# KeyNet: An Asymmetric Key-Style Framework for Watermarking Deep Learning Models
## 5 Experimental Results
### Experiments and Results
The table shows the accuracy before and after overwriting each marked model and its corresponding private model depending on the fraction of training data known by the attacker (from 1% to 30%). \begin{table}
\begin{tabular}{c c c c c c c c c c c c} \hline
**Dataset** & \multicolumn{10}{c}{**FMNIST5**} \\ \hline
**DL Model** & \multicolumn{10}{c}{**CNN**} & \multicolumn{10}{c}{**LeNet**} \\ \hline
**Data fraction \%** & 1 & 3 & 6 & 10 & 20 & 30 & 1 & 3 & 6 & 10 & 20 & 30 \\ \hline
**Marked model** & 92.32 & 92.32 & 92.32 & 92.32 & 92.32 & 92.32 & 89.94 & 89.94 & 89.94 & 89.94 & 89.94 & 89.94 \\
**Accuracy before \%** & 76.18 & 81.88 & 87.86 & 89.1 & 91.38 & 91.84 & 74.64 & 79.44 & 86.36 & 88.86 & 89.58 & 89.52 \\ \hline
**Owner’s WM detection** & 26.97 & 28.53 & 38.52 & 46.83 & 70 & 68.03 & 26.32 & 18.71 & 43.99 & 57.4 & 75.83 & 65.66 \\
**Accuracy \%** & 100 & 100 & 100 & 100 & 100 & 99.25 & 99.65 & 99.84 & 99.92 & 99.89 & 99.92 \\ \hline \end{tabular}
\end{table} 
Table 8: Overwriting attack results with FMNIST5 marked models. The table shows the accuracy before and after overwriting each marked model and its corresponding private model depending on the fraction of training data known by the attacker (from 1% to 30%). should be more than enough. On the other hand, even if the owner's signature is known by an attacker, the cryptographic hash function makes it impossible to deduce the owner's information from her signature. **Unforgeability. ** To prove ownership of a DL model that is not his/hers, an attacker needs to pass the verification protocol (Algorithm 3). However, the private model allowing watermark extraction is kept secret by the legitimate owner. Without the private model, even if the attacker knows both the WM carrier set and the owner's signature, the attacker can only try a random strategy. Yet, the probability of randomly guessing the right position at least a proportion \(T\) of \(r\) rounds is at most \(1/z^{\lfloor T\rfloor}\). This probability can be made negligibly small by increasing the number \(r\) of verification rounds. Thus, _KeyNet_ partially meets the unforgeability requirement: an attacker can embed additional WMs into a marked model, but cannot claim ownership of another party's WM. **Capacity. ** Capacity can be viewed from two perspectives: (i) the framework allows the inclusion of a large amount of WM information, and (ii) triggers available in the verification process are large enough. Given that hashes are one-way functions with fixed length, the information that can be embedded in them is virtually unlimited. In our experiments, we used a medium-sized signature of \(s=25\) characters. Nevertheless, _KeyNet_ allows flexibility in specifying various signature sizes and in using hash functions other than SHA256. On the other hand, _KeyNet_ can use a large number of samples in WM verification. In addition to using all samples belonging to a certain distribution (the WM carrier set), it allows using samples from other distributions due to the method of labeling and training used. The marked model gives the signature information if the signature is placed on top of a WM carrier set's sample, while samples from different distributions are given the label 0 (even if they are signed with the signature of the legitimate owner). **Uniqueness and scalability. **_KeyNet_ can be easily extended to produce unique copies of a DL model for each user, as well as scale to cover a large number of users in the system. Furthermore, it can link a remote copy of a DL model with its user with minimal effort and high reliability. In our experiments, we distributed two unique copies of the FMNIST5-CNN model: one for _User1_ and another for _User2_, each copy having its corresponding private model. We took a pretrained FMNIST5-CNN model and fine-tuned it for 30 epochs to embed the WM linked to a specific user. To do so, we signed two copies of the WM carrier set, where each copy was signed using different joint signatures.