Decision-based iterative fragile watermarking for model integrity verification
On the map: LLM safety and security → Watermarking generated content and models
Abstract (arXiv)
Typically, foundation models are hosted on cloud servers to meet the high demand for their services. However, this exposes them to security risks, as attackers can modify them after uploading to the cloud or transferring from a local system. To address this issue, we propose an iterative decision-based fragile watermarking algorithm that transforms normal training samples into fragile samples that are sensitive to model changes. We then compare the output of sensitive samples from the original model to that of the compromised model during validation to assess the model's completeness.The proposed fragile watermarking algorithm is an optimization problem that aims to minimize the variance of the predicted probability distribution outputed by the target model when fed with the converted sample.We convert normal samples to fragile samples through multiple iterations. Our method has some advantages: (1) the iterative update of samples is done in a decision-based black-box manner, relying solely on the predicted probability distribution of the target model, which reduces the risk of exposure to adversarial attacks, (2) the small-amplitude multiple iterations approach allows the fragile samples to perform well visually, with a PSNR of 55 dB in TinyImageNet compared to the original samples, (3) even with changes in the overall parameters of the model of magnitude 1e-4, the fragile samples can detect such changes, and (4) the method is independent of the specific model structure and dataset. We demonstrate the effectiveness of our method on multiple models and datasets, and show that it outperforms the current state-of-the-art.
Key facts. Cited by 2 papers in the map (data through 7 Oct 2026). Placed in Watermarking generated content and models, one of 12 directions in LLM safety and security. Builds on 21 of its 48 references that are in the map. First posted on arXiv 13 May 2023.
Builds on
21 of 48 references.
Closest ancestors · 1
Same direction, newest first
Other references · 20
- 2015Deep Residual Learning for Image Recognitioncited by 51,809
- 2018BERT: Pre-training of Deep Bidirectional Transformers for Language Understandingcited by 40,204
- 2020An Image is Worth 16x16 Words: Transformers for Image Recognition at Scalecited by 29,915
- 2021On the Opportunities and Risks of Foundation Modelscited by 3,961
- 2017BadNets: Identifying Vulnerabilities in the Machine Learning Model Supply Chaincited by 1,052
- 2015Effective Approaches to Attention-based Neural Machine Translationcited by 1,024
- 2014Deep Speech: Scaling up end-to-end speech recognitioncited by 354
- 2018Turning Your Weakness Into a Strength: Watermarking Deep Neural Networks by Backdooringcited by 334
- 2017Embedding Watermarks into Deep Neural Networkscited by 227
- 2017Towards Poisoning of Deep Learning Algorithms with Back-gradient Optimizationcited by 188
- 2017Machine Learning Models that Remember Too Muchcited by 165
- 2020Entangled Watermarks as a Defense against Model Extractioncited by 144
8 more
- 2019TBT: Targeted Neural Network Attack with Bit Trojancited by 112
- 2017Adversarial Frontier Stitching for Remote Neural Network Watermarkingcited by 110
- 2019Bit-Flip Attack: Crushing Neural Network with Progressive Bit Searchcited by 106
- 2018Is feature selection secure against training data poisoning?cited by 88
- 2019[Extended version] Rethinking Deep Neural Network Ownership Verification: Embedding Passports to Defeat Ambiguity Attackscited by 82
- 2020Can Adversarial Weight Perturbations Inject Neural Backdoors?cited by 51
- 2021Reversible Watermarking in Deep Convolutional Neural Networks for Integrity Authenticationcited by 17
- 2019RIGA: Covert and Robust White-Box Watermarking of Deep Neural Networkscited by 9
Built on by
Citing papers per year: 2024: 2.
2 papers.