Logo
ScienceStack
Table of Contents
Fetching ...
Sign In

SEW: Strengthening Robustness of Black-box DNN Watermarking via Specificity Enhancement

Huming Qiu, Mi Zhang, Junjie Sun, Peiyi Chen, Xiaohan Zhang, Min Yang

TL;DR

This work addresses the vulnerability of black-box DNN watermarks to removal by focusing on watermark specificity. It defines a noise-upper-bound based metric to quantify specificity and introduces Specificity-Enhanced Watermarking (SEW), which uses a key dataset and an adaptive cover dataset to suppress approximate keys while preserving watermark verification. Empirical results on CIFAR-10/100 and TinyImageNet show SEW significantly improves robustness against six removal attacks with negligible impact on accuracy and verification, and the approach extends to NLP with similar gains and stealth. The paper also provides an open-source implementation and discusses practical trade-offs and future directions for broader applicability and defense enhancements.

Abstract

To ensure the responsible distribution and use of open-source deep neural networks (DNNs), DNN watermarking has become a crucial technique to trace and verify unauthorized model replication or misuse. In practice, black-box watermarks manifest as specific predictive behaviors for specially crafted samples. However, due to the generalization nature of DNNs, the keys to extracting the watermark message are not unique, which would provide attackers with more opportunities. Advanced attack techniques can reverse-engineer approximate replacements for the original watermark keys, enabling subsequent watermark removal. In this paper, we explore black-box DNN watermarking specificity, which refers to the accuracy of a watermark's response to a key. Using this concept, we introduce Specificity-Enhanced Watermarking (SEW), a new method that improves specificity by reducing the association between the watermark and approximate keys. Through extensive evaluation using three popular watermarking benchmarks, we validate that enhancing specificity significantly contributes to strengthening robustness against removal attacks. SEW effectively defends against six state-of-the-art removal attacks, while maintaining model usability and watermark verification performance.

SEW: Strengthening Robustness of Black-box DNN Watermarking via Specificity Enhancement

TL;DR

This work addresses the vulnerability of black-box DNN watermarks to removal by focusing on watermark specificity. It defines a noise-upper-bound based metric to quantify specificity and introduces Specificity-Enhanced Watermarking (SEW), which uses a key dataset and an adaptive cover dataset to suppress approximate keys while preserving watermark verification. Empirical results on CIFAR-10/100 and TinyImageNet show SEW significantly improves robustness against six removal attacks with negligible impact on accuracy and verification, and the approach extends to NLP with similar gains and stealth. The paper also provides an open-source implementation and discusses practical trade-offs and future directions for broader applicability and defense enhancements.

Abstract

To ensure the responsible distribution and use of open-source deep neural networks (DNNs), DNN watermarking has become a crucial technique to trace and verify unauthorized model replication or misuse. In practice, black-box watermarks manifest as specific predictive behaviors for specially crafted samples. However, due to the generalization nature of DNNs, the keys to extracting the watermark message are not unique, which would provide attackers with more opportunities. Advanced attack techniques can reverse-engineer approximate replacements for the original watermark keys, enabling subsequent watermark removal. In this paper, we explore black-box DNN watermarking specificity, which refers to the accuracy of a watermark's response to a key. Using this concept, we introduce Specificity-Enhanced Watermarking (SEW), a new method that improves specificity by reducing the association between the watermark and approximate keys. Through extensive evaluation using three popular watermarking benchmarks, we validate that enhancing specificity significantly contributes to strengthening robustness against removal attacks. SEW effectively defends against six state-of-the-art removal attacks, while maintaining model usability and watermark verification performance.
Paper Structure (26 sections, 5 equations, 8 figures, 6 tables, 1 algorithm)

This paper contains 26 sections, 5 equations, 8 figures, 6 tables, 1 algorithm.

Table of Contents

  1. Introduction
  2. Related Work
  3. Black-box DNN watermarking
  4. Watermark Removal Attacks
  5. SECURITY SETTINGS
  6. Threat Model
  7. Limitations of Extraction Attacks
  8. Methodology
  9. Watermark Specificity Measurement
  10. Watermark Specificity Enhancement
  11. Evaluation Results
  12. Evaluation Setups
  13. RQ1: Specificity Evaluation
  14. RQ2: Robustness Evaluation
  15. RQ3: Explanation of Robustness
  16. ...and 11 more sections

Figures (8)

  • Figure 1: Examples of reverse-engineered keys generated by watermark removal attacks. The first column shows the original key with "TEST" text and full-image noise, while the last three columns display the reverse-engineered keys.
  • Figure 2: Noise addition analysis process for samples with the watermark key, the fuzzy state indicate being in the noise upper bound.
  • Figure 3: Overview of SEW.
  • Figure 4: Performance of Fine-Tuning and Fine-Pruning on SEW.
  • Figure 5: [RQ 2] The reverse-engineered keys by Neural Cleanse on the target label.
  • ...and 3 more figures

Theorems & Definitions (3)

  • definition 1
  • definition 2
  • definition 3