# Watermarking Tiny MLCommons Image Applications Without Extra Deployability Costs
## 6 Approaches Being Modeled
### Watermarking by Means of Backdooring
#### 6.2.4 Trigger Dataset Generated Using GANs  
To guarantee the distinctiveness required by the watermarking applications, one of the preferred approaches involved the creation of novel, one-of-a-kind images. This was achieved through the application of generative adversarial networks (GANs), which were capable of synthesizing unique visual content. GAN was introduced by ref. [50] as the first approach for generative AI (GenAI).  
GANs are a class of ML topologies capable of generating realistic image data by pitting two NNs against each other. A GAN consists of two main components.  
Generator (G) generates new image samples from random noise inputs. G is initialized to produce random outputs. Then, G is trained to produce images that the discriminator (D) will classify as real.  
D is initialized to classify input images as real or fake. It evaluates the authenticity of the generated samples by G, distinguishing the real samples from the fake samples G generated.  
The NNs are trained in alternating steps: this is done by back-propagating the D's feedback through the G, adjusting its weights to improve the realism of the generated images. The training aims to reach a state where the G produces highly realistic images that the D can no longer distinguish from real images, leading to a D accuracy of around 50%. D's loss measures how well the D can distinguish between real and fake images, and the G's loss measures how well the G can fool the D into believing its outputs are real. Over time, the G improves and produces increasingly realistic images that are difficult to differentiate from real images, achieving high-quality data generation. However, in this work, the G produced images without the need to be fully differentiable from the original images, such that they can be distinguished from each other. They were only required to be classifiable somehow and uncorrelated with each other. In the approach implemented, the G model was loaded in memory at the beginning from a given file. G has been previously trained to generate images that mimic the distribution of CIFAR-10. Random noise vectors were the input to G as seeds from which G produced many images. For each noise vector, the G outputs a synthetic image. However, these images did not have the desired output resolution; therefore, they were resized to the target dimension of the NN model input size. The resizing ensured that all generated images had a consistent resolution, which is suitable for applications that require a fixed input dimension.  
After resizing, the pixel values of the generated images were adjusted from their original range (between \(-1\) and \(1\) due to the use of the \(TanH\) activation function in the G's output layer) to the standard 8-bit range. This scaling was also required to visualize and process them through common image-processing tools and libraries. Then, the array of generated images was stored as a NumPy array. This file format was convenient for storing large arrays of data and can be easily loaded for further analysis and processing. An example of these images can be seen in Figure 4.