Towards Traitor Tracing in Black-and-White-Box DNN Watermarking with Tardos-Based Codes

The growing popularity of Deep Neural Networks, which often require computationally expensive training and access to a vast amount of data, calls for accurate authorship verification methods to deter unlawful dissemination of the models and identify the source of the leak. In DNN watermarking the ow...

Full description

Saved in:
Bibliographic Details
Published in2023 IEEE International Workshop on Information Forensics and Security (WIFS) pp. 1 - 6
Main Authors Rodriguez-Lois, Elena, Perez-Gonzalez, Fernando
Format Conference Proceeding
LanguageEnglish
Published IEEE 04.12.2023
Subjects
Artificial neural networks
black-box
Closed box
Codes
Data security
DNN watermarking
fingerprinting
Forensics
Tardos codes
Training
traitor tracing
Watermarking
white-box
Online AccessGet full text

Cover

More Information
Summary:The growing popularity of Deep Neural Networks, which often require computationally expensive training and access to a vast amount of data, calls for accurate authorship verification methods to deter unlawful dissemination of the models and identify the source of the leak. In DNN watermarking the owner may have access to the full network (white-box) or only be able to extract information from its output to queries (black-box), but a watermarked model may include both approaches in order to gather sufficient evidence to then gain access to the network. Although there has been limited research in white-box watermarking that considers traitor tracing, this problem is yet to be explored in the black-box scenario. In this paper, we propose a black-and-white-box watermarking method for DNN classifiers that opens the door to collusion-resistant traitor tracing in black-box, exploiting the properties of Tardos codes, and making it possible to identify the source of the leak before access to the model is granted. While experimental results show that the method can successfully identify traitors, even when further attacks have been performed, we also discuss its limitations and open problems for traitor tracing in black-box.
ISSN:2157-4774
DOI:10.1109/WIFS58808.2023.10374879