Hashed Watermark as a Filter: Defeating Forging and Overwriting Attacks
  in Weight-based Neural Network Watermarking
Authors: name: Yuan Yao, name: Jin Song, name: Jian Jin

As valuable digital assets, deep neural networks necessitate robust ownership
protection, positioning neural network watermarking (NNW) as a promising
solution. Among various NNW approaches, weight-based methods are favored for
their simplicity and practicality; however, they remain vulnerable to forging
and overwriting attacks. To address those challenges, we propose NeuralMark, a
robust method built around a hashed watermark filter. Specifically, we utilize
a hash function to generate an irreversible binary watermark from a secret key,
which is then used as a filter to select the model parameters for embedding.
This design cleverly intertwines the embedding parameters with the hashed
watermark, providing a robust defense against both forging and overwriting
attacks. An average pooling is also incorporated to resist fine-tuning and
pruning attacks. Furthermore, it can be seamlessly integrated into various
neural network architectures, ensuring broad applicability. Theoretically, we
analyze its security boundary. Empirically, we verify its effectiveness and
robustness across 13 distinct Convolutional and Transformer architectures,
covering five image classification tasks and one text generation task. The
source codes are available at https://github.com/AIResearch-Group/NeuralMark.