A Game Between the Defender and the Attacker for Trigger-based Black-box Model Watermarking

TL;DR

This paper introduces a game-theoretic framework for trigger-based black-box watermarking of DNNs, providing a theoretical foundation for designing more robust watermarking schemes against attackers.

Contribution

It formulates a game between attacker and defender, defining payoff functions and optimal responses to advance the theoretical understanding of model watermarking.

Findings

Constructed payoff functions for attacker and defender

Determined optimal strategies for both players

Enriched the theoretical foundation of watermarking

Abstract

Watermarking deep neural network (DNN) models has attracted a great deal of attention and interest in recent years because of the increasing demand to protect the intellectual property of DNN models. Many practical algorithms have been proposed by covertly embedding a secret watermark into a given DNN model through either parametric/structural modulation or backdooring against intellectual property infringement from the attacker while preserving the model performance on the original task. Despite the performance of these approaches, the lack of basic research restricts the algorithmic design to either a trial-based method or a data-driven technique. This has motivated the authors in this paper to introduce a game between the model attacker and the model defender for trigger-based black-box model watermarking. For each of the two players, we construct the payoff function and determine the optimal response, which enriches the theoretical foundation of model watermarking and may inspire us to develop novel schemes in the future.