  Deep Neural Networks (DNN) are gaining higher commercial values in computer
vision applications, e.g., image classification, video analytics, etc. This
calls for urgent demands of the intellectual property (IP) protection of DNN
models. In this paper, we present a novel watermarking scheme to achieve the
ownership verification of DNN architectures. Existing works all embedded
watermarks into the model parameters while treating the architecture as public
property. These solutions were proven to be vulnerable by an adversary to
detect or remove the watermarks. In contrast, we claim the model architectures
as an important IP for model owners, and propose to implant watermarks into the
architectures. We design new algorithms based on Neural Architecture Search
(NAS) to generate watermarked architectures, which are unique enough to
represent the ownership, while maintaining high model usability. Such
watermarks can be extracted via side-channel-based model extraction techniques
with high fidelity. We conduct comprehensive experiments on watermarked CNN
models for image classification tasks and the experimental results show our
scheme has negligible impact on the model performance, and exhibits strong
robustness against various model transformations and adaptive attacks.

Cryptography and Security