# PK-Judge: Enhancing IP Protection of Neural Network Models Using an Asymmetric Approach
## 6 Results and Discussion  
### Implementation Across Watermarking Frameworks and Model Architectures  
In a white-box setting, PK-Judge has been comprehensively validated by integrating it into three established watermarking frameworks serving as host protocols. These include: (1) DeepSigns [12], which leverages statistical alignment of activation distributions to embed watermarks; (2) RIGA [21], a protocol that uses adversarial training to embed a watermark, jointly training an extractor network to recover encoded bits and a detector network to ensure covertness; and (3) DeepSign [14], which employs fragile wavelet hashing, transforming CNN layer weights into the frequency domain with wavelet techniques to embed watermarks via scrambling and scaling. In all frameworks, ECC-encoded digital signatures were embedded to ensure robust ownership identification. Ownership verification achieved an effective bit error rate (EBER) of zero under challenge-response protocols, where the framework successfully decodes the embedded signatures without errors even when subjected to adversarial queries. This multi-framework evaluation highlights PK-Judge's adaptability across diverse embedding strategies, enhancing its efficacy in securing intellectual property.  
We implemented PK-Judge using PyTorch [66], enabling the model owner to configure the architecture, specify the training dataset, select a watermarking protocol, and set associated hyperparameters. For our experiments, we utilized ResNet18 [67] trained on CIFAR10 [68] for RIGA. We also employed ResNet18 on CIFAR10 for DeepSigns. For DeepSigns [12], we conducted experiments on ResNet101 [67] and DenseNet201 [69] (modified with two fully connected layers before the output) using CIFAR10, partitioning the watermark to enhance capacity as described in Section 5.3. For comparative analysis, we extended experiments to MNIST with an MLP (784-512 FC-512 FC-10 FC) and CIFAR10 with a CNN (3\(\times\)32\(\times\)32;32C3(1)-32C3(1)-MP2(1)-64C3(1)-64C3(1)-MP2(1)-512 FC-10 FC) and a ResNet18, evaluating PK-Judge's performance across these datasets and architectures to assess its adaptability and fidelity.  
**DeepSigns Protocol:** We focus on the DeepSigns protocol [12] as the primary host watermarking framework for PK-Judge, due to its established robustness against different attacks. Below, we detail the DeepSigns protocol, given its extensive use in our experiments. For the watermarking protocols of other schemes, we refer the reader to their respective papers [14; 21].  
**Embedding**: Select \(s\) Gaussians \(\{\mathcal{N}(\mu_{i},\sigma^{2})\}_{i=1}^{s}\) from \(S\) classes. Encode binary vector \(b\in\{0,1\}^{s\times N}\) via: \(G_{\sigma}=\sigma(\mu A)\), \(\hat{b}=\mathbb{I}[G_{\sigma}\geq 0.5]\) with projection matrix \(A\sim\mathcal{N}(0,1)\). Train model with loss:  
\[\mathcal{L}_{0}+\lambda_{1}\Big{(}\|\mu_{y^{*}}^{l}-f^{l}(x,\theta)\|_{2}^{2}- \sum_{i\
eq y^{*}}\|\mu_{i}^{l}-f^{l}(x,\theta)\|_{2}^{2}\Big{)}+\lambda_{2} \sum_{i,j}(b_{ij}\log G_{\sigma,ij}+(1-b_{ij})\log(1-G_{\sigma,ij})\big{)}.\]  
where \(\mathcal{L}_{0}\) is the original task loss, \(\lambda_{1}\) aligns with the Gaussian mixture prior, and \(\lambda_{2}\) ensures watermark fidelity.  
**Extraction**: Compute \(\mu^{\prime}\) from layer activations using key samples. Recover \(b^{\prime}\) via:  
\[b^{\prime}=I[\sigma(l\mu^{\prime}A)\geq 0.5].\qquad\text{ where }\mathbb{I}_{\{\cdot\}}\text{ is the indicator function.}\]  
**Verification**: \(\text{BER}=\frac{1}{sN}\sum_{i,j}\mathbb{I}[b_{ij}\
eq b_{ij}^{\prime}]\). If \(\text{BER}>\tau\), the watermark is invalid.