[Paper Review] DeepSigns: A Generic Watermarking Framework for IP Protection of Deep Learning Models

Bita Darvish Rouhani, Huili Chen+1 more|arXiv (Cornell University)|Apr 2, 2018

Adversarial Robustness in Machine Learning84 citations

TL;DR

DeepSigns embeds robust digital watermarks into deep learning models by modifying the distribution of activations across layers and via a post-processing step on the output layer, enabling IP ownership proof in both white-box and black-box settings while preserving model accuracy and resisting common attacks.

ABSTRACT

Deep Learning (DL) models have caused a paradigm shift in our ability to comprehend raw data in various important fields, ranging from intelligence warfare and healthcare to autonomous transportation and automated manufacturing. A practical concern, in the rush to adopt DL models as a service, is protecting the models against Intellectual Property (IP) infringement. The DL models are commonly built by allocating significant computational resources that process vast amounts of proprietary training data. The resulting models are therefore considered to be the IP of the model builder and need to be protected to preserve the owner's competitive advantage. This paper proposes DeepSigns, a novel end-to-end IP protection framework that enables insertion of coherent digital watermarks in contemporary DL models. DeepSigns, for the first time, introduces a generic watermarking methodology that can be used for protecting DL owner's IP rights in both white-box and black-box settings, where the adversary may or may not have the knowledge of the model internals. The suggested methodology is based on embedding the owner's signature (watermark) in the probability density function (pdf) of the data abstraction obtained in different layers of a DL model. DeepSigns can demonstrably withstand various removal and transformation attacks, including model compression, model fine-tuning, and watermark overwriting. Proof-of-concept evaluations on MNIST, and CIFAR10 datasets, as well as a wide variety of neural network architectures including Wide Residual Networks, Convolution Neural Networks, and Multi-Layer Perceptrons corroborate DeepSigns' effectiveness and applicability.

Motivation & Objective

• Motivate IP protection for deep learning models amid rising deployment as services.
• Propose a generic watermarking framework that works in both white-box and black-box settings.
• Embed watermarks in the activation distribution of hidden layers and, post-training, in the output layer without compromising accuracy.
• Demonstrate robustness against model compression, fine-tuning, and watermark overwriting.
• Provide practical metrics and an API to facilitate adoption across architectures.

Proposed method

• Embed N-bit watermark strings into the means of Gaussian components in layer-wise activation distributions (Gaussian Mixture Model prior).
• Augment the training loss with a term (loss1) that encourages activation means to align with selected Gaussian centers; include a second term (loss2) to push activation features toward a binarized projection of watermark bits via SGD optimization.
• Use a random projection matrix A and sigmoid followed by hard thresholding to map selected Gaussian centers to watermark bits (b).
• Jointly optimize loss0 (classification), loss1 (GMM alignment), and loss2 (watermark bit alignment) during training to embed the watermark without sacrificing accuracy.
• Watermark the output layer as a post-processing step by exploiting tail regions of the class-conditional distribution, generating K input keys, and fine-tuning with those keys to enforce correct tagging of key samples.

Experimental results

Research questions

• RQ1 Can a generic watermarking framework protect DL model ownership in both white-box and black-box deployments?
• RQ2 Is it possible to embed robust watermarks without degrading base model accuracy across architectures (MLPs, CNNs, ResNets, WideResNet)?
• RQ3 How resilient is the watermark to common DL model transformations such as pruning, fine-tuning, and overwriting?
• RQ4 Can watermark extraction reliably verify ownership with low false positives and reasonable detection thresholds across settings?
• RQ5 What practical metrics and API support are needed to enable adoption of watermarking in real-world DL practice?

Key findings

• DeepSigns can embed watermarks by embedding binary information in the pdf of intermediate activations and the output layer without decreasing prediction accuracy in evaluated models.
• The framework demonstrates robustness against pruning, fine-tuning, and watermark overwriting in extensive experiments across MNIST, CIFAR-10, and multiple architectures (MLP, CNN, WideResNet).
• It provides a dual watermarking approach: functional watermarking in hidden layers (via Gaussian centers and projection) and output-layer watermarking via post-training data-key based triggering.
• The method yields a high detection capability with mechanisms to control false positives through carefully chosen keys and thresholds, applicable to both white-box and black-box scenarios.
• An API and set of evaluation metrics are proposed to facilitate adoption and comparison with future DL watermarking methods.