OVLA: Neural Network Ownership Verification using Latent Watermarks
Ownership verification for neural networks is important for protecting these
models from illegal copying, free-riding, re-distribution and other
intellectual property misuse. We present a novel methodology for neural network
ownership verification based on the notion of latent watermarks. Existing
ownership verification methods either modify or introduce constraints to the
neural network parameters, which are accessible to an attacker in a white-box
attack and can be harmful to the network's normal operation, or train the
network to respond to specific watermarks in the inputs similar to data
poisoning-based backdoor attacks, which are susceptible to backdoor removal
techniques. In this paper, we address these problems by decoupling a network's
normal operation from its responses to watermarked inputs during ownership
verification. The key idea is to train the network such that the watermarks
remain dormant unless the owner's secret key is applied to activate it. The
secret key is realized as a specific perturbation only known to the owner to
the network's parameters. We show that our approach offers strong defense
against backdoor detection, backdoor removal and surrogate model attacks.In
addition, our method provides protection against ambiguity attacks where the
attacker either tries to guess the secret weight key or uses fine-tuning to
embed their own watermarks with a different key into a pre-trained neural
network. Experimental results demonstrate the advantages and effectiveness of
our proposed approach.
Feisi Fu, Wenchao Li
# OVLA: Neural Network Ownership Verification using Latent Watermarks

###### Abstract

Ownership verification for neural networks is important for protecting these models from illegal copying, free-riding, re-distribution and other intellectual property misuse. We present a novel methodology for neural network ownership verification based on the notion of _latent watermarks_. Existing ownership verification methods either modify or introduce constraints to the neural network parameters, which are accessible to an attacker in a white-box attack and can be harmful to the network's normal operation, or train the network to respond to specific watermarks in the inputs similar to data poisoning-based backdoor attacks, which are susceptible to backdoor removal techniques. In this paper, we address these problems by _decoupling_ a network's normal operation from its responses to watermarked inputs during ownership verification. The key idea is to train the network such that the watermarks remain dormant unless the owner's secret key is applied to activate it. The secret key is realized as a specific perturbation only known to the owner to the network's parameters. We show that our approach offers strong defense against backdoor detection, backdoor removal and surrogate model attacks.In addition, our method provides protection against ambiguity attacks where the attacker either tries to guess the secret weight key or uses fine-tuning to embed their own watermarks with a different key into a pre-trained neural network. Experimental results demonstrate the advantages and effectiveness of our proposed approach.

## 1 Introduction

Deep neural networks (DNNs) have demonstrated impressive performances on a wide variety of applications ranging from image recognition Krizhevsky et al. (2012) to protein folding Jo et al. (2015). Obtaining these levels of performance often requires constructing large models with many parameters. For example, the well-known VGG-16 network Simonyan and Zisserman (2014) has about 138 million parameters, not to mention that the more recent large-scale language models like GPT-3 Floridi and Chiriatti (2020) which has 175 billion parameters. Training these models are expensive - requires a large amount of good-quality training data Krizhevsky et al. (2012), dedicated GPU clusters Patterson et al. (2021), days if not weeks to train Patterson et al. (2021), and specialized tuning Sada (2021). Given the high cost of developing and training these models and the massive profits that they may help generate, these models are valuable intellectual properties (IPs) to their owners and it is important to protect them from misuse such as illegal copying, re-distribution, and free-riding. In this paper, we refer to the type of schemes that aim that ascertaining the ownership of a neural network _ownership verification (OV)_.

Most approaches for neural network ownership verification employ some form of _digital watermarks_. In the context of DNNs, the watermark information is embedded into a hosting DNN Uchida et al. (2017); Nagai et al. (2018); Adi et al. (2018); Zhang et al. (2018); Ma et al. (2021); Wang et al. (2021). A DNN model can then be queried to extract the watermark or verify the presence of a watermark. Existing methods of DNN watermarking roughly fall into the following two categories.

1. **Static Watermarking**. The idea is to embed watermark information into the weights of a DNN. Representative techniques include adding a parameter regularization term to the DNN loss function and then verifying the ownership
of the DNN by parameter projection Uchida et al. (2017), Nagai et al. (2018), and generating a matrix as a fingerprint of the DNN and inserting the fingerprint by adding a penalty term to force the user-selected parameters to be close to the fingerprint matrix Chen et al. (2019). One problem of such approaches is that the additional parameter constraints can degrade the DNN's performance for normal operation. In addition, it has been shown that most static watermark schemes are vulnerable to watermark removal attacks such as model compression Cheng et al. (2017), fine-tuning Wang and Kerschbaum (2019), and watermark overwrites Wang and Kerschbaum (2019). A recent paper leverages this insight to embed a parameter mask as the watermark such that the network would still have high accuracy when it is pruned using this mask Chen et al. (2021). However, one potential issue with this approach is that a user-designed mask limits the structure of pruned model and can hinder training. Finally, it is also worth noting that an OV scheme that uses static watermarks requires a judge or the owner to have _white-box access_ to the DNN in question.

2. **Dynamic Watermarking**. The idea is to train the DNN to produce specific outputs when a pre-determined watermark is present in the input Adi et al. (2018), Zhang et al. (2018), Yang et al. (2021). Given the connection to backdoor attacks on neural networks Gu et al. (2017), this approach is sometimes referred to _backdoor-based watermarks_. In a similar vein, authors of Le Merrer et al. (2020) propose to use adversarial perturbations of certain training examples as watermarks. When separate training instances are used as watermarked inputs, these inputs are also called a trigger set in the literature Fan et al. (2019). An advantage of dynamic watermarking is that it allows the owner to probe the DNN in question by supplying watermarked inputs and observing the DNN's outputs without white-box access to the network. However, similar to static watermarking schemes, dynamic watermarking is also susceptible to watermark removal attacks via fine-tuning, model pruning or watermark overwriting Boenisch (2020). In addition, dynamic watermarking schemes is vulnerable to surrogate model attacks Dong et al. (2021), i.e. an attacker can create a surrogate DNN by querying the victim model and then extract the watermark information through trigger reverse-engineering Wang et al. (2019).

In addition to watermark removal and surrogate model attacks, ambiguity attacks Craver et al. (1998), Fan et al. (2019) post significant challenges to DNN ownership verification. These attacks aim at casting doubt on the ownership of a DNN by forging additional watermarks on top of the original ones. An effort aimed at failing this type of attacks adds a so-called passport layer after each convolutional layer to modulate the performance of the network depending on the correctness of the user-supplied passport Fan et al. (2019). However, due to the coupling of passport learning and model learning, there is a substantial drop in normal-operation performance. On the other hand, distributing the passports along with the models for normal operation cannot prevent illegal copying or re-distribution. A subsequent work extended this idea by removing the need to change the network's architecture and training a passport-aware branch that is only added during ownership verification Zhang et al. (2020). However, it still suffers from performance degradation compared to a normally trained model. Another work applies the passport idea which was originally developed for convolutional neural networks to watermarking generative adversarial networks Ong et al. (2021).

In this paper, we propose OVLA (**o**w**nership **v**erification using **I**a**tent **w**atermarks), a novel DNN ownership verification methodology with strong performance guarantee, defense against backdoor detection, backdoor removal, surrogate model attacks and ambiguity attacks. The key idea of OVLA is to _decouple the network's normal operation from its responses to watermarked inputs during ownership verification_. Instead of limiting the passport to the normalization layers of the DNN such as in Fan et al. (2019), Zhang et al. (2020), we show that it is possible to realize the passport (called _secret weight key_ in this paper) as a perturbation to the weights of almost any layer in the network. Compared with existing approaches, OVLA provides provably guarantee on the network's performance during normal operation. We show that OVLA-watermarked DNNs can effectively evade backdoor detection techniques, are immune to surrogate model attacks, and are resistant to watermark removal methods such as fine-tuning and model pruning. In addition, OVLA offers strong defense against ambiguity attacks where the attacker either tries to guess the secret weight key or uses fine-tuning to embed their own watermarks with a different key into a pre-trained neural network. The latter type of ambiguity attacks is unexplored in current literature. Figure 1 illustrates the high-level ownership verification flow of OVLA, where the user registration mechanism is designed specifically for guarding against the second type of ambiguity attacks (details in Section 2.7). We summarize our contributions below.

1. We present OVLA, a novel DNN ownership verification methodology that effectively decouples ownership verification from the DNN's normal operation.

2. We provide theoretical analysis to show that OVLA is the first DNN ownership verification method with provable performance guarantees and strong defenses against surrogate model attacks and fine-tuning-based ambiguity attacks. The latter is not explored in current literature.

3. Across a set of benchmarks, OVLA- watermarked DNNs show strong empirical resistance against backdoor detection, backdoor removal, key guessing-based ambiguity attacks.
## 2 Background

### Deep Neural Networks

An \(R\)-layer feed-forward DNN \(f=\kappa_{R}\circ\sigma\circ\kappa_{R-1}\circ...\circ\sigma\circ\kappa_{1}:X\to Y\) is a composition of linear functions \(\kappa_{r},r=1,2,...,R\) and activation function \(\sigma\), where \(X\subseteq\mathbb{R}^{m}\) is the input domain and \(Y\subseteq\mathbb{R}^{n}\) is the output domain. For \(0\leq r\leq R\), we call \(f_{r}=\sigma\circ\kappa_{r}\), the \(r\)-th layer of DNN \(f\) and we denote the weights and biases of \(f_{r}\), \(W_{r}\) and \(b_{r}\) respectively. We use \(\theta=\{W_{r},b_{r}\}_{r=1}^{r=R}\) to denote the set of parameters in \(f\), and we write \(f(x)\) as \(f(x;\theta)\).

### Digital Watermarking

In general, digital watermarking refers to a technique that embeds a message, called watermark information, into a hosting multimedia content. In this paper, we consider zero-bit watermark which is also known as ownership verification.

In general, a watermarking technique includes two parts: embedding and extraction (verification).

(1) For embedding, an embedding function \(E\) takes some watermark information \(W\) and a carrier model \(M\) and output a watermarked model \(M^{\prime}=E(\bar{M},W)\).

(2a) For extraction, the goal is to extract the watermark information \(W^{\prime}\) (potentially different from \(W\) due to imperfect extraction) from a watermarked model \(M^{\prime}\). We use \(D\) to denote the extraction function such that \(W^{\prime}=D(M^{\prime})\).

(2b) During ownership verification, the verification function \(D\) takes \(W\) and \(M^{\prime}\) as inputs and outputs \(D(W,M^{\prime})=\{\texttt{True},\texttt{False}\}\).

### Backdoor Attacks

We consider data poisoning-based backdoor attacks that train a DNN with a portion of the training data modified to include pre-determined trigger pattern(s) and their target label(s). An example trigger pattern is a small yellow square pasted on a specific location of an image. The training process will force the DNN to associate any image with the trigger pattern to the target label. We call \(f\) a backdoored DNN if it has a high accuracy on clean data and classifies trigger data to its target label.

### Zero-bit Backdoor-based Watermarking

We consider zero-bit backdoor-based watermark which applies backdoor attacks as the watermark embedding function and then verifies the presence of the watermark by checking the network's accuracy on a set of inputs with the trigger added (henceforth called a _trigger set_ for convenience)1.

Figure 1: Flow chart of OVLA.
The embedding process is to train a DNN \(f=E(D,D_{T},T_{L})\) with additional trigger data \(D_{T}\) and trigger labels \(T_{L}\), where \(D\) is the original training data.

Watermark verification is to verify the watermarked DNN's accuracy on trigger data, \(T^{\prime}_{L}=D(f,D_{T})\), where \(T^{\prime}_{L}\) is the DNN's prediction on trigger data. If \(T^{\prime}_{L}\) is close to \(T_{L}\), then the verification is considered successful. Formally, the verification process is to check if

\[Pr_{x\in D_{T}}[\arg\max f(x)\neq T_{L}(x)]\leq\epsilon \tag{1}\]

where \(\epsilon\) is a user-defined threshold and \(\arg\max\) is to take the label with the maximal probability as predicted by \(f\).

### Adversarial Weight Perturbation

Adversarial weight perturbation (AWP) has been introduced for improving the robustness of a neural network Wu et al. (2020). Several existing works Rakin et al. (2020); Chen et al. (2021); Garg et al. (2020); Ning et al. (2022) show that adversarial weight perturbation can be used in place of data poisoning to introduce a backdoor to a DNN.

For a DNN \(f(x;\theta)\), we call \(\delta\) an AWP if by adding \(\delta\) to the weight parameters \(\theta\), the resulting DNN \(f(x;\theta+\delta)\) is is a backdoored DNN for some trigger set known to the attacker.

### Surrogate Model Attacks

In a surrogate model attack, the attacker treats the victim watermarked DNN as a black-box and tries to replicate its functionality by constructing a surrogate model that is trained from repeated input-output queries on the victim DNN. The attacker then reverse-engineers the watermark information from the surrogate model Li et al. (2021); Gou et al. (2021).

### Ambiguity Attacks

Ambiguity attacks aim to cast doubt on the ownership of the model Craver et al. (1998). The ambiguity arises when two separate parties can both claim ownership of the model by demonstrating successful ownership verification on their chosen watermarks. In this paper, we consider two kinds of ambiguity attacks:

1. **Free-rider Attacks**. The attackers, known as free riders, benefit from the system without contributing their fair share Lin et al. (2019). In DNN OV, a free-rider is an attacker who embeds their own watermark into a DNN which was not trained by them. In particular, we consider the setting where the attacker fine-tunes a pre-trained DNN to embed their own watermark.

2. **Key Guessing Attacks**. The goal of these attacks is to guess the secret weight key or find a substituted key (and the associated trigger set) to claim ownership of the target DNN.

### Free-rider Attacks vs. Key Guessing Attacks.

With a slight abuse of the terminology, we use free-rider attacks to refer to attacks that require modifying a pre-trained DNN in a relatively inexpensive way to claim ownership (i.e. they are _almost_ free-riders), and key guessing attacks to refer to attacks that try to "guess" the watermark information and do not require modifying the DNN.

## 3 Overview of Ovla

In this section, we introduce the OVLA scheme, which includes: (1) User Registration, (2) Latent Watermark Embedding, and (3) Latent Watermark Verification (Figure 2).

The key idea of OVLA is to train the network such that the watermarks remain dormant unless the owner's secret key is applied to activate it. This highlights a fundamental difference between OVLA and existing dynamic watermarking schemes: instead of directly verifying the trigger-set accuracy of the trained DNN \(f(x;\theta)\), _OVLA verifies the trigger-set accuracy of DNN \(\hat{f}=f(x;\theta+\delta)\)_ where \(\delta\) is the owner's secret weight key and we call \(f(x;\theta+\delta)\) the unlocked DNN. In addition, \(f\) is trained in such a way that it does not respond to the trigger.

### User Registration

We propose to include a trusted authority (TA) which applies a registration function \(R\) to any user who wishes to register under the OVLA system. The trusted authority plays a similar role as the certificate authority in public-key infrastructure
and can double as a judge in ownership disputes. \(R\) takes a user-defined string as input and outputs a secret weight key which is issued to the user.

The reason of having a trusted authority is to prevent users from registering a self-designed secret weight key. A non-centralized registration could be built if all the users agree to use the same public one-way function Goldreich as the registration function. The property of a one-way function would make it extremely costly to register a self-designed secret weight key.

### Latent Watermark Embedding

The watermark is latent in the sense that the network does not respond to it unless the secret weight key is applied. Latent watermarks are embedded during training using a specially crafted loss function. We use \(L_{1}(\theta)\) to denote the loss for DNN's normal operation on a clean dataset \(D\) (with a label function \(C_{L}\)). To embed a latent watermark, we use a latent watermark dataset \(D_{T}\), which is a subset of clean data injected with the watermark (with a label function \(T_{L}\)) and a pre-determined secret weight key \(\delta\). To separate the DNN's normal operation from latent watermark verification, we define the latent watermark loss \(L_{2}\) as the sum of following three terms:

\[L_{2}(\theta)=\sum_{x\in D_{T}}L(f(x;\theta),C_{L}(x))+\lambda_{1}\sum_{x\in D }L(f(x;\theta+\delta),C_{L}(x))+\lambda_{2}\sum_{x\in D_{T}}L(f(x;\theta+ \delta),T_{L}(x))\]

where \(\lambda_{1}\), \(\lambda_{2}\) are hyperparameters that control the importance of each term. The first term is used to force the DNN not to respond to latent watermarks without the secret weight key, thereby avoiding leaking any watermark information. The last two terms are designed for latent watermark verification which we will explain in more detail in Section 3.3. Finally, the loss function for the DNN training process is a weighted sum of \(L_{1}\) and \(L_{2}\).

### Latent Watermark Verification

To claim the ownership of a DNN \(f\), one should have a registered secret weight key \(\delta\), a latent watermark set \(D_{T}\) and a trigger label function \(T_{L}\). Formally, the verification process is to check if

\[Pr_{x\in D}[\arg\max f(x;\theta+\delta)\neq C_{L}(x)]\leq\epsilon_{1}\quad Pr_ {x\in D_{T}}[\arg\max f(x;\theta+\delta)\neq T_{L}(x)]\leq\epsilon_{2} \tag{2}\]

where \(\theta\) is the parameter of \(f\) and \(\epsilon_{1},\epsilon_{2}\) are user-defined thresholds.

For a latent watermarked DNN \(f\), minimizing the last two terms in loss function 2 force the perturbed DNN \(\hat{f}\) to map any clean data \(x\) to its label \(C_{L}(x)\) and any latent watermark data to its trigger label \(T_{L}(x)\). Therefore, the ownership of a DNN trained with loss function 2 can be verified the owner with the corresponding secret weight key.

Figure 2: Left: Watermarked DNN, which behaves like a clean DNN, and does not respond to the watermarked input. Right: Unlocked DNN, which is used for ownership verification and correctly maps a watermarked input to its target class (class 0).
## 4 Analysis of \(\mathtt{O\VLA}\)

### Performance Guarantee

In this section, we provide theoretical support on how \(\mathtt{OVLA}\)'s scheme of decoupling the DNN's normal operation and the backdoor-based ownership verification can preserve the performance of the target DNN. First, we show that any continuous function can be approximated by \(f(x;\theta)\) where \(f(x;\theta+\delta)\) is a backdoored DNN.

To this end, we consider a stronger version which requires showing that any \(C(\mathbf{R}^{m+k},\mathbf{R}^{n})\) function can be approximated by \(f(x;\theta+\delta)\), where we take \((x,\delta)\in\mathbf{R}^{m+k}\) as variables and \(\theta\) as the parameter of this function.

**Theorem 1** (Universal Approximation Theorem for Parameter Space).: _Suppose \(f(x;\theta)\) is a fully connected feedforward neural network with more than four hidden layers. \(\delta\) is a perturbation for the weights of a single layer which is between the 2nd hidden layer and the last 2nd layer inclusive. We claim that the resulting neural network \(f(x;\theta+\delta)\) is a universal approximation for any \(C(\mathbf{R}^{m+k},\mathbf{R}^{n})\), where \(k\) is the dimension of \(\delta\). That is, for any \(g:\mathbf{R}^{m+k}\rightarrow\mathbf{R}^{n}\), there exists a \(\theta\) such that \(\sup||f(x;\theta+\delta)-g(x,\delta)||<\epsilon\)._

**Corollary 1** (Performance Guarantee).: _Suppose \(f(x;\theta)\) is a feed-forward neural network with more than four hidden layers. For any non-zero weight perturbation \(\delta\) which has the same size as the weight of a single layer between the 2nd hidden layer and the last 2nd layer inclusive. Then by the Universal Approximation Theorem for Parameter Space, there exists a secret weight key \(\delta\) such that \(f(x;\theta)\) can approximate any continuous function where \(f(x;\theta+\delta)\) is a backdoored DNN._

Corollary 1 also ensures that \(\mathtt{OVLA}\) can work for any secret weight key issued by the trusted authority.

### Defense against Backdoor Detection

We consider backdoor detection techniques based on reverse-engineering the trigger and its target class. Neural Cleanse Wang et al. (2019) is a good representative of these techniques. It assumes a white-box model where the attacker has access to the DNN parameters and uses a gradient-based optimization method to reverse-engineer the trigger and its target class. Such backdoor detection methods can be used by an attacker to extract the watermark information for a backdoor-based watermarked DNN.

For \(\mathtt{OVLA}\), without the secret weight key \(\delta\), the watermarked DNN does not respond to the latent watermark. Therefore, for attackers who do not have knowledge of \(\delta\), such backdoor detection methods will not identify the latent watermarks. An experiment in Section 5 shows that the latent watermarked DNNs are indeed closer to clean DNNs than to backdoored DNNs.

### Immunity to Surrogate Model Attacks

Surrogate model attacks target both static and dynamic watermarking schemes, since the watermark information (i.e. DNN's weights for static watermarking and the trigger and its target class for dynamic watermarking) could be leaked by performing input-output queries on the target model. On the contrary, a latent watermarked DNN does not respond to the watermarks unless the secret weight key is applied and thus the watermark information would not be leaked through input-output queries.

In the following theorem, we claim that \(\mathtt{OVLA}\) is immune to surrogate model attacks due to the arbitrariness of the unlocked DNN, i.e. it is not possible to recover \(f(x;\theta+\delta)\) given only input-output queries of \(f(x;\theta)\).

**Theorem 2** (Immunity to Surrogate Model Attacks).: _Suppose \(f(x;\theta)\) is a latent watermarked DNN with non-zero secret weight key \(\delta\), \(D\) is the clean dataset and \(D_{T}\) is the trigger set. For any \(\epsilon>0\), there exists another DNN \(f(x;\theta^{\prime})\):_

1. \(Pr_{x\in D}[\arg\max f(x;\theta)\neq\arg\max f(x;\theta^{\prime})]\leq\epsilon\)_;_
2. \(Pr_{x\in D_{T}}[\arg\max f(x;\theta+\delta)=\arg\max f(x;\theta^{\prime}+\delta )]\leq\frac{1}{c}+\epsilon\)_._

### Immunity to Free-Rider Attacks

To the best of our knowledge, existing DNN OV techniques do not offer protection against free-rider attacks. Specifically, a (almost) free-rider can fine-tune (which is much less expensive than training) a pre-trained DNN which does not belong to them to embed their own watermarks and then claim ownership of the resulting DNN.

For \(\mathtt{OVLA}\), while we do not directly prohibit embedding watermarks through fine-tuning, the following theorem shows that using fine-tuning to embed a _latent_ watermark is as expensive as (re)training from scratch. Thus, there is no incentive for an attacker to forge their own latent watermarks on a pre-trained model this way.
**Theorem 3** (Immunity to Free-Rider Attacks).: _If the secret weight key \(\delta\) is non-sparse and \(||\delta||_{2}\) is large enough, then \(\theta+\delta\) is close to a normal distribution on the whole parameter space, where \(\theta\) is the parameter of a pre-trained DNN \(f(x,\theta)\). Therefore, embedding \(\delta\) into \(f(x,\theta)\) via fine-tuning is as difficult as retraining from scratch._

## 5 Experiments

In this section, we implement OVLA on a set of DNN models and evaluate their performances under backdoor detection, key guessing attacks, and watermark removal via model pruning and fine-tuning. The experiments are designed to answer the following questions:

1. How do the OVLA-watermarked DNNs perform relatively to normally trained DNNs on clean data?

2. How well does OVLA protect the watermarked models against key guessing attacks?

3. Can the OVLA-watermarked DNNs evade backdoor detection methods such as Neural Cleanse?

4. How well does the OVLA-watermarked DNNs resist watermark removal techniques such as model pruning and fine-tuning?

We use the following **evaluation metrics**:

1. **AC**: the accuracy of a watermarked DNN on clean test data;

2. **AW**: the accuracy of a watermarked DNN on latent watermark data (the trigger set);

3. **ACU**: the accuracy of a unlocked DNN (after the secret weight key is applied) on clean test data;

4. **AWU**: the accuracy of a unlocked DNN on latent watermark data.

### OVLA on MNIST/CIFAR10/GTSRB

We train a OVLA-watermarked DNN on MNIST LeCun (1998)/CIFAR10 Krizhevsky et al. (2009)/GTSRB Stallkamp et al. (2012) separately. For MNIST, we use a three-layer multilayer perceptron; for CIFAR10, we use vgg16_comp Simonyan and Zisserman (2014); for GTSRB, we use a six-layer convolutional neural network O'Shea and Nash (2015). More details about the DNN structure and the training hyperparameters can be found in the Supplemental Material. We then verify each OVLA-watermarked DNN on both clean data and latent watermark data.

The results are presented in Table 1. The performance of the OVLA-watermarked DNNs on clean data is very close to (and sometimes even better than) the performance of non-watermarked DNNs. For the watermark data, the unlocked DNNs \(f(x,\theta+\delta)\) achieve \(>\)\(99.93\%\) AWU for all cases.

### Defense against Key Guessing Attacks

We train a OVLA-watermarked DNN for each of the datasets MNIST/CIFAR10/GTSRB. We then sample 100 randomly generated weight key from a high dimensional uniform distribution (every entry is drawn from a uniform distribution between 0 and 1) and then perform ownership verification for the OVLA-watermarked DNN unlocked using a random weight key. From Figure 3, we can observe that all the randomly sampled keys fail the ownership verification.

### Defense against Backdoor Detection

We use the implementation of Neural Cleanse Wang et al. (2019) in TrojanZoo Pang et al. (2022) to evaluate how well OVLA-watermarked DNNs can evade backdoor detection. The GTSRB dataset is omitted because it is not supported by

\begin{table}
\begin{tabular}{c c c c c c c c c c c c} \hline \hline  & \multicolumn{4}{c}{MNIST} & \multicolumn{4}{c}{CIFAR10} & \multicolumn{4}{c}{GTSRB} \\ \#L & AC & AW & ACU & AWU & AC & AW & ACU & AWU & AC & AW & ACU & AWU \\ \hline
0 & \(98.03\%\) & \(9.82\%\) & - & - & \(78.67\%\) & \(10.88\%\) & - & - & \(91.79\%\) & \(0.25\%\) & - & - \\
1 & \(97.96\%\) & \(9.85\%\) & \(97.0\%\) & **100.0\%** & \(80.85\%\) & \(10.48\%\) & \(67.63\%\) & \(99.99\%\) & \(90.36\%\) & \(0.43\%\) & \(88.8\%\) & \(99.97\%\) \\
2 & \(97.87\%\) & \(9.8\%\) & \(97.88\%\) & **100.0\%** & \(89.99\%\) & \(8.95\%\) & \(70.7\%\) & **100.0\%** & \(90.56\%\) & \(6.03\%\) & \(88.15\%\) & \(99.93\%\) \\
3 & **98.07\%** & \(9.83\%\) & \(97.94\%\) & **100.0\%** & \(78.43\%\) & \(10.06\%\) & \(74.22\%\) & **99.99\%** & \(92.06\%\) & \(0.4\%\) & \(92.16\%\) & \(99.98\%\) \\
4 & - & - & - & - & **81.63\%** & \(9.97\%\) & \(80.51\%\) & **100.0\%** & **92.67\%** & \(0.54\%\) & \(92.46\%\) & \(99.99\%\) \\ \hline \hline \end{tabular}
\end{table}
Table 1: The performance of OVLA generated watermark on MNIST/CIFAR10/GTSRB. All models are train with 100 epochs. #L: The layer that secret weight key lies on (L=0 is the performance of a non-watermarked DNN).
TrojanZoo. Table 2 shows that the detection results of Neural Cleanse. We can observe that Neural Cleanse is not able to find any trigger with a small \(L_{1}\) norm2 for both OVLA and Clean DNN (DNNs trained normally on only clean data). Thus, OVLA-watermarked DNNs would be treated as Clean DNNs when inspected by backdoor detection methods like Neural Cleanse.

Footnote 2: Note that empirically speaking, for any DNN, there almost always exists a universal adversarial perturbation Moosavi-Dezfooli et al. (2017) with a large enough \(L_{1}\) norm.

### Resistance to Model Pruning

We train a OVLA-watermarked DNN on MNIST/CIFAR10 and then apply model pruning Cheng et al. (2017) to the OVLA-watermarked DNN. Pruning is applied to the last convolutional layer. We again use TrojanZoo for this evaluation Pang et al. (2022) and omit GTSRB since it is not yet supported by the tool. We report how the performances on clean data and watermarked data change as the ratio of pruning increases. Results for MNIST are included in Supplemental Material.

In Figure 4, we can observe that OVLA's performance is similar to that of clean DNN as the network is pruned - almost no accuracy (AC) drop even when 95% of neurons are pruned. On the contrary, for backdoor-based watermarks Adi et al. (2018), accuracy drops to 55% when 95% neurons are pruned. In fact, the OVLA-watermarked DNNs can still pass ownership verification when 97% neurons are pruned.

### Resistance to Fine-Tuning

We train a OVLA-watermarked DNN on MNIST/MNIST/CIFAR10 and then fine-tune the trained DNN with \(20\%\) clean data from the training dataset. We then perform ownership verification on the fine-tuned DNN and record how its performance changes during fine-tuning. Results for using secret weight key on the first layer are reported in Table 3.

\begin{table}
\begin{tabular}{c|c c c c} \hline  & \multicolumn{2}{c}{OVLA} & Clean DNN & BadNet Adi et al. (2018) \\ \hline \multirow{3}{*}{MNIST} & ACC & 99.920\% & 99.910\% & **100.000\%** \\  & Norm & 47.635 & 77.725 & **2.177** \\  & NormMD & 1.868 & 0.034 & **-3.438** \\ \hline \multirow{3}{*}{CIFAR10} & ACC & 0.080\% & 0.010\% & **99.710\%** \\  & NormMD & 31.854 & 71.780 & **7.490** \\ \cline{1-1}  & NormMD & 0.186 & 1.924 & **-1.357** \\ \hline \end{tabular}
\end{table}
Table 2: Neural Cleanse Wang et al. (2019) results for OVLA/Clean DNN/BadNet on MNIST/CIFAR10. Clean DNN is a DNN trained using only clean data; BadNet Adi et al. (2018) is used as a backdoor-based dynamic watermarking scheme. ACC: backdoor accuracy on the reverse-engineered trigger. Norm: \(L_{1}\) norm of the reverse-engineered trigger. NormMD: norm deviation of the reverse-engineered trigger (negative NormMD means the norm is less than the median and positive NormMD means the norm is greater than the median). A DNN is considered as a backdoored DNN if the backdoor accuracy is higher than some accuracy threshold (usually set to 90%) and the NormMD is less than some NormMD threshold (usually set to -1).

Figure 3: Defense against Key Guessing Attacks on MNIST/CIFAR10/GTSRB. The red dot corresponds to result of using the secret weight key \(\delta\). The blue dots correspond to results produced from using randomly guessed keys. We use \(\epsilon_{1}=\epsilon_{2}=0.05\) as the thresholds for latent watermark verification, i.e. any dot inside the red shaded area would be considered as verified.
More result can be found in the Supplemental Material. Same as Section 5.2, we set \(\epsilon=5\%\) as the threshold of watermark verification. Only one fine-tuned DNN (at the 91st epoch for MNIST) failed the watermark verification.

## 6 Conclusion

In this paper, we propose OVLA, a novel DNN ownership verification methodology that decouples ownership verification from the DNN's normal operation. Our methodology has strong theoretical guarantees on normal operation performance, and defense against surrogate model attacks and free-rider attacks. In addition, OVLA-watermarked DNNs show strong empirical resistance to backdoor detection, backdoor removal, key guessing-based ambiguity attacks.
