# Reversible Watermarking in Deep Convolutional Neural Networks for Integrity Authentication

arXiv: https://arxiv.org/abs/2104.04268 · HTML: https://mlsanity.com/paper/2104.04268/

## Key facts

- Cited by 17 papers in the map (data through 14 Oct 2026).
- Builds on 16 of its 26 references that are in the map.
- First posted on arXiv 9 Apr 2021.

## Builds on (most cited first, 16 of 16)

- [Deep Residual Learning for Image Recognition](https://mlsanity.com/paper/1512.03385/) (2015)
- [Very Deep Convolutional Networks for Large-Scale Image Recognition](https://mlsanity.com/paper/1409.1556/) (2014)
- [Densely Connected Convolutional Networks](https://mlsanity.com/paper/1608.06993/) (2016)
- [MobileNetV2: Inverted Residuals and Linear Bottlenecks](https://mlsanity.com/paper/1801.04381/) (2018)
- [BadNets: Identifying Vulnerabilities in the Machine Learning Model Supply Chain](https://mlsanity.com/paper/1708.06733/) (2017)
- [Fine-Pruning: Defending Against Backdooring Attacks on Deep Neural Networks](https://mlsanity.com/paper/1805.12185/) (2018)
- [Detecting Backdoor Attacks on Deep Neural Networks by Activation Clustering](https://mlsanity.com/paper/1811.03728/) (2018)
- [SiamRPN++: Evolution of Siamese Visual Tracking with Very Deep Networks](https://mlsanity.com/paper/1812.11703/) (2018)
- [Turning Your Weakness Into a Strength: Watermarking Deep Neural Networks by Backdooring](https://mlsanity.com/paper/1802.04633/) (2018)
- [Embedding Watermarks into Deep Neural Networks](https://mlsanity.com/paper/1701.04082/) (2017)
- [Machine Learning Models that Remember Too Much](https://mlsanity.com/paper/1709.07886/) (2017)
- [Model Watermarking for Image Processing Networks](https://mlsanity.com/paper/2002.11088/) (2020)
- [Model-Reuse Attacks on Deep Learning Systems](https://mlsanity.com/paper/1812.00483/) (2018)
- [An Entropy-based Pruning Method for CNN Compression](https://mlsanity.com/paper/1706.05791/) (2017)
- [DeepSigns: A Generic Watermarking Framework for IP Protection of Deep Learning Models](https://mlsanity.com/paper/1804.00750/) (2018)
- [On the iterative refinement of densely connected representation levels for semantic segmentation](https://mlsanity.com/paper/1804.11332/) (2018)

## Built on by (most cited first, 17 of 17)

- [Watermarking Techniques for Large Language Models: A Survey](https://mlsanity.com/paper/2409.00089/) (2024)
- [AdvParams: An Active DNN Intellectual Property Protection Technique via Adversarial Perturbation Based Parameter Encryption](https://mlsanity.com/paper/2105.13697/) (2021)
- [Identifying Appropriate Intellectual Property Protection Mechanisms for Machine Learning Models: A Systematization of Watermarking, Fingerprinting, Model Access, and Attacks](https://mlsanity.com/paper/2304.11285/) (2023)
- [Neural network fragile watermarking with no model performance degradation](https://mlsanity.com/paper/2208.07585/) (2022)
- [Protecting the Intellectual Properties of Deep Neural Networks with an Additional Class and Steganographic Images](https://mlsanity.com/paper/2104.09203/) (2021)
- [DeepEclipse: How to Break White-Box DNN-Watermarking Schemes](https://mlsanity.com/paper/2403.03590/) (2024)
- [Steganographic Passport: An Owner and User Verifiable Credential for Deep Model IP Protection Without Retraining](https://mlsanity.com/paper/2404.02889/) (2024)
- [Knowledge-Free Black-Box Watermark and Ownership Proof for Image Classification Neural Networks](https://mlsanity.com/paper/2204.04522/) (2022)
- [Decision-based iterative fragile watermarking for model integrity verification](https://mlsanity.com/paper/2305.09684/) (2023)
- [Turn Passive to Active: A Survey on Active Intellectual Property Protection of Deep Learning Models](https://mlsanity.com/paper/2310.09822/) (2023)
- [Reversible Quantization Index Modulation for Static Deep Neural Network Watermarking](https://mlsanity.com/paper/2305.17879/) (2023)
- [Towards Deep Network Steganography: From Networks to Networks](https://mlsanity.com/paper/2307.03444/) (2023)
- [SSL-Auth: An Authentication Framework by Fragile Watermarking for Pre-trained Encoders in Self-supervised Learning](https://mlsanity.com/paper/2308.04673/) (2023)
- [A Survey of Fragile Model Watermarking](https://mlsanity.com/paper/2406.04809/) (2024)
- [Protecting Intellectual Property of EEG-based Neural Networks with Watermarking](https://mlsanity.com/paper/2502.05931/) (2025)
- [Adaptive White-Box Watermarking with Self-Mutual Check Parameters in Deep Neural Networks](https://mlsanity.com/paper/2308.11235/) (2023)
- [Secure AI Watermarking Framework for IP Protection in Multi-Tenant Cloud Platforms](https://mlsanity.com/paper/2608.02656/) (2026)

## Abstract (arXiv)

Deep convolutional neural networks have made outstanding contributions in many fields such as computer vision in the past few years and many researchers published well-trained network for downloading. But recent studies have shown serious concerns about integrity due to model-reuse attacks and backdoor attacks. In order to protect these open-source networks, many algorithms have been proposed such as watermarking. However, these existing algorithms modify the contents of the network permanently and are not suitable for integrity authentication. In this paper, we propose a reversible watermarking algorithm for integrity authentication. Specifically, we present the reversible watermarking problem of deep convolutional neural networks and utilize the pruning theory of model compression technology to construct a host sequence used for embedding watermarking information by histogram shift. As shown in the experiments, the influence of embedding reversible watermarking on the classification performance is less than 0.5% and the parameters of the model can be fully recovered after extracting the watermarking. At the same time, the integrity of the model can be verified by applying the reversible watermarking: if the model is modified illegally, the authentication information generated by original model will be absolutely different from the extracted watermarking information.