Seeds Don't Lie: An Adaptive Watermarking Framework for Computer Vision Models
On the map: LLM safety and security → Watermarking generated content and models
Abstract (arXiv)
In recent years, various watermarking methods were suggested to detect computer vision models obtained illegitimately from their owners, however they fail to demonstrate satisfactory robustness against model extraction attacks. In this paper, we present an adaptive framework to watermark a protected model, leveraging the unique behavior present in the model due to a unique random seed initialized during the model training. This watermark is used to detect extracted models, which have the same unique behavior, indicating an unauthorized usage of the protected model's intellectual property (IP). First, we show how an initial seed for random number generation as part of model training produces distinct characteristics in the model's decision boundaries, which are inherited by extracted models and present in their decision boundaries, but aren't present in non-extracted models trained on the same data-set with a different seed. Based on our findings, we suggest the Robust Adaptive Watermarking (RAW) Framework, which utilizes the unique behavior present in the protected and extracted models to generate a watermark key-set and verification model. We show that the framework is robust to (1) unseen model extraction attacks, and (2) extracted models which undergo a blurring method (e.g., weight pruning). We evaluate the framework's robustness against a naive attacker (unaware that the model is watermarked), and an informed attacker (who employs blurring strategies to remove watermarked behavior from an extracted model), and achieve outstanding (i.e., >0.9) AUC values. Finally, we show that the framework is robust to model extraction attacks with different structure and/or architecture than the protected model.
Key facts. No citing papers in the map yet (data through 7 Oct 2026). Placed in Watermarking generated content and models, one of 12 directions in LLM safety and security. Builds on 20 of its 28 references that are in the map. First posted on arXiv 24 Nov 2022.
Builds on
20 of 28 references.
References · 20
- 2015Deep Residual Learning for Image Recognitioncited by 51,809
- 2014Adam: A Method for Stochastic Optimizationcited by 36,960
- 2015Distilling the Knowledge in a Neural Networkcited by 10,076
- 2016Densely Connected Convolutional Networkscited by 6,691
- 2016Wide Residual Networkscited by 3,057
- 2016Adversarial examples in the physical worldcited by 1,762
- 2016Stealing Machine Learning Models via Prediction APIscited by 602
- 2017To prune, or not to prune: exploring the efficacy of pruning for model compressioncited by 596
- 2016Quantized Neural Networks: Training Neural Networks with Low Precision Weights and Activationscited by 413
- 2018Turning Your Weakness Into a Strength: Watermarking Deep Neural Networks by Backdooringcited by 334
- 2020Entangled Watermarks as a Defense against Model Extractioncited by 144
- 2017Adversarial Frontier Stitching for Remote Neural Network Watermarkingcited by 110
8 more
- 2019Deep Neural Network Fingerprinting by Conferrable Adversarial Examplescited by 90
- 2019[Extended version] Rethinking Deep Neural Network Ownership Verification: Embedding Passports to Defeat Ambiguity Attackscited by 82
- 2018Copycat CNN: Stealing Knowledge by Persuading Confession with Random Non-Labeled Datacited by 69
- 2021A survey of deep neural network watermarking techniquescited by 69
- 2021SoK: How Robust is Image Classification Deep Neural Network Watermarking? (Extended Version)cited by 67
- 2019How to Prove Your Model Belongs to You: A Blind-Watermark based Framework to Protect Intellectual Property of DNNcited by 58
- 2019Robust Watermarking of Neural Network with Exponential Weightingcited by 48
- 2018Digital Watermarking for Deep Neural Networkscited by 37
Built on by
Not cited yet.