州高新区（滨江）区块链与数据安全研究院）；College of Computing and Data Science, Nanyang Technological University（南洋理工大学计算与数据科学学院）；Tsinghua Shenzhen International Graduate School, Tsinghua University（清华大学深圳国际研究生院）
Black-box Dataset Ownership Verification via Backdoor Watermarking
Tsinghua Shenzhen International Graduate School, Tsinghua University（清华大学深圳国际研究生院）；School of Information Science and Technology, Southwest Jiaotong University（西南交通大学信息科学与技术学院）；Research Center of Artificial Intelligence, Peng Cheng Laboratory（鹏城实验室人工智能研究中心）；Ant Group（蚂蚁集团）
SSL-WM: A Black-Box Watermarking Approach for Encoders Pre-trained by Self-supervised Learning
Institute of Information Engineering, Chinese Academy of Sciences（中国科学院信息工程研究所）；School of Cyber Security, University of Chinese Academy of Sciences（中国科学院大学网络空间安全学院）；Department of Computer Science, Metropolitan College, Boston University（波士顿大学大都会学院计算机科学系）
Backdoor-based watermarking schemes were proposed to protect the intellectual property of artificial intelligence models, especially deep neural networks, under the black-box setting. Compared with ordinary backdoors, backdoor-based watermarks need to digitally incorporate the owner's identity, which fact adds extra requirements to the trigger generation and verification programs. Moreover, these concerns produce additional security risks after the watermarking scheme has been published for as a forensics tool or the owner's evidence has been eavesdropped on. This paper proposes the capsulatio…
Graph Neural Networks (GNNs) are valuable intellectual property, yet many watermarks rely on backdoor triggers that break under common model edits and create ownership ambiguity. We present InvGNN-WM, which ties ownership to a model's implicit perception of a graph invariant, enabling trigger-free, black-box verification with negligible task impact. A lightweight head predicts normalized algebraic connectivity on an owner-private carrier set; a sign-sensitive decoder outputs bits, and a calibrated threshold controls the false-positive rate. Across diverse node and graph classification datasets…
Universiti Malaya（马来亚大学）；WeBank AI Lab（微众银行人工智能实验室）
By and large, existing Intellectual Property (IP) protection on deep neural networks typically i) focus on image classification task only, and ii) follow a standard digital watermarking framework that was conventionally used to protect the ownership of multimedia and video content. This paper demonstrates that the current digital watermarking framework is insufficient to protect image captioning tasks that are often regarded as one of the frontiers AI problems. As a remedy, this paper studies and proposes two different embedding schemes in the hidden memory state of a recurrent neural network …
CBW: Towards Dataset Ownership Verification for Speaker Verification via Clustering-based Backdoor Watermarking
College of Computing and Data Science, Nanyang Technological University（南洋理工大学计算与数据科学学院）；School of Mathematics, Sun Yat-sen University（中山大学数学学院）；Zhejiang University（浙江大学）；Hangzhou High-Tech Zone (Binjiang) Institute of Blockchain and Data Security（杭州高新区（滨江）区块链与数据安全研究院）；Tsinghua University（清华大学）；Tsinghua Shenzhen International Graduate School, Tsinghua University（清华大学深圳国际研究生院）；Research Center of Artificial Intelligence, Peng Cheng Laboratory（鹏城实验室人工智能研究中心）
In this paper, a quantization based watermark casting and blind watermark retrieval algorithm operating in YCbCr color space using discrete wavelet transform (DWT), for ownership verification and image authentication applications is implemented. This method uses implicit visual masking by inserting watermark bits into only the wavelet coefficients of high magnitude, in Y channel of YCbCr color space. A blind watermark retrieval technique that can detect the embedded watermark without the help from the original uncorrupted image is devised which is computationally efficient. The new watermarkin…
CertDW: Towards Certified Dataset Ownership Verification via Conformal Calibration
School of Control and Computer Engineering, North China Electric Power University（控制与计算机工程学院，华北电力大学）；College of Computing and Data Science, Nanyang Technological University（计算与数据科学学院，南洋理工大学）；School of Cybersecurity, Northwestern Polytechnical University（网络安全学院，西北工业大学）；Department of Computer Science, University of Maryland（计算机科学系，马里兰大学）；Alibaba Group（阿里巴巴集团）
Neural Honeytrace: Plug&Play Watermarking Framework against Model Extraction Attacks
School of Cyberspace Security, Beijing University of Posts and Telecommunications（北京邮电大学网络安全学院）；Cyberspace Institute of Advanced Technology, Guangzhou University（广州大学网络空间技术研究院）；Huangpu Research School of Guangzhou University（广州大学黄埔研究学院）
