# Digital Watermarking for Deep Neural Networks

arXiv: https://arxiv.org/abs/1802.02601 · HTML: https://mlsanity.com/paper/1802.02601/

## Key facts

- Cited by 39 papers in the map (data through 14 Oct 2026).
- First posted on arXiv 6 Feb 2018.

## Built on by (most cited first, 30 of 39)

- [Deep Model Intellectual Property Protection via Deep Watermarking](https://mlsanity.com/paper/2103.04980/) (2021)
- [Frequency Domain-based Dataset Distillation](https://mlsanity.com/paper/2311.08819/) (2023)
- [Model Barrier: A Compact Un-Transferable Isolation Domain for Model Intellectual Property Protection](https://mlsanity.com/paper/2303.11078/) (2023)
- [Identifying Appropriate Intellectual Property Protection Mechanisms for Machine Learning Models: A Systematization of Watermarking, Fingerprinting, Model Access, and Attacks](https://mlsanity.com/paper/2304.11285/) (2023)
- [Does Your Neural Code Completion Model Use My Code? A Membership Inference Approach](https://mlsanity.com/paper/2404.14296/) (2024)
- [Piracy-Resistant DNN Watermarking by Block-Wise Image Transformation with Secret Key](https://mlsanity.com/paper/2104.04241/) (2021)
- [PassFlow: Guessing Passwords with Generative Flows](https://mlsanity.com/paper/2105.06165/) (2021)
- [Wide Flat Minimum Watermarking for Robust Ownership Verification of GANs](https://mlsanity.com/paper/2310.16919/) (2023)
- [Safe Distillation Box](https://mlsanity.com/paper/2112.03695/) (2021)
- [Neural Lineage](https://mlsanity.com/paper/2406.11129/) (2024)
- [Bucks for Buckets (B4B): Active Defenses Against Stealing Encoders](https://mlsanity.com/paper/2310.08571/) (2023)
- [DuFFin: A Dual-Level Fingerprinting Framework for LLMs IP Protection](https://mlsanity.com/paper/2505.16530/) (2025)
- [Robust Black-box Watermarking for Deep NeuralNetwork using Inverse Document Frequency](https://mlsanity.com/paper/2103.05590/) (2021)
- [ZKROWNN: Zero Knowledge Right of Ownership for Neural Networks](https://mlsanity.com/paper/2309.06779/) (2023)
- [ModelLock: Locking Your Model With a Spell](https://mlsanity.com/paper/2405.16285/) (2024)
- [DeepiSign: Invisible Fragile Watermark to Protect the Integrityand Authenticity of CNN](https://mlsanity.com/paper/2101.04319/) (2021)
- [Privacy Inference Attacks and Defenses in Cloud-based Deep Neural Network: A Survey](https://mlsanity.com/paper/2105.06300/) (2021)
- [Anti-Neuron Watermarking: Protecting Personal Data Against Unauthorized Neural Networks](https://mlsanity.com/paper/2109.09023/) (2021)
- [DynaMarks: Defending Against Deep Learning Model Extraction Using Dynamic Watermarking](https://mlsanity.com/paper/2207.13321/) (2022)
- [TATTOOED: A Robust Deep Neural Network Watermarking Scheme based on Spread-Spectrum Channel Coding](https://mlsanity.com/paper/2202.06091/) (2022)
- [TinyMLOps: Operational Challenges for Widespread Edge AI Adoption](https://mlsanity.com/paper/2203.10923/) (2022)
- [Revisiting the Information Capacity of Neural Network Watermarks: Upper Bound Estimation and Beyond](https://mlsanity.com/paper/2402.12720/) (2024)
- [Inference Attacks: A Taxonomy, Survey, and Promising Directions](https://mlsanity.com/paper/2406.02027/) (2024)
- [Proactive Schemes: A Survey of Adversarial Attacks for Social Good](https://mlsanity.com/paper/2409.16491/) (2024)
- [Beyond Dataset Watermarking: Model-Level Copyright Protection for Code Summarization Models](https://mlsanity.com/paper/2410.14102/) (2024)
- [ActiveGuard: An Active DNN IP Protection Technique via Adversarial Examples](https://mlsanity.com/paper/2103.01527/) (2021)
- [Immunization of Pruning Attack in DNN Watermarking Using Constant Weight Code](https://mlsanity.com/paper/2107.02961/) (2021)
- [Exploring Structure Consistency for Deep Model Watermarking](https://mlsanity.com/paper/2108.02360/) (2021)
- [Stealing and Evading Malware Classifiers and Antivirus at Low False Positive Conditions](https://mlsanity.com/paper/2204.06241/) (2022)
- [Embedding Watermarks in Diffusion Process for Model Intellectual Property Protection](https://mlsanity.com/paper/2410.22445/) (2024)

## Abstract (arXiv)

Although deep neural networks have made tremendous progress in the area of multimedia representation, training neural models requires a large amount of data and time. It is well-known that utilizing trained models as initial weights often achieves lower training error than neural networks that are not pre-trained. A fine-tuning step helps to reduce both the computational cost and improve performance. Therefore, sharing trained models has been very important for the rapid progress of research and development. In addition, trained models could be important assets for the owner(s) who trained them, hence we regard trained models as intellectual property. In this paper, we propose a digital watermarking technology for ownership authorization of deep neural networks. First, we formulate a new problem: embedding watermarks into deep neural networks. We also define requirements, embedding situations, and attack types on watermarking in deep neural networks. Second, we propose a general framework for embedding a watermark in model parameters, using a parameter regularizer. Our approach does not impair the performance of networks into which a watermark is placed because the watermark is embedded while training the host network. Finally, we perform comprehensive experiments to reveal the potential of watermarking deep neural networks as the basis of this new research effort. We show that our framework can embed a watermark during the training of a deep neural network from scratch, and during fine-tuning and distilling, without impairing its performance. The embedded watermark does not disappear even after fine-tuning or parameter pruning; the watermark remains complete even after 65% of parameters are pruned.