SEW: 通过增强特异性来加强黑盒DNN水印的鲁棒性
SEW: Strengthening Robustness of Black-box DNN Watermarking via Specificity Enhancement
AI总结：
SEW通过增强水印特异性来提高黑盒DNN水印的鲁棒性，有效防御多种移除攻击。
摘要：
为确保开源深度神经网络（DNN）的负责任分布和使用，DNN水印技术已成为追踪和验证未经授权模型复制或滥用的关键技术。在实践中，黑盒水印表现为针对特别设计的样本的具体预测行为。然而，由于DNN的泛化性质，提取水印信息的密钥并不唯一，这会为攻击者提供更多机会。先进的攻击技术可以逆向工程出原始水印密钥的近似替代品，从而进行后续的水印移除。在本文中，我们探讨了黑盒DNN水印的特异性，即水印对密钥的响应准确性。利用这一概念，我们引入了特异性增强水印（SEW）方法，通过减少水印与近似密钥之间的关联性来提高特异性。通过使用三个流行的水印技术基准进行广泛评估，我们验证了增强特异性在增强对抗移除攻击的鲁棒性方面显著贡献。SEW有效防御了六种最先进的移除攻击，同时保持了模型的可用性和水印验证性能。
英文摘要：
To ensure the responsible distribution and use of open-source deep neural networks (DNNs), DNN watermarking has become a crucial technique to trace and verify unauthorized model replication or misuse. In practice, black-box watermarks manifest as specific predictive behaviors for specially crafted samples. However, due to the generalization nature of DNNs, the keys to extracting the watermark message are not unique, which would provide attackers with more opportunities. Advanced attack techniques can reverse-engineer approximate replacements for the original watermark keys, enabling subsequent watermark removal. In this paper, we explore black-box DNN watermarking specificity, which refers to the accuracy of a watermark's response to a key. Using this concept, we introduce Specificity-Enhanced Watermarking (SEW), a new method that improves specificity by reducing the association between the watermark and approximate keys. Through extensive evaluation using three popular watermarking benchmarks, we validate that enhancing specificity significantly contributes to strengthening robustness against removal attacks. SEW effectively defends against six state-of-the-art removal attacks, while maintaining model usability and watermark verification performance.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
