Adversarial frontier stitching for remote neural network watermarking

• Published in: Neural computing & applications Vol. 32; no. 13; pp. 9233 - 9244
• Main Authors: Le Merrer, Erwan, Pérez, Patrick, Trédan, Gilles
• Format: Journal Article
• Language: English
• Published: London Springer London 01.07.2020; Springer Nature B.V; Springer Verlag
• Subjects: Algorithms; Artificial Intelligence; Artificial neural networks; Computational Biology/Bioinformatics; Computational Science and Engineering; Computer Science; Cryptography and Security; Data acquisition; Data Mining and Knowledge Discovery; Embedding; Image classification; Image Processing and Computer Vision; Machine learning; Neural and Evolutionary Computing; Neural networks; Object recognition; Original Article; Probability and Statistics in Computer Science; Queries; Stitching; Watermarking; Model decision frontiers; Neural network models; Black box interaction; Adversarial examples; Watermarking
• ISSN: 0941-0643; 1433-3058
• DOI: 10.1007/s00521-019-04434-z

The state-of-the-art performance of deep learning models comes at a high cost for companies and institutions, due to the tedious data collection and the heavy processing requirements. Recently, Nagai et al. (Int J Multimed Inf Retr 7(1):3–16, 2018), Uchida et al. (Embedding watermarks into deep neural networks, ICMR, 2017) proposed to watermark convolutional neural networks for image classification, by embedding information into their weights. While this is a clear progress toward model protection, this technique solely allows for extracting the watermark from a network that one accesses locally and entirely. Instead, we aim at allowing the extraction of the watermark from a neural network (or any other machine learning model) that is operated remotely , and available through a service API. To this end, we propose to mark the model’s action itself, tweaking slightly its decision frontiers so that a set of specific queries convey the desired information. In the present paper, we formally introduce the problem and propose a novel zero-bit watermarking algorithm that makes use of adversarial model examples . While limiting the loss of performance of the protected model, this algorithm allows subsequent extraction of the watermark using only few queries. We experimented the approach on three neural networks designed for image classification, in the context of MNIST digit recognition task.