# RoSe-Mix: Robust and Secure Deep Neural Network Watermarking in Black-Box Settings via Image Mixup
## 1 Introduction  
Recent advances in machine learning (ML) have revolutionized many fields, like natural language processing [1], time series analysis [2], and computer vision [3]. Deep neural networks (DNNs) are the ML models that contribute the most to these advancements. However, their development necessitates important and huge resources, including large and high-quality datasets that are often difficult to obtain due to confidentiality constraints, expensive hardware, like GPUs, and the rare expertise of specialists for data annotation and of data science engineers to design well-adapted model architectures and hyper-parameters [4].  
As stated, training a DNN is a costly task, also making them valuable assets that need to be protected in terms of intellectual property (IP). To safeguard the latter, the most promising solution is DNN watermarking [5, 6, 7]. This allows the owner to embed a secret in the model in such a way that it proves its ownership. DNN watermarking is classified into two settings: white-box and black-box. These techniques are defined by the level ofaccess required by the watermark extractor. In the white-box technique [5, 8, 9, 10, 11, 12, 13, 14], internal parameters that directly correspond to the weights of the DNN models are accessible. In the black-box technique, only the final output of the DNN model is observed. In this case, the watermark is extracted by querying a set of trigger inputs to the DNN model [15, 16, 17, 18, 19, 20, 21, 22]. This set is called a trigger set and consists of crafted inputs and outputs to embed a backdoor in the model to prove ownership. However, these watermarking modulations have two main limitations. First, the set of samples created to embed the watermark is the same as those used to perform the verification. If the verifier is malicious, they can potentially steal this set and claim model ownership. Second, the choice of target labels is generally naive, leading to a minimal amount of work for a potential usurper to reverse engineer the input-output pairs a posteriori and then build an illegitimate IP proof. In this paper, we present RoSe-Mix, a black-box watermarking technique that takes advantage of two existing black-box watermarking techniques, RoSe [23] and Mixer [24], to exponentially increase the necessary work for an attacker to claim an illegitimate model. Our contributions are summarized as follows:  
* We present the strengths of RoSe [23] and Mixer [25] and demonstrate how their combination can enhance the security and robustness of the watermark while being merged into RoSe-Mix.
* We provide a security analysis of this method by formalizing the complexity for an attacker to break the watermarking scheme, demonstrating that breaking the watermarking protocol is exponentially hard with respect to the size of the selected secret key.
* We conduct experiments on several datasets and models to evaluate the performance of our proposed method.  
Section 2 provides an overview of DNN watermarking techniques. Section 3 describes our motivation to merge RoSe and Mixer and presents RoSe-Mix. Finally, Section 4 presents experimental results using different datasets and models.