An increase in the usage of proprietary datasets to train deep learning models has exacerbated IP protection issues. The current watermarking solutions frequently demand access to the internals of the model and prompt visible alterations to the data, thus rendering these methods impracticable or easy to remove. Here, we present Radioactive Data, a cryptographically verifiable dataset-level watermarking solution that directly embeds imperceptible, owner-specific triggers into training data. The triggers are generated using a hash-based key derived from the owner's identity and are aligned with PCA feature vectors to be seamlessly integrated with any model architecture. The system was experimented on tabular data, showing watermarking causes negligible degradation in performance (0.17% drop in accuracy) and a 22.39% overhead in training time. The watermark provides full resistance against fine-tuning and adversarial attacks and remains at 43.8% survivability under 50% weight pruning. The clean models exhibiting a 50% false positive rate is characteristic of the binary confirmation systems used and congestion within the decision boundaries. This indicates the models and systems used should strive for improved future separation. Despite this drawback, our approach ensures a strong, covert, and efficient means of protecting dataset ownership in black-box AI situations.

错误:搜索内容不能为空,请输入英文关键词
错误:关键词超出字数限制,请精简
高级检索

A Robust Parametric Watermarking Framework for Deep Neural Network Ownership Verification

  • Sachin Patel,
  • Ayush Patel,
  • Marmik Patel,
  • Rishi Soni,
  • Selin Parmar,
  • Premal Patel,
  • Dhawnil Chauhan,
  • Dipika Damodar

摘要

An increase in the usage of proprietary datasets to train deep learning models has exacerbated IP protection issues. The current watermarking solutions frequently demand access to the internals of the model and prompt visible alterations to the data, thus rendering these methods impracticable or easy to remove. Here, we present Radioactive Data, a cryptographically verifiable dataset-level watermarking solution that directly embeds imperceptible, owner-specific triggers into training data. The triggers are generated using a hash-based key derived from the owner's identity and are aligned with PCA feature vectors to be seamlessly integrated with any model architecture. The system was experimented on tabular data, showing watermarking causes negligible degradation in performance (0.17% drop in accuracy) and a 22.39% overhead in training time. The watermark provides full resistance against fine-tuning and adversarial attacks and remains at 43.8% survivability under 50% weight pruning. The clean models exhibiting a 50% false positive rate is characteristic of the binary confirmation systems used and congestion within the decision boundaries. This indicates the models and systems used should strive for improved future separation. Despite this drawback, our approach ensures a strong, covert, and efficient means of protecting dataset ownership in black-box AI situations.