# KeyNet: An Asymmetric Key-Style Framework for Watermarking Deep Learning Models
## 1 Introduction
### Contributions and Plan of This Article  
We propose _KeyNet_, a novel watermarking framework that meets a wide range of desirable requirements for effective watermarking. In particular it offers fidelity, robustness, reliability, integrity, capacity, security, authentication, uniqueness, and scalability. _KeyNet_ depends on three components: the WM carrier set distribution, the signature, and the marked model and its corresponding private model. The private model is trained \begin{table}
\begin{tabular}{p{142.3 pt} p{284.5 pt}} \hline \hline
**Requirement** & **Description** \\ \hline _Fidelity_ & The accuracy of the marked model on the original task shall not be degraded as a result of watermark embedding. \\ \hline _Robustness_ & The watermark shall be robust against model modifications such as model fine-tuning, model compression or WM overwriting. \\ \hline _Reliability_ & Watermark extraction shall exhibit a minimal false negative rate to allow legitimate owners to detect the WM with high probability. \\ \hline _Integrity_ & Watermark extraction shall result in a minimal amount of false positives; unmarked models must not be falsely claimed. \\ \hline _Capacity_ & It must be possible to include a large amount of watermark information in the target model. \\ \hline _Security_ & The watermark must not leave a detectable footprint on the marked model; an unauthorized party must not be able to detect the existence of a WM. \\ \hline _Unforgability_ & An attacker must not be able to claim ownership of another party’s watermark, or to embed additional watermarks into a marked model. \\ \hline _Authentication_ & A strong link between the owner and her watermark must be provided; reliable verification of the legitimate owner’s identity shall be guaranteed. \\ \hline _Generality_ & The watermarking methodology must be applicable to different DL architectures and data sets. \\ \hline _Efficiency_ & Embedding and extracting WMs shall not entail a large overhead. \\ \hline _Uniqueness_ & The watermarking methodology must be able to embed a unique watermark for each user in order to distinguish each distributed marked model individually. \\ \hline _Scalability_ & Unique watermarking must scale to many users. \\ \hline \hline \end{tabular}
\end{table} 
Table 1: Requirements for watermarking of deep learning models. together with the original model to decode the WM information from the marked model's predictions. The WM information is only triggered by passing a sample from the WM carrier set signed by the legitimate owner to the corresponding marked model. The predictions of the marked model represent the encoded WM information that can be decoded only by the corresponding private model. The private model takes the predictions as input and decodes the WM information. Unlike in previous works (discussed in Section 2), a watermarked input can take more than one label, which corresponds to the position of the owner's signature. Besides, the number of WM classes can be greater than the original task classes. To successfully embed the WM and preserve the original task accuracy, the owner leverages multi-task learning (MTL) to learn both the original and the watermarking tasks together. After that, the owner distributes the marked original model, and keeps the private model secret. The owner uses the private model as a private key to decode the original model's outputs on the WM carrier set. The main contributions of our work can be summarized as follows:  
* _KeyNet_ provides a strong link between the owner and her marked model by integrating two reliable authentication methods: a cryptographic hashing algorithm and a verification protocol. Furthermore, the use of a cryptographic hash improves the capacity of embedding WM information. Besides being robust against DL model modifications such as compression and fine-tuning, _KeyNet_ does not allow the WM to be overwritten by attackers without losing the accuracy of the original task.