DeepTracer: Tracing Stolen Model via Deep Coupled Watermarks

TL;DR

DeepTracer introduces a robust watermarking framework that embeds watermarks into models in a way that resists removal during stealing attacks, ensuring reliable ownership verification.

Contribution

The paper proposes a novel watermarking method with a coupling loss and sample filtering to enhance robustness against model stealing and watermark removal.

Findings

Outperforms existing watermarking methods in robustness

Effective in defending against model stealing attacks

Achieves state-of-the-art results across multiple datasets

Abstract

Model watermarking techniques can embed watermark information into the protected model for ownership declaration by constructing specific input-output pairs. However, existing watermarks are easily removed when facing model stealing attacks, and make it difficult for model owners to effectively verify the copyright of stolen models. In this paper, we analyze the root cause of the failure of current watermarking methods under model stealing scenarios and then explore potential solutions. Specifically, we introduce a robust watermarking framework, DeepTracer, which leverages a novel watermark samples construction method and a same-class coupling loss constraint. DeepTracer can incur a high-coupling model between watermark task and primary task that makes adversaries inevitably learn the hidden watermark task when stealing the primary task functionality. Furthermore, we propose an effective watermark samples filtering mechanism that elaborately select watermark key samples used in model ownership verification to enhance the reliability of watermarks. Extensive experiments across multiple datasets and models demonstrate that our method surpasses existing approaches in defending against various model stealing attacks, as well as watermark attacks, and achieves new state-of-the-art effectiveness and robustness.