基于个性化归一化的鲁棒免重训练GAN指纹方法
Robust Retraining-free GAN Fingerprinting via Personalized Normalization
AI总结：
针对为每个用户生成带不同指纹的GAN模型需重训练、耗时耗资源的问题，提出基于个性化归一化的免重训练方法，仅通过前向传播即可嵌入不同指纹，且抗攻击鲁棒性优于现有最优方法。
摘要：
近年来，生成模型的商业应用显著增长，模型开发者将生成模型授权并分发给用户，用户再利用这些模型提供服务。在这种场景下，当出现许可协议违规或任何恶意使用行为时，需要追踪并识别责任用户。尽管已有方法能让生成对抗网络（Generative Adversarial Networks，GAN）在其生成的图像中嵌入不可见水印，但由于需要重训练模型以嵌入所需指纹，为每个用户生成带有不同水印（即指纹）的模型既耗时又耗费资源。本文提出了一种免重训练的GAN指纹方法，让模型开发者能够轻松生成功能相同但指纹不同的模型副本。我们通过插入额外的个性化归一化（Personalized Normalization，PN）层修改生成器，其参数（缩放项和偏置项）由两个专用的浅层网络（ParamGen Nets）以指纹为输入生成。同时训练一个水印解码器，用于从生成的图像中提取指纹。该方法仅需改变ParamGen Nets的输入并执行一次前向传播，即可在GAN中嵌入不同指纹，无需微调或重训练。在针对模型级和图像级攻击的鲁棒性方面，所提方法的性能也优于现有最优水平。
英文摘要：
In recent years, there has been significant growth in the commercial applications of generative models, licensed and distributed by model developers to users, who in turn use them to offer services. In this scenario, there is a need to track and identify the responsible user in the presence of a violation of the license agreement or any kind of malicious usage. Although there are methods enabling Generative Adversarial Networks (GANs) to include invisible watermarks in the images they produce, generating a model with a different watermark, referred to as a fingerprint, for each user is time- and resource-consuming due to the need to retrain the model to include the desired fingerprint. In this paper, we propose a retraining-free GAN fingerprinting method that allows model developers to easily generate model copies with the same functionality but different fingerprints. The generator is modified by inserting additional Personalized Normalization (PN) layers whose parameters (scaling and bias) are generated by two dedicated shallow networks (ParamGen Nets) taking the fingerprint as input. A watermark decoder is trained simultaneously to extract the fingerprint from the generated images. The proposed method can embed different fingerprints inside the GAN by just changing the input of the ParamGen Nets and performing a feedforward pass, without finetuning or retraining. The performance of the proposed method in terms of robustness against both model-level and image-level attacks is also superior to the state-of-the-art.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
