# RoSe-Mix: Robust and Secure Deep Neural Network Watermarking in Black-Box Settings via Image Mixup
## 3 Proposed Method
### RoSe-Mix: A Hybrid Watermarking Approach  
In this section, we introduce our proposed method, which combines the secret-keyed hash function from RoSe with the Dirichlet distribution from Mixer to generate the mixing coefficients, denoted by \(\mathbf{\lambda}\) and \(\mathbf{\mu}\). These coefficients are then used to create trigger samples and their corresponding labels, leveraging the strengths of both methods. This fusion improves the security of the watermark generation, allowing for ownership verification using unseen samples. The generation of the trigger set begins by selecting a set of \(n_{e}\) images, namely \(\{x_{1},x_{2},\ldots,x_{n_{e}}\}\), from the training set \(D_{\text{train}}=\{(x_{i},y_{i})\}_{i=1}^{n}\subset\mathcal{X}\times\mathcal{C}\), where \(n\) is the number of training samples, \(\mathcal{X}\) the input space, and \(\mathcal{C}=\{1,\ldots,c\}\) the set of classes. These images are concatenated and hashed using a cryptographic hash function, \(H\), with the secret key, \(sk\), resulting in a unique bitstream:  
\[\text{bitstream}=H(x_{1}\|x_{2}\|\ldots\|x_{n_{e}};sk), \tag{1}\]  
This bitstream is then transformed into a numeric seed by applying the function \(\mathcal{O}_{H}(\cdot)\):  
\[\text{seed}=\mathcal{O}_{H}(\text{bitstream}), \tag{2}\]  
Using this seed, a deterministic sequence of random numbers is generated, which is then used to form the vector \(\mathbf{\alpha}=(\alpha_{1},\ldots,\alpha_{k})\). This vector serves as a parameter for a Dirichlet distribution that generates the mixing coefficients \(\mathbf{\lambda}=(\lambda_{1},\ldots,\lambda_{k})\):  
\[\mathbf{\lambda}\sim\text{Dirichlet}(\mathbf{\alpha}), \tag{3}\]  
The same procedure is repeated to generate the coefficients in \(\mathbf{\mu}\). These coefficients are used to generate the new pairs of samples by merging them according to the Mixup principle described in Mixer [25]. For inputs, we have the following rule to generate a key input, \(\tilde{x}_{s}\):  
\[\tilde{x}_{s}=\text{clip}\left(\sum_{i=1}^{k}\lambda_{i}x_{i}+x_{\text{ overlay}}\right), \tag{4}\]  
where \(x_{\text{overlay}}\) is an additive overlay added to the Mixup sample to enhance secrecy, and clip ensures that the pixel values remain within valid limits. These Mixer samples form the set of inputs \(\tilde{X}=\{\tilde{x}_{s}\}_{s=1}^{n_{e}}\). Figure 3 shows an example of samples from the trigger set generated as described previously. As an example, Figure 3d is a mixed sample between a car, \(x_{1}\), and a horse, \(x_{2}\), where \(\lambda_{1}>\lambda_{2}\). Next, the corresponding labels for the Mixer samples are generated. For each Mixer sample, \(\tilde{x}_{s}\), the true labels, \(y_{i}\), of the constituent images, \(x_{i}\), are converted to their one-hot  
Figure 3: Examples of trigger set samples created using RoSe-Mix. All samples are built from the CIFAR10 dataset [29], where \(k=2\). The small squares represent the overlay, \(x_{\text{overlay}}\)encoded forms, \(\mathbf{y}_{i}\). The key label, \(\bar{y}_{s}\), for the Mixer sample is a combination of these one-hot encoded labels, weighted by the \(\mu_{i}\) coefficients:  
\[\bar{y}_{s}=\sum_{i=1}^{k}\mu_{i}\mathbf{y}_{i}, \tag{5}\]  
where \(\sum_{i=1}^{k}\mu_{i}=1\). The set of all generated labels, \(\bar{Y}\), corresponds to the Mixer samples in \(\bar{X}\) and forms the trigger set \(S_{e}=\{(\bar{s}_{s},\bar{y}_{s})\}_{s=1}^{n_{e}}\). Once the Mixer trigger set, \(S_{e}\), is created, it is combined with the training dataset, \(D_{\text{train}}\), during the training phase of the model. It can also be applied with fine-tuning in the case where we distribute the model among several clients (called traitor tracking in watermarking [30]). By including these watermarked samples in the training process, the model learns to associate specific patterns with the watermarked outputs, embedding the watermark in its behavior. This process ensures that the model is capable of recognizing these mixed-up patterns, even for unseen data during verification.