Neural Network Watermarking via Hidden Layer Trigger Images
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing neural network watermarking techniques fail to detect sophisticated copying methods that rearrange hidden layer nodes and add noise to avoid detection, making it difficult to authenticate and protect deployed neural networks.
Innovation Solution
A method is introduced that generates and stores trigger images for each node of a neural network's hidden layer, allowing for the detection of copied networks by reordering nodes based on these images and applying a watermarking process, such as random projection, to generate and compare keys, thereby identifying authentic and copied networks.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If existing neural network watermarking techniques are used, then basic copying detection is possible, but sophisticated copying methods (rearranging hidden layer nodes and adding noise) can avoid detection
Solution Approach 1:
The system performs preliminary actions by generating and storing trigger images for each node of the hidden layer before copying occurs. These trigger images serve as fingerprints that can detect even sophisticated modifications later, resolving the contradiction by preparing detection mechanisms in advance that remain effective against advanced copying techniques.
Solution Approach 2:
The patent introduces trigger images as intermediary elements between the neural network nodes and the copying detection process. These trigger images act as mediators that capture the unique activation patterns of each node, enabling detection of copying even when nodes are rearranged or noisy, thus improving reliability against sophisticated copying methods.
2Reliability
If trigger images are generated and stored for each hidden layer node, then detection of rearranged and noisy copies becomes possible, but system complexity increases
Solution Approach 1:
The system segments the hidden layer into individual nodes, generating and storing separate trigger images for each node. This segmentation approach simplifies the overall detection process by breaking down the complex authentication task into manageable unit-level comparisons, reducing the computational burden despite the increased number of trigger images.
Solution Approach 2:
The patent changes the parameter representation from raw node activations to compressed trigger images. This parameter transformation reduces the amount of data that needs to be stored and processed while maintaining the unique identification capability of each node, thus managing system complexity while preserving authentication accuracy.
3Adaptability or versatility
If hidden layer nodes are rearranged or noise is added to copied networks, then the copied network maintains functionality, but detection becomes more difficult
Solution Approach 1:
The system uses trigger images as feedback mechanisms that capture the original node activation patterns. When a copied network is evaluated, the trigger images provide feedback about the expected activation patterns, enabling detection of rearrangements or noise additions even though the copied network maintains its functional behavior.
Solution Approach 2:
Instead of trying to detect changes in the copied network's output (which maintains functionality), the patent inverts the approach by detecting the unique activation fingerprints of the original nodes through trigger images. This inversion makes detection possible regardless of how the copied network maintains its functionality through rearrangement or noise.
Data Source
AI summary
Methods and apparatus, including computer program products, are provided for watermarking neural networks. In some embodiments, there may be provided a method. The method may include determining, for a neural network, an activation layer output by a hidden layer of the neural network. The method may include selecting a watermarking process. The method may include applying the selected watermarking process to the activation layer output to generate a key. The method may include storing, for the neural network to enable detection of copying of the neural network, the selected watermarking process and the key. Related systems, methods, and articles of manufacture are also described.