Anti-Neuron Watermarking: Protecting Personal Data Against Unauthorized Neural Networks

TL;DR

This paper introduces a novel watermarking method using linear color transformations to protect individual user data from unauthorized neural network training, enabling verification of data ownership even when data is a small part of the training set.

Contribution

It presents the first approach to watermark individual user data for neural networks, using color transformations to embed verifiable signatures into trained models.

Findings

Watermarking with color transformations enables ownership verification.

The method is effective even when user data is a tiny training subset.

It provides a new tool for data protection in deep learning.

Abstract

We study protecting a user's data (images in this work) against a learner's unauthorized use in training neural networks. It is especially challenging when the user's data is only a tiny percentage of the learner's complete training set. We revisit the traditional watermarking under modern deep learning settings to tackle the challenge. We show that when a user watermarks images using a specialized linear color transformation, a neural network classifier will be imprinted with the signature so that a third-party arbitrator can verify the potentially unauthorized usage of the user data by inferring the watermark signature from the neural network. We also discuss what watermarking properties and signature spaces make the arbitrator's verification convincing. To our best knowledge, this work is the first to protect an individual user's data ownership from unauthorized use in training neural networks.