BlackMarks: Black-box Multi-bit Watermarking for Deep Neural Networks

1 INTRODUCTION . Deep neural networks and other Deep Learning ( DL ) variants have revolutionized various critical fields ranging from biomedical diagnosis and autonomous transportation to computer vision and natural language processing ( Deng & Yu , 2014 ; Ribeiro et al. , 2015 ) . Training a highly accurate DNN is a costly process since it requires : ( i ) processing massive amounts of data acquired for the target application ; ( ii ) allocating substantial computing resources to fine-tune the underlying topology ( i.e. , type and number of hidden layers ) , and hyper-parameters ( i.e. , learning rate , batch size ) , and DNN weights to obtain the most accurate model . Therefore , developing a high-performance DNN is impractical for the majority of customers with constrained computational capabilities . Given the costly process of designing/training , DNNs are typically considered to be the intellectual property of the model builder and needs to be protected to preserve the owner ’ s competitive advantage . Digital watermarking has been immensely leveraged over the past decade for ownership protection in the multimedia domain where the host of the watermark can be images , video contents , and functional artifacts such as digital integrated circuits ( Furht & Kirovski , 2004 ; Hartung & Kutter , 1999 ; Qu & Potkonjak , 2007 ) . However , the development of DNN watermarking techniques is still in its early stage . Designing a coherent DNN watermarking scheme for model ownership proof is challenging since the embedded WM is required to yield high detection rates and withstand potential attacks while minimally affecting the original functionality and overhead of the target DNN . Existing DNN watermarking techniques can be categorized into two types depending on the application scenario . ‘ White-box ’ watermarking assumes the availability of model internals ( e.g. , weights ) for WM extraction ( Uchida et al. , 2017 ) whereas ‘ black-box ’ watermarking assumes that the output predictions can be obtained for WM detection ( Merrer et al. , 2017 ; Adi et al. , 2018b ) . On the one hand , white-box WMs have a larger capacity ( carrying multiple-bit information ) but limited appli- cability due to the strong assumption . On the other hand , black-box WMs enable IP protection for Machine Learning as a Service ( MLaaS ) ( Ribeiro et al. , 2015 ) where only zero-bit watermarking methods have been proposed . It is desirable to develop a systematic watermarking approach that combines the advantages of both types of WMs . While all present black-box watermarking papers embed the WM as a statistical bias in the decision boundaries of the DNN ( high accuracy on the WM trigger set ) , our work is the first to prove that it is feasible to leverage the model ’ s predictions to carry a multi-bit string instead of a one-bit boolean decision ( existence or not of the WM ) . By introducing BlackMarks , this paper makes the following contributions : • Proposing BlackMarks , the first end-to-end black-box watermarking framework that en- ables multi-bit WM embedding . BlackMarks possesses higher capacity compared to prior works and only requires the predictions of the queried model for WM extraction . • Characterizing the requirements for an effective watermarking methodology in the deep learning domain . Such metrics provide new perspectives for model designers and enable coherent comparison of current and pending DNN IP protection techniques . • Performing extensive evaluation of BlackMarks ’ performance on various benchmarks . Experimental results show that BlackMarks enables robust WM embedding with high detection rates and low false alarm rates . As a side benefit , we find out that BlackMarks ’ WM embedding process improves the robustness of the model against adversarial attacks . 2 PRELIMINARY AND RELATED WORK . Digital watermarks are invisible identifiers embedded as an integral part of the host design and have been widely adopted in the multimedia domain for IP protection ( Lu , 2004 ; Cox et al. , 2007 ) . Conventional digital watermarking techniques consist of two phases : WM embedding and WM extraction . Figure 1 shows the workflow of a typical constraint-based watermarking system . The original problem is used as the cover constraints to hide the owner ’ s WM signature . To embed the WM , the IP designer creates the stego-key and a set of additional constraints that do not conflict with cover constraints . Combining these two constraints yields the stego-problem , which is solved to produce the stego-solution . Note that the stego-solution simultaneously satisfies both the original constraints and the WM-specific constraints , thus enables the designer to extract the WM and claim the authorship . An effective watermarking method is required to meet a set of criteria including imperceptibility , robustness , verifiability , capacity , and low overhead ( Singh & Chadha , 2013 ) . IP protection of valuable DNN models is a subject of increasing interests to researchers and practitioners . Uchida et al . ( 2017 ) take the first step towards DNN watermarking by embedding the WM in the weights of intermediate layers and training the model with an additional regularization loss . The WM is later extracted from the weights of the marked layer assuming a white-box scenario . Rouhani et al . ( 2018a ) present the first generic watermarking approach that is applicable in both white-box and black-box settings by embedding the WM in the activation maps of the intermediate layers and the output layer , respectively . To alleviate the constraint on the availability of model internals during WM extraction , several papers propose zero-bit watermarking techniques that are applicable in the black-box scenario . Merrer et al . ( 2017 ) craft adversarial samples to carry the ‘ zero-bit ’ WM and embeds them in the decision boundary of the model by fine-tuning the DNN with the WM . Null hypothesis testing is performed to detect the WM based on the remote model ’ s response to the WM query images . Adi et al . ( 2018a ) suggest to use the incorrectly classified images from the training data as the WM trigger images and generate random labels as the corresponding key labels . A commitment scheme is applied to the trigger set to produce the WM marking key and the verification key . The existence of the WM is determined by querying the model with the marking keys and performing statistical hypothesis testing . Zhang et al . ( 2018 ) propose three WM generation algorithms ( ‘ unrelated ’ , ‘ content ’ , ‘ noise ’ ) and embed the WM by training the model with the concatenation of the training set and the WM set . To detect the WM , the remote model is queried by the WM set and the corresponding accuracy is thresholded to make the binary decision . To the best of our knowledge , none of the prior works has addressed the problem of multi-bit black-box watermarking . 3 BLACKMARKS OVERVIEW . Figure 2 shows the global flow of BlackMarks framework . BlackMarks consists of two main phases : WM embedding and WM extraction . The workflow of each phase is explained below . Watermark Embedding . The WM embedding module of BlackMarks takes the pre-trained model and the owner-specific WM signature as its inputs . The output is the watermarked DNN together with a set of WM keys . A model-dependent encoding scheme is devised to map all possible labels into bit ‘ 0 ’ and bit ‘ 1 ’ . Note that WM embedding is a one-time task performed locally by the owner before the model is distributed . Details of each step are discussed in Section 4.1 . Watermark Extraction . To verify the IP of a remote DNN and detect potential IP infringement , BlackMarks first queries the DNN service with the WM keys . The owner ’ s signature is then decoded from the corresponding predictions using the encoding scheme . The Bit Error Rate ( BER ) between the extracted signature and the true one is computed . A zero BER implies that the owner ’ s IP is deployed in the remote DNN service . Section 4.2 discusses the details of WM extraction . 3.1 EVALUATION CRITERIA . Table 1 details the evaluation criteria for an effective DNN watermarking methodology . In addition to previously suggested requirements in Uchida et al . ( 2017 ) ; Merrer et al . ( 2017 ) , we believe verifiability and integrity are two other major factors that need to be considered when designing a practical DNN watermarking methodology . Verifiabiity is important because the embedded signature should be accurately extracted using the pertinent WM keys ; the model owner is thereby able to detect any misuse of her model with a high probability . Integrity ensures that the IP infringement detection policy yields a minimal false alarms rate , meaning that there is a very low chance of falsely proving the ownership of an unmarked model used by a third party . BlackMarks satisfies all the requirements listed in Table 1 as we empirically show in Section 5 . 3.2 ATTACK MODEL . To validate the robustness of a potential DL watermarking approach , one should evaluate the performance of the proposed methodology against ( at least ) three types of contemporary attacks : ( i ) model fine-tuning . This attack involves re-training of the original model to alter the model parameters and find a new local minimum while preserving the accuracy . ( ii ) parameter pruning . Pruning is a common approach for efficient DNN execution , particularly on embedded devices . We identify model pruning as another attack approach that might affect the watermark extraction . ( iii ) watermark overwriting . A third-party user who is aware of the methodology used for DNN watermarking may try to embed a new WM in the distributed model and overwrite the original one . 4 BLACKMARKS METHODOLOGY . BlackMarks takes advantage of the fact that there is not a unique solution for modern non-convex optimization problems used by DL models ( Choromanska et al. , 2015 ; Rouhani et al. , 2017 ) to embed the WM signature in the output activations of the target DNN . In this section , we detail the workflow of WM embedding and extraction phase shown in Figure 2 and discuss the watermarking overhead . We use image classification as the cover problem in this paper , however , BlackMarks can be easily generalized to other data applications for IP protection of the deployed models . 4.1 WATERMARK EMBEDDING . Algorithm 1 summarizes the steps of BlackMarks ’ WM embedding . BlackMarks encodes the ownerspecific WM information in the distribution of the output activations ( before softmax ) while preserving the correct functionality on the original task . The rationale behind our approach is to explore the unused space within the high dimensional DNN ( Rouhani et al. , 2018b ) for WM embedding . BlackMarks formulates WM embedding as a one-time , ‘ post-processing ’ step that is performed on the pre-trained DNN locally by the owner before model distribution/deployment . We explicitly discuss each of the steps outlined in Algorithm 1 in the following of this section . 1 Encoding Scheme Design . Recall that our objective is to encode a binary string ( owner ’ s signature ) into the predictions made by the DNN when queried by the WM keys . BlackMarks designs a model-dependent encoding scheme that maps the class predictions to binary bits . The encoding scheme ( f ) is obtained by clustering the output activations corresponding to all categories ( C ) into two groups based on their similarity . To do so , BlackMarks computes the averaged output activations triggered by images in each class and divides them into two groups using K-means clustering . The resulting encoding scheme specifies the labels corresponding to bit ‘ 0 ’ and bit ‘ 1 ’ , respectively . 2 Key Generation 1 . The key generation module takes the encoding scheme , the owner ’ s private signature ( b ∈ { 0 , 1 } K , where K is also used as the key length ) , and the original training data as inputs . The output is a set of WM key image-label pairs for the target DNN . More specifically , BlackMarks deploys targeted adversarial attacks to craft the WM key images and labels . If the given bit in b is ‘ 0 ’ , the source class and the target class for the WM image ( ‘ adversarial sample ’ ) are determined by uniformly randomly selecting a class label that belongs to the cluster ‘ 0 ’ and cluster ‘ 1 ’ determined by the encoding scheme ( f ) , respectively . The source class is used as the corresponding WM key label . The WM keys for bit ‘ 1 ’ in b are generated in a similar way . We use targeted Momentum Iterative Method ( MIM , Dong et al. , 2018 ) and Jacobian-based Saliency Map Approach ( JSMA , Papernot et al. , 2016b ) in our experiments ( see Appendix A.1 ) . BlackMarks framework is generic and compatible with other targeted adversarial attack emthods for key generation . BlackMarks aims to design specific WM key images as the queries for model authentication instead of crafting standard adversarial samples that are indistinguishable to human eyes to fool the DNN . However , BlackMarks ’ WM key images can be considered as a generalization of ‘ adversarial samples ’ with relaxed constraints on the perturbation level and a different objective . We assume that the WM signature and the key generation parameters ( e.g. , source and target classes , maximum distortion , step size , and the number of attack iterations ) are secrets specified by the owner . It ’ s worth noting that the transferability of adversarial samples ( Papernot et al. , 2016a ; 2017 ) might lead to false positives of WM detection as shown in Merrer et al . ( 2017 ) . To address this problem , we set the initial key size to be larger than the owner ’ s desired value K ′ > K and generate the WM keys accordingly ( K ′ = 5 × K in our experiments ) . The intuition here is that we want to filter out the highly transferable WM keys that are located near the decision boundaries . 3 Model Fine-tuning . To enable seamless encoding of the WM information , BlackMarks incorporates an additive WM-specific embedding loss ( LWM ) to the conventional cross-entropy loss ( L0 ) during DNN fine-tuning where a mixture of the WM keys and ( a subset of ) the original training data is fed to the model . The formulation of the total regularized loss ( LR ) is given in Eq . ( 1 ) where the embedding strength λ controls the contribution of the additive loss . Here , we use Hamming Distance as the loss function LWM to measure the difference between the extracted signature ( obtained by decode predictions ) and the true signature b. LR = L0 + λ · LWM ( b , decode predictions ( Y keyM∗ , f ) ) . ( 1 ) Note that without the additional regularization loss ( LWM ) , this retraining procedure resembles ‘ adversarial training ’ ( Kurakin et al. , 2016 ) . All of the existing zero-bit black-box watermarking papers ( Merrer et al. , 2017 ; Zhang et al. , 2018 ; Adi et al. , 2018a ) leverages ‘ adversarial training ’ for WM embedding to ensure that the marked model has a high classification accuracy on the WM trigger set . However , such an approach does not directly apply to multi-bit WM embedding where we care about the difference between the decoded signature and the original one instead of the difference between the received predictions and the WM key labels . BlackMarks identifies this inherent requirement of multi-bit watermarking and formulates an additive embedding loss ( LWM ) to encode the WM . The rationale behind our design is that , when queried by WM key images , an additional penalty shall be applied if the prediction of the marked model does not belong to the same code-bit cluster as the corresponding WM key label . 4 Key Generation 2 . Once the model is fine-tuned with the regularized loss in step 3 , we first find out the indices of initial WM keys that are correctly classified by the watermarked model ( denoted by IM∗ ) . To identify and remove WM keys images with high transferability , we construct T variants of the original unmarked model ( T = 3 in our experiments ) to find out the indices of common misclassified initial keys ( denoted by IM ) . Finally , the intersection of IM∗ and IM determines the indices of proper key candidates to carry the WM signature . A random subset of candidate WM keys is then selected as the final WM keys according to the owner ’ s key size ( K ) . In the global flow ( Figure 2 ) , we merge the two key generation steps into one module for simplicity .

Summary: The paper proposes an approach for model watermarking (i.e., watermarking a trained neural neteowrk). The watermark is a bit string, which is embedded in the model as part of a fine-tuning procedure, and can be decoded from the network from the model's specific predictions for a specific set of inputs (called keys) chosen during the fine-tuning step. The process generates a watermark when we can be confident that a model that didn't go through the exact same fine-tuning procedure gives significantly different predictions on the set of keys. The application scenario is when a company A wants to deploy a model for which A has IP ownership, and A wants to assess whether a competitor is (illegaly) re-using A's model. The approach presented in the paper works in the black-box setting, meaning that whether a model posesses the watermark can be assessed only by querying the model (i.e., without access to the internals of the model).