Neural Network Watermark Embedding via Weight Distribution Transformation
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing neural network watermark embedding algorithms face issues with detectability and robustness, as they alter the weight distribution of the model, making watermarks easier to detect and less resistant to attacks like overwriting and model compression.
Innovation Solution
A method that trains an embedded neural network model using weight information and watermark information, updating the weights to embed the watermark robustly, and uses adversarial training to enhance concealment, involving multiple neural network layers and distinguishability data for hiding.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If watermark information is embedded in the neural network model using existing algorithms, then the neural network model can be protected, but the weight distribution of the model is changed making the watermark easier to be detected
Solution Approach 1:
The patent transforms the watermark embedding problem from directly modifying weight values to changing the distribution characteristics of weights. By using a transformation matrix to map weight information to watermark information, the method embeds watermark in the statistical properties of weight distribution rather than individual weight values, making the watermark harder to detect while maintaining model functionality
Solution Approach 2:
The patent introduces a transformation matrix as an intermediary between the neural network weights and the watermark information. This matrix serves as a mediator that converts weight distributions into watermark signals, allowing watermark embedding without directly altering the original weight values, thereby reducing detectability
2Reliability
If watermark information is embedded in the neural network model using existing algorithms, then the neural network model can be protected, but the embedded watermark information is less robust to watermark attacks such as overwriting attacks and model compression
Solution Approach 1:
The patent performs preliminary transformation of weight information into watermark information before any potential attacks occur. By pre-embedding the watermark through a transformation matrix and using the transformed weights to reconstruct the model, the watermark is integrated into the model's fundamental structure, making it resistant to subsequent attacks like overwriting or compression
Solution Approach 2:
The patent creates a composite structure by combining original weight information with transformation matrix information to generate embedded weights. This composite approach integrates watermark information deeply into the model architecture, making the watermark as integral to the model as the original weights, thereby enhancing robustness against attacks
Data Source
AI summary
A method and an apparatus for embedding watermark information are disclosed in the present disclosure. The method trains an embedded neural network model using weight information of a target neural network model and target watermark information that is to be embedded into the target neural network model, updates the weight information of the target neural network model according to target watermark embedded data provided by the embedded neural network model, and obtains a target neural network model embedded with the target watermark information. Since the embedded neural network model includes multiple neural network layers, this method increases the complexity of the watermark embedding process, and is able to avoid the problem that watermark information of existing neural network models has poor robustness to watermarking attacks such as overwriting attacks and model compression.