Unambiguous and High-Fidelity Backdoor Watermarking for Deep Neural Networks

Page view(s)
89
Checked on Nov 27, 2024
Unambiguous and High-Fidelity Backdoor Watermarking for Deep Neural Networks
Title:
Unambiguous and High-Fidelity Backdoor Watermarking for Deep Neural Networks
Journal Title:
IEEE Transactions on Neural Networks and Learning Systems
Publication Date:
06 March 2023
Citation:
Hua, G., Teoh, A. B. J., Xiang, Y., & Jiang, H. (2023). Unambiguous and High-Fidelity Backdoor Watermarking for Deep Neural Networks. IEEE Transactions on Neural Networks and Learning Systems, 1–14. https://doi.org/10.1109/tnnls.2023.3250210
Abstract:
The unprecedented success of deep learning could not be achieved without the synergy of big data, computing power, and human knowledge, among which none is free. This calls for the copyright protection of deep neural networks (DNNs), which has been tackled via DNN watermarking. Due to the special structure of DNNs, backdoor watermarks have been one of the popular solutions. In this article, we first present a big picture of DNN watermarking scenarios with rigorous definitions unifying the black-and white-box concepts across watermark embedding, attack, and verification phases. Then, from the perspective of data diversity, especially adversarial and open set examples overlooked in the existing works, we rigorously reveal the vulnerability of backdoor watermarks against black-box ambiguity attacks. To solve this problem, we propose an unambiguous backdoor watermarking scheme via the design of deterministically dependent trigger samples and labels, showing that the cost of ambiguity attacks will increase from the existing linear complexity to exponential complexity. Furthermore, noting that the existing definition of backdoor fidelity is solely concerned with classification accuracy, we propose to more rigorously evaluate fidelity via examining training data feature distributions and decision boundaries before and after backdoor embedding. Incorporating the proposed prototype guided regularizer (PGR) and fine-tune all layers (FTAL) strategy, we show that backdoor fidelity can be substantially improved. Experimental results using two versions of the basic ResNet18, advanced wide residual network (WRN28_10) and EfficientNet-B0, on MNIST, CIFAR-10, CIFAR-100, and FOOD-101 classification tasks, respectively, illustrate the advantages of the proposed method.
License type:
Publisher Copyright
Funding Info:
This work was supported in part by the 2020–2021 International Scholar Exchange Fellowship (ISEF) Program through the Chey Institute for Advanced Studies, South Korea; and in part by the National Natural Science Foundation of China (NSFC) under Grant U19B2004.
Description:
© 2023 IEEE. Personal use of this material is permitted. Permission from IEEE must be obtained for all other uses, in any current or future media, including reprinting/republishing this material for advertising or promotional purposes, creating new collective works, for resale or redistribution to servers or lists, or reuse of any copyrighted component of this work in other works.
ISSN:
2162-237X
2162-2388
Files uploaded:

File Size Format Action
unambiguous-and-high-fidelity-backdoor-watermarking-for-deep-neural-networks-amended.pdf 1.79 MB PDF Request a copy