# KeyNet: An Asymmetric Key-Style Framework for Watermarking Deep Learning Models
## 5 Experimental Results
### Experiments and Results
\begin{table}
\begin{tabular}{c c c c c c c c c c c c} \hline Data Set & \multicolumn{8}{c}{**CIFAR10**} & \multicolumn{8}{c}{**FMNIST5**} \\ \hline DL model & \multicolumn{3}{c}{ResNet18} & \multicolumn{3}{c}{VGG16} & \multicolumn{3}{c}{CNN} & \multicolumn{3}{c}{LeNet} \\ \hline Number of epochs & 50 & 100 & 200 & 50 & 100 & 200 & 50 & 100 & 200 & 50 & 100 & 200 \\ \hline Marked model & 92.40 & 92.33 & 92.47 & 91.31 & 91.64 & 91.69 & 92.30 & 92.52 & 92.40 & 89.84 & 90.06 & 90.12 \\ Accuracy \% & 98.19 & 98.05 & 99.12 & 97.20 & 94.72 & 96.67 & 97.35 & 97.02 & 96.92 & 98.23 & 97.42 & 96.4 \\ \hline \end{tabular}
\end{table} 
Table 6: Fine-tuning results. In the fine-tuning attack, the marked models were retrained based on the original task loss only. Figure 3: Robustness against model compression. The X-axis indicates the pruning levels we used for each marked model. The blue bars indicate the marked model accuracy in the original task, while the orange bars indicate the accuracy of WM detection. The horizontal dotted line indicates the threshold \(T=90\%\) used to verify the ownership of the model. our watermark easily survives the attacks in the conditions described in [49]. For fractions above 10%, the accuracy of the marked model became competitive, but an attacker holding such a large amount of training data can easily train her own model and has no need to pirate the owner's model [18]. **Integrity. **_KeyNet_ meets the integrity requirement by yielding low WM accuracy detection with unmarked models, and thus it does not falsely claim ownership of models owned by a third party. In our experiments, there were 6 classes for the watermarking task. Looking at Table 9, the accuracy of falsely claimed ownership of unmarked models is not far from guessing 1 out of 6 numbers randomly, which equals approximately 16.6%. **Authentication. **_KeyNet_ fulfills the authentication requirement by design. Using a cryptographic hash function such as _SHA256_ to generate the owners' signatures establishes a strong link between owners and their WMs. Furthermore, the verification protocol of _KeyNet_ provides strong evidence of ownership. When the authority uses a fake signature, the marked model does not respond. This dual authentication method provides unquestionable confidence in the identity of the legitimate owner. **Security. ** As _KeyNet_ embeds the WM in the dynamic content of DL models through joint training, and as modern deep learning models contain a huge number of parameters, detecting the presence of the WM in such models is infeasible. In case the attacker knows that a model contains WM information and wants to destroy it, he/she will only be able to do so by also impairing the accuracy of the model in the original task. Regarding the security of the owner's signature, the use of a strong cryptographic hash function, such as SHA256, provides high security, as we next justify. On the one hand, if the signature size \(s\) is taken long enough, it is virtually impossible for two different parties to have the same signature: the probability of collision for \(s\) hexadecimal digits is \(1/16^{s}\), so \(s=25\) \begin{table}
\begin{tabular}{c c c c c c c c c c c c c} \hline \multicolumn{1}{c}{**Dataset**} & \multicolumn{10}{c}{**CIFAR10**} \\ \hline
**DL Model** & \multicolumn{10}{c}{**ResNet18**} & \multicolumn{10}{c}{**VGG16**} \\ \hline
**Data fraction \%** & 1 & 3 & 6 & 10 & 20 & 30 & 1 & 3 & 6 & 10 & 20 & 30 \\ \hline
**Marked model** & 92.53 & 92.53 & 92.53 & 92.53 & 92.53 & 92.53 & 92.53 & 91.74 & 91.74 & 91.74 & 91.74 & 91.74 \\
**Accuracy after \%** & 39.05 & 63.75 & 83.31 & 86.35 & 89.91 & 90.9 & 34.61 & 71.86 & 81.2 & 83.9 & 88.07 & 89.67 \\ \hline
**Owners’ WM detection** & 24.53 & 20.35 & 22.27 & 28.3 & 37.33 & 41.15 & 32.32 & 30.88 & 28.61 & 32.48 & 30.32 & 44.4 \\
**Accuracy after \%** & 99.97 & 99.89 & 99.95 & 99.9 & 99.94 & 99.97 & 99.69 & 99.68 & 99.89 & 99.87 & 99.9 & 99.96 \\ \hline \end{tabular}
\end{table} 
Table 7: Overwriting attack results with CIFAR10 marked models.