# Robust Black-box Watermarking for Deep NeuralNetwork using Inverse Document Frequency

arXiv: https://arxiv.org/abs/2103.05590 · HTML: https://mlsanity.com/paper/2103.05590/

## Key facts

- Cited by 6 papers in the map (data through 14 Oct 2026).
- Builds on 14 of its 31 references that are in the map.
- First posted on arXiv 9 Mar 2021.

## Builds on (most cited first, 14 of 14)

- [Turning Your Weakness Into a Strength: Watermarking Deep Neural Networks by Backdooring](https://mlsanity.com/paper/1802.04633/) (2018)
- [Embedding Watermarks into Deep Neural Networks](https://mlsanity.com/paper/1701.04082/) (2017)
- [Entangled Watermarks as a Defense against Model Extraction](https://mlsanity.com/paper/2002.12200/) (2020)
- [Adversarial Frontier Stitching for Remote Neural Network Watermarking](https://mlsanity.com/paper/1711.01894/) (2017)
- [DAWN: Dynamic Adversarial Watermarking of Neural Networks](https://mlsanity.com/paper/1906.00830/) (2019)
- [Deep Neural Network Fingerprinting by Conferrable Adversarial Examples](https://mlsanity.com/paper/1912.00888/) (2019)
- [[Extended version] Rethinking Deep Neural Network Ownership Verification: Embedding Passports to Defeat Ambiguity Attacks](https://mlsanity.com/paper/1909.07830/) (2019)
- [Robust Watermarking of Neural Network with Exponential Weighting](https://mlsanity.com/paper/1901.06151/) (2019)
- [Digital Watermarking for Deep Neural Networks](https://mlsanity.com/paper/1802.02601/) (2018)
- [BlackMarks: Blackbox Multibit Watermarking for Deep Neural Networks](https://mlsanity.com/paper/1904.00344/) (2019)
- [DeepSigns: A Generic Watermarking Framework for IP Protection of Deep Learning Models](https://mlsanity.com/paper/1804.00750/) (2018)
- [Training DNN Model with Secret Key for Model Protection](https://mlsanity.com/paper/2008.02450/) (2020)
- [RIGA: Covert and Robust White-Box Watermarking of Deep Neural Networks](https://mlsanity.com/paper/1910.14268/) (2019)
- [Evolutionary Trigger Set Generation for DNN Black-Box Watermarking](https://mlsanity.com/paper/1906.04411/) (2019)

## Built on by (most cited first, 6 of 6)

- [Watermarking Pre-trained Language Models with Backdooring](https://mlsanity.com/paper/2210.07543/) (2022)
- [CodeMark: Imperceptible Watermarking for Code Datasets against Neural Code Completion Models](https://mlsanity.com/paper/2308.14401/) (2023)
- [HuRef: HUman-REadable Fingerprint for Large Language Models](https://mlsanity.com/paper/2312.04828/) (2023)
- [Challenges and Remedies to Privacy and Security in AIGC: Exploring the Potential of Privacy Computing, Blockchain, and Beyond](https://mlsanity.com/paper/2306.00419/) (2023)
- [DeepHider: A Covert NLP Watermarking Framework Based on Multi-task Learning](https://mlsanity.com/paper/2208.04676/) (2022)
- [Task-Agnostic Language Model Watermarking via High Entropy Passthrough Layers](https://mlsanity.com/paper/2412.12563/) (2024)

## Abstract (arXiv)

Deep learning techniques are one of the most significant elements of any Artificial Intelligence (AI) services. Recently, these Machine Learning (ML) methods, such as Deep Neural Networks (DNNs), presented exceptional achievement in implementing human-level capabilities for various predicaments, such as Natural Processing Language (NLP), voice recognition, and image processing, etc. Training these models are expensive in terms of computational power and the existence of enough labelled data. Thus, ML-based models such as DNNs establish genuine business value and intellectual property (IP) for their owners. Therefore the trained models need to be protected from any adversary attacks such as illegal redistribution, reproducing, and derivation. Watermarking can be considered as an effective technique for securing a DNN model. However, so far, most of the watermarking algorithm focuses on watermarking the DNN by adding noise to an image. To this end, we propose a framework for watermarking a DNN model designed for a textual domain. The watermark generation scheme provides a secure watermarking method by combining Term Frequency (TF) and Inverse Document Frequency (IDF) of a particular word. The proposed embedding procedure takes place in the model's training time, making the watermark verification stage straightforward by sending the watermarked document to the trained model. The experimental results show that watermarked models have the same accuracy as the original ones. The proposed framework accurately verifies the ownership of all surrogate models without impairing the performance. The proposed algorithm is robust against well-known attacks such as parameter pruning and brute force attack.