[Paper Review] WAFFLE: Watermarking in Federated Learning

Buse Gul Atli, Yuxi Xia+2 more|arXiv (Cornell University)|Aug 17, 2020

Privacy-Preserving Technologies in Data60 references4 citations

TL;DR

WAFFLE is the first watermarking scheme for federated learning that embeds a resilient watermark into deep neural network models without requiring access to training data. It uses a server-side retraining step after each aggregation to embed a backdoor-based watermark with minimal accuracy drop (-0.17%) and low computational overhead (+3.2%), enabling model ownership verification in decentralized training settings.

ABSTRACT

Federated learning is a distributed learning technique where machine learning models are trained on client devices in which the local training data resides. The training is coordinated via a central server which is, typically, controlled by the intended owner of the resulting model. By avoiding the need to transport the training data to the central server, federated learning improves privacy and efficiency. But it raises the risk of model theft by clients because the resulting model is available on every client device. Even if the application software used for local training may attempt to prevent direct access to the model, a malicious client may bypass any such restrictions by reverse engineering the application software. Watermarking is a well-known deterrence method against model theft by providing the means for model owners to demonstrate ownership of their models. Several recent deep neural network (DNN) watermarking techniques use backdooring: training the models with additional mislabeled data. Backdooring requires full access to the training data and control of the training process. This is feasible when a single party trains the model in a centralized manner, but not in a federated learning setting where the training process and training data are distributed among several client devices. In this paper, we present WAFFLE, the first approach to watermark DNN models trained using federated learning. It introduces a retraining step at the server after each aggregation of local models into the global model. We show that WAFFLE efficiently embeds a resilient watermark into models incurring only negligible degradation in test accuracy (-0.17%), and does not require access to training data. We also introduce a novel technique to generate the backdoor used as a watermark. It outperforms prior techniques, imposing no communication, and low computational (+3.2%) overhead.

Motivation & Objective

• Address the challenge of model ownership in federated learning, where clients can reverse-engineer and steal models.
• Develop a watermarking technique that works in a decentralized setting where the model owner lacks access to training data and cannot control the training process.
• Ensure the watermark is resilient to removal attempts and can be verified even under black-box access.
• Minimize performance degradation and computational overhead in the presence of potentially malicious clients.
• Enable ownership demonstration through a novel backdoor generation technique that does not require communication overhead or access to raw data.

Proposed method

• Introduces a server-side retraining step after each aggregation round to embed a watermark into the global model.
• Employs a novel backdoor-based watermarking technique that generates mislabeled inputs using a surrogate model trained on synthetic data.
• Uses a secret watermark pattern that is embedded into the model during retraining, ensuring resilience against removal.
• Applies a regularization loss to preserve model utility while embedding the watermark, minimizing accuracy degradation.
• Generates watermarks without requiring access to the original training data, relying instead on a surrogate model and data augmentation.
• Enables ownership verification via a black-box test using the embedded backdoor pattern, even when the model is extracted or shared.

Figure 1: Architecture and adversary model for watermarking in federated learning. Parties under the control of an adversary are highlighted in red.

Experimental results

Research questions

• RQ1 Can a watermark be effectively embedded into a DNN model trained via federated learning without access to the training data?
• RQ2 How can watermarking be made resilient to model extraction and removal attacks in a decentralized training environment?
• RQ3 What is the impact of watermarking on model accuracy and computational efficiency in federated learning?
• RQ4 Can a watermark be verified using only black-box access to the model, without requiring model weights or gradients?
• RQ5 How does the proposed method scale under non-IID data distributions and adversarial client behavior?

Key findings

• WAFFLE achieves a negligible test accuracy degradation of -0.17% when embedding watermarks in federated learning models.
• The method incurs only a 3.2% increase in computational overhead, making it efficient for real-world deployment.
• The watermark is resilient to model stealing and removal attacks, even when adversaries attempt to extract or modify the model.
• The approach works effectively under non-IID data distributions, maintaining watermark resilience and model utility with only a slight increase in communication and computation.
• The watermark can be verified via black-box testing, enabling ownership demonstration without requiring white-box access to the model.
• The proposed backdoor generation technique does not require communication overhead and is effective even when the training data is inaccessible.

(a)