Deep Neural Networks (DNNs) are increasingly deployed in cloud servers and autonomous agents due to their superior performance. The deployed DNN is either leveraged in a white-box setting (model internals are publicly known) or a black-box setting (only model outputs are known) depending on the application. A practical concern in the rush to adopt DNNs is protecting the models against Intellectual Property (IP) infringement. We propose BlackMarks, the first end-to-end multi-bit watermarking framework that is applicable in the black-box scenario. BlackMarks takes the pre-trained unmarked model and the owner’s binary signature as inputs. The output is the corresponding marked model with specific keys that can be later used to trigger the embedded watermark. To do so, BlackMarks first designs a model-dependent encoding scheme that maps all possible classes in the task to bit ‘0’ and bit ‘1’. Given the owner’s watermark signature (a binary string), a set of key image and label pairs is designed using targeted adversarial attacks. The watermark (WM) is then encoded in the distribution of output activations of the DNN by fine-tuning the model with a WM-specific regularized loss. To extract the WM, BlackMarks queries the model with the WM key images and decodes the owner’s signature from the corresponding predictions using the designed encoding scheme. We perform a comprehensive evaluation of BlackMarks’ performance on MNIST, CIFAR-10, ImageNet datasets and corroborate its effectiveness and robustness. BlackMarks preserves the functionality of the original DNN and incurs negligible WM embedding overhead as low as 2.054%. Deep neural networks and other Deep Learning (DL) variants have revolutionized various critical fields ranging from biomedical diagnosis and autonomous transportation to computer vision and natural language processing BID7 BID25 . Training a highly accurate DNN is a costly process since it requires: (i) processing massive amounts of data acquired for the target application; (ii) allocating substantial computing resources to fine-tune the underlying topology (i.e., type and number of hidden layers), and hyper-parameters (i.e., learning rate, batch size), and DNN weights to obtain the most accurate model. Therefore, developing a high-performance DNN is impractical for the majority of customers with constrained computational capabilities. Given the costly process of designing/training, DNNs are typically considered to be the intellectual property of the model builder and needs to be protected to preserve the owner's competitive advantage.Digital watermarking has been immensely leveraged over the past decade for ownership protection in the multimedia domain where the host of the watermark can be images, video contents, and functional artifacts such as digital integrated circuits BID9 BID12 BID24 . However, the development of DNN watermarking techniques is still in its early stage. Designing a coherent DNN watermarking scheme for model ownership proof is challenging since the embedded WM is required to yield high detection rates and withstand potential attacks while minimally affecting the original functionality and overhead of the target DNN.Existing DNN watermarking techniques can be categorized into two types depending on the application scenario. 'White-box' watermarking assumes the availability of model internals (e.g., weights) for WM extraction BID31 whereas 'black-box' watermarking assumes that the output predictions can be obtained for WM detection BID20 BID1 . On the one hand, white-box WMs have a larger capacity (carrying multiple-bit information) but limited appli-cability due to the strong assumption. On the other hand, black-box WMs enable IP protection for Machine Learning as a Service (MLaaS) BID25 where only zero-bit watermarking methods have been proposed. It is desirable to develop a systematic watermarking approach that combines the advantages of both types of WMs. While all present black-box watermarking papers embed the WM as a statistical bias in the decision boundaries of the DNN (high accuracy on the WM trigger set), our work is the first to prove that it is feasible to leverage the model's predictions to carry a multi-bit string instead of a one-bit boolean decision (existence or not of the WM).By introducing BlackMarks, this paper makes the following contributions:• Proposing BlackMarks, the first end-to-end black-box watermarking framework that enables multi-bit WM embedding. BlackMarks possesses higher capacity compared to prior works and only requires the predictions of the queried model for WM extraction.• Characterizing the requirements for an effective watermarking methodology in the deep learning domain. Such metrics provide new perspectives for model designers and enable coherent comparison of current and pending DNN IP protection techniques.• Performing extensive evaluation of BlackMarks' performance on various benchmarks. Experimental results show that BlackMarks enables robust WM embedding with high detection rates and low false alarm rates. As a side benefit, we find out that BlackMarks' WM embedding process improves the robustness of the model against adversarial attacks. Recall that WM embedding leverages a similar approach as 'adversarial training' while incorporating a WM-specific regularization loss (Section 4.1). Here, we study the effect of WM embedding on the model's robustness against adversarial attacks. TAB8 in Appendix A.3 compares the robustness of the pre-trained unmarked model and the corresponding watermarked model (K = 50) against different white-box adversarial attacks. It can be seen that for each type of the attack, the marked model has higher accuracy on the adversarial samples compared to the unmarked baseline. Such improvement is intuitive to understand since during WM embedding, the first term (cross-entropy loss) in the total regularized loss (see Eq.(1)) enforces the model to learn the correct predictions on training data as well as on the WM keys ('adversarial samples'), thus having a similar effect as 'adversarial training' BID16 . Therefore, BlackMarks has a side benefit of improving the model's robustness against adversarial attacks.In the future, we plan to extend BlackMarks framework to the multi-user setting for fingerprinting purpose. BID3 present the first collusion-resilient DNN fingerprinting approach for unique user tracking in the white-box setting. To the best of our knowledge, no black-box fingerprinting has been proposed due to the lack of black-box multi-bit watermarking schemes. BlackMarks proves the feasibility of black-box fingerprinting methods and builds the technical foundation. We propose BlackMarks, the first black-box multi-bit watermarking framework for IP protection of DNNs. To the best of our knowledge, this work provides the first empirical evidence that embedding and extracting multi-bit information using the model's predictions are possible. Our comprehensive evaluation of BlackMarks' performance on various benchmarks corroborates that BlackMarks coherently embeds robust watermarks in the output predictions of the target DNN with an additional overhead as low as 2.054%. BlackMarks possesses superior capacity compared to all existing zerobit watermarking techniques and paves the way for future black-box fingerprinting techniques.For ImageNet dataset (where the total number of categories is C = 1000), the sizes of the code-bit cluster '0' and cluster '1' are larger than ones in MNIST and CIFAR-10 dataset. Therefore, the searching space for targeted adversarial samples is larger and the probability of WM key collision is smaller, ensuring the robustness of the generated WM keys against the WM over-writing attack.JSMA is not applied to the ImageNet benchmark since the excessive memory requirement BID32 ) cannot be satisfied by our 11.74GiB test machine.Model Fine-tuning for WM Embedding. To embed the WM, we set the hyper-parameter λ to 0.5 for MNIST and CIFAR-10 benchmark, and to 0.01 for ImageNet benchmark in our experiments. The pre-trained unmarked model is fine-tuned for 15 epochs with the regularized loss in Eq. FORMULA0 for all benchmarks. We use the same batch size and the optimizer setting used for training the original neural network, except that the learning rate is reduced by a factor of 10. Such retraining procedure coherently encodes the WM key in the distribution of output activations while preventing the accuracy drop on the legitimate data.
Proposing the first watermarking framework for multi-bit signature embedding and extraction using the outputs of the DNN.  Proposes a method for multi-bit watermarking of neural networks in a black-box setting and demonstrate that the predictions of existing models can carry a multi-bit string that can later be used to verify ownership. The paper proposes an approach for model watermarking where the watermark is a bit string embedded in the model as part of a fine-tuning procedure