Protecting Intellectual Property of EEG-based Neural Networks with Watermarking

TL;DR

This paper presents a cryptographic watermarking framework for EEG-based neural networks that ensures robust intellectual property protection, high detection reliability, and resilience against various attacks while maintaining model accuracy.

Contribution

It introduces a novel wonder filter-based watermarking method tailored for EEG models, combining cryptographic techniques to enhance security and robustness against tampering and piracy.

Findings

Watermark detection accuracy exceeds 99.4% on the DEAP dataset.

Watermarked models retain over 90% classification accuracy after aggressive pruning.

Piracy resistance is demonstrated by inability to embed secondary watermarks without significant accuracy loss.

Abstract

EEG-based neural networks, pivotal in medical diagnosis and brain-computer interfaces, face significant intellectual property (IP) risks due to their reliance on sensitive neurophysiological data and resource-intensive development. Current watermarking methods, particularly those using abstract trigger sets, lack robust authentication and fail to address the unique challenges of EEG models. This paper introduces a cryptographic wonder filter-based watermarking framework tailored for EEG-based neural networks. Leveraging collision-resistant hashing and public-key encryption, the wonder filter embeds the watermark during training, ensuring minimal distortion ($\leq 5\%$ drop in EEG task accuracy) and high reliability (100\% watermark detection). The framework is rigorously evaluated against adversarial attacks, including fine-tuning, transfer learning, and neuron pruning. Results demonstrate persistent watermark retention, with classification accuracy for watermarked states remaining above 90\% even after aggressive pruning, while primary task performance degrades faster, deterring removal attempts. Piracy resistance is validated by the inability to embed secondary watermarks without severe accuracy loss ( $>10\%$ in EEGNet and CCNN models). Cryptographic hashing ensures authentication, reducing brute-force attack success probabilities. Evaluated on the DEAP dataset across models (CCNN, EEGNet, TSception), the method achieves $>99.4\%$ null-embedding accuracy, effectively eliminating false positives. By integrating wonder filters with EEG-specific adaptations, this work bridges a critical gap in IP protection for neurophysiological models, offering a secure, tamper-proof solution for healthcare and biometric applications. The framework's robustness against adversarial modifications underscores its potential to safeguard sensitive EEG models while maintaining diagnostic utility.