Method for copyright protection of deep neural networks using digital watermarking

Abstract

The article proposes a new method of copyright protection for deep neural networks. The main idea of the method is to embed digital watermarks into the protected model by retraining it on a unique set of pseudo-holographic images (pseudo-holograms). A pseudo-hologram is a two-dimensional sinusoidal signal that encodes a binary sequence of arbitrary length. By changing the phase of each sinusoid, it is possible to form various pseudo-hologram images based on a single bit sequence. The proposed approach to embedding is to generate a training sample in such a way that pseudo-holograms formed on the basis of one sequence fall into the same class. In this case, each class will correspond to different bit sequences. Verification of the digital watermark is carried out by applying various pseudo-holograms to the input of the model and checking whether the hidden sequence corresponds to a certain class. Experimental studies confirm the efficiency of the method and its compliance with all quality criteria established for the methods of neural network watermarking.