深度学习模型的版权保护研究综述

王馨雅; 华光; 江昊; 张海剑

doi:10.11959/j.issn.2096-109x.2022015

您当前的位置：

首页 >

文章列表页 >

深度学习模型的版权保护研究综述

综述 | 更新时间：2024-06-03

- 深度学习模型的版权保护研究综述
- Survey on intellectual property protection for deep learning model
- 网络与信息安全学报 2022年8卷第2期页码：1-14
- 作者机构：
- 作者简介：
  
  [ "王馨雅（1998- ），女，湖北仙桃人，武汉大学硕士生，主要研究方向为神经网络水印，人工智能安全" ]
  [ "华光（1986- ），男，湖北武汉人，武汉大学研究员、博士生导师，主要研究方向为多媒体安全与取证、人工智能安全" ]
  [ "江昊（1976- ），男，湖北武汉人，武汉大学教授、博士生导师，主要研究方向为移动网络、大数据分析、人工智能" ]
  [ "张海剑（1983- ），男，湖北宜昌人。武汉大学副教授，主要研究方向为时频分析、语音与阵列信号处理、媒体内容安全" ]
- 基金信息：
  
  国家自然科学基金;The National Natural Science Foundation of China(61802284);国家自然科学基金企业创新发展联合基金重点项目;The National Natural Science Foundation of China Enterprise Innovation Development Key Project(U19B2004);广东省科技专项基金;The Special Fund for Science and Technology of Guang-dong Province(2019SDR002)
- DOI：10.11959/j.issn.2096-109x.2022015
  中图分类号： TP393
- 网络首发：2022-04，
  
  纸质出版：2022-04-15
- 稿件说明：
移动端阅览
王馨雅, 华光, 江昊, 等. 深度学习模型的版权保护研究综述[J]. 网络与信息安全学报, 2022,8(2):1-14.

Xinya WANG, Guang HUA, Hao JIANG, et al. Survey on intellectual property protection for deep learning model[J]. Chinese Journal of Network and Information Security, 2022, 8(2): 1-14.
王馨雅, 华光, 江昊, 等. 深度学习模型的版权保护研究综述[J]. 网络与信息安全学报, 2022,8(2):1-14. DOI： 10.11959/j.issn.2096-109x.2022015.

Xinya WANG, Guang HUA, Hao JIANG, et al. Survey on intellectual property protection for deep learning model[J]. Chinese Journal of Network and Information Security, 2022, 8(2): 1-14. DOI： 10.11959/j.issn.2096-109x.2022015.

摘要

随着深度学习技术的迅猛发展，深度学习模型在图像分类、语音识别等领域得到了广泛应用。训练深度学习模型依赖大量的数据和算力，成本高昂，因此，出售已训练好的模型或者提供特定的服务(如DLaaS)成为一种商业模式。然而，如果模型遭到恶意用户窃取，则可能会对模型训练者的商业利益造成损害。此外，网络拓扑结构设计和参数训练的过程包含着模型训练者的智慧结晶，因此一个训练完备的模型应属于模型开发者的知识产权从而得到保护。近年来，深度神经网络水印成为一个新兴的研究课题，研究者将多媒体内容保护的方法引入深度学习模型保护领域，试图在深度神经网络模型中嵌入水印以验证模型的所有权。目前已有大量方法被提出，但缺乏梳理和概括。对神经网络水印领域已有的方法进行了梳理和总结，并探讨了该领域未来的研究方向。给出神经网络水印的模型框架，并介绍了分类模型、模型后门等基础概念。按照水印嵌入的机制将已有的方法分类为两类：一是嵌入网络内部，以网络内部信息作为载体；二是建立网络后门，将后门特殊映射关系作为水印。分别对基于这两种思想的深度神经网络水印方法进行了全面的阐述和总结，讨论了各方法的特点、优势和局限性，同时介绍并讨论了相应的水印攻击方法。通过分析水印中的白盒与黑盒场景可知，白盒分发的模型难以得到有效保护，而黑盒分发和黑盒验证场景下的神经网络水印防攻值得进一步的研究。

Abstract

With the rapid development of deep learning technology

deep learning models have been widely used in many fields such as image classification and speech recognition.Training a deep learning model relies on a large amount of data and computing power

thus selling the trained model or providing specific services (DLaaS

e.g.) has become a new business.However

the commercial interests of model trainers and the intellectual property rights of model developers may be violated if the model is maliciously stolen.With deep neural network watermarking becoming a new research topic

multimedia copyright protection techniques were used for deep learning model protection.Numerous methods have been proposed in this field and then a comprehensive survey is needed.the existing deep neural network watermarking methods were elaborated and summarized and the future research directions of this field were discussed.The overall framework of neural network watermarking was presented

whereby the basic concepts such as classification model and model backdoor were introduced.Secondly

the existing methods were divided into two types according to the mechanism of watermark embedding

one is to embed the watermark bits into the carrier of internal information of the network

and the other one uses the established backdoor mapping as the watermark.These two existing deep neural network watermarking methods were analyzed and summarized

and attacks to the watermarks were also introduced and discussed.By analyzing the white-box and black-box conditions in watermarking scenario

it comes to the conclusion that the model is difficult to be effectively protected when it is distributed in the white-box manner

and the neural network watermark defenses in the black-box distribution and black-box verification are both worthy for further research.

关键词

Keywords

references

DENG J , DONG W , SOCHER R , et al . ImageNet:a large-scale hierarchical image database [C ] // Proceedings of 2009 IEEE Conference on Computer Vision and Pattern Recognition . 2009 : 248 - 255 .

BROWN T , MANN B , RYDER N , et al . Language models are few-shot learners [C ] // Advances in Neural Information Processing Systems (NeurIPS) . 2020 : 1877 - 1901 .

CECIL R R , SOARES J . IBM Watson studio:a platform to transform data to intelligence [M ] . Pharmaceutical Supply Chains-Medicines Shortages . Springer International Publishing , 2019 : 183 - 192 .

HITAJ D , MANCINI L V . Have you stolen my model? evasion attacks against deep neural network watermarking techniques [J ] . 2018 :arXiv:1809.00615.

TRAMÈR F , ZHANG F , JUELS A , et al . Stealing machine learning models via prediction APIs [C ] // Proceedings of the 25th USENIX Conference on Security Symposium . 2016 : 601 - 618 .

HUA G , HUANG J W , SHI Y Q , et al . Twenty years of digital audio watermarking—a comprehensive review [J ] . Signal Processing , 2016 , 128 : 222 - 242 .

ASIKUZZAMAN M , PICKERING M R . An overview of digital video watermarking [J ] . IEEE Transactions on Circuits and Systems for Video Technology , 2018 , 28 ( 9 ): 2131 - 2153 .

UCHIDA Y , NAGAI Y , SAKAZAWA S , et al . Embedding watermarks into deep neural networks [C ] // Proceedings of ICMR '17:Proceedings of the 2017 ACM on International Conference on Multimedia Retrieval . 2017 : 269 - 277 .

LIN N , CHEN X M , LU H , et al . Chaotic weights:a novel approach to protect intellectual property of deep neural networks [J ] . IEEE Transactions on Computer-Aided Design of Integrated Circuits and Systems , 2021 , 40 ( 7 ): 1327 - 1339 .

LI Y , WANG H X , BARNI M . A survey of deep neural network watermarking techniques [J ] . Neurocomputing , 2021 , 461 : 171 - 193 .

ANDRIUSHCHENKO M , CROCE F , FLAMMARION N , et al . Square attack:a query-efficient black-box adversarial attack via random search [M ] . Computer Vision-ECCV 2020 . Cham : Springer International Publishing , 2020 : 484 - 501 .

SERBAN A , POLL E , VISSER J . Adversarial examples on object recognition [J ] . ACM Computing Surveys , 2020 , 53 ( 3 ): 1 - 38 .

MOOSAVI-DEZFOOLI S M , FAWZI A , FAWZI O , et al . Universal adversarial perturbations [C ] // Proceedings of 2017 IEEE Conference on Computer Vision and Pattern Recognition . Piscataway:IEEE Press , 2017 : 86 - 94 .

ZHANG J , CHEN D D , LIAO J , et al . Model watermarking for image processing networks [J ] . Proceedings of the AAAI Conference on Artificial Intelligence , 2020 , 34 ( 7 ): 12805 - 12812 .

ZHANG J , CHEN D , LIAO J , et al . Deep model intellectual property protection via deep watermarking [J ] . IEEE Transactions on Pattern Analysis and Machine Intelligence , 2021 .

WU H Z , LIU G , YAO Y W , et al . Watermarking neural networks with watermarked images [J ] . IEEE Transactions on Circuits and Systems for Video Technology , 2021 , 31 ( 7 ): 2591 - 2601 .

CHEN H L , ROUHANI B D , FU C , et al . DeepMarks:a secure fingerprinting framework for digital rights management of deep learning models [C ] // Proceedings of ICMR '19:Proceedings of the 2019 on International Conference on Multimedia Retrieval . 2019 : 105 - 113 .

ROUHANI B D , CHEN H L , KOUSHANFAR F . DeepSigns:an end-to-end watermarking framework for ownership protection of deep neural networks [C ] // Proceedings of ASPLOS '19:Proceedings of the Twenty-Fourth International Conference on Architectural Support for Programming Languages and Operating Systems . 2019 : 485 - 497 .

KURIBAYASHI M , FUNABIKI N . Efficient decentralized tracing protocol for fingerprinting system with index table [C ] // Proceedings of 2019 Asia-Pacific Signal and Information Processing Association Annual Summit and Conference (APSIPA ASC) . 2019 : 1595 - 1601 .

FENG L , ZHANG X . Watermarking neural network with compensation mechanism [C ] // Knowledge Science,Engineering and Management . 2020 : 363 - 375 .

TARTAGLIONE E , GRANGETTO M , CAVAGNINO D , et al . Delving in the loss landscape to embed robust watermarks into neural networks [C ] // Proceedings of 2020 25th International Conference on Pattern Recognition (ICPR) . 2021 : 1243 - 1250 .

FAN L , NG K , CHAN C S . Rethinking deep neural network ownership verification:Embedding passports to defeat ambiguity attacks [C ] // Advances in Neural Information Processing Systems (NeurIPS 2019) . 2019 : 4716 - 4725 .

SEBASTIAN S , ATLI B G , MARCHAL S , et al . DAWN:dynamic adversarial watermarking of neural networks [C ] // Proceedings of the 29th ACM International Conference on Multimedia . 2021 .

VENUGOPAL A , USZKOREIT J , TALBOT D , et al . Watermarking the outputs of structured prediction with an application in statistical machine translation [R ] .

LOU X X , GUO S W , ZHANG T W , et al . When NAS meets watermarking:ownership verification of DNN models via cache side channels [J ] . 2021 :arXiv:2102.03523.

HE H , KANG S , SAKAMOTO Y . A weight-wise watermarking technique for DNN models and its robustness against overwriting attack [C ] // Proceedings of International Workshop on Advanced Imaging Technology (IWAIT) 2021 . 2021 : 442 - 446 .

LYU P Z , LI P , ZHANG S Z , et al . HufuNet:embedding the left piece as watermark and keeping the right piece for ownership verification in deep neural networks [J ] . 2021 :arXiv:2103.13628.

LI M , ZHONG Q , ZHANG L Y , et al . Protecting the intellectual property of deep neural networks with watermarking:the frequency domain approach [C ] // Proceedings of 2020 IEEE 19th International Conference on Trust,Security and Privacy in Computing and Communications (TrustCom) . 2021 : 402 - 409 .

LI Z , HU C Y , ZHANG Y , et al . How to prove your model belongs to you:a blind-watermark based framework to protect intellectual property of DNN [C ] // Proceedings of ACSAC '19:Proceedings of the 35th Annual Computer Security Applications Conference . 2019 .

GUO J , POTKONJAK M . Evolutionary trigger set generation for DNN black-box watermarking [R ] .

YOSSI A , BAUM C , CISSE M , et al . Turning your weakness into a strength:Watermarking deep neural networks by backdooring [C ] // 27th USENIX Security Symposium (USENIX Security 18) . 2018 : 1615 - 1631 .

ZHONG Q , ZHANG L Y , ZHANG J , et al . Protecting IP of deep neural networks with watermarking:a new label helps [C ] // Advances in Knowledge Discovery and Data Mining . 2020 : 462 - 474 .

GOODFELLOW I J , SHLENS J , SZEGEDY C . Explaining and harnessing adversarial examples [J ] . CoRR , 2014 .

SERBAN A , POLL E , VISSER J . Adversarial examples on object recognition [J ] . ACM Computing Surveys , 2020 , 53 ( 3 ): 1 - 38 .

MERRER L E , PÉREZ P , TRÉDAN G , . Adversarial frontier stitching for remote neural network watermarking [J ] . Neural Computing and Applications , 2020 , 32 ( 13 ): 9233 - 9244 .

LUKAS N , ZHANG Y , KERSCHBAUM F . Deep neural network fingerprinting by conferrable adversarial examples [C ] // International Conference on Learning Representations (ICLR) . 2021 .

ZHAO J J , HU Q Y , LIU G Y , et al . AFA:adversarial fingerprinting authentication for deep neural networks [J ] . Computer Communications , 2020 , 150 : 488 - 497 .

CHEN H , ROUHANI B D , KOUSHANFAR F . Blackmarks:blackbox multibit watermarking for deep neural networks [J ] . CoRR . 2019 .

ZHU R J , ZHANG X P , SHI M T , et al . Secure neural network watermarking protocol against forging attack [J ] . EURASIP Journal on Image and Video Processing , 2020 ( 2020 ): 37 .

APRILPYONE M , KIYA H . Piracy-resistant DNN watermarking by block-wise image transformation with secret key [R ] . 2021 .

Deepstego:protecting intellectual property of deep neural networks by steganography [J ] . CoRR . 2019 .

ALDAGHRI N , MAHDAVIFAR H , BEIRAMI A . Coded machine unlearning [J ] . IEEE Access , 2021 , 9 : 88137 - 88150 .

BOURTOULE L , CHANDRASEKARAN V , CHOQUETTECHOO C A , et al . Machine unlearning [C ] // Proceedings of 2021 IEEE Symposium on Security and Privacy . 2021 : 141 - 159 .

MOLNAR C , CASALICCHIO G , BISCHL B . Interpretable machine learning-a brief history,state-of-the-art and challenges [C ] // ECML PKDD 2020 Workshops . 2020 .

MOLNAR C , KÖNIG G , HERBINGER J , et al . General pitfalls of model-agnostic interpretation methods for machine learning models [J ] . 2020 :arXiv:2007.04131.

SAMEK W , MONTAVON G , LAPUSCHKIN S , et al . Toward interpretable machine learning:transparent deep neural networks and beyond [R ] . 2020 .

SU J W , VARGAS D V , SAKURAI K . One pixel attack for fooling deep neural networks [J ] . IEEE Transactions on Evolutionary Computation , 2019 , 23 ( 5 ): 828 - 841 .

GENG C X , HUANG S J , CHEN S C . Recent advances in open set recognition:a survey [J ] . IEEE Transactions on Pattern Analysis and Machine Intelligence , 2021 , 43 ( 10 ): 3614 - 3631 .

WANG T H , KERSCHBAUM F . Attacks on digital watermarks for deep neural networks [C ] // Proceedings of ICASSP 2019 - 2019 IEEE International Conference on Acoustics,Speech and Signal Processing . 2019 : 2622 - 2626 .

WANG T H , KERSCHBAUM F . Robust and undetectable white-box watermarks for deep neural networks [R ] . 2019 .

SHAFIEINEJAD M , WANG J Q , LUKAS N , et al . On the robustness of the backdoor-based watermarking in deep neural networks [R ] . 2019 .

WANG T H , KERSCHBAUM F . RIGA:covert and robust white-box watermarking of deep neural networks [C ] // Proceedings of the Web Conference 2021 . 2021 .

CHEN X Y , WANG W X , BENDER C , et al . REFIT:a unified watermark removal framework for deep learning systems with limited data [C ] // Proceedings of the 2021 ACM Asia Conference on Computer and Communications Security . 2021 : 321 - 335 .

LIU K , DOLAN-GAVITT B , GARG S . Fine-pruning:defending against backdooring attacks on deep neural networks [C ] // Research in Attacks,Intrusions,and Defenses . 2018 .

HAN S , POOL J , TRAN J , et al . Learning both weights and connections for efficient neural networks [R ] . 2015 .

RYOTA N , SAKUMA J . Robust watermarking of neural network with exponential weighting [C ] // Proceedings of the 2019 ACM Asia Conference on Computer and Communications Security . 2019 : 228 - 240 .

YANG Z Q , DANG H , CHANG E C . Effectiveness of distillation attack and countermeasure on neural network watermarking [R ] . 2019 .

CHEN X Y , WANG W X , DING Y M , et al . Leveraging unlabeled data for watermark removal of deep neural networks [C ] // Proc of the 36th Int Conf on Machine Learning . 2019 .

LIU X K , LI F T , WEN B H , et al . Removing backdoor-based watermarks in neural networks with limited data [C ] // Proceedings of 2020 25th International Conference on Pattern Recognition (ICPR) . 2021 : 10149 - 10156 .

AIKEN W , KIM H , WOO S , et al . Neural network laundering:removing black-box backdoor watermarks from deep neural networks [J ] . Computers ＆ Security , 2021 ,106:102277.

GUO J , POTKONJAK M . Watermarking deep neural networks for embedded systems [C ] // Proceedings of the International Conference on Computer-Aided Design . 2018 : 1 - 8 .

GUO S W , ZHANG T W , QIU H , et al . The hidden vulnerability of watermarking for deep neural networks [R ] . 2020 .

QUAN Y H , TENG H , CHEN Y X , et al . Watermarking deep neural networks in image processing [J ] . IEEE Transactions on Neural Networks and Learning Systems , 2021 , 32 ( 5 ): 1852 - 1865 .

SKRIPNIUK V , YU N , ABDELNABI S , et al . Black-box watermarking for generative adversarial networks [R ] . 2020 .

YADOLLAHI M M , SHOELEH F , DADKHAH S , et al . Robust black-box watermarking for deep neural network using inverse document frequency [R ] . 2021 .

CHEN H L , DARVISH B , KOUSHANFAR F . SpecMark:a spectral watermarking framework for IP protection of speech recognition systems [C ] // Proceedings of Interspeech 2020 . 2020 : 2312 - 2316 .

ZHAO X Y , WU H Z , ZHANG X P . Watermarking graph neural networks by random graphs [C ] // Proceedings of 2021 9th International Symposium on Digital Forensics and Security (ISDFS) . 2021 : 1 - 6 .

GUAN X Q , FENG H M , ZHANG W M , et al . Reversible watermarking in deep convolutional neural networks for integrity authentication [C ] // Proceedings of the 28th ACM International Conference on Multimedia . 2020 : 2273 - 2280 .

浏览量

1625

下载量

CSCD

文章被引用时，请邮件提醒。

提交

工具集

关联资源

暂无数据