  Due to the wide use of highly-valuable and large-scale deep neural networks
(DNNs), it becomes crucial to protect the intellectual property of DNNs so that
the ownership of disputed or stolen DNNs can be verified. Most existing
solutions embed backdoors in DNN model training such that DNN ownership can be
verified by triggering distinguishable model behaviors with a set of secret
inputs. However, such solutions are vulnerable to model fine-tuning and
pruning. They also suffer from fraudulent ownership claim as attackers can
discover adversarial samples and use them as secret inputs to trigger
distinguishable behaviors from stolen models. To address these problems, we
propose a novel DNN watermarking solution, named HufuNet, for protecting the
ownership of DNN models. We evaluate HufuNet rigorously on four benchmark
datasets with five popular DNN models, including convolutional neural network
(CNN) and recurrent neural network (RNN). The experiments demonstrate HufuNet
is highly robust against model fine-tuning/pruning, kernels cutoff/supplement,
functionality-equivalent attack, and fraudulent ownership claims, thus highly
promising to protect large-scale DNN models in the real-world.
