Hashed Watermark as a Filter: Defeating Forging and Overwriting Attacks
  in Weight-based Neural Network Watermarking
As valuable digital assets, deep neural networks necessitate robust ownership
protection, positioning neural network watermarking (NNW) as a promising
solution. Among various NNW approaches, weight-based methods are favored for
their simplicity and practicality; however, they remain vulnerable to forging
and overwriting attacks. To address those challenges, we propose NeuralMark, a
robust method built around a hashed watermark filter. Specifically, we utilize
a hash function to generate an irreversible binary watermark from a secret key,
which is then used as a filter to select the model parameters for embedding.
This design cleverly intertwines the embedding parameters with the hashed
watermark, providing a robust defense against both forging and overwriting
attacks. An average pooling is also incorporated to resist fine-tuning and
pruning attacks. Furthermore, it can be seamlessly integrated into various
neural network architectures, ensuring broad applicability. Theoretically, we
analyze its security boundary. Empirically, we verify its effectiveness and
robustness across 13 distinct Convolutional and Transformer architectures,
covering five image classification tasks and one text generation task. The
source codes are available at https://github.com/AIResearch-Group/NeuralMark.
6876fe45257d4f0435370790
Yuan Yao
6876fe45257d4f0435370791
Jin Song
6876fe45257d4f0435370792
Jian Jin
Hashed Watermark as a Filter: Defeating Forging and Overwriting Attacks
  in Weight-based Neural Network Watermarking
As valuable digital assets, deep neural networks necessitate robust ownership
protection, positioning neural network watermarking (NNW) as a promising
solution. Among various NNW approaches, weight-based methods are favored for
their simplicity and practicality; however, they remain vulnerable to forging
and overwriting attacks. To address those challenges, we propose NeuralMark, a
robust method built around a hashed watermark filter. Specifically, we utilize
a hash function to generate an irreversible binary watermark from a secret key,
which is then used as a filter to select the model parameters for embedding.
This design cleverly intertwines the embedding parameters with the hashed
watermark, providing a robust defense against both forging and overwriting
attacks. An average pooling is also incorporated to resist fine-tuning and
pruning attacks. Furthermore, it can be seamlessly integrated into various
neural network architectures, ensuring broad applicability. Theoretically, we
analyze its security boundary. Empirically, we verify its effectiveness and
robustness across 13 distinct Convolutional and Transformer architectures,
covering five image classification tasks and one text generation task. The
source codes are available at https://github.com/AIResearch-Group/NeuralMark.
NeuralMark is a robust neural network watermarking method using a hashed watermark filter to protect model ownership against forging, overwriting, fine-tuning, and pruning attacks.
neural network watermarking weight-based methods hash function binary watermark model parameters embedding average pooling Convolutional architectures Transformer architectures image classification text generation