# Solving the Capsulation Attack against Backdoor-based Deep Neural Network Watermarks by Reversing Triggers

arXiv: https://arxiv.org/abs/2208.14127 · HTML: https://mlsanity.com/paper/2208.14127/

## Key facts

- Cited by 1 papers in the map (data through 14 Oct 2026).
- First posted on arXiv 30 Aug 2022.

## Built on by (most cited first, 1 of 1)

- [FedReverse: Multiparty Reversible Deep Neural Network Watermarking](https://mlsanity.com/paper/2312.05738/) (2023)

## Abstract (arXiv)

Backdoor-based watermarking schemes were proposed to protect the intellectual property of artificial intelligence models, especially deep neural networks, under the black-box setting. Compared with ordinary backdoors, backdoor-based watermarks need to digitally incorporate the owner's identity, which fact adds extra requirements to the trigger generation and verification programs. Moreover, these concerns produce additional security risks after the watermarking scheme has been published for as a forensics tool or the owner's evidence has been eavesdropped on. This paper proposes the capsulation attack, an efficient method that can invalidate most established backdoor-based watermarking schemes without sacrificing the pirated model's functionality. By encapsulating the deep neural network with a rule-based or Bayes filter, an adversary can block ownership probing and reject the ownership verification. We propose a metric, CAScore, to measure a backdoor-based watermarking scheme's security against the capsulation attack. This paper also proposes a new backdoor-based deep neural network watermarking scheme that is secure against the capsulation attack by reversing the encoding process and randomizing the exposure of triggers.