# PK-Judge: Enhancing IP Protection of Neural Network Models Using an Asymmetric Approach
###### Abstract  
This paper introduces PK-Judge, a novel neural network watermarking framework designed to enhance the intellectual property (IP) protection by incorporating an asymmetric cryptographic approach in the verification process. Inspired by the paradigm shift from HTTP to HTTPS in enhancing web security, this work integrates public key infrastructure (PKI) principles to establish a secure and verifiable watermarking system. Unlike symmetric approaches, PK-Judge employs a public key infrastructure (PKI) to decouple ownership validation from the extraction process, significantly increasing its resilience against adversarial attacks. Additionally, it incorporates a robust challenge-response mechanism to mitigate replay attacks and leverages error correction codes (ECC) to achieve an Effective Bit Error Rate (EBER) of zero, ensuring watermark integrity even under conditions such as fine-tuning, pruning, and overwriting. Furthermore, PK-Judge introduces a new requirement based on the principle of separation of privilege, setting a foundation for secure and scalable watermarking mechanisms in machine learning. By addressing these critical challenges, PK-Judge advances the state-of-the-art in neural network IP protection and integrity, paving the way for trust-based AI technologies that prioritize security and verifiability. w +
Footnote †: journal: _Big Data Comp. Comput._  
_Applications of the IEEE Transactions on_  
advent of the digital age has made it easier to reproduce and distribute a watermarked content, often leading to unauthorized copying and distribution. A robust digital watermark should be able to resist various attacks and manipulations, be difficult to remove without degrading the quality of the original content, and be detectable even in modified versions of the content [7; 9]. As digital content proliferates across various platforms and channels, the significance of digital watermarking continues to escalate, serving both as a deterrent against misuse and a mechanism for rights management [10]. In the context of deep learning domain, many protocols like [11; 12; 13; 14; 15] adopt a symmetric watermarking scheme by inserting random bits into the model space. Ownership validation is then a matter of extracting this watermark and evaluating it against a response using a \"pre-defined acceptable threshold\". If the match exceeds this threshold, the model's ownership is confirmed. Thus, the determination \"valid owner\" in current IP protection protocols is attributed to the knowledge of a suitable number of bits that had been watermarked in the model. Such a determination method is weak. One can make this a more challenging task to exploit by increasing the size of the watermark, as well as increasing the percentage of accuracy for acceptance. This alone will introduce challenges due to potential size and nosiness of the embed-extraction process. But our work, see Section 5, does demonstrate we can overcome this. By itself, a system of I-know-the-secret/extract-the-watermark and compare the two is a symmetric scheme. Symmetric schemes used for authentication are prone to abuse. Once one reveals their knowledge of the secret, that secret has been revealed even if this reveal was completed in a secure and private setting, there is a potential for exposure. A solution to overcome the potential for exposure in an application such as IP protection is to embed many secret keys (all of the same size) in multiple places and discard a key once used and in a 'determination' and then move to the next embedded key, when challenged for ownership. Such a method is impractical, and prone for other types of abuse. Here we introduce a novel approach of proving ownership by embedding a digital signature. Only one public key can validate the digital signature. Knowledge of the watermark does not demonstrate ownership; rather, by verifying the extracted digital signature with the public key, all entities know the owner of the model is the owner of the signing key (which is secret-but tied to the unique public key).