Bi-Level Optimization for Robust DNN Watermarking
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing deep neural network (DNN) watermarking techniques face challenges in preserving model functionality while providing robustness against transformation attacks, such as fine-tuning, pruning, and watermark overwriting, and often require full access to the model or lead to performance degradation.
Innovation Solution
A bi-level optimization framework is introduced, where an inner loop optimizes example-level problems to generate robust exemplars and an outer loop implements masked adaptive optimization to achieve robustness, modifying only a small subset of weights with large gradients for key samples while preserving normal model behavior.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Ease of operation
If white-box watermarking techniques are used to embed watermarks into the internal structure of DNN models, then watermark embedding flexibility and extraction capability are improved, but full access to the DNN model is required which limits utility in deployed systems
Solution Approach 1:
The watermarking system is divided into two independent components: a watermark embedding module that creates watermarked models during training, and a watermark verification module that operates independently on the deployed model. This segmentation allows the verification process to work without requiring full model access, resolving the contradiction between embedding flexibility and deployed system utility.
Solution Approach 2:
The patent introduces an intermediary verification process that observes model behavior through input-output pairs without requiring internal model access. This intermediary mechanism enables watermark verification in deployed systems while maintaining the flexibility of white-box embedding techniques during the training phase.
2Reliability
If black-box watermarking techniques are used to inject key samples into the model, then false positive rate is reduced, but unexpected modification to the learned function occurs leading to performance degradation
Solution Approach 1:
The patent performs preliminary watermark embedding during the model training phase, integrating the watermarking process into the training objective function. This preliminary action ensures that the watermark is embedded in a way that does not conflict with the model's learned function, preventing performance degradation while maintaining low false positive rates through proper key sample selection.
Solution Approach 2:
The patent modifies the training objective function by adding a watermarking loss term that works alongside the standard classification loss. This parameter change allows the model to learn both the classification task and the watermark embedding simultaneously, preventing unexpected modifications to the learned function while maintaining reliability through controlled gradient updates.
3Ease of manufacture
If existing watermarking techniques are applied to DNN models, then watermark embedding is achieved, but robustness against transformation attacks such as fine-tuning, pruning, and watermark overwriting is not optimized
Solution Approach 1:
The patent employs a dynamic watermark embedding strategy where the watermark strength and key samples are adapted during the training process based on the model's learning progress. This dynamic approach allows the watermark to evolve alongside the model parameters, making it more robust against transformation attacks while maintaining ease of implementation through standard training procedures.
Solution Approach 2:
The patent incorporates feedback mechanisms where the watermark verification results are used to adjust the embedding process. By monitoring whether the watermark survives transformation attacks and adjusting the embedding strength or key samples accordingly, the system achieves robustness against attacks while maintaining a straightforward embedding process during training.
Data Source
AI summary
Presented herein are embodiments of a bi-level optimization framework an inner loop phase optimizes an example-level problem to generate robust exemplars, while an outer loop phase proposes an adaptive optimization to achieve the robustness of the projected DNN models. Embodiments for watermarking a deep neural network include obtaining a set of temporary parameters for a temporary model. The set of temporary parameters may be generated based upon a set of base parameters of a base model. Embodiments may further include generating a set of boundary watermark exemplars using the set of temporary parameters for the temporary model. In one or more embodiments, the set of boundary watermark exemplars maximizes an identification loss of the temporary model on a set of watermark data. Embodiments may further include outputting a watermark embedded base model by embedding the set of boundary watermark exemplars into one or more base parameters of the base model.