AI Research Portal

This paper introduces NeuralMark, a weight-based neural network watermarking method designed to protect model ownership against forging and overwriting attacks. The core idea is a hashed watermark filter, which uses an irreversible binary watermark generated from a secret key via a hash function to selectively embed watermarks into model parameters. This design intertwines embedding parameters with the hashed watermark, providing robust defense. Empirically, NeuralMark demonstrates effectiveness and robustness across 13 distinct Convolutional and Transformer architectures, five image classification tasks, and one text generation task, maintaining high watermark detection rates while minimally impacting model performance.

Existing neural network watermarking (NNW) methods, particularly weight-based approaches, face several challenges:

Vulnerability to Forging Attacks: Current weight-based methods are susceptible to adversaries fabricating counterfeit watermarks and inferring the corresponding secret key through reverse engineering, leading to ownership ambiguity.

Proposal of NeuralMark, a weight-based method for safeguarding model ownership, accompanied by a theoretical analysis of its security boundary.
Development of an elegant hashed watermark filter within NeuralMark to defend against both forging and overwriting attacks.
Extensive experimental verification of NeuralMark's effectiveness and robustness across 13 distinct Convolutional and Transformer architectures, five image classification tasks, and one text generation task.

NeuralMark is a weight-based method that protects model ownership through a three-step process: hashed watermark generation, watermark embedding, and watermark verification.

Hashed Watermark Generation A hash-based mapping generates a binary watermark b ∈ {0,1}n from a secret key K ∈ Rk×n. The hash function H(·) (specifically SHAKE-256) ensures irreversibility and dynamic output length adjustment. Auxiliary content C can be incorporated, yielding b = H(K||C). This process provides Gradient Obfuscation due to the avalanche effect of the hash function, impeding gradient computation for reverse-engineering.

Watermark Embedding

Parameter Selection: A subset of model parameters is selected and flattened into a parameter vector w ∈ Rm.
Filtering: The hashed watermark b is used as a filter to select parameters for embedding. In each filtering round r, the watermark b is repeated to match the length of w(r-1), forming b(r). Parameters from w(r-1) are selected at positions where b(r) equals one, forming w(r). This process, repeated R times, yields the filtered parameter vector w(R). This provides Embedding Isolation by reducing parameter overlap between the model owner's and adversary's selected parameters.
Average Pooling: The average pooling operation AVG(·) is applied to the filtered parameters w(R) to calculate the final parameters w = AVG(w(R)) ∈ Rk. This enhances robustness against fine-tuning and pruning attacks.
Objective: The overall optimal objective is formulated as: min Lm + λLe(b, b) where Lm is the main task loss (e.g., classification loss), Le(,) is the binary cross-entropy loss, b = δ(WK) is the extracted watermark (with δ(.) being the sigmoid function), and λ is a positive trade-off hyper-parameter.

Watermark Verification

The relevant subset of model parameters from a potentially unauthorized model is extracted.
Hashed watermark filtering and average pooling are applied to derive an extracted watermark b.
This extracted watermark b is compared to the model owner's watermark b using the watermark detection rate ρ, defined by: ρ = (1/n) Σ[i=1 to n] 1[bi = T(δ(b))] where T(x) is a threshold function (1 if x > 0.5, 0 otherwise) and 1(φ) is an indicator function.
Model ownership is confirmed if the detection rate ρ exceeds a theoretical security boundary ρ* and the watermark corresponds to the hash function output of the secret key.

Hashed Watermark Generation:
- Hash function: SHAKE-256 (an extendable-output function from the SHA-3 family).
- Watermark length: n = 256.
- Secret key: K ∈ Rk×n, with elements drawn from a random distribution (e.g., standard Gaussian distribution).
- Watermarks are binary vectors of 0s and 1s.
Watermark Embedding:
- Filtering rounds: Not stated in the paper (default setting of 4 rounds mentioned in Appendix G).
- Pooling operation: Average pooling AVG(·).
- Loss function: Binary cross-entropy loss for watermark embedding.
- Hyper-parameter: λ (positive trade-off hyper-parameter).
Watermark Verification:
- Threshold function T(x): Outputs 1 if x > 0.5 and 0 otherwise.
- Security boundary: ρ* = 88.29% for n = 256.
Adversary Capabilities (Threat Model): Assumes a fully trusted third-party verifier, adversary can access watermarked model, identify watermark-containing layers, and obtain original training datasets, but is limited in computational resources.

Datasets:
- Image Classification: CIFAR-10, CIFAR-100, Caltech-101, Caltech-256, TinyImageNet.
- Text Generation: E2E.
Architectures:
- Convolutional: AlexNet, VGG-13, VGG-16, GoogLeNet, ResNet-18, ResNet-34, WideResNet-50, MobileNet-V3-L.
- Transformer: ViT-B/16, Swin-V2-B, Swin-V2-S.
- Text Generation: GPT-2-S, GPT-2-M.
Metrics:
- Image Classification: Classification accuracy (%).
- Text Generation: BLEU, NIST, MET, ROUGE-L, CIDEr.
- Watermark Embedding: Watermark detection rate (%).
Baselines: VanillaMark, GreedyMark, VoteMark, and Clean (no watermark embedding).
Numeric Results:
- Fidelity (Model Performance):
  - NeuralMark maintains 100% watermark detection rate across diverse datasets and architectures with minimal impact on model performance. For example, on CIFAR-100 with ResNet-18, Clean achieves 76.23% accuracy, while NeuralMark achieves 76.34%.
  - On E2E with GPT-2-S, Clean achieves BLEU 69.36, NIST 8.76, MET 46.06, ROUGE-L 70.85, CIDEr 2.48. NeuralMark achieves BLEU 69.59, NIST 8.79, MET 46.01, ROUGE-L 70.85, CIDEr 2.48.
- Robustness against Forging Attacks: NeuralMark and GreedyMark demonstrate robust resistance, achieving 100% detection rates for original watermarks, while VanillaMark and VoteMark are vulnerable (e.g., for VanillaMark, a pair of counterfeited secret key and watermark can be successfully learned).
- Robustness against Overwriting Attacks:
  - With increasing λ (embedding strength of adversary's watermark), NeuralMark's original watermark detection rate remains at 100%, while baselines significantly decline (e.g., at λ = 1000 on CIFAR-100 to CIFAR-10 task, VanillaMark drops to 53.90%, GreedyMark to 49.60%, VoteMark to 59.37%).
  - With increasing η (learning rate), larger η values hurt model performance. At η = 0.005, original watermark detection rates for VanillaMark, GreedyMark, and VoteMark drop sharply, whereas NeuralMark maintains a detection rate close to 100%.
- Robustness against Fine-tuning Attacks: NeuralMark maintains a 100% watermark detection rate across all fine-tuning tasks, while baselines experience slight reductions. For example, on CIFAR-100 to CIFAR-10 task with ResNet-18, NeuralMark maintains 100% detection rate, while VanillaMark drops to 85.93%.
- Robustness against Pruning Attacks: As pruning ratio increases, NeuralMark's performance degrades slightly, but its detection rate remains nearly 100%.
Runtime/Training Cost: Not stated in the paper.

The current work focuses on white-box Neural Network Watermarking (NNW), leaving the investigation of black-box and box-free NNW methods for future work.
The adversary is assumed to be limited in computational resources, which might not hold in all real-world scenarios.
The paper plans to investigate how the proposed hashed watermark filter can be incorporated with existing watermarking approaches to offer complementary protection against broader attack scenarios, implying that its current scope of protection is not exhaustive.

Method evidence: "Specifically, we utilize a hash function to generate an irreversible binary watermark from a secret key, which is then used as a filter to select the model parameters for embedding." (section: Abstract)
Result evidence: "We observe that all methods have minimal impact on model performance while successfully embedding watermarks, indicating that NeuralMark and other methods maintain model performance across diverse datasets during watermark embedding." (section: Fidelity Evaluation)
Limitation evidence: "In future work, we plan to investigate how the proposed hashed watermark filter can be incorporated with existing watermarking approaches to offer complementary protection against broader attack scenarios." (section: Conclusion)

Hashed Watermark as a Filter: A Unified Defense Against Forging and Overwriting Attacks in Neural Network Watermarking

Summary

Problem

Key Contributions

Method

Technical Details

Results

Weaknesses / Limitations

Evidence

Additional Figures