ML Model Watermarking via Training Data Pixel Patterns
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Machine learning models, particularly neural networks, are vulnerable to theft and unauthorized use due to their complexity, making it difficult to protect them from extraction and cloning, especially in applications requiring low-latency online operations like autonomous driving, where storing models in the cloud is not feasible.
Innovation Solution
A method for watermarking machine learning models by modifying a subset of labeled training data with a pixel pattern, which is then used to train the model, allowing for reliable identification of the model's authenticity during inference operations without full access to the model's internals.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Speed
If the ML model is stored on a device to enable low-latency online operations, then execution speed is improved, but the model becomes vulnerable to extraction and cloning
Solution Approach 1:
The patent applies preliminary action by embedding a watermark pattern into the training data before model training. This watermark is embedded in advance into a subset of training images, and the model learns to recognize this pattern during training. When deployed on the device, the model can verify its authenticity by recognizing the watermark, providing security without requiring cloud connectivity or complex runtime protection mechanisms.
2Reliability
If the ML model is stored in the cloud to protect from theft, then model security is improved, but low-latency online operations cannot be performed
Solution Approach 1:
The patent uses the watermark pattern as an intermediary mechanism to transfer security functionality from the cloud to the device. Instead of requiring continuous cloud connection for verification, the watermark serves as a self-contained verification mechanism embedded in the model itself. The model can independently verify its authenticity by recognizing the watermark pattern, eliminating the need for cloud storage while maintaining security.
3Reliability
If the training data is modified with a pixel pattern to watermark the model, then model authentication capability is improved, but the quality of training data may be degraded
Solution Approach 1:
The patent applies local quality by modifying only a subset of the training data rather than the entire dataset. Specifically, the watermark pattern is embedded in approximately 10-20% of the training images, selected to provide sufficient authentication capability while minimizing impact on overall training quality. The modifications are localized to specific regions within selected images, preserving the majority of training data in its original high-quality state.
Data Source
AI summary
A method is provided for watermarking a machine learning model used for object detection or image classification. In the method, a first subset of a labeled set of ML training samples is selected. The first subset is of a predetermined class of images. In one embodiment, the first pixel pattern is selected and sized to have substantially the same dimensions as each sample of the first subset or each bounding box in the case of an object detector. Each sample of the first subset is relabeled to have a different label than the original label. An opacity of the pixel pattern may be adjusted independently for different parts of the pattern. The ML model is trained with the labeled set of ML training samples and the first subset of relabeled ML training samples. Using multiple different opacity factors provides both reliability and credibility to the watermark.