# KeyNet: An Asymmetric Key-Style Framework for Watermarking Deep Learning Models
## 5 Experimental Results
### Experimental Setup  
**Original task data sets and DL models. ** We used two image classification data sets: CIFAR10 [38] and FMNIST5. CIFAR10 has 10 classes, while FMNIST5 is a subset of the public data set Fashion-MNIST [39]; FMNIST5 contains the samples that belong to the first five classes in Fashion-MNIST (classes from 0 to 4). Table 2 summarizes the original task data sets, the carrier set, and the DL models and their corresponding private models. **Watermark carrier sets. ** We employed three different data sets as WM carrier sets: STL10 [43], MNIST [44], and Fashion-MNIST (the latter was used only in attacks). We applied Algorithm 1 to label the carrier set's images. Then, we passed the carrier set, the owner's information, the signature size, a fake signature, some samples from different distributions, and a list containing the labeling order of the positions of the owner's signature in the carrier set. We used the following labeling order: 1: Top left, 2: Top right, 3: Bottom left, 4: Bottom right, and 5: Image center. Algorithm 1 assigns label 0 to an image if (i) the image belongs to the carrier set but does not carry any signature, (ii) the image belongs to the carrier set but carries a signature different from the owner's signature, or (iii) the image does not belong to the carrier set distribution (even if it is signed with the owner's real signature). For WM accuracy evaluation, we randomly sampled 15% of the WM carrier set. After that, we signed them in different random positions and assigned them the corresponding labels. Figure 2 shows some examples of signed carrier set images and their corresponding labels. **Attacker configurations. ** We assumed the attacker has varying percentages of the training data, ranging from 1% to 30% of the original training data. The attacker's training data were randomly sampled from the original training data. We also assumed that the WM carrier set distribution is a secret between the owner and the authority, so we assigned the attacker different WM carrier sets from those of the owner. The attacker's private model was slightly different as well, because the owner's private model and its architecture are secret. The rest of the attacker's configurations and hyper-parameters were the same as the owner's. Table 3 summarizes the attacker's WM carrier sets and private model architectures. \begin{table}
\begin{tabular}{c c c c c} \hline
**Data Set** & **WM Carrier Set** & **DL Model** & **DL Model Architecture** & **Private Model Architecture** \\ \hline \multirow{3}{*}{CIFAR10} & \multirow{3}{*}{STL10} & ResNet18 & See [40]. & FC(10,20), FC(20,10), FC(10,6) \\  & & VGG16 & See [41]. & (496 learnable parameters) \\ \hline \multirow{3}{*}{FMNIST5} & \multirow{3}{*}{MNIST} & \multirow{3}{*}{CNN} & C(3,32,5,1,2), MP(2,1), & C(32,64,3,1,2), MP(2,1), \\  & & & FC(4096,4096), FC(4096,5) & FC(5, 10), FC(10,20), FC(20,6) \\ \cline{1-1}  & & \multirow{3}{*}{LeNet} & See [42]. & (411 learnable parameters) \\ \hline \end{tabular}
\end{table} 
Table 2: Data sets and deep learning model architectures. \(C(3,32,5,1,2)\) denotes a convolutional layer with 3 input channels, 32 output channels, a kernel of size \(5\times 5\), a stride of 1, and a padding of 2, \(MP(2,1)\) denotes a max-pooling layer with a kernel of size \(2\times 2\) and a stride of 1, and \(FC(10,20)\) indicates a fully connected layer with 10 inputs and 20 output neurons. We used _ReLU_ as an activation function in the hidden layers. We used _LogSoftmax_ as an activation function in the output layers for all DL models. The rightmost column contains the architecture of the corresponding private models. Figure 2: Examples of signed STL10 carrier set images employed with the CIFAR10 data set. Each image shows the signature position and its corresponding label. **Performance metric. ** We used _accuracy_ as performance metric to evaluate all the original and WM tasks. _Accuracy_ is the number of correct predictions divided by the total number of predictions. **Training hyperparameters.