Unambiguous and High-Fidelity Backdoor Watermarking for Deep Neural Networks.

Area of Science:

• Computer Science
• Artificial Intelligence
• Machine Learning

Background:

• Deep learning's success relies on big data, computing power, and knowledge, necessitating copyright protection for deep neural networks (DNNs).
• DNN watermarking, particularly backdoor watermarking, is a key solution for copyright protection.
• Existing methods overlook data diversity, leading to vulnerabilities in backdoor watermarks against ambiguity attacks.

Purpose of the Study:

• To unify definitions for DNN watermarking scenarios (embedding, attack, verification) across black- and white-box settings.
• To reveal the vulnerability of backdoor watermarks against black-box ambiguity attacks, especially with adversarial and open-set examples.
• To propose an improved backdoor watermarking scheme that enhances security and fidelity.

Main Methods:

• Developed a unified framework for DNN watermarking scenarios.
• Introduced an unambiguous backdoor watermarking scheme with deterministically dependent trigger samples and labels.
• Proposed a rigorous fidelity evaluation method examining feature distributions and decision boundaries.
• Incorporated Prototype Guided Regularizer (PGR) and Fine-Tune All Layers (FTAL) strategy.

Main Results:

• Demonstrated increased complexity (linear to exponential) for ambiguity attacks against the proposed scheme.
• Showcased substantial improvements in backdoor fidelity by evaluating feature distributions and decision boundaries.
• Validated the effectiveness of the proposed method on ResNet18, WRN28_10, and EfficientNet-B0 across multiple datasets (MNIST, CIFAR-10, CIFAR-100, FOOD-101).

Conclusions:

• The proposed unambiguous backdoor watermarking scheme significantly enhances DNN copyright protection.
• The method effectively mitigates ambiguity attacks and improves watermark fidelity.
• The approach offers a more robust and secure solution for protecting deep neural networks.