A weight-wise watermarking technique for DNN models and its robustness against overwriting attack

Abstract

With the increasing accuracy of Deep Neural Network (DNN) models, a high-performance DNN model becomes more and more expensive to train. Moreover, like common multimedia resources, DNN models will be distributed or shared over the Internet. For these reasons, a high-performance model can be considered as an Intellectual Property (IP). However, because of the nature of deep learning, conventional watermarks for DNN models are usually vulnerable to attack. To protect the authentication of these DNN models, we proposed a watermarking technique that performs satisfactorily in terms of security, robustness, and embedding capacity without impairing the accuracy of the host DNN model. However, it has not been compared with other techniques in terms of robustness against overwriting attack. To this end, we extend our previous work5 by conducting more comparison experiments to evaluate the performance of our method.