With the increasing application value of machine learning, the intellectual property (IP) rights of deep neural networks (DNN) are getting more and more attention. With our analysis, most of the existing DNN watermarking methods can resist fine-tuning and pruning attack, but distillation attack. To address these problem, we propose a new DNN watermarking framework, Unified Soft-label Perturbation (USP), having a detector paired with the model to be watermarked, and Customized Soft-label Perturbation (CSP), embedding watermark via adding perturbation into the model output probability distribution. Experimental results show that our methods can resist all watermark removal attacks and outperform in distillation attack. Besides, we also have an excellent trade-off between the main task and watermarking that achieving 98.68% watermark accuracy while only affecting the main task accuracy by 0.59%.
翻译:随着机器学习的应用价值的提高,深神经网络的知识产权越来越受到越来越多的关注。通过我们的分析,现有的大多数DNN水标记方法可以抵制微调和修剪攻击,但蒸馏攻击。为了解决这些问题,我们提议一个新的DNN水标记框架(Unid Soft-label Perturbation (USP) ), 配有水标记模型的探测器, 以及定制的软标签插图(CSP ), 通过在模型输出概率分布中添加扰动, 嵌入水标记。 实验结果显示, 我们的方法可以抵制所有去除水标记的攻击和蒸馏攻击的外形。 此外, 我们还在主要任务和水标记之间有一个极好的交换点, 即实现98.68%的水标记精度, 只影响主要任务精确度0.59%。