DeepiSign-G: Generic Watermark to Stamp Hidden DNN Parameters for Self-contained Tracking

TL;DR

DeepiSign-G introduces a versatile, fragile watermarking technique embedded in model parameters' Walsh-Hadamard transform coefficients, enabling comprehensive, self-contained verification of CNN and RNN models against various attacks without performance loss.

Contribution

It presents DeepiSign-G, a novel watermarking method applicable to multiple DNN architectures, enhancing security and integrity verification with high detection accuracy and metadata embedding capabilities.

Findings

Effectively detects model modifications across architectures.

Maintains model performance while embedding watermarks.

Achieves nearly perfect attack detection with minimal coefficient hiding.

Abstract

Deep learning solutions in critical domains like autonomous vehicles, facial recognition, and sentiment analysis require caution due to the severe consequences of errors. Research shows these models are vulnerable to adversarial attacks, such as data poisoning and neural trojaning, which can covertly manipulate model behavior, compromising reliability and safety. Current defense strategies like watermarking have limitations: they fail to detect all model modifications and primarily focus on attacks on CNNs in the image domain, neglecting other critical architectures like RNNs. To address these gaps, we introduce DeepiSign-G, a versatile watermarking approach designed for comprehensive verification of leading DNN architectures, including CNNs and RNNs. DeepiSign-G enhances model security by embedding an invisible watermark within the Walsh-Hadamard transform coefficients of the model's parameters. This watermark is highly sensitive and fragile, ensuring prompt detection of any modifications. Unlike traditional hashing techniques, DeepiSign-G allows substantial metadata incorporation directly within the model, enabling detailed, self-contained tracking and verification. We demonstrate DeepiSign-G's applicability across various architectures, including CNN models (VGG, ResNets, DenseNet) and RNNs (Text sentiment classifier). We experiment with four popular datasets: VGG Face, CIFAR10, GTSRB Traffic Sign, and Large Movie Review. We also evaluate DeepiSign-G under five potential attacks. Our comprehensive evaluation confirms that DeepiSign-G effectively detects these attacks without compromising CNN and RNN model performance, highlighting its efficacy as a robust security measure for deep learning applications. Detection of integrity breaches is nearly perfect, while hiding only a bit in approximately 1% of the Walsh-Hadamard coefficients.