Reversible Quantization Index Modulation for Static Deep Neural Network Watermarking

Reversible deep neural network (DNN) watermarking involves the embedding of a watermark into the weights of a DNN model in a manner that allows for its extraction without any permanent modifications or loss of information. This reversible embedding process is analogous to static DNN watermarking, where the watermark is embedded directly into the network weights during the training phase [12, 10]. However, reversible watermarking techniques ensure that the original weights can be perfectly recovered after the watermark is extracted.

The mathematical model for reversible DNN watermarking can be described as follows. Let $\mathbf{W}$ denote the set of all weights in a trained DNN model. During watermark embedding, specific weights from $\mathbf{W}$ are selected based on a location sequence $\mathbf{c}$ guided by a clue or key $cl$, resulting in a cover sequence $\mathbf{s}$. The information sequence $\mathbf{m}$ is then embedded into $\mathbf{s}$ using a carefully designed embedding function $\textrm{Emb}(\cdot)$, resulting in the watermarked sequence $\mathbf{s}_{w}$.

To ensure correct extraction and recovery of the watermark, the following triplet of operations is applied:

where $\textrm{Emb}(\cdot)$ represents the embedding function that embeds the information sequence $\mathbf{m}$ into the cover sequence $\mathbf{s}$ to produce the watermarked sequence $\mathbf{s}_{w}$. $\textrm{Ext}(\cdot)$ and $\textrm{Rec}(\cdot)$ denote the extraction and recovery functions, respectively. $\mathbf{n}$ represents the additive noise present in the received watermarked sequence $\mathbf{y}=\mathbf{s}_{w}+\mathbf{n}$.

While reversible DNN watermarking shares similarities with reversible image watermarking, there are notable differences in terms of the cover format, robustness, and fidelity requirements. Table I summarizes the key differences between reversible image watermarking and reversible DNN watermarking. Reversible DNN watermarking operates on floating-point weights, which differ from the unsigned integers typically used in reversible image watermarking. The fidelity requirement in reversible DNN watermarking pertains to the effectiveness of the host network after watermark embedding, rather than the visual quality of the host signal as in image watermarking. Additionally, reversible DNN watermarking should have the capacity to embed a large amount of data or information into the network weights. Security is crucial to prevent unauthorized parties from accessing, reading, or modifying the watermark. Lastly, efficiency is important to ensure faster embedding and extraction processes for DNN watermarking algorithms.

By understanding the unique characteristics and requirements of reversible DNN watermarking, we can develop tailored algorithms and techniques that enable the embedding, extraction, and recovery of watermarks while preserving the integrity and effectiveness of the DNN models.

We observe that there exists a quantization error $e$ between the cover vector $s$ and its quantized watermarked vector $Q_{(m,k)}(s)$, given by:

If we only use $Q_{m}(s)$ as the watermarked vector, the information about $e$ is lost. However, QIM has a certain error tolerance capability. If we consider $e$ as ”beneficial noise” and add it back to $Q_{m}(s)$, we can maintain the information about the cover $s$, making the scheme reversible. The challenge lies in properly scaling the ”beneficial noise” to meet specific requirements. First, the scaled $e$ should be small enough to stay within the correct decoding region. Second, the scaled $e$ should not be too small to avoid exceeding the representation accuracy of numbers.

The method that incorporates these ideas is called R-QIM. Its embedding operation is defined as:

where $\alpha$ represents a scaling factor that satisfies $\alpha\in\left(\frac{|\mathcal{M}|-1}{|\mathcal{M}|},1\right)$, $Q_{(m,k)}(s)$ is an encrypted quantizer defined as:

In Eq. (10), $Q_{\Delta}(s)$ denotes the same $Q_{\Delta}(s)=\Delta\lfloor s/\Delta\rfloor$ used in conventional QIM, and $k$ represents a dithering component for secrecy. R-QIM can be considered a fast version of the lattice-based method proposed in [29].

The parameters $k$ and $\alpha$ are typically treated as secret keys in a watermarking scheme. By setting $k=0$ and $\alpha=0.5$, we can achieve a 1-bit embedding example of R-QIM as depicted in Fig. 2(b). In this case, the watermarked covers are distributed in the green and red zones around the circle and cross positions, rather than on the positions themselves.

For the receiver, the estimated watermark can be extracted from the received signal $y$ using the following equation:

If the noise term $n$ is small enough to satisfy the condition:

the correct extraction $\hat{d_{m}}=d_{m}$ is achieved, whether in a noiseless or noisy channel.

To estimate the original weight $s$ from the received signal $y$, we use the following equation:

The correct restoration $\hat{s}=s$ occurs if and only if $n=0$ such that $y=s_{\rm{R-QIM}}$. In the presence of noise, the estimation error is given by:

By setting $\alpha=0.5$ and $k=0$, the embedding distortion is depicted in Fig. 3(b), with a maximum error of $\alpha\Delta/2=\Delta/4$. If the quantization errors are uniformly distributed over $[-(\Delta/2),(\Delta/2)]$, the mean-squared embedding distortion is:

Since $\bigcup_{m=0}^{|\mathcal{M}|-1}\Lambda_{m}=\mathbb{R}$ (as shown in Fig. 2), each bit of the watermark can be embedded into a host sample with any characteristic and distribution. These features make R-QIM capable of accommodating a watermark of almost the same maximum length as the number of host samples.

In this section, we compare the R-QIM algorithm with the HS algorithm proposed in [24] and discuss their respective advantages in terms of usability, capacity, and imperceptibility.

First, let’s consider usability. The HS algorithm is not suitable for RDH-based static DNN watermarking due to two main reasons. Firstly, it mismatches the host of uniform distribution, which makes the watermarked sequence exhibit obvious statistical characteristics. This vulnerability makes the algorithm defenseless against passive attacks. Secondly, the low capacity of the HS algorithm becomes even worse when applied to uniformly distributed hosts. Therefore, HS is not feasible for static DNN watermarking, as the data preprocessing operation makes the host sequence uniform rather than normally distributed. We conducted experiments to verify this by preprocessing different randomly generated data of normal distribution, testing them multiple times for skewness, kurtosis, and Kolmogorov-Smirnov (K-S) tests, and plotting the Quantile-Quantile (Q-Q) plot for one of the test results. The results (Fig. 4) clearly show that the preprocessed data becomes flatter and deviates from a normal distribution according to the K-S test. Figures 4(d), (e), and (f) demonstrate that the preprocessed data follows a uniform distribution. Thus, HS [24] lacks practical usability, while R-QIM is feasible for data admitting any distribution.

Next, let’s analyze the theoretical advantages of R-QIM in terms of capacity and imperceptibility compared to HS. To evaluate the embedding capacity, we consider a host sequence of length $L$ and analyze the maximum available watermark length $C_{\rm{max}}$ for both R-QIM and HS. In the HS algorithm, the watermark is only embedded into the bin where $s=\Omega_{\mathrm{max}}$, and the other bins do not contain any information about the watermarks. Recall that Regions i, ii and iii are shown in Fig. 1(c). The maximum length of the available watermark in HS can be calculated as:

On the other hand, in R-QIM, the entire host sequence can be used to embed the watermark, resulting in $C_{\rm{max},R-QIM}=L$. It is evident that for host sequences of the same length, R-QIM has a higher embedding capacity.

In terms of embedding distortion or imperceptibility, we define the signal-to-watermark ratio (SWR) as a measure. The SWR is defined as:

where $\sigma^{2}_{\mathbf{s}}$ and $\sigma^{2}_{\mathbf{w}}$ represent the power of the host and the additive watermark, respectively. A smaller value of $\sigma^{2}_{\mathbf{w}}$ indicates a higher SWR, which implies better imperceptibility. To analyze the embedding distortion fairly, we assume the same capacity and host distribution for both HS in [24] and R-QIM, corresponding to embedding the watermark into the host $\Omega_{\mathrm{max}}$ which follows a Gaussian distribution.

Regarding the embedding distortion, we have the following result:

According to Theorem 1, when considering a fixed setting with $\Delta=1$ in HS [24], it can be observed that R-QIM achieves lower embedding distortion and better fidelity, based on the aforementioned assumption. Furthermore, it indicates that the fidelity of R-QIM can be controlled. When $\Delta>\sqrt{3}$, by adjusting the parameters, we can obtain flexible fidelity performance, whether it is better or worse than HS. In the subsequent scheme design, we will demonstrate the benefits of this feature.

To address security concerns, R-QIM requires additional measures. The watermarking, extracting, and restoring processes based on R-QIM are presented through pseudo-codes in Mark (Algorithm 1), Extract (Algorithm 2), and Restore (Algorithm 3). In these algorithms, certain parameters such as $cl$ and $k$ are set using a pseudo-random number generator (PRNG), while others like the step size $\Delta$ and scaling factor $\alpha$ are determined by the owner.

Mark (Algorithm 1) takes as input the trained model $\mathbf{W}$, the watermark m, and the aforementioned parameters. It outputs the watermarked model $\mathbf{W}_{wtm}$ along with side information, including the watermark information $\mathbf{w\_info}$ and the secret key $\mathbf{sk}$. By selecting a sequence $\mathbf{s}=[s_{0},s_{1},...,s_{L-1}]$ with the clue $cl$ and extracting relevant information ($L$ and $|\mathcal{M}|$) from m using the $\mathrm{Info}$ function, each bit of the watermark $m_{i}$ is embedded into $s_{i}$ using the R-QIM embedding equation (9) via the $\mathrm{Emb}(\cdot)$ function. The watermark information $\mathbf{w\_info}$ combines $L$ and $|\mathcal{M}|$, while $\mathbf{sk}$ includes $cl$, $k$, and $\Delta$. To maintain the security properties of the embedded watermark, the owner of the DNN model should keep $\mathbf{w\_info}$, $\mathbf{sk}$, and $\alpha$ confidential.

Extract (Algorithm 2) performs the watermark extraction from the watermarked model $\mathbf{W}_{wtm}$ generated by Mark. With the assistance of the watermark information $\mathbf{w\_info}$ and the secret key $\mathbf{sk}$ held by the owner, an estimated sequence $\hat{\mathbf{d}}$ is created using the R-QIM extraction equation (11) via the $\mathrm{Ext}(\cdot)$ function, following the same selection process as in Mark. Then, utilizing the watermark information in the codebook, Extract outputs an estimated watermark $\hat{\mathbf{m}}$ derived from $\hat{\mathbf{d}}$. Notably, since watermark extraction requires the assistance of the secret key $\mathbf{sk}$ rather than the scaling

factor $\alpha$, which relates to the security of DNN model recovery, Extract should be performed by the DNN model owner or a trusted third-party institution, ensuring the non-disclosure of the scaling factor $\alpha$.

Restore (Algorithm 3) takes the watermarked model $\mathbf{W}_{wtm}$ as input and restores it to its original form using the watermark information $\mathbf{w\_info}$, the secret key $\mathbf{sk}$, and the scaling factor $\alpha$ as side information. After the same selection process as Mark, each sample $y_{i}$ is recovered to $s_{i}$ one by one using the R-QIM recovery equation (13) via the $\mathrm{Rec}(\cdot)$ function. Since the correct restoration relies on the noise term $n$, we can detect tampering in the watermarked model under a noiseless channel or a known noisy channel, making the watermarking process reversible for protecting the integrity of the watermarked model. Furthermore, as the restored model no longer contains the watermark, the effectiveness of the restoration process can be evaluated by verifying the absence of the watermark in the DNN model.

To enable reversibility in DNN watermarks, Guan et al. [24] introduced the concept of integrity protection for DNN models. They proposed a scheme that verifies whether a DNN model has been tampered with by comparing the bit differences in weights between the restored and original models. Building on this idea, we present an integrity protection scheme that employs R-QIM [24], as depicted in Figure 5 (a).

In this scheme, Alice embeds her watermarks into a commercialized DNN model $\mathbf{W}$ using the Mark algorithm [24], resulting in a watermarked DNN model $\mathbf{W}_{wtm}$. During transmission, Mallory illegally intercepts $\mathbf{W}_{wtm}$, modifies its weights, and profits from sharing the tampered model. To identify tampering, we define two types of operations for noiseless and noisy channels.

• •

  Noiseless channel: In this scenario, where correct recovery is guaranteed, the tampered DNN model is restored using the Restore algorithm [24] to obtain an estimated model. Notably, the Restore function can meet the requirements of perfect recovery after watermark extraction since Equation (13) [24] contains $Q_{\frac{\Delta}{|\mathcal{M}|}+k}(y)$, which can be regarded as watermark extraction. The weights of the restored model are then compared to the original model using a difference function $\mathrm{Diff}(\cdot)$, which calculates a difference ratio $b$. Due to the sensitivity of the recovery process, even minor changes to $\mathbf{W}_{wtm}$ would lead to differences in the weights of the restored model. This characteristic allows for integrity assessment, where $b=1$ (or $b=0$) indicates that $\mathbf{W}_{wtm}$ has (not) been tampered with.

• •

  Noisy channel: In this scenario, tampering of DNN models can be identified when the noise term $n$ is sufficiently small. By leveraging Equation (14) [24], the difference between the restored and original models can be theoretically measured, allowing for a comparison that excludes the interference of the noise term $n$. Theoretical differences between the restored and original models are computed using Equation (14) [24], and a difference ratio $b$ is obtained. When $b=1$ (or $b=0$), it indicates that $\mathbf{W}_{wtm}$ has (not) been tampered with.

In summary, our proposed scheme is well-suited for integrity protection compared to the scheme presented by Guan et al. [24]. Our scheme offers higher fidelity for $\mathbf{W}_{wtm}$, as justified by Theorem 1 [24]. Additionally, our scheme is the first to protect the integrity of $\mathbf{W}_{wtm}$ over noisy channels.

In addition to integrity protection, reversible DNN watermarking can be utilized for infringement identification of suspicious DNN models. When the watermark is removed during the recovery operation, no watermark remains in the restored model. This enables the distinction between a legal user holding the restored model and an illegal user holding the watermarked model. Based on this concept, we propose a novel scheme for infringement identification of DNN models, where a user receives a secret key for recovery after legalization and obtains a restored model. The proposed scheme for legitimate authentication is illustrated in Figure 5 (b). For simplicity, we refer to the owner, legal user, illegal user, and trusted third-party institution as ”Alice,” ”Bob,” ”Mallory,” and ”Institution,” respectively.

In our proposed scheme, Alice sells her commercialized DNN model $\mathbf{W}$ through an online/offline platform and utilizes our scheme for marking the ownership of $\mathbf{W}$. After embedding a watermark into $\mathbf{W}$ using the Mark algorithm [24], the resulting watermarked model $\mathbf{W}_{wtm}$ is sent to the platform, serving as an exhibit or trial product to promote Alice’s model. As the embedding process occurs after model training, the fidelity of $\mathbf{W}_{wtm}$ is intentionally lower, ensuring that its disclosure does not harm Alice’s rights.

When Bob expresses interest in the product, Alice shares $\mathbf{w\_info}$, $\mathbf{sk}$, and $\alpha$ with him. Bob can then recover $\mathbf{W}_{wtm}$ to its original form using the Restore algorithm [24]. The recovered model is identical to the original model, maximizing its effectiveness, and the watermark is completely removed, making it undetectable in the recovered model. If Mallory illegally steals the DNN model and shares it on public platforms, Alice can report the incident to the Institution for arbitration. To authenticate the legitimacy of the suspicious model held by Mallory, Alice or the Institution can extract the estimated watermark $\hat{\textbf{m}}$ from the suspect model using the Extract algorithm [24]. Then, $\hat{\textbf{m}}$ can be compared to Alice’s watermark using $\mathrm{Diff}(\cdot)$, which outputs a difference ratio $b$ for detecting the presence of the embedded watermark. When $b\leq 0.1$, the watermark is considered detected, and Mallory is identified as an illegal user.

To avoid infringing on Alice’s rights, the DNN watermarking scheme for infringement identification should exhibit lower fidelity, ensuring that the effectiveness of the watermarked model is no better than the original one. Thanks to Theorem 1 [24], R-QIM offers greater distortion than HS [24] by setting $\Delta>\sqrt{3}$ and an appropriate $\alpha$, making it more suitable for the infringement identification scenario.

In Section 3.2, we theoretically identified potential weaknesses of the HS method. To support our claims, we conducted a numerical analysis of the weights of DNN models.

Figure 6 presents the Q-Q plot comparing the original and preprocessed weights of the MLP and VGG models against normal and uniform distributions. We observe that the original weights of both models exhibit a distribution closer to the normal distribution, while the preprocessed weights clearly follow the uniform distribution as integers.

Furthermore, we performed an analysis of skewness, kurtosis, K-S test, and Jarque-Bera (J-B) test results for the original and preprocessed weights of the MLP and VGG models. The summarized analysis is presented in Table II. The results indicate that:

i) Data preprocessing flattens the distribution of the weights, resulting in lower kurtosis values for the preprocessed weights.

ii) Neither the original nor the preprocessed weights of the MLP and VGG models pass the K-S and J-B tests.

These experiments demonstrate that realistic DNN weights do not follow a normal distribution. However, this does not undermine the validity of the data preprocessing method proposed in [24] for transforming data from a normal to a uniform distribution. Nevertheless, it highlights the limited usability of the [24] method.

In order to assess the adaptability and superiority of the two proposed schemes in terms of capacity and fidelity, we conducted several experiments to compare R-QIM with HS in two specific applications. The first application focuses on integrity protection, which requires a watermarking method with a high embedding capacity and minimal embedding damage. Therefore, we compared the maximum available capacity, classification accuracy, and training loss between our proposed scheme and the method proposed by [24] with a fixed step size $\Delta=1$.

The results for the maximum available capacity are presented in Table III, revealing a significant difference between R-QIM and HS. Regardless of whether it is group A or B, the table clearly indicates that R-QIM exhibits a higher embedding capability compared to the benchmark method, which aligns with our theoretical analysis.

Regarding fidelity, we compared the training loss and classification accuracy of the watermarked models embedded at different epochs using R-QIM and HS. The corresponding results are depicted in Fig. 7. It can be observed that R-QIM consistently outperforms the benchmark method in both metrics for both group A and B, with the difference being more pronounced in group B. Importantly, these observations support our assumption that lower embedding distortion leads to better fidelity of the watermarked model.

For infringement identification, according to Theorem 1, R-QIM can achieve a more noticeable decline in fidelity compared to HS by setting $\Delta>\sqrt{3}$. To verify this, we examined the classification accuracy and training loss of MLP and VGG models with different values of $\alpha$ and $\Delta$, as shown in Fig. 8. Based on these observations, we conclude the following: i) As $\alpha$ and $\Delta$ increase, the loss of the watermarked model increases while the accuracy decreases, which aligns with our expectation regarding the relationship between distortion and fidelity. ii) When $\Delta=1<\sqrt{3}$ in R-QIM, it outperforms HS in terms of both loss and accuracy for groups A and B. However, when $\Delta=3$ and $5>\sqrt{3}$, HS performs better than R-QIM. This finding supports Theorem 1 and demonstrates the flexible performance of R-QIM, which determines its applicability in infringement identification.

To assess the performance of R-QIM recovery, we conducted several simulations focusing on the accuracy of the recovered values and the presence of watermarks. In these experiments, the watermarks were converted to uniform data consisting of 4264 bits.

In the first experiment, we aimed to compare the performance difference in implementing reversible operations. We trained two combinations from scratch twice for 60 epochs and embedded the watermark at epoch 30 using the proposed scheme. In the first run (denoted by the green line), a reversible operation was applied immediately after the embedding process, while in the second run (denoted by the red line), no reversible operation was applied. Fig. 9 presents notable observations from this experiment: i) After watermark embedding, the model’s accuracy sharply degraded due to the parameter modification. However, with the implementation of the proposed reversible operation, the reduced accuracy immediately restored. This demonstrates the effectiveness of the reversible operation in offsetting the damages caused by watermark embedding. ii) Without the reversible operation, when the reduced accuracy reached a plateau, the accuracy of both groups dropped below that of the reversible operation applied case. This indicates incomplete compensation in subsequent training for the watermarked model without reversible operation, while the compensation is complete with the reversible operation. iii) We observed that group A was more severely affected than group B after watermark embedding, and it reached a slower plateau in subsequent training, suggesting a higher effectiveness of the reversible operation in group A.

To analyze the specific effects of the various processes in the proposed method, we compared the values of the original, watermarked, and recovered weights for the two combinations in Fig. 10. In this figure, the points representing the original and recovered cover (represented by a horizontal line and a vertical bar, respectively) coincide at each index of the sample, indicating correct recovery. Additionally, the distribution of watermarked weights (represented by crosses) in Fig. 10 illustrates the impact on the weights caused by watermark embedding.

Finally, as the infringement identification function relies on determining whether the restored DNN model contains a watermark, we compared the bit error rate (BER) metric of the watermark with and without the reversible operation, as depicted in Fig. 11. The BER value of the watermarked model was 0.0005, whereas it increased to 0.43 after applying the reversible operation. This confirms that the reversible operation can effectively remove the watermark embedded in the host model, thereby demonstrating the validity of the legitimacy authentication scheme.