We present a novel watermarking scheme to verify the ownership of DNN models.
Existing solutions embedded watermarks into the model parameters, which were
proven to be removable and detectable by an adversary to invalidate the
protection. In contrast, we propose to implant watermarks into the model
architectures. We design new algorithms based on Neural Architecture Search
(NAS) to generate watermarked architectures, which are unique enough to
represent the ownership, while maintaining high model usability. We further
leverage cache side channels to extract and verify watermarks from the
black-box models at inference. Theoretical analysis and extensive evaluations
show our scheme has negligible impact on the model performance, and exhibits
strong robustness against various model transformations.
Go to Source of this post
Author Of this post: <a href="http://arxiv.org/find/cs/1/au:+Lou_X/0/1/0/all/0/1">Xiaoxuan Lou</a>, <a href="http://arxiv.org/find/cs/1/au:+Guo_S/0/1/0/all/0/1">Shangwei Guo</a>, <a href="http://arxiv.org/find/cs/1/au:+Zhang_T/0/1/0/all/0/1">Tianwei Zhang</a>, <a href="http://arxiv.org/find/cs/1/au:+Zhang_Y/0/1/0/all/0/1">Yinqian Zhang</a>, <a href="http://arxiv.org/find/cs/1/au:+Liu_Y/0/1/0/all/0/1">Yang Liu</a>