# KeyNet: An Asymmetric Key-Style Framework for Watermarking Deep Learning Models
## 5 Experimental Results
### Experiments and Results
In our experiments, we sampled 30% of the original data and used them to fine-tune the marked model by optimizing its parameters based only the loss of the original task. Table 6 outlines the impact of fine-tuning on the WM detection accuracy with all benchmarks. We can notice that _KeyNet_ is robust against fine-tuning and was able to preserve a WM detection accuracy of about 97% after 200 epochs. The explanation for this strong persistence against fine-tuning is that _KeyNet_ does not embed the WM information within the decision boundaries of the original task classes. Therefore, the effect of fine-tuning on the WM is very small. * _Model compression._ We used the compression approach proposed in [47] to prune the weight parameters in the marked DL models. To prune a particular layer, we first sorted the weights in the specified layer by their magnitudes. Then, we masked to zero the smallest magnitude weights until the desired pruning level was reached. Figure 3 shows the impact of model compression on both WM detection accuracy and original task accuracy with different pruning rates. We see that _KeyNet_ is robust against model compression, and the accuracy of the WM remains above the threshold \(T=90\%\) as long as the marked model is still useful for the original task. This is consistent because when the marked model becomes useless due to excessive compression, the owner will not be interested in claiming its ownership. * _Watermark overwriting._ Assuming that the attacker is aware of the methodology used to embed the WM, he may embed a new WM that may damage the original one. In our experiments, we assumed that the attacker knows the methodology but knows neither the owner's carrier set nor the owner's private model architecture. We studied the effect on the WM of the attacker's knowing various fractions of the original training \begin{table}
\begin{tabular}{c c c c c c c} \hline \hline \multirow{2}{*}{**Data Set**} & \multirow{2}{*}{**DL Model**} & \multirow{2}{*}{
\begin{tabular}{c} **Unmarked Model** \\ **Accuracy \%** \\ \end{tabular} } & \multicolumn{2}{c}{**Marked Model**} & \multicolumn{2}{c}{**Watermark Detection**} \\  & & & **Accuracy \%** & & **Accuracy \%** \\ \hline \multirow{2}{*}{**CIFAR10**} & ResNet18 & 91.96 & 92.07 & 92.53 & 99.96 & 99.97 \\  & VGG16 & 90.59 & 90.52 & 91.74 & 99.68 & 99.89 \\ \hline \multirow{2}{*}{**FANISTS**} & CNN & 92.08 & 92.42 & 92.32 & 99.98 & 99.90 \\  & LeNet & 90.68 & 89.94 & 88.94 & 99.55 & 99.79 \\ \hline \hline \end{tabular}
\end{table} 
Table 5: Fidelity results. Column 3 shows the accuracy of the unmarked models in the original tasks (baseline accuracy) before embedding the WM. Columns 4 and 5 show the accuracy of the marked model in the original task after embedding WM by fine-tuning a pretrained model or by training the combined model from scratch. Columns 6 and 7 show the accuracy of the private model in detecting the WM using the predictions of the corresponding marked model. To embed the WM in a pretrained model, we fine-tuned it for 30 epochs while we trained models from scratch for 250 epochs. data, ranging from 1% to 30%. We chose the lower bound 1% based on the work in [49]; the authors of that paper demonstrate that an attacker with less than 1% of the original data is able to remove the watermark with a slight loss in the accuracy of the original task. To overwrite the WM, the attacker selected his/her own carrier set and signed it using Algorithm 1 with his/her signature. Then, he/she trained her private model along with the marked model in the same way as in Algorithm 2. Tables 7 and 8 summarize the results of WM overwriting experiments. The attacker was able to successfully overwrite the original WM and successfully embed her new WM, but this was done at the cost of a substantial accuracy loss in the original task when using a fraction of the training data up to 10%. Thus,