# KeyNet: An Asymmetric Key-Style Framework for Watermarking Deep Learning Models
## 4 The _KeyNet_ Framework
### Watermark Carrier Set Signing and Labeling  
The methodology we use for labeling the WM carrier set is key in our approach. In contrast to related works, which assign a unique label to each of the WM carrier set samples, our labeling method allows for a single sample to carry more than one label. More precisely, any sample \(c\in D_{um}\) can take one of \(z\) labels \(\{l_{k}\}_{k=1}^{z}\), where \(z\) is the number of predefined positions \(\{p_{k}\}_{k=1}^{z}\) at which the _signature_ of the owner can be placed. Besides the \(z\) positions, if a sample is not signed by the legitimate owner, it uses label 0 by default. Moreover, if the sample is not in \(D_{um}\), it uses label 0 by default even if it is signed by the owner. Algorithm 1 formalizes the method used to sign and label the \(D_{um}\) samples. First and foremost, the owner's information and the metadata of her model are endorsed by the authority. This information is a string of arbitrary length. After that, Algorithm 1 returns the signed \(D_{um}^{signed}\) WM carrier set consisting of pairs (signed \(D_{um}\) sample, label), a signed \(D_{dif}^{signed}\) consisting of pairs (signed sample from a set \(D_{dif}\) of different distribution, 0), and the owner's signature used to sign the samples. The inputs to Algorithm 1 are:  
1. The owner's information string \(infStr\) that has been endorsed by the authority. 2. The size of the signature \(s\) to be placed on the WM carrier set samples. 3. The owner's WM carrier set \(D_{um}\). 4. The set of position-label pairs \(PL=\{p_{k},l_{k}\}_{k=1}^{z}\) that defines the signature positions and their corresponding labels. 5. A small set of samples \(D_{dif}\) from other distributions than \(D_{um}\). Algorithm 1 starts its work by taking the hash value for \(infStr\) and then converting it to a squared array of size \(s\), as follows. In our implementation we use _SHA256_, which yields 256 bits that are converted to 64 characters by digesting them to hexadecimal. The last \(s\) (with \(s\leq 64\)) among the digested characters are converted to a decimal vector of length \(s\). The decimal vector values are normalized between 0 and 1 by dividing them by the maximum value in the vector. The normalized vector is then reshaped into a squared array. The resulting array represents the owner's _signature_. Note that it is also possible to use any hashing function different from SHA256. ```
0: Owner's information \(infStr\), owner's signature size \(s\), owner's WM carrier set \(D_{wm}\), signature positions/labels set \(PL\), other distributions' samples \(D_{\mathit{diff}}\)
0: signed labeled WM samples \(D_{wm}^{\mathit{signed}}\), signed samples from different distributions \(D_{\mathit{diff}}^{\mathit{signed}}\), owner's signature \(signature\)
1:\(signature\gets hashAndReshape(infStr,s)\)//Theownersignature. 2:\(fakeStr\gets modify(infStr)\)//Fakeinformationstring. 3:\(signature_{fake}\gets hashAndReshape(fakeStr,s),signature_{fake}\
eq signature\)//A fake signature. 4:\(D_{wm}^{\mathit{signed}},D_{\mathit{diff}}^{\mathit{signed}}=[\ ],[\ ]\)
5:for each sample \(c\) in \(D_{\mathit{wm}}\)do
6:for each position, label \((p_{k},l_{k})\) in \(PL\)do
7:\(c^{p_{k}}\gets sign(signature,c,p_{k})\)
8:\(Add((c^{p_{k}},l_{k}),D_{wm}^{\mathit{signed}})\)
9:endfor
10:\(p_{k}\gets selectRandomPosition()\)
11:\(c^{\mathit{ch}}\leftarrow sign(signature_{fake},c,p_{k})\)
12:\(Add((c^{p_{k}},0),D_{wm}^{\mathit{signed}})\)
13:\(Add((c,0),D_{wm}^{\mathit{signed}})\)
14:\(fakeStr\gets modify(infStr)\)//Newfakeinformationstring.