Turning Your Weakness Into a Strength: Watermarking Deep Neural Networks by Backdooring

TL;DR

This paper introduces a black-box watermarking method for deep neural networks that preserves model performance, is robust against attacks, and can be integrated with existing training processes to protect intellectual property.

Contribution

It presents a novel watermarking scheme for DNNs that is applicable in black-box settings and theoretically relates to backdooring techniques.

Findings

Watermarking does not affect primary task accuracy.

The scheme is robust against various practical attacks.

Theoretical analysis links watermarking to backdooring methods.

Abstract

Deep Neural Networks have recently gained lots of success after enabling several breakthroughs in notoriously challenging problems. Training these networks is computationally expensive and requires vast amounts of training data. Selling such pre-trained models can, therefore, be a lucrative business model. Unfortunately, once the models are sold they can be easily copied and redistributed. To avoid this, a tracking mechanism to identify models as the intellectual property of a particular vendor is necessary. In this work, we present an approach for watermarking Deep Neural Networks in a black-box way. Our scheme works for general classification tasks and can easily be combined with current learning algorithms. We show experimentally that such a watermark has no noticeable impact on the primary task that the model is designed for and evaluate the robustness of our proposal against a multitude of practical attacks. Moreover, we provide a theoretical analysis, relating our approach to previous work on backdooring.