A Survey of Fragile Model Watermarking

TL;DR

This survey reviews the development of fragile model watermarking techniques used to detect tampering and alterations in neural network models, highlighting their importance in safeguarding model integrity.

Contribution

It provides a comprehensive overview and categorization of existing fragile watermarking methods, revealing the field's developmental trajectory and guiding future research.

Findings

Categorizes existing fragile watermarking techniques

Identifies key challenges and research directions

Highlights the importance of tampering detection in models

Abstract

Model fragile watermarking, inspired by both the field of adversarial attacks on neural networks and traditional multimedia fragile watermarking, has gradually emerged as a potent tool for detecting tampering, and has witnessed rapid development in recent years. Unlike robust watermarks, which are widely used for identifying model copyrights, fragile watermarks for models are designed to identify whether models have been subjected to unexpected alterations such as backdoors, poisoning, compression, among others. These alterations can pose unknown risks to model users, such as misidentifying stop signs as speed limit signs in classic autonomous driving scenarios. This paper provides an overview of the relevant work in the field of model fragile watermarking since its inception, categorizing them and revealing the developmental trajectory of the field, thus offering a comprehensive survey for future endeavors in model fragile watermarking.