Towards Robust Model Watermark via Reducing Parametric Vulnerability

TL;DR

This paper proposes a new approach to enhance the robustness of neural network watermarks by minimizing parametric vulnerabilities, making it harder for attackers to remove watermarks through fine-tuning or other attacks.

Contribution

It introduces a mini-max formulation to identify and recover watermark behaviors in models vulnerable to removal, significantly improving watermark robustness.

Findings

Enhanced watermark robustness against removal attacks

Identified many watermark-removed models near watermarked models

Proposed method effectively recovers watermark behavior

Abstract

Deep neural networks are valuable assets considering their commercial benefits and huge demands for costly annotation and computation resources. To protect the copyright of DNNs, backdoor-based ownership verification becomes popular recently, in which the model owner can watermark the model by embedding a specific backdoor behavior before releasing it. The defenders (usually the model owners) can identify whether a suspicious third-party model is ``stolen'' from them based on the presence of the behavior. Unfortunately, these watermarks are proven to be vulnerable to removal attacks even like fine-tuning. To further explore this vulnerability, we investigate the parameter space and find there exist many watermark-removed models in the vicinity of the watermarked one, which may be easily used by removal attacks. Inspired by this finding, we propose a mini-max formulation to find these watermark-removed models and recover their watermark behavior. Extensive experiments demonstrate that our method improves the robustness of the model watermarking against parametric changes and numerous watermark-removal attacks. The codes for reproducing our main experiments are available at \url{https://github.com/GuanhaoGan/robust-model-watermarking}.