Adversarial Watermarking for Deep Learning Data Protection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing methods for protecting original data used in deep learning are inadequate, as they either fail to prevent data breaches or allow the original data to be recovered through image processing technology.
Innovation Solution
A method is developed to convert original data into optimal noisy data that humans can recognize, but from which a learning network outputs different results, using a data breach preventing device that adds noise and performs adversarial attacks to generate watermarked data.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Adaptability or versatility
If naive watermarked data is used to share datasets, then data sharing is enabled, but the original data can still be recovered through image processing technology
Solution Approach 1:
The patent transforms the watermarking approach by changing the parameter space from simple pixel-level watermarks to adversarial perturbations in the frequency domain. By applying Fourier transforms and modifying frequency components, the watermark becomes imperceptible to human vision but highly effective at preventing recovery of original data through traditional image processing methods.
Solution Approach 2:
The patent replaces traditional mechanical/image processing watermarking methods with a machine learning-based adversarial attack system. Instead of relying on visual imperceptibility alone, the system uses trained neural networks to generate perturbations that actively prevent recovery algorithms from reconstructing original data, substituting mechanical processing with intelligent adaptive systems.
2Reliability
If adversarial watermarks are applied to prevent recovery, then data protection is improved, but the watermarks are easily erasable by image processing technology
Solution Approach 1:
The patent converts the vulnerability of traditional watermarks (their visibility and susceptibility to processing) into an advantage by making them imperceptible and robust. The adversarial perturbations are designed to be invisible to humans but create significant interference for recovery algorithms, effectively using the harm of undetectability to protect the watermark from being erased.
Solution Approach 2:
The patent applies preliminary adversarial training and frequency domain transformations before the watermarking process. By pre-training the adversarial model and establishing the frequency domain framework in advance, the system creates watermarks that are inherently resistant to subsequent image processing attacks, preventing erasure before it can occur.
3Reliability
If optimal noisy data is generated that humans can recognize but learning networks output different results, then data breach prevention is achieved, but the accuracy of learning networks trained with watermarked data degrades
Solution Approach 1:
The patent applies local quality modification by adding adversarial noise only to specific frequency components or localized regions of the data. This allows the watermark to affect learning network processing in critical areas while maintaining overall recognizability for human users, thereby preventing data breaches without completely degrading learning network accuracy in non-critical regions.
Data Source
Figure 1
Figure 2(A)~2(C)
Figure 3
AI summary
A method for preventing breach of original data for deep learning is provided. The method includes steps of: a data breach preventing device (a) adding noise onto the acquired original data to generate 1-st noisy data; and (b)(b1) while increasing an integer k from 1 to an integer larger than 0, (i) inputting k-th noisy data into a learning network, to apply learning operations to the k-th noisy data using learned parameters of the learning network, and to output k-th characteristic information, and (ii) launching an adversarial attack on the k-th noisy data via backpropagation using at least one of (ii-1) (k_1)-st losses calculated using the k-th characteristic information and a 1-st ground truth, and (ii-2) (k_2)-nd losses calculated using (1) a k-th task specific output and (2) a 2-nd ground truth, and generating (k+1)-th noisy data, and (b2) as a result, generating n-th noisy data as watermarked data.