[Paper Review] DAWN: Dynamic Adversarial Watermarking of Neural Networks

Sebastian Szyller, Buse Gul Atli+2 more|arXiv (Cornell University)|Jun 3, 2019

Adversarial Robustness in Machine LearningComputer Science49 references61 citations

TL;DR

DAWN embeds dynamic, client-specific watermarks at a model's prediction API to deter model extraction attacks, enabling ownership verification with negligible utility loss.

ABSTRACT

Training machine learning (ML) models is expensive in terms of computational power, amounts of labeled data and human expertise. Thus, ML models constitute intellectual property (IP) and business value for their owners. Embedding digital watermarks during model training allows a model owner to later identify their models in case of theft or misuse. However, model functionality can also be stolen via model extraction, where an adversary trains a surrogate model using results returned from a prediction API of the original model. Recent work has shown that model extraction is a realistic threat. Existing watermarking schemes are ineffective against IP theft via model extraction since it is the adversary who trains the surrogate model. In this paper, we introduce DAWN (Dynamic Adversarial Watermarking of Neural Networks), the first approach to use watermarking to deter model extraction IP theft. Unlike prior watermarking schemes, DAWN does not impose changes to the training process but it operates at the prediction API of the protected model, by dynamically changing the responses for a small subset of queries (e.g., <0.5%) from API clients. This set is a watermark that will be embedded in case a client uses its queries to train a surrogate model. We show that DAWN is resilient against two state-of-the-art model extraction attacks, effectively watermarking all extracted surrogate models, allowing model owners to reliably demonstrate ownership (with confidence $>1- 2^{-64}$), incurring negligible loss of prediction accuracy (0.03-0.5%).

Motivation & Objective

• Motivate IP protection for ML models and deter model extraction via prediction APIs.
• Introduce a dynamic, adversarial watermarking mechanism that operates during API queries.
• Ensure watermarking is client-specific, hard to remove, and linkable to the querying client.

Proposed method

• Watermark generation uses a cryptographic hash (HMAC-SHA256) to decide which inputs are watermarked and what incorrect label to return.
• The watermark is a backdoor; the trigger set T_A consists of a fraction r_w of API queries where F_V’s responses are replaced with B_V(x).
• Backdoor function B_V is a keyed permutation of the original prediction probabilities, ensuring watermark outputs resemble legitimate predictions.
• Indistinguishability is improved by mapping inputs to a representation M_V(x) to stabilize W_V and B_V against small input perturbations.
• Verification computes the fraction of trigger-set inputs where the surrogate model F_A’s outputs differ from the watermark labels, with a probabilistic threshold e to declare ownership.
• Demonstration of ownership uses a trusted judge and a public ledger to publish commitments and verify surrogacy.

Experimental results

Research questions

• RQ1 Can DAWN reliably watermark all surrogate models produced by model extraction without significantly degrading the original model’s utility?
• RQ2 Is the watermark robust against adversarial manipulation and state-of-the-art extraction attacks?
• RQ3 Can ownership be linked to specific API clients and verifiably demonstrated via a trusted process?

Key findings

• DAWN achieves ownership demonstration with confidence greater than 1 − 2^(-64).
• Watermarking incurs a negligible accuracy loss of 0.03% to 0.5% on the protected model.
• Watermarks are client-specific and linkable to the querying API client.
• DAWN is resilient to two state-of-the-art model extraction attacks.
• The method does not require changing the training process of the protected model and operates at the prediction API level.
• Experiments on multiple models and datasets show robustness to adversarial manipulation and evasion.