Concealed Meta-data Embedding in Deep Neural Network Weights
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing methods for embedding digital watermarks in Deep Neural Networks (DNNs) are limited as they require watermarking during the training phase, which is costly and inflexible, and they struggle to effectively track and protect trained models from unauthorized use.
Innovation Solution
The proposed method embeds concealed meta-data into the weights of a trained DNN after training is complete, using techniques such as transforming weights into a different domain, adding meta-data, and performing an inverse domain transform to create new weights with an embedded watermark, without affecting the model's performance.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If digital watermarks are embedded during the training phase, then the model can be protected, but the process is costly and inflexible
Solution Approach 1:
The patent applies preliminary action by embedding watermarks during the training phase when the model architecture is being formed. The watermark is integrated into the model weights and structure before deployment, allowing protection to be established in advance. This enables the model to carry protection information from the outset without requiring post-training modifications.
Solution Approach 2:
The patent utilizes parameter changes by modifying model parameters (weights) during training to incorporate watermark information. The watermark is embedded by altering weight values or adding watermark-specific parameters to the model architecture. This allows the same model structure to serve both functional and protective purposes through parameter modification.
2Reliability
If digital watermarks are embedded in trained models, then ownership can be identified, but the model file size and memory requirements increase
Solution Approach 1:
The patent applies the nested doll principle by embedding the watermark directly within the existing model weights and structure. Rather than adding a separate watermark file, the watermark information is nested inside the model parameters themselves. This allows the watermark to be carried within the model's own data structure without requiring additional external storage space.
Solution Approach 2:
The patent merges the watermark functionality with the model weights by integrating both purposes into a single data structure. The model weights serve dual functions: representing the trained model and carrying the watermark information. This combining approach eliminates the need for separate watermark storage and reduces overall data requirements.
3Ease of operation
If the model is stored in unencrypted ONNX format, then it is easy to transmit and modify, but intellectual property protection is compromised
Solution Approach 1:
The patent introduces an intermediary approach by embedding the watermark as an intermediate layer between the model data and external systems. The watermark acts as a mediator that provides protection information without changing the fundamental ONNX format or transmission capabilities. The model can still be transmitted in standard format while the embedded watermark provides IP protection when the model is accessed or executed.
Data Source
AI summary
Systems and methods for embedding concealed meta-data into DNNs. Specifically, the system and method presented consists of receiving a trained neural network that includes one or more layers each having weights. The disclosed process includes transforming at least one layer to a transformed domain, adding information to the layer(s) in the transformed domain, and performing an inverse domain transform on at least one layer such that the layer(s) has new weights with an embedded watermark.