Neural Network Weight Watermarking for Unauthorized Use Detection
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Training large scale neural networks requires significant computational resources and time, and reusing trained model parameters is often prohibited due to their core technology status, making it difficult to detect unauthorized use.
Innovation Solution
Embedding watermark information into neural network weights by using a second neural network to update the weights based on gradients obtained from the error between the output of the first neural network and the watermark bits, allowing for detection even after re-training.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Productivity
If trained model parameters are distributed for re-use, then efficiency of study is improved, but unauthorized use cannot be detected
Solution Approach 1:
Watermark information is embedded into the model parameters before distribution. This preliminary action ensures that even if parameters are reused or modified, the embedded watermark persists and can be detected later to verify authorization status
Solution Approach 2:
A second neural network is used as an intermediary to extract and verify the watermark information from the model parameters. This mediator enables detection of unauthorized use without affecting the primary functionality of the distributed parameters
2Adaptability or versatility
If model parameters are modified for re-training, then adaptability is improved, but watermark detection becomes difficult
Solution Approach 1:
The watermark is embedded in a robust manner during the initial training phase, creating a persistent marker that survives subsequent modifications and re-training operations. This preliminary embedding ensures long-term detectability
Solution Approach 2:
A verification mechanism using a second neural network provides feedback by extracting and checking the watermark information from modified parameters. This feedback system enables continuous monitoring of authorization status even after parameter modifications
Data Source
Figure 1
Figure 2
Figure 3
AI summary
An information processing method for embedding watermark bits into weights of a first neural network includes: obtaining an output of a second neural network by inputting a plurality of input values obtained from a plurality of weights of the first neural network to the second neural network; obtaining second gradients of the respective plurality of input values based on an error between the output of the second neural network and the watermark bits; and updating the weights based on values obtained by adding first gradients of the weights of the first neural network that have been obtained based on backpropagation and the respective second gradients.