Persistence of Backdoor-Based Watermarks for Neural Networks: A Comprehensive Evaluation.

Area of Science:

• Artificial Intelligence
• Machine Learning
• Computer Vision

Background:

• Deep neural networks (DNNs) offer advanced capabilities but their resource-intensive training raises intellectual property (IP) concerns.
• DNNs are often publicly accessible online, necessitating robust protection mechanisms like watermarking.
• Backdoor-based watermarking is a key technique for safeguarding DNNs, but its robustness against fine-tuning remains uncertain.

Purpose of the Study:

• To evaluate the persistence of backdoor-based watermarks in DNNs subjected to fine-tuning.
• To propose and develop a novel data-driven approach for restoring DNN watermarks after fine-tuning without revealing the trigger set.
• To investigate the effectiveness of reintroducing training data for watermark restoration.

Main Methods:

• Extensive evaluation of recent backdoor-based watermark persistence under fine-tuning scenarios.
• Development of a novel data-driven technique to restore watermarks post-fine-tuning.
• Utilizing loss landscape visualization to understand the watermark restoration mechanism.

Main Results:

• Watermarks can be restored after fine-tuning by reintroducing training data, provided model parameters haven't drastically shifted.
• Trigger accuracy can be recovered up to 100%, depending on the trigger samples used.
• Introducing training data during fine-tuning can help alleviate watermark vanishing.

Conclusions:

• The proposed method offers a viable solution for restoring lost DNN watermarks after fine-tuning.
• This approach enhances the robustness and practicality of backdoor-based watermarking schemes.
• Further research into optimizing data introduction during fine-tuning can improve watermark persistence.