Neural Network Watermarking With Joint Weight and Output Embedding
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing neural network watermarking techniques either require white box access for weight watermarking or black box access for output watermarking, and lack an efficient online method to embed watermarks without additional processing delay or cost.
Innovation Solution
Jointly watermark both the weights and outputs of neural networks using an encoder neural network, enabling end-to-end training and supervision for robust watermarking, applicable in white and black box setups.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If separate watermarking methods are used for weights and outputs, then watermark coverage is improved, but processing overhead and complexity increase
Solution Approach 1:
The patent combines weight watermarking and output watermarking into a single unified process. The encoder neural network simultaneously embeds watermarks into both the neural network weights and the output data, eliminating the need for separate watermarking operations and reducing overall process complexity while maintaining comprehensive watermark coverage
Solution Approach 2:
The encoder neural network serves multiple functions: it acts as both the watermarking mechanism and the processing component. This single component handles both weight modification and output watermarking, reducing the number of required components and simplifying the overall system architecture
2Reliability
If traditional watermarking techniques are applied, then ownership indication is achieved, but additional processing delay is introduced
Solution Approach 1:
The watermarking process is performed during the training phase of the neural network, before deployment. The encoder neural network embeds watermarks into the weights and output patterns during training, so that when the network is deployed, the watermarking function is already integrated and requires no additional processing time during inference
Solution Approach 2:
The neural network itself performs the watermarking function through its trained parameters. The watermarks are embedded in the weight values and output patterns that the network naturally produces during normal operation, eliminating the need for separate watermarking processing steps during deployment
3Manufacturing precision
If white box access is required for weight watermarking, then watermark embedding precision is improved, but accessibility and ease of use deteriorate
Solution Approach 1:
The encoder neural network acts as an intermediary that translates watermark information into both weight modifications and output patterns. This intermediary structure allows the system to achieve precise watermark embedding through the encoder's learned parameters while maintaining ease of use, as the encoding process is automated and does not require manual intervention or deep expertise
Data Source
AI summary
A processor-implemented method includes receiving neural network weights from an artificial neural network. The method also includes jointly embedding, by an encoder neural network, a first watermark into the neural network weights of the artificial neural network and a second watermark into an output of the artificial neural network to generate watermarked weights and watermarked output. The method further includes transmitting the watermarked weights and watermarked output. A processor-implemented method by a decoder neural network includes receiving watermarked neural network weights for an artificial neural network. The method also includes receiving a first private key. The method further includes decoding the watermarked neural network weights based on the first private key to obtain a first watermark.