Neural Network Watermarking via Parameter Bit Updates
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing neural network watermarking techniques lack robustness against modifications, particularly in embedded devices, leading to watermark erasure and unauthorized use.
Innovation Solution
A white-box digital watermarking method that minimally modifies neural network parameters by iteratively updating index bits based on a message, using operations like XOR with a random vector, and incorporating redundancy through encrypted codes or visible signatures.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If white-box watermarking techniques are used to insert watermarks into neural network parameters, then the neural network can be protected and marked, but the watermark is sensitive to modifications such as relearning, pruning, quantization, and format changes causing watermark erasure
Solution Approach 1:
The patent divides the neural network parameters into multiple blocks and applies watermarking to specific selected blocks rather than all parameters. This segmentation allows the watermark to be embedded in a way that is less susceptible to modifications in other parts of the network, thereby improving robustness against relearning, pruning, and quantization attacks.
Solution Approach 2:
The patent applies different watermarking strategies to different parameter blocks based on their importance and vulnerability. By selecting specific blocks for watermarking and using tailored embedding methods for each block, the system achieves localized protection that maintains watermark integrity even when other parts of the network are modified.
2Reliability
If digital watermarks are inserted into neural network parameters to protect against unauthorized use, then the neural network can be traced and protected, but the functional qualities such as accuracy and performance may be degraded
Solution Approach 1:
The patent applies watermarking to only a partial set of parameter blocks rather than all parameters. This partial action ensures that the watermarking process does not excessively modify the network parameters, thereby preserving the functional qualities like accuracy and performance while still providing effective protection and traceability.
Solution Approach 2:
The patent uses subtle parameter changes for watermark embedding, such as modifying least significant bits or applying small perturbations, rather than large modifications. This approach allows the watermark to be embedded with minimal impact on the neural network's functional performance, maintaining both protection and accuracy.
3Reliability
If existing watermarking techniques are applied to neural networks deployed in embedded devices, then the neural network can be protected, but the techniques are not robust enough against modifications and attacks in embedded environments
Solution Approach 1:
The patent employs dynamic watermark embedding strategies that adapt to the specific characteristics of embedded device neural networks. The watermarking process dynamically selects parameter blocks and embedding methods based on the network architecture and deployment context, ensuring robustness against modifications specific to embedded environments while maintaining protection effectiveness.
Data Source
AI summary
A method of digitally watermarking a neural network, implemented by an electronic device, the neural network being stored within a data structure including blocks of parameters. The method includes, for a current parameter block consisting of at least N parameters representing real numbers, obtaining a message including N bits, at least N iterations of a parameter modification operation within the current block, including obtaining a current parameter, from among the at least N parameters of the current parameter block, and updating the value of a predetermined index bit of the current parameter as a function of a bit in the message.