Certified Watermarks for Neural Networks

1 INTRODUCTION . With the rise of deep learning , there has been an extraordinary growth in the use of neural networks in various computer vision and natural language understanding tasks . In parallel with this growth in applications , there has been exponential growth in terms of the cost required to develop and train state-of-the-art models ( Amodei & Hernandez , 2018 ) . For example , the latest GPT-3 generative language model ( Brown et al. , 2020 ) is estimated to cost around 4.6 million dollars ( Li , 2020 ) in TPU cost alone . This does not include the cost of acquiring and labeling data or paying engineers , which may be even greater . With up-front investment costs growing , if access to models is offered as a service , the incentive is strong for an adversary to try to steal the model , sidestepping the costly training process . Incentives are equally strong for companies to protect such a significant investment . Watermarking techniques have long been used to protect the copyright of digital multimedia ( Hartung & Kutter , 1999 ) . The copyright holder hides some imperceptible information in images , videos , or sound . When they suspect a copyright violation , the source and destination of the multimedia can be identified , enabling appropriate follow-up actions ( Hartung & Kutter , 1999 ) . Recently , watermarking has been extended to deter the theft of machine learning models ( Uchida et al. , 2017 ; Zhang et al. , 2018 ) . The model owner either imprints a predetermined signature into the parameters of the model ( Uchida et al. , 2017 ) or trains the model to give predetermined predictions ( Zhang et al. , 2018 ) for a certain trigger set ( e.g . images superimposed with a predetermined pattern ) . A strong watermark must also resist removal by a motivated adversary . Even though the watermarks in ( Uchida et al. , 2017 ; Zhang et al. , 2018 ; Adi et al. , 2018 ) initially claimed some resistance to various watermark removal attacks , it was later shown in ( Shafieinejad et al. , 2019 ; Aiken et al. , 2020 ) that these watermarks can in fact be removed with more sophisticated methods , using a combination of distillation , parameter regularization , and finetuning . To avoid the cat-and-mouse game of everstronger watermark techniques that are only later defeated by new adversaries , we propose the first certifiable watermark : unless the attacker changes the model parameters by more than a certain ` 2 distance , the watermark is guaranteed to remain . To the best of our knowledge , our proposed watermarking technique is the first to provide a certificate against an ` 2 adversary . Although the bound obtained by the certificate is relatively small , we see it as a first step towards developing watermarks with provable guarantees . Additionally we empirically find that our certified watermark is more resistant to previously proposed watermark removal attacks ( Shafieinejad et al. , 2019 ; Aiken et al. , 2020 ) compared to its counterparts – it is thus valuable even when a certificate is not required . 2 RELATED WORK . Watermark techniques ( Uchida et al. , 2017 ) proposed the first method of watermarking neural networks : they embed the watermark into the parameters of the network during training through regularization . However , the proposed approach requires explicit inspection of the parameters for ownership verification . Later , ( Zhang et al. , 2018 ; Rouhani et al. , 2018 ) improved upon this approach , such that the watermark can be verified through API-only access to the model . Specifically , they embed the watermark by forcing the network to deliberately misclassify certain “ backdoor ” images . The ownership can then be verified through the adversary ’ s API by testing its predictions on these images . In light of later and stronger watermark removal techniques ( Aiken et al. , 2020 ; Wang & Kerschbaum , 2019 ; Shafieinejad et al. , 2019 ) , several papers have proposed methods to improve neural network watermarking . ( Wang & Kerschbaum , 2019 ) propose an improved white-box watermark that avoids the detection and removal techniques from ( Wang & Kerschbaum , 2019 ) . ( Li et al. , 2019 ) propose using values outside of the range of representable images as the trigger set pattern . They show that their watermark is quite resistant to a finetuning attack . However , since their trigger set does not consist of valid images , their method does not allow for black-box ownership verification against a realistic API that only accepts actual images , while our proposed watermark is effective even in the black-box setting . ( Szyller et al. , 2019 ) proposed watermarking methods for models housed behind an API . Unlike our method , their method does not embed a watermark into the model weights itself , and so can not work in scenarios where the weights of the model may be stolen directly , e.g . when the model is housed on mobile devices . Finally , ( Lukas et al. , 2019 ) propose using a particular type of adversarial example ( “ conferrable ” adversarial examples ) to construct the trigger set . This makes the watermark scheme resistant even to the strongest watermark removal attack : ground-up distillation which , starting from a random initialization , trains a new network to imitate the stolen model ( Shafieinejad et al. , 2019 ) . However , for their approach to be effective , they need to train a large number of models ( 72 ) on a large amount of data ( e.g . requiring CINIC as opposed to CIFAR-10 ) . While our approach does not achieve this impressive resistance to ground-up distillation , it is also much less costly . Watermark removal attacks However , one concern for all these watermark methods is that a sufficiently motivated adversary may attempt to remove the watermark . Even though ( Zhang et al. , 2018 ; Rouhani et al. , 2018 ; Adi et al. , 2018 ; Uchida et al. , 2017 ) all claim that their methods are resistant to watermark removal attacks , such as finetuning , other authors ( Aiken et al. , 2020 ; Shafieinejad et al. , 2019 ) later show that by adding regularization , finetuning and pruning , their watermarks can be removed without compromising the prediction accuracy of the stolen model . Wang & Kerschbaum ( 2019 ) shows that the watermark signals embedded by ( Uchida et al. , 2017 ) can be easily detected and overwritten ; ( Chen et al. , 2019 ) shows that by leveraging both labeled and unlabeled data , the watermark can be more efficiently removed without compromising the accuracy . Even if the watermark appears empirically resistant to currently known attacks , stronger attacks may eventually come along , prompting better watermark methods , and so on . To avoid this cycle , we propose the first certifiably unremovable watermark : given that parameters are not modified more than a given threshold ` 2 distance , the watermark will be preserved . Certified defenses for adversarial robustness Our work is inspired by recent work on certified adversarial robustness , ( Cohen et al. , 2019 ; Chiang et al. , 2019 ; Wong & Kolter , 2017 ; Mirman et al. , 2018 ; Weng et al. , 2018 ; Zhang et al. , 2019 ; Eykholt et al. , 2017 ; Levine & Feizi , 2019 ) . Certified adversarial robustness involves not only training the model to be robust to adversarial attacks under particular threat models , but also proving that no possible attacks under a particular constraint could possibly succeed . Specifically , in this paper , we used the randomized smoothing technique first developed by ( Cohen et al. , 2019 ; Lecuyer et al. , 2019 ) for classifiers , and later extended by ( Chiang et al. , 2020 ) to deal with regression models . However , as opposed to defending against an ` 2-bounded threat models in the image space , we are now defending against an ` 2-bounded adversary in the parameter space . Surprisingly , even though the certificate holds only when randomized smoothing is applied , empirically , when our watermark is evaluated in a black-box setting on the non-smoothed model , it also exhibits stronger persistence compared to previous methods . 3 METHODS . Below , we introduce the formal model for neural network watermarking , and the watermark removal adversaries that we are concerned with . Then , we describe some background related to randomized smoothing , and show that by using randomized smoothing we can create a watermark that provably can not be removed by an ` 2 adversary . 3.1 WATERMARKING . White box vs black box We first introduce the distinction between black box and white box settings from the perspective of the owner of the model . In a white box setting , parameters are known . In a black box setting , the model parameters are hidden behind an API . We consider cases where the owner may have either black box or white box access to verify their watermarks . Black-box watermarking In backdoor-based watermarking , the owner employs a “ trigger set ” of specially chosen images that has disjoint distribution compared to the original dataset . If another model makes correct predictions on this trigger set , then this is evidence that the model has been stolen . A backdoor-based watermark can be verified in a black-box setting . The trigger set may be chosen in various ways . ( Zhang et al. , 2018 ) considered three different methods of generating the trigger set : embedded content , pre-specified noise , and abstract images . Embedded content methods embed text over existing datasets and assigns all examples with the text overlay the same fixed label . Pre-specified noise overlays Gaussian noise on top of existing dataset and again assigns the examples with the same fixed label . For abstract images , a set of images from a different domain is additionally used to train the network . For example , MNIST images could form the trigger set for a CIFAR-10 network , so if an adversary ’ s model performs exceedingly well on MNIST images , then the adversary must have used the stolen model . Examples of trigger set images are presented in Figure 1 . Our proposed method builds upon such backdoor-based watermarks , so our marked model can also naturally be verified in the black-box manner even though our certificate is only valid in the whitebox setting described in the next section . White-box watermarking White-box watermarks in general embed information directly into the parameters . Our proposed watermark does not directly embed information into parameters , but parameter access is required for verification , which makes our proposed method a white-box watermark . The rationale for using such a white-box watermark is detailed below . In the black-box setting , to verify model ownership , we generally check that the trigger set accuracy function from parameters to accuracy f ( θ ) is larger than a threshold ( Shafieinejad et al. , 2019 ) . The trigger set accuracy function takes in model parameter as input and outputs the accuracy on the trigger set . Since directly certifying the function is hard , we first convert the trigger set accuracy function f ( θ ) to its smoothed counterpart h ( θ ) , and then check that h ( θ ) is greater than the threshold t for ownership verification . Practically , one converts the base function to the smoothed function by injecting random noise into the parameters during multiple trigger set evaluations , and then taking the median trigger set accuracy as ĥ . Note that this verification process requires access to parameters , so ownership verification using ĥ is considered a white-box watermark . Watermark Removal Threat Model In our experiments , we consider three different threat models to the watermark verification : 1 ) distillation , 2 ) finetuning , and 3 ) an ` 2 adversary . In the distillation threat model ( 1 ) , we assume that the adversary initializes their model with our original model , and then trains their model with distillation using unlabeled data that comes from the same distribution . In other words , the adversary uses our original model to label the unlabeled data for finetuning . ( Shafieinejad et al. , 2019 ) propose first adding some regularization during the initial part of the attack to remove the watermark , and then later turning off the regularization to fully recover the test accuracy of the model . We experiment with this distillation attack both with and without regularization . In the finetuning threat model ( 2 ) , the adversary has its own labeled dataset from the original datagenerating distribution . This adversary is strictly stronger compared to the distillation threat model . In our experiments , we make the conservative assumption that the adversary has exactly the same amount of data as the model owner . The ` 2 adversary ( 3 ) obtains the original model parameters , and then is allowed to move the parameters at most a certain ` 2 distance to maximally decrease trigger set accuracy . Even though the ` 2 adversary is not a completely realistic threat model , we argue similarly to the adversarial robustness literature ( Carlini et al. , 2019 ) that being able to defend against a small ` 2 adversary is a requirement for defending against more sophisticated attacks . In our experiments , we empirically find that a large shift of parameters in ` 2 distance is indicative of the strength of the adversary . For example , training the models for more time , with a larger learning rate , or using ground truth labels as opposed to distillation are all stronger attacks , and as expected , they both remove the watermark faster and move the parameters by a greater ` 2 distance ( Table 2 ) . Additionally , given a local Lipschitz constant of L and a learning rate of r , the number of steps required to move outside of the - ` 2 ball can be upper bounded by / ( rL ) , and we think the number of steps is a good proxy to the computational budget of the adversary .

Summary: This paper present the first certifiable neural network watermark method. By extending method proposed by Chiang et.al. [1] to the watermark embedding and extraction process, it is possible to ensure that the watermark is robust to watermark removal when the network parameters are modified by less than a certain calculated value. Specifically, the proposed method adds Gaussian noises to parameters instead of images. Overall, the idea of making a provable model watermark is novel.