2022/04/30 by Yifan Yan, Yan, Yifan, Xudong Pan +7 · 2 citations
Computer Science · Engineering · Mathematics · #Advanced Memory and Neural Computing #Advanced Neural Network Applications #Adversarial Robustness in Machine Learning #Artificial intelligence #Box office #Business #Computer Vision and Pattern Recognition (cs.CV) #Computer engineering #Computer science #Computer security #Cryptography and Security (cs.CR) #Digital watermarking #Distributed computing #FOS: Computer and information sciences #Image (mathematics) #Invariant (physics) #Machine Learning (cs.LG) #Mathematics #Operating system #Overhead (engineering) #Programming language #Set (abstract data type) #Theoretical computer science #Watermark #cs.CR #cs.CV #cs.LG
paper · pdf · doi:10.48550/arxiv.2205.00199
published in arXiv (Cornell University) (Cornell University) · in submission; a preprint version
openalex publication_date 2022/04/30 · arxiv created 2022/05/19 · arxiv updated 2022/05/20 · openalex created_date 2025/10/10 · openalex updated_date 2026/07/28
Recently, how to protect the Intellectual Property (IP) of deep neural networks (DNN) becomes a major concern for the AI industry. To combat potential model piracy, recent works explore various watermarking strategies to embed secret identity messages into the prediction behaviors or the internals (e.g., weights and neuron activation) of the target model. Sacrificing less functionality and involving more knowledge about the target model, the latter branch of watermarking schemes (i.e., white-box model watermarking) is claimed to be accurate, credible and secure against most known watermark removal attacks, with emerging research efforts and applications in the industry. In this paper, we present the first effective removal attack which cracks almost all the existing white-box watermarking schemes with provably no performance overhead and no required prior knowledge. By analyzing these IP protection mechanisms at the granularity of neurons, we for the first time discover their common dependence on a set of fragile features of a local neuron group, all of which can be arbitrarily tampered by our proposed chain of invariant neuron transforms. On 9 state-of-the-art white-box watermarking schemes and a broad set of industry-level DNN architectures, our attack for the first time reduces the embedded identity message in the protected models to be almost random. Meanwhile, unlike known removal attacks, our attack requires no prior knowledge on the training data distribution or the adopted watermark algorithms, and leaves model functionality intact.