Not Just Change the Labels, Learn the Features: Watermarking Deep Neural Networks with Multi-View Data
<|reference_start|>Not Just Change the Labels, Learn the Features: Watermarking Deep Neural Networks with Multi-View Data: With the increasing prevalence of Machine Learning as a Service (MLaaS) platforms, there is a growing focus on deep neural network (DNN) watermarking techniques. These methods are used to facilitate the verification of ownership for a target DNN model to protect intellectual property. One of the most widely employed watermarking techniques involves embedding a trigger set into the source model. Unfortunately, existing methodologies based on trigger sets are still susceptible to functionality-stealing attacks, potentially enabling adversaries to steal the functionality of the source model without a reliable means of verifying ownership. In this paper, we first introduce a novel perspective on trigger set-based watermarking methods from a feature learning perspective. Specifically, we demonstrate that by selecting data exhibiting multiple features, also referred to as \emph{multi-view data}, it becomes feasible to effectively defend functionality stealing attacks. Based on this perspective, we introduce a novel watermarking technique based on Multi-view dATa, called MAT, for efficiently embedding watermarks within DNNs. This approach involves constructing a trigger set with multi-view data and incorporating a simple feature-based regularization method for training the source model. We validate our method across various benchmarks and demonstrate its efficacy in defending against model extraction attacks, surpassing relevant baselines by a significant margin. The code is available at: \href{https://github.com/liyuxuan-github/MAT}{https://github.com/liyuxuan-github/MAT}.<|reference_end|>
@article{li2024not,
    title={Not Just Change the Labels, Learn the Features: Watermarking Deep Neural
  Networks with Multi-View Data},
    author={Yuxuan Li, Sarthak Kumar Maharana, Yunhui Guo},
    journal={arXiv preprint arXiv:2403.10663},
    year={2024},
    archivePrefix={arXiv},
    eprint={2403.10663},
    primaryClass={cs.CR cs.CV cs.LG}
}