# RoSe-Mix: Robust and Secure Deep Neural Network Watermarking in Black-Box Settings via Image Mixup
## 2 Related Works  
In this section, we introduce the notion of DNN watermarking by defining its requirements and properties. We then present state-of-the-art methods, particularly focusing on RoSe [23] and Mixer [25], the two key methods used in our proposal. DNN watermarking is a technique that consists of embedding a secret in a model. This secret can then be extracted later and used by its owner to identify or track the model's illegal copies. To be usable in a real scenario, the watermarking modulation should respect several properties [26]. The first one concerns the model's fidelity, which quantifies the performance degradation on the main task of the model after watermark embedding. The second property is the robustness of the watermark, which defines whether the watermark resists various model modifications (intentional or not). Finally, security corresponds to the difficulty for an attacker to estimate the secret key linked to the watermark. The first DNN watermarking modulation was proposed by [PERSON] et al. [5] and consists of embedding a binary string in the model parameters using a regularization term and a secret key. When the model owner wants to extract the secret binary string, it is mandatory to have full access to the model parameters. This constraint categorizes the method as a white-box technique [8, 10, 11, 12, 27, 28]. On the other hand, black-box techniques rely on the fact that only the inputs and outputs of the model are accessible during the verification phase. This scenario fits well with machine learning as a service application where DNNs are available through an API. Relying on this assumption, black-box watermarking techniques hide the secret in the model's behavior. [PERSON] et al. [PERSON] et al. (2018) were the first to propose such a technique. Their main contribution is the definition of the trigger set \(S_{e}\), which is a set of crafted inputs, \(\widehat{X}\), and outputs, \(\widehat{Y}\), used to create a backdoor in the model. This backdoor is then used by the owner to recognize its possibly stolen model. In their paper, \(\widehat{X}\) is composed of unrelated images (i.e., out-of-distribution images), while \(\widehat{Y}\) is randomly selected from the set of classes, \(\mathcal{C}\). Several methods have been developed focusing on how to build the trigger set. We can also cite [PERSON] et al. (2017), who used training images with additional patterns (text or noise) to trigger the model. Other methods craft \(S_{e}\) using different techniques, such as adversarial examples ([PERSON] et al., 2017) or invisible masks ([PERSON] et al., 2017). While the majority of existing methods focus on the machine-learning aspect of the problem, i.e., how to embed a watermark that respects the fidelity and robustness requirements, few are interested in the security side. To improve the security of the watermark, [PERSON] et al. [PERSON] et al. (2018) proposed a black-box watermarking protocol called RoSe. This method uses one-way hashing functions and the injection of image-label pairs into the DNN during training, with these pairs serving as the trigger set for verifying ownership of a possibly stolen model. This method demonstrates strong security guarantees since breaking the watermarking scheme is NP-hard. Figure 1 illustrates this process for the MNIST dataset. In their subsequent work, they introduce Mixer (2018), a black-box watermarking technique where the triggers used during training differ from those used for ownership verification. To achieve this, they use the principle of Mixup, a data augmentation technique originally proposed by [PERSON] et al. (2017), where new training samples are created by combining pairs of samples and their corresponding labels. By doing so, the method breaks the dependency on a fixed trigger set and its limited size. Figure 2 shows the Mixer process to generate one sample with \(k=2\). Figure 1: RoSe method applied to the MNIST dataset for trigger set generation.