Secure Watermark for Deep Neural Networks with Multi-task Learning

An adversary can tune $M$ by methods including: (1) FT: running backpropagation on a local dataset, (2) NP: cut out links in $M$ that are less important, and (3) FP: pruning unnecessary neurons in $M$ and fine-tuning $M$. The adversary’s local dataset is usually much smaller than the original training dataset for $M$ and fewer epochs are needed. FT and NP can compromise watermarking methods that encode information into $M$’s weight in a reversible way [16]. Meanwhile, [31] suggested that FP can efficiently eliminate backdoors from image classification models and watermarks within.

If the adversary can distinguish a watermarked model from a clean one, then the watermark is of less use since the adversary can use the clean models and escape copyright regulation. The adversary can adopt backdoor screening methods [56, 50, 49] or reverse engineering [20, 5] to detect and possibly eliminate backdoor-based watermarks. For weight-based watermarks, the host has to ensure that the weights of a watermarked model do not deviate from that of a clean model too much. Otherwise, the property inference attack [15] can distinguish two models.

As an extension to detection, we consider an adversary who is capable of identifying the host of a model without its permission as a threat to privacy. A watermarked DNN should expose no information about its host unless the host wants to. Otherwise, it is possible that models be evaluated not by their performance but by their authors.

Having obtained the model and the watermarking method, the adversary can embed its watermark into the model and declare the ownership afterward. Embedding an extra watermark only requires the redundancy of parameter representation in the model. Therefore new watermarks can always be embedded unless one proves that such redundancy has been depleted, which is generally impossible. A concrete requirement is: the insertion of a new watermark should not erase the previous watermarks.

For a model with multiple watermarks, it is necessary that an an incontrovertible time-stamp is included into ownership verification to break this redeclaration dilemma.

Even without tuning the parameters, model theft is still possible. Similar to [29], we define ownership piracy as attacks by which the adversary claims ownership over a DNN model without tuning its parameters or training extra learning modules. For zero-bit watermarking schemes (no secret key is involved, the security depends on the secrecy of the algorithm), the adversary can claim ownership by publishing a copy of the scheme. For a backdoor-based watermarking scheme that is not carefully designed, the adversary can detect the backdoor and claim that the backdoor as its watermark.

The secure watermarking schemes usually make use of cryptological protocols[60, 27]. In these schemes, the adversary is almost impossible to pretend to be the host using any probabilistic machine that terminates within time complexity polynomial to the security parameters (PPT).

The watermarked model should perform slightly worse than, if not as well as, the clean model. The definition for this property is:

which can be examined a posteriori. However, it is hard to explicitly incorporate this definition into the watermarking scheme. Instead, we resort to the following definition:

Although it is stronger than (3), (4) is a tractable definition. We only have to ensure that the parameters of $M_{\text{WM}}$ does not deviate from those of $M_{\text{clean}}$ too much.

After being tuned with the adversary’s dataset $\mathcal{D}_{\text{adversary}}$, the model’s parameters shift and the verification accuracy of the watermark might decline. Let $M^{\prime}\xleftarrow[\mathcal{D}_{\text{adversary}}]{\text{tuning}}M_{\text{WM}}$ denotes a model $M^{\prime}$ obtained by tuning $M_{\text{WM}}$ with $\mathcal{D}_{\text{adversary}}$. A watermarking scheme is secure against tuning iff:

To meet (5), the host has to simulate the effects of tuning and make $\texttt{verify}(\cdot,\texttt{key})$ insensitive to them in the neighbour of $M_{\text{WM}}$.

According to [52], one definition for the security against watermark detection is: no PPT can distinguish a watermarked model from a clean one with nonnegligible probability. Although this definition is impractical due to the lack of a universal backdoor detector, it is crucial that the watermark does not differentiate a watermarked model from a clean model too much. Moreover, the host should be able to control the level of this difference by tuning the watermarking method. Let $\theta$ be a parameter within WM that regulates such difference, it is desirable that

where $M^{\infty}_{\text{WM}}$ is the model returned from WM with $\theta\rightarrow\infty$.

To protect the host’s privacy, it is sufficient that any adversary cannot distinguish between two models watermarked with different keys. Fixing the primary task $\mathcal{T}_{\text{primary}}$ and the structure of the model $\mathcal{M}$, we first introduce an experiment $\texttt{Exp}^{\text{detect}}_{\mathcal{\mathcal{A}}}$ in which an adversary $\mathcal{A}$ tries to identify the host of a model:

The intuition behind this definition is: an adversary cannot identify the host from the model, even if the number of candidates has been reduced to two. Almost all backdoor-based watermarking schemes are insecure under this definition. In order to protect privacy, it is crucial that WM be a probabilistic algorithm and verify depend on key.

Assume that the adversary has watermarked $M_{\text{WM}}$ with another secret key $\texttt{key}_{\texttt{adv}}$ using a subprocess of WM and obtained $M_{\texttt{adv}}$: $M_{\texttt{adv}}\xleftarrow[\texttt{key}_{\texttt{adv}}]{\text{overwriting}}M_{\text{WM}}$. The overwriting watermark should not invalid the original one, formally, for any legal $\texttt{key}_{\text{adv}}$:

During which the randomness in choosing $\texttt{key}_{\texttt{adv}}$, generating $M_{\texttt{adv}}$, and computing verify is integrated out. A watermarking scheme meets (7) is defined to be secure against watermark overwriting. This property is usually examined empirically in the literature [3, 12, 27].

In an ownership piracy attack, the adversary pirate a model by recovering key and forging verify through querying $M_{\text{WM}}$ (or verify if available). We define three levels of security according to the efforts needed to pirate a model.

1. 1.

   Level I: The adversary only needs to wrap $M_{\text{WM}}$ or query it for a constant number of times. All zero-bit watermarking schemes belong to this level.

2. 2.

   Level II: The adversary has to query $M_{\text{WM}}$ for a number of times that is a polynomial function of the security parameter. The more the adversary queries, the more likely it is going to succeed in pretending to be the host. The key and verify, in this case, is generally simple. For example, [12, 3] are of this level of security.

3. 3.

   Level III: The adversary is almost impossible to pirate ownership of the model given queries of times that is a polynomial function of the security parameter. Such schemes usually borrow methods from cryptography to generate the pseudorandomness. Methods in [27, 60] are examples of this level.

Watermarking schemes of level I and II can be adopted as theft detectors. But the host can hardly adopt a level I/II scheme to convince a third-party about ownership. Using a watermarking scheme of level III, a host can prove to any third-party the model’s possessor. This is the only case that the watermark has forensics value.

The scheme in [26] is a zero-bit watermarking scheme. The method proposed by Zhang et al. in [59] adopts marked images or noise as the backdoor triggers. But only a few marks that are easily forgeable were examined. The protocol of Uchida et al. [48] can be enhanced into level III secure against ownership piracy only if an authority is responsible for distributing the secret key, e.g. [55]. But it lacks covertness and the privacy-preserving property.

The VAE adopted in [29] has to be used conjugately with a secret key that enhances the robustness of the backdoor. The adversary can collect a set of mistaken samples from one class, slightly disturb them, and claim to have watermarked the neural network. To claim the ownership of a model watermarked by Adi et al. [3], the adversary samples its collection of triggers from the mistaken samples, encrypts them with a key, and submits the encrypted pairs. The perfect security of their scheme depends on the model to perform nearly perfect in the primary task, which is unrealistic in practice. As for DeepSigns [12], one adversary can choose one class and compute the empirical mean of the output of the activation functions (since the outliers are easy to detect) then generate a random matrix as the mask and claim ownership.

The scheme in [60] is of level III secure against ownership piracy as proved in the original paper. So is the method in [27] since it is generally hard to guess the actual pattern of the Wonder Filter mask from a space with size $2^{P}$, where $P$ is the number of pixels of the mask. The scheme by Guan et al. in [16] is secure but extremely fragile, hence is out of the scope of practical watermarking schemes.

A comprehensive summary of established watermarking schemes judged according to the enumerated security requirements is given in Table 1.

The structure of our watermarking scheme is illustrated in Fig.1. The entire network consists of the backbone network and two independent backends: $c_{\text{p}}$ and $c_{\text{WM}}$. The published model $M_{\text{WM}}$ is the backbone followed by $c_{\text{p}}$. While $f_{\text{WM}}$ is the watermarking branch for the watermarking task, in which $c_{\text{WM}}$ takes the output of different layers from the backbone as its input. By having $c_{\text{WM}}$ monitor the outputs of different layers of the backbone network, it is harder for an adversary to design modifications to invalid $c_{\text{WM}}$ completely.

To produce a watermarked model, a host should:

1. 1.

   Generate a collection of $N$ samples $\mathcal{D}^{\texttt{key}}_{\text{WM}}=\left\{x_{i},y_{i}\right\}_{i=1}^{N}$ using a pseudo-random algorithm with key as the random seed.

2. 2.

   Optimize the entire DNN to jointly minimize the loss on $\mathcal{D}^{\texttt{key}}_{\text{WM}}$ and $\mathcal{D}_{\text{primary}}$. During the optimization, a series of regularizers are designed to meet the security requirements enumerated in Section 2.

3. 3.

   Publishes $M_{\text{WM}}$.

To prove its ownership over a model $M$ to a third-party:

1. 1.

   The host submits $M$, $c_{\text{WM}}$ and key.

2. 2.

   The third-party generates $\mathcal{D}_{\text{WM}}^{\texttt{key}}$ with key and combines $c_{\text{WM}}$ with $M$’s backbone to build a DNN for $\mathcal{T}_{\text{WM}}$.

3. 3.

   If the statistical test indicates that $c_{\text{WM}}$ with $M$’s backbone performs well on $\mathcal{D}_{\text{WM}}^{\texttt{key}}$ then the third-party confirms the host’s ownership over $M$.

To enhance the reliability of the ownership protection, it is necessary to use a protocol to authorize the watermark of the model’s host. Otherwise any adversary who has downloaded $M_{\text{WM}}$ can embed its watermark into it and pirate the model.

One option is to use an trusted key distribution center or a timing agency, which is in charge of authorizing the time stamp of the hosts’ watermarks. However, such centralized protocols are vulnerable and expensive. For this reason we resort to decentralized consensus protocols such as Raft [37] or PBFT [8], which were designed to synchronize message within a distributed community. Under these protocols, one message from a user is responded and recorded by a majority of clients within the community so this message becomes authorized and unforgeable.

Concretely, a client $s$ under this DNN watermarking protocol is given a pair of public key and private key. $s$ can publish a watermarked model or claim its ownership over some model by broadcasting:

Publishing a model: After finishing training a model watermarked withkey, $s$ obtains $M_{\text{WM}}$ and $c_{\text{WM}}$. Then $s$ signs and broadcasts the following message to the entire community:

where $\|$ denotes string concatenation, time is the time stamp, and hash is a preimage resistant hash function mapping a model into a string and is accessible for all clients. Other clients within the community verify this message using $s$’s public key, verify that time lies within a recent time window and write this message into their memory. Once $s$ is confirmed that the majority of clients has recorded its broadcast (e.g. when $s$ receives a confirmation from the current leader under the Raft protocol), it publishes $M_{\text{WM}}$.

Proving its ownership over a model $M$: $s$ signs and broadcasts the following message:

where $l_{M}$ and $l_{c_{\text{WM}}}$ are pointers to $M$ and $c_{\text{WM}}$. Upon receiving this request, any client can independently conduct the ownership proof. It firstly downloads the model from $l_{M}$ and examines its hash. Then it downloads $c_{\text{WM}}$ and retrieves the Publish message from $s$ by $\texttt{hash}(c_{\text{WM}})$. The last steps follow Section. 3.2.1. After finishing the verification, this client can broadcast its result as the proof for $s$’s ownership over the model in $l_{M}$.

To verify the ownership of a model $M$ to a host with key given $c_{\text{WM}}$, the process verify operates as Algo. 2.

If $M=M_{\text{WM}}$ then $M$ has been trained to minimize the binary classification loss on $\mathcal{T}_{\text{WM}}$, hence the test is likely to succeed in Algo. 2, this justifies the requirement from (1). For an arbitrary $\texttt{key}^{\prime}\neq\texttt{key}$, the induced watermark training data $\mathcal{D}^{\texttt{key}^{\prime}}_{\text{WM}}$ can hardly be similar to $\mathcal{D}^{\texttt{key}}_{\text{WM}}$. To formulate this intuition, consider the event where $\mathcal{D}^{\texttt{key}^{\prime}}_{\text{WM}}$ shares $q\cdot N$ terms with $\mathcal{D}^{\texttt{key}}_{\text{WM}}$, $q\in(0,1)$. With a pseudorandom generator, it is computationally impossible to distinguish $\pi^{\texttt{key}}$ from an sequence of $N$ randomly selected intergers. The same argument holds for $\texttt{l}^{\texttt{key}}$ and a random binary string of length $N$. Therefore the probability of this event can be upper bounded by:

where $r=\frac{N}{2^{m+1}}$. For an arbitrary $q$, let $r<\frac{1}{2+(1-q)N}$ then the probability that $\mathcal{D}^{\texttt{key}^{\prime}}_{\text{WM}}$ overlaps with $\mathcal{D}^{\texttt{key}}_{\text{WM}}$ with a portion of $q$ declines exponentially.

For numbers not appeared in $\pi^{\texttt{key}}$, the watermarking branch is expected to output a random guess. Therefore if $q$ is smaller than a threshold $\tau$ then $\mathcal{D}^{\texttt{key}^{\prime}}_{\text{WM}}$ can hardly pass the statistical test in Algo.2 with $n$ big enough. So let

and $n$ be large enough would make an effective collision in the watermark dataset almost impossible. For simplicity, setting $m=3\cdot\lceil\log_{2}(N)\rceil\geq\log_{2}(N^{3})$ is sufficient.

In cases $M_{\text{WM}}$ is replaced by an arbitrary model whose backbone structure happens to be consistent with $c_{\text{WM}}$, the output of the watermarking branch remains a random guess. This justifies the second requirement for correct verification (2).

To select the threshold $\gamma$, assume that the random guess strategy achieves an average accuracy of at most $p=0.5+\alpha$, where $\alpha\geq 0$ is a bias term which is assumed to decline with the growth of $n$. The verification process returns 1 iff the watermark classifier achieves binary classification of accuracy no less than $\gamma$. The demand for security is that by randomly guessing, the probability that an adversary passes the test declines exponentially with $n$. Let $X$ denotes the number of correct guessing with average accuracy $p$, an adversary suceeds only if $X\geq\gamma\cdot N$. By the Chernoff theorem:

where $\lambda$ is an arbitrary nonnegative number. If $\gamma$ is larger than $p$ by a constant independent of $N$ then $\left(\frac{1-p+p\cdot\text{e}^{\lambda}}{\text{e}^{\gamma\cdot\lambda}}\right)$ is less than 1 with proper $\lambda$, reducing the probability of successful attack into negligibility.

Denote the trainable parameters of the DNN model by w. The optimization target for $\mathcal{T}_{\text{primary}}$ takes the form:

where $l$ is the loss defined by $\mathcal{T}_{\text{primary}}$ and $u(\cdot)$ is a regularizer reflecting the prior knowledge on w. The normal training process computes the empirical loss in (8) by stochastically sampling batches and adopting gradient-based optimizers.

The proposed watermarking task adds an extra data dependent term to the loss function:

where $l_{\text{WM}}$ is the cross entropy loss for binary classification. We omitted the dependency of $\mathcal{D}_{\text{WM}}$ on key in this section for conciseness.

To train multiple tasks, we can minimize the loss function for multiple tasks (9) directly or train the watermarking task and the primary task alternatively [7]. Since $\mathcal{D}_{\text{WM}}$ is much smaller than $\mathcal{D}_{\text{primary}}$, it is possible that $\mathcal{T}_{\text{WM}}$ does not properly converge when being learned simultaneously with $\mathcal{T}_{\text{primary}}$. Hence we first optimize w according to the loss on the primary task (8) to obtain $\textbf{w}_{0}$:

Next, instead of directly optimizing the network w.r.t. (9), the following loss function is minimized:

where

By introducing the regularizer $R_{\text{func}}$ in (11), w is confined in the neighbour of $\textbf{w}_{0}$. Given this constraint and the continuity of $M_{\text{WM}}$ as a function of w, we can expect the functionality-preserving property defined in (4). Then the weaker version of functionality-preserving (3) is tractable as well.

To be secure against adversary’s tuning, it is sufficient to make $c_{\text{WM}}$ robust against tuning by the definition in (5). Although $\mathcal{D}_{\text{adversary}}$ is unknown to the host, we assume that $\mathcal{D}_{\text{adversary}}$ shares a similar distribution as $\mathcal{D}_{\text{primary}}$. Otherwise the stolen model would not have the state-of-the-art performance on the adversary’s task. To simulate the influence of tuning, a subset of $\mathcal{D}_{\text{primary}}$ is firstly sampled as an estimation of $\mathcal{D}_{\text{adversary}}$: $\mathcal{D}^{\prime}_{\text{primary}}\xleftarrow{\text{sample}}\mathcal{D}_{\text{primary}}$. Let w be the current configuration of the model’s parameter. Tuning is usually tantanmount to minimizing the empirical loss on $\mathcal{D}^{\prime}_{\text{primary}}$ by starting from w, which results in an updated parameter: $\textbf{w}^{\text{t}}\xleftarrow[\mathcal{D}^{\prime}_{\text{primary}}]{\text{tune}}\textbf{w}$. In practice, $\textbf{w}^{\text{t}}$ is obtained by replacing $\mathcal{D}_{\text{primary}}$ in (8) by $\mathcal{D}^{\prime}_{\text{primary}}$ and conducting a few rounds of gradient descents from w.

To achieve the security against tuning defined in (5), it is sufficient that the parameter w satisfies:

The condition (12), Algo.1 together with the assumption that $\mathcal{D}_{\text{adversary}}$ is similar to $\mathcal{D}_{\text{primary}}$ imply (5).

To exert the constraint in (12) to the training process, we design a new regularizer as follows:

Then the loss to be optimized is updated from (10) to:

$R_{\text{DA}}$ defined by (13) can be understood as one kind of data augmentation for $\mathcal{T}_{\text{WM}}$. Data augmentation aims to improve the model’s robustness against some specific perturbation in the input. This is done by proactively adding such perturbation to the training data. According to [45], data augmentation can be formulated as an additional regularizer:

Unlike in the ordinary data domain of $\mathcal{T}_{\text{primary}}$, it is hard to explicitly define augmentation for $\mathcal{T}_{\text{WM}}$ against tuning. However, a regularizer with the form of (15) can be derived from (13) by interchanging the order of summation so the perturbation takes the form:

Consider the extreme case where $\lambda_{1}\rightarrow\infty$. Under this configuration, the parameters of $M_{\text{WM}}$ are frozen and only the parameters in $c_{\text{WM}}$ are tuned. Therefore $M_{\text{WM}}$ is exactly the same as $M_{\text{clean}}$ and it seems that we have not insert any information into the model. However, by broadcasting the designed message, the host can still prove that it has obtained the white-box access to the model at an early time, which fact is enough for ownership verification. This justifies the security against watermark detection by the definition of (6), where $\lambda_{1}$ casts the role of $\theta$.

Recall the definition of privacy-preserving in Section 2.3.4. We prove that, under certain configurations, the proposed watermarking method is privacy-preserving.

This theorem indicates that, the MTL-based watermarking scheme can protect the host’s privacy. Moreover, given $N$, it is crucial to increase the input dimensionality of $c_{\text{WM}}$ or using a sophiscated structure for $c_{\text{WM}}$ to increase its VC-dimensionality.

It is possible to meet the definition of the security against watermark overwriting in (7) by adding the perturbation of embedding other secret keys into $R_{\text{DA}}$. But this requires building other classifier structures and is expensive even for the host. For an adversary with insufficient training data, it is common to freeze the weights in the backbone layers as in transfer learning [38], hence (7) is satisfied. For general cases, an adversary would not disturb the backbone of the DNN too much for the sake of its functionality on the primary task. Hence we expect the watermarking branch to remain valid after overwriting.

We leave the examination of the security against watermark overwriting as an empirical study.

Recall that in ownership piracy, the adversary is not allowed to train its own watermark classifier. Instead, it can only forge a key given a model $M_{\text{WM}}$ and a legal $c_{\text{WM}}$, this is possible if the adversary has participated in the proof for some other client. Now the adversary is to find a new key $\texttt{key}_{\text{adv}}$ such that $\mathcal{D}^{\texttt{key}_{\text{adv}}}_{\text{WM}}$ can pass the statistical test defined by the watermarking branch $M_{\text{WM}}$ and $c_{\text{WM}}$. Although it is easy to find a set of $N$ intergers with half of them classified as $0$ and half $1$ by querying the watermarking branch as an oracle, it is hard to restore a legal $\texttt{key}_{\text{adv}}$ from this set. The protocol should adopt a stream cipher secure against key recovery attack [42], which, by definition, blocks this sort of ownership piracy and makes the proposed watermarking scheme of level III secure against ownership piracy. If $c_{\text{WM}}$ is kept secret then the ownership piracy is impossible. Afterall, ownership piracy is invalid when an authorized time stamp is avilable.