[Paper Review] HufuNet: Embedding the Left Piece as Watermark and Keeping the Right Piece for Ownership Verification in Deep Neural Networks

Peizhuo Lv, Li Pan+5 more|arXiv (Cornell University)|Mar 25, 2021

Adversarial Robustness in Machine Learning43 references4 citations

TL;DR

HufuNet proposes a novel DNN watermarking scheme that embeds a lightweight watermark (EPH) into the left half of a model while keeping the corresponding secret (SPH) on the owner's side for ownership verification. It achieves high robustness against fine-tuning, pruning, kernel manipulation, and fraudulent claims using adversarial samples, with negligible performance degradation on benchmark models.

ABSTRACT

Due to the wide use of highly-valuable and large-scale deep neural networks (DNNs), it becomes crucial to protect the intellectual property of DNNs so that the ownership of disputed or stolen DNNs can be verified. Most existing solutions embed backdoors in DNN model training such that DNN ownership can be verified by triggering distinguishable model behaviors with a set of secret inputs. However, such solutions are vulnerable to model fine-tuning and pruning. They also suffer from fraudulent ownership claim as attackers can discover adversarial samples and use them as secret inputs to trigger distinguishable behaviors from stolen models. To address these problems, we propose a novel DNN watermarking solution, named HufuNet, for protecting the ownership of DNN models. We evaluate HufuNet rigorously on four benchmark datasets with five popular DNN models, including convolutional neural network (CNN) and recurrent neural network (RNN). The experiments demonstrate HufuNet is highly robust against model fine-tuning/pruning, kernels cutoff/supplement, functionality-equivalent attack, and fraudulent ownership claims, thus highly promising to protect large-scale DNN models in the real-world.

Motivation & Objective

• To address the vulnerability of existing DNN watermarking schemes to model fine-tuning, pruning, and adversarial sample-based fraudulent ownership claims.
• To design a watermarking mechanism that maintains high model performance while ensuring strong robustness against common model manipulation attacks.
• To prevent attackers from forging valid watermarks by exploiting adversarial examples as triggers.
• To enable reliable, blind ownership verification without exposing the watermark to statistical analysis or reverse engineering.
• To provide a practical, secure, and stealthy solution for protecting large-scale DNN intellectual property in real-world deployment.

Proposed method

• HufuNet divides the watermark into two parts: the Embedded Piece of Hufu (EPH), embedded into the DNN model’s parameters, and the Secret Piece of Hufu (SPH), kept securely by the model owner.
• The EPH is distributed across nearly all layers of the DNN, occupying a small portion of the parameter space to ensure stealthiness and resistance to statistical analysis.
• Ownership verification is performed by comparing the model’s output on a specific input (derived from SPH) with the expected output, using SPH as the secret key.
• The scheme is designed to be robust against kernel cutoff/supplement, functionality-equivalent attacks, and model fine-tuning, even with large learning rates and unlabeled data.
• It avoids reliance on backdoor triggers or labeled adversarial examples, reducing the risk of adversarial sample exploitation for fraudulent claims.
• The method is evaluated across five popular DNN architectures (CNNs and RNNs) on four benchmark datasets to validate robustness and fidelity.

Experimental results

Research questions

• RQ1 Can a watermarking scheme remain effective after model fine-tuning and pruning without significant performance degradation?
• RQ2 Can the scheme resist attacks that exploit adversarial examples to forge ownership claims?
• RQ3 Is it possible to embed a watermark in a way that avoids detection via statistical analysis of layer parameter variance?
• RQ4 How effective is the scheme against functionality-equivalent attacks that preserve model accuracy while altering structure?
• RQ5 Can the scheme be applied robustly across diverse DNN architectures and datasets without compromising model fidelity?

Key findings

• HufuNet demonstrated high robustness against model fine-tuning and pruning, with no significant performance degradation on all five DNN models tested across four benchmark datasets.
• The scheme successfully resisted attacks that used adversarial samples as fake triggers, preventing fraudulent ownership claims.
• The EPH was distributed across nearly all layers, minimizing detectable statistical variance differences, thus enhancing stealthiness against statistical analysis.
• HufuNet maintained near-identical accuracy to the original models, with negligible performance loss, even after kernel cutoff/supplement and distillation-based attacks.
• The method showed resilience to functionality-equivalent attacks, preserving model behavior while altering internal structure.
• Verification using the SPH secret key correctly identified watermarked models and rejected innocent or modified models without false positives.