DCT-Based Watermarking for Deep Neural Networks
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing DNN watermarking techniques face challenges such as high embedding overhead, susceptibility to model disturbances, and low robustness against intellectual property attacks, which compromise the security and integrity of deep neural network models.
Innovation Solution
A Discrete Cosine Transform (DCT) based DNN digital watermarking scheme that embeds part of the watermark in random elements of the DNN model, utilizing the strong compaction property of DCT to hide large amounts of data without significantly affecting performance, and randomizes the watermark signal to enhance robustness, ensuring that removing the watermark destroys the DNN model.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If watermark is embedded in DNN model parameters, then copyright protection is achieved, but model performance deteriorates
Solution Approach 1:
The patent applies local quality by selectively embedding watermark data only in specific frequency components (high-frequency coefficients) of the DCT-transformed model parameters, while preserving low-frequency coefficients that contain critical model information. This localized embedding strategy protects copyright while minimizing impact on model performance.
Solution Approach 2:
The patent transforms model parameters from spatial domain to frequency domain using DCT, then embeds watermark in selected frequency coefficients. This parameter transformation allows watermark embedding with controlled impact on original model functionality.
2Reliability
If watermark embedding capacity is increased, then copyright security is improved, but model performance drops
Solution Approach 1:
The patent embeds watermark data in only a portion of the available parameters (specifically high-frequency DCT coefficients), which constitutes partial action. This selective embedding provides sufficient copyright security while avoiding excessive modification that would degrade model performance.
Solution Approach 2:
By transforming to frequency domain and selectively modifying high-frequency coefficients, the patent changes parameters in a way that increases watermark capacity while the inherent redundancy in high-frequency components absorbs the modifications without significant performance loss.
3Reliability
If watermark is embedded in critical model parameters, then robustness against attacks is improved, but model performance deteriorates
Solution Approach 1:
The patent embeds watermark in high-frequency DCT coefficients which are less critical for model performance but sufficient for copyright protection. This local embedding in non-critical regions provides robustness without significant performance degradation.
Solution Approach 2:
The patent exploits the inherent redundancy and 'porosity' of high-frequency DCT coefficients to embed watermark data. These coefficients act as porous structures that can absorb watermark information without significantly affecting the overall model integrity or performance.
4Ease of manufacture
If simple LSB techniques are used for watermarking, then ease of implementation is improved, but robustness and security deteriorate
Solution Approach 1:
The patent replaces the simple spatial-domain LSB mechanism with a frequency-domain DCT-based embedding system. This substitution maintains relative simplicity of implementation while dramatically improving robustness and security through the properties of frequency transformation and selective coefficient modification.
Data Source
AI summary
The invention discloses a DNN watermarking method, comprising embedding part of the digital watermark in selected redundant elements of a deep neural network (DNN) model—without compromising the performance of the DNN. The proposed method aims for a robust watermark scheme by embedding a large watermark that can span the whole DNN model. If an adversary attempts to destroy the watermark, the whole DNN model will be destroyed. However, maximizing the hiding capacity can lead to degradation in the performance of the DNN model. In this work, this capacity-performance trade-off problem is solved using the Discrete Cosine Transform (DCT). Moreover, the DCT can work more efficiently with highly correlated data. Therefore, this work suggests segmenting the weights of the DNN model into correlated segments to fully exploit the advantages of the DCT.