[Paper Review] Spread-Transform Dither Modulation Watermarking of Deep Neural Network

Yue Li, Benedetta Tondi+1 more|arXiv (Cornell University)|Dec 28, 2020

Advanced Steganography and Watermarking Techniques20 references4 citations

TL;DR

This paper proposes a novel DNN watermarking method based on Spread-Transform Dither Modulation (ST-DM) that enhances payload and reduces accuracy degradation by embedding watermarks through a side-informed, quantized correlation mechanism in the loss function. Experiments show it achieves higher payload with lower test error than conventional Spread Spectrum watermarking, while maintaining robustness against pruning and fine-tuning.

ABSTRACT

DNN watermarking is receiving an increasing attention as a suitable mean to protect the Intellectual Property Rights associated to DNN models. Several methods proposed so far are inspired to the popular Spread Spectrum (SS) paradigm according to which the watermark bits are embedded into the projection of the weights of the DNN model onto a pseudorandom sequence. In this paper, we propose a new DNN watermarking algorithm that leverages on the watermarking with side information paradigm to decrease the obtrusiveness of the watermark and increase its payload. In particular, the new scheme exploits the main ideas of ST-DM (Spread Transform Dither Modulation) watermarking to improve the performance of a recently proposed algorithm based on conventional SS. The experiments we carried out by applying the proposed scheme to watermark different models, demonstrate its capability to provide a higher payload with a lower impact on network accuracy than a baseline method based on conventional SS, while retaining a satisfactory level of robustness.

Motivation & Objective

• Address the growing need to protect Deep Neural Network (DNN) Intellectual Property Rights (IPR) in commercial and distributed AI systems.
• Overcome the limitations of existing Spread Spectrum (SS) watermarking methods in DNNs, which often cause high accuracy degradation or low payload capacity.
• Leverage the informed watermarking paradigm—specifically ST-DM—to reduce watermark obtrusiveness and increase embedding efficiency.
• Improve robustness against common model attacks such as parameter pruning and fine-tuning while maintaining high watermark extraction reliability.
• Demonstrate that ST-DM-based watermarking in DNNs can achieve better trade-offs between payload, accuracy, and robustness than prior SS-based approaches.

Proposed method

• Introduce a new regularization term into the DNN training loss function that enforces the correlation between network weights and a pseudorandom spreading sequence to assume quantized values corresponding to watermark bits (0 or 1).
• Apply the ST-DM framework by projecting the watermark onto a pseudorandom spreading sequence before dither modulation, ensuring low distortion and high robustness.
• Use interleaved, equally spaced quantizers to represent watermark bit values (0 or 1), enabling binary watermark embedding via informed coding with side information.
• Enable multi-bit watermarking by using different spreading sequences for different bits, allowing scalable payload capacity.
• Train the DNN from scratch with the modified loss function, embedding the watermark directly during optimization rather than post-processing.
• Ensure robustness by leveraging the inherent resilience of DM and ST-DM to signal perturbations, including pruning and fine-tuning attacks.

Experimental results

Research questions

• RQ1 Can ST-DM-based watermarking achieve higher payload with lower accuracy degradation compared to conventional Spread Spectrum (SS) watermarking in DNNs?
• RQ2 How does the proposed ST-DM method perform under parameter pruning attacks, and does it maintain robustness comparable to baseline SS methods?
• RQ3 Does the integration of informed coding via ST-DM reduce watermark obtrusiveness while preserving high watermark extraction reliability?
• RQ4 What is the trade-off between watermark payload and test error rate under pruning and fine-tuning attacks in the proposed method?
• RQ5 Can the proposed method resist watermark overwriting attacks when the attacker has knowledge of the watermarking scheme?

Key findings

• The proposed ST-DM-based watermarking method achieves a higher payload with a lower test error rate compared to Uchida et al.’s SS-based method, demonstrating improved efficiency.
• For a 256-bit payload on the conv4 layer, W-DM-WRN maintains a BER of 0 even at 70% pruning, while W-WRN maintains BER=0 up to 70% pruning, showing comparable robustness.
• At 30% pruning, the test error rate (TER) for W-DM-WRN is 8.87% and for W-WRN is 8.99%, both significantly lower than the baseline model’s 8.73% at 10% pruning.
• The maximum pruning percentage before test error increases beyond baseline is 20% for conv4 with 256-bit payload, and 10% for other layers, with both W-DM-WRN and W-WRN showing similar robustness.
• The BER remains 0 for both models at pruning levels up to 60%, indicating strong resilience to parameter removal.
• The method achieves a 0 BER across all tested pruning levels up to 60%, confirming high reliability and robustness under structural model modifications.