论文标题
图像分类神经网络的无知识黑盒水印和所有权证明
Knowledge-Free Black-Box Watermark and Ownership Proof for Image Classification Neural Networks
论文作者
论文摘要
水印已成为对深神经网络所有权验证和知识产权保护的合理候选人。关于图像分类神经网络，当前的水印方案均匀地诉诸后门触发器。但是，将后门注入神经网络需要了解培训数据集，这在现实世界中通常无法使用。同时，建立了水印方案监督所有权验证和水印算法本身的潜在损害。这些担心会从工业应用中拒绝当前的水印方案。为了应对这些挑战，我们为图像分类神经网络提出了一种无知识的黑盒水印方案。利用从无数据蒸馏过程获得的图像发生器可以在后门注入过程中稳定网络的性能。精致的编码和验证协议旨在确保该计划的安全性针对知识渊博的对手。我们还对水印方案的能力进行开创性分析。实验结果证明了拟议的水印方案的功能性能和安全性。
Watermarking has become a plausible candidate for ownership verification and intellectual property protection of deep neural networks. Regarding image classification neural networks, current watermarking schemes uniformly resort to backdoor triggers. However, injecting a backdoor into a neural network requires knowledge of the training dataset, which is usually unavailable in the real-world commercialization. Meanwhile, established watermarking schemes oversight the potential damage of exposed evidence during ownership verification and the watermarking algorithms themselves. Those concerns decline current watermarking schemes from industrial applications. To confront these challenges, we propose a knowledge-free black-box watermarking scheme for image classification neural networks. The image generator obtained from a data-free distillation process is leveraged to stabilize the network's performance during the backdoor injection. A delicate encoding and verification protocol is designed to ensure the scheme's security against knowledgable adversaries. We also give a pioneering analysis of the capacity of the watermarking scheme. Experiment results proved the functionality-preserving capability and security of the proposed watermarking scheme.
