# KeyNet: An Asymmetric Key-Style Framework for Watermarking Deep Learning Models
## 5 Experimental Results
### Experiments and Results
Once we got two unique carrier sets, we trained two unique marked models, each one with its corresponding private model using Algorithm 2. In the end, we got two unique marked copies of the model with their corresponding private models and users. We distributed each copy to its corresponding user. We then assumed that _User 1_, respectively, _User 2_, leaked their model, and we tried to find the leaker as follows. 1. We took a small set (say 6 samples) of the WM carrier set. 2. We signed a copy of these samples in random places with _User1_'s joint signature; another copy was also signed in the same way for _User2_. 3. We queried \(h^{\prime}\) (the allegedly leaked model) with the samples signed by _User1_ to obtain their predictions. We did the same with _User2_ samples. \begin{table}
\begin{tabular}{c c c c c c c} \hline \hline \multirow{2}{*}{**Dataset**} & \multirow{2}{*}{**DL Model**} & \multirow{2}{*}{
\begin{tabular}{c} **Watermark Detection Accuracy** \\ **with Marked Models\%** \\ \end{tabular} } & \multicolumn{4}{c}{**Watermark Detection Accuracy**} \\  & & & & **with Unmarked Models \%** \\ \cline{3-6}  & & & **Same Topology** & **Accuracy** & **Different Topology** & **Accuracy** \\ \hline
**CIFAR10** & **ResNet18** & 99.97\% & ResNet18 & 18.92\% & VGG16 & 19.80\% \\
**CIFAR10** & **VGG16** & 99.89\% & VGG16 & 7.92\% & ResNet18 & 12.32\% \\
**FMNIST5** & **CNN** & 99.98\% & CNN & 12.96\% & ResNet & 10.97\% \\
**FMNIST5** & **LeNet** & 99.55\% & LeNet & 17.93\% & CNN & 17.75\% \\ \hline \hline \end{tabular}
\end{table} 
Table 9: Integrity results with unmarked models. Each private model was tested with two different unmarked models: one model has the same topology as its corresponding marked model, the other one has a different topology. The last four columns show the accuracy detection obtained with the unmarked models. 4. We passed the predictions from samples signed with _[PERSON]_'s signature to her private model and calculated the accuracy at detecting the WM. We did the same with _[PERSON]_'s predictions and his private model. Figure 4a shows the results of model owner detection if _[PERSON]_ leaked her model. We see that we were able to determine that the model copy was most likely leaked by _[PERSON]_. Figure 4(a1) shows the normalized confusion matrix of _[PERSON]_'s private model in detecting the WM information using the predictions of _[PERSON]_'s remote model. It shows that the accuracy at detecting signature positions was almost 100% when we sent the samples signed by _[PERSON]_. Figure 4(a2) shows the normalized confusion matrix of _[PERSON]_'s private model in detecting the WM information by using the predictions of _[PERSON]_'s remote model when the samples were signed with _[PERSON]_' signature. As _[PERSON]_'s model was trained to distinguish only _[PERSON]_'s signature position, it output features that led _[PERSON]_'s private model to provide label 0 for samples signed by _User2_. Figure 4b provides similar results when _[PERSON]_ leaked his model. The same conclusions hold. Note that the private models were unable to distinguish the signature positions and output the label 0 when they were fed with predictions of non-corresponding marked models and non-corresponding signatures. This is an interesting feature of _KeyNet_, as all the remote models and their private models learned a common representation of label 0. Regarding **scalability**, if we want to query a remote model in case we have \(u\) users and we decide to use \(m\) signed samples for verification, then the number of remote model queries will be \(u\times m\), and thus linear in \(u\). **Efficiency and generality. ** The efficiency of _KeyNet_ is related to the size of the output of the model to be marked. The smaller the number of output neurons, the fewer the  
Figure 4: Normalized confusion matrices of the accuracy in detecting the individual copies of the FMNIST5-CNN model distributed among two users. Subfigure (**a**) shows the detection accuracy of the predictions of _User1_’ copy.