{"type":"ScholarlyArticle","title":"Probabilistically Robust Watermarking of Neural Networks","authors":[{"name":"Mikhail Pautov","slug":"mikhail-pautov","given":"Mikhail","family":"Pautov","affiliation":"Artificial Intelligence Research Institute , Moscow , Russia; Skolkovo Institute of Science and Technology , Moscow , Russia; ISP RAS Research Center for Trusted Artificial Intelligence , Moscow , Russia"},{"name":"Nikita Bogdanov","slug":"nikita-bogdanov","given":"Nikita","family":"Bogdanov","affiliation":"Skolkovo Institute of Science and Technology , Moscow , Russia"},{"name":"Stanislav Pyatkin","slug":"stanislav-pyatkin","given":"Stanislav","family":"Pyatkin","affiliation":"Skolkovo Institute of Science and Technology , Moscow , Russia"},{"name":"Oleg Rogov","slug":"oleg-rogov","given":"Oleg","family":"Rogov","affiliation":"Artificial Intelligence Research Institute , Moscow , Russia; Skolkovo Institute of Science and Technology , Moscow , Russia"},{"name":"Ivan Oseledets","slug":"ivan-oseledets","given":"Ivan","family":"Oseledets","affiliation":"Artificial Intelligence Research Institute , Moscow , Russia; Skolkovo Institute of Science and Technology , Moscow , Russia"}],"abstract":"As deep learning (DL) models are widely and effectively used in Machine Learning as a Service (MLaaS) platforms, there is a rapidly growing interest in DL watermarking techniques that can be used to confirm the ownership of a particular model. Unfortunately, these methods usually produce watermarks susceptible to model stealing attacks. In our research, we introduce a novel trigger set-based watermarking approach that demonstrates resilience against functionality stealing attacks, particularly those involving extraction and distillation. Our approach does not require additional model training and can be applied to any model architecture. The key idea of our method is to compute the trigger set, which is transferable between the source model and the set of proxy models with a high probability. In our experimental study, we show that if the probability of the set being transferable is reasonably high, it can be effectively used for ownership verification of the stolen model. We evaluate our method on multiple benchmarks and show that our approach outperforms current state-of-the-art watermarking techniques in all considered experimental setups.","doi":"10.24963/ijcai.2024/528","url":"https://ijcai.org/proceedings/2024/528","pdf":"https://ijcai.org/proceedings/2024/0528.pdf","markdown":"https://ijcai.org/proceedings/2024/528.md","bibtex":"https://ijcai.org/proceedings/2024/bibtex/528","volume":{"slug":"2024","title":"Proceedings of the Thirty-Third International Joint Conference on Artificial Intelligence","short_title":"IJCAI 2024","url":"https://ijcai.org/proceedings/2024/","year":2024,"location":"Jeju, Korea","dates":"3-9 August 2024","editors":"Kate Larson","isbn":"978-1-956792-04-1","publisher":"International Joint Conferences on Artificial Intelligence Organization","doi_prefix":"10.24963/ijcai.2024"},"section":"Machine Learning","track":"Main Track","number":528,"pages":{"first":4778,"last":4787},"keywords":["AI Ethics, Trust, Fairness: ETF: Trustworthy AI","AI Ethics, Trust, Fairness: ETF: Safety and robustness","Machine Learning: ML: Adversarial machine learning","Uncertainty in AI: UAI: Applications"],"videos":[],"references":[{"position":1,"raw":"[Adi et al., 2018] Yossi Adi, Carsten Baum, Moustapha Cisse, Benny Pinkas, and Joseph Keshet. Turning your weakness into a strength: Watermarking deep neural net- works by backdooring. In 27th USENIX Security Sympo- sium (USENIX Security 18), pages 1615-1631, 2018.","title":"Turning your weakness into a strength: Watermarking deep neural networks by backdooring","authors":"Yossi Adi, Carsten Baum, Moustapha Cisse, Benny Pinkas, Joseph Keshet","year":"2018","venue":"27th USENIX Security Symposium (USENIX Security 18)","doi":null,"url":null,"internal_url":null},{"position":2,"raw":"[Bansal et al., 2022] Arpit Bansal, Ping-yeh Chiang, Michael J Curry, Rajiv Jain, Curtis Wigington, Varun Manjunatha, John P Dickerson, and Tom Goldstein. Certified neural network watermarks with randomized smoothing. In International Conference on Machine Learning, pages 1450-1465. PMLR, 2022.","title":"Certified neural network watermarks with randomized smoothing","authors":"Arpit Bansal, Ping-Yeh Chiang, Michael J Curry, Rajiv Jain, Curtis Wigington, Varun Manjunatha, John P Dickerson, Tom Goldstein","year":"2022","venue":"International Conference on Machine Learning","doi":null,"url":null,"internal_url":null},{"position":3,"raw":"[Brown et al., 2020] Tom Brown, Benjamin Mann, Nick Ry- der, Melanie Subbiah, Jared D Kaplan, Prafulla Dhari- wal, Arvind Neelakantan, Pranav Shyam, Girish Sastry, Amanda Askell, et al. Language models are few-shot learners. Advances in Neural Information Processing Sys- tems, 33:1877-1901, 2020.","title":"Language models are few-shot learners","authors":"Tom Brown, Benjamin Mann, Nick Ryder, Melanie Subbiah, Jared D Kaplan, Prafulla Dhariwal, Arvind Neelakantan, Pranav Shyam, Girish Sastry, Amanda Askell","year":"2020","venue":"Advances in Neural Information Processing Systems","doi":null,"url":null,"internal_url":null},{"position":4,"raw":"[Buhalis and Moldavska, 2022] Dimitrios Buhalis and Iuliia Moldavska. Voice assistants in hospitality: using artificial intelligence for customer service. Journal of Hospitality and Tourism Technology, 13(3):386-403, 2022.","title":"Dimitrios Buhalis and Iuliia Moldavska. Voice assistants in hospitality: using artificial intelligence for customer service","authors":"Moldavska Buhalis","year":"2022","venue":"Journal of Hospitality and Tourism Technology","doi":null,"url":null,"internal_url":null},{"position":5,"raw":"[Clopper and Pearson, 1934] Charles J Clopper and Egon S Pearson. The use of confidence or fiducial limits illustrated in the case of the binomial. Biometrika, 26(4):404-413, 1934.","title":"The use of confidence or fiducial limits illustrated in the case of the binomial","authors":"J Charles, Egon S Clopper, Pearson","year":"1934","venue":"Biometrika","doi":null,"url":null,"internal_url":null},{"position":6,"raw":"[Ding et al., 2021] Xiaohan Ding, Xiangyu Zhang, Ningning Ma, Jungong Han, Guiguang Ding, and Jian Sun. Repvgg: Making vgg-style convnets great again. In Proceedings of the IEEE/CVF conference on computer vision and pattern recognition, pages 13733-13742, 2021.","title":"Repvgg: Making vgg-style convnets great again","authors":"Xiaohan Ding, Xiangyu Zhang, Ningning Ma, Jungong Han, Guiguang Ding, Jian Sun","year":"2021","venue":"Proceedings of the IEEE/CVF conference on computer vision and pattern recognition","doi":null,"url":null,"internal_url":null},{"position":7,"raw":"[Dosovitskiy et al., 2021] Alexey Dosovitskiy, Lucas Beyer, Alexander Kolesnikov, Dirk Weissenborn, Xiaohua Zhai, Thomas Unterthiner, Mostafa Dehghani, Matthias Min- derer, Georg Heigold, Sylvain Gelly, Jakob Uszkoreit, and Neil Houlsby. An image is worth 16x16 words: Trans- formers for image recognition at scale. In International Conference on Learning Representations, 2021.","title":"An image is worth 16x16 words: Transformers for image recognition at scale","authors":"Alexey Dosovitskiy, Lucas Beyer, Alexander Kolesnikov, Dirk Weissenborn, Xiaohua Zhai, Thomas Unterthiner, Mostafa Dehghani, Matthias Minderer, Georg Heigold, Sylvain Gelly, Jakob Uszkoreit, Neil Houlsby","year":"2021","venue":"International Conference on Learning Representations","doi":null,"url":null,"internal_url":null},{"position":8,"raw":"[Goncharov et al., 2021] Mikhail Goncharov, Maxim Pisov, Alexey Shevtsov, Boris Shirokikh, Anvar Kurmukov, Ivan Blokhin, Valeria Chernina, Alexander Solovev, Victor Gombolevskiy, Sergey Morozov, et al. Ct-based covid-19 triage: Deep multitask learning improves joint identifica- tion and severity quantification. Medical image analysis, 71:102054, 2021.","title":"Ct-based covid-19 triage: Deep multitask learning improves joint identification and severity quantification","authors":"Mikhail Goncharov, Maxim Pisov, Alexey Shevtsov, Boris Shirokikh, Anvar Kurmukov, Ivan Blokhin, Valeria Chernina, Alexander Solovev, Victor Gombolevskiy, Sergey Morozov","year":"2021","venue":"Medical image analysis","doi":null,"url":null,"internal_url":null},{"position":9,"raw":"[Guo and Potkonjak, 2018] Jia Guo and Miodrag Potkonjak. Watermarking deep neural networks for embedded sys- tems. In Iris Bahar, editor, Proceedings of the Interna- tional Conference on Computer-Aided Design -ICCAD '18, pages 1-8. ACM Press, 2018.","title":"Watermarking deep neural networks for embedded systems","authors":"Potkonjak Guo, Jia Guo, Miodrag Potkonjak","year":"2018","venue":"Proceedings of the International Conference on Computer-Aided Design -ICCAD '18","doi":null,"url":null,"internal_url":null},{"position":10,"raw":"[Hartung and Kutter, 1999] Frank Hartung and Martin Kut- ter. Multimedia watermarking techniques. Proceedings of the IEEE, 87(7):1079-1107, 1999.","title":"Multimedia watermarking techniques","authors":"Kutter Hartung, Frank Hartung, Martin Kutter","year":"1999","venue":"Proceedings of the IEEE","doi":null,"url":null,"internal_url":null},{"position":11,"raw":"[He et al., 2016] Kaiming He, Xiangyu Zhang, Shaoqing Ren, and Jian Sun. Deep residual learning for image recognition. In Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition, pages 770-778, 2016.","title":"Deep residual learning for image recognition","authors":"Kaiming He, Xiangyu Zhang, Shaoqing Ren, Jian Sun","year":"2016","venue":"Proceedings of the IEEE Conference on Computer Vision and Pattern Recognition","doi":null,"url":null,"internal_url":null},{"position":12,"raw":"[He et al., 2023] Kelei He, Chen Gan, Zhuoyuan Li, Islem Rekik, Zihao Yin, Wen Ji, Yang Gao, Qian Wang, Junfeng Zhang, and Dinggang Shen. Transformers in medical im- age analysis. Intelligent Medicine, 3(1):59-78, 2023.","title":"Transformers in medical image analysis","authors":"He","year":"2023","venue":"Intelligent Medicine","doi":null,"url":null,"internal_url":null},{"position":13,"raw":"[Hinton et al., 2015] Geoffrey Hinton, Oriol Vinyals, and Jeffrey Dean. Distilling the knowledge in a neural net- work. In NIPS Deep Learning and Representation Learn- ing Workshop, 2015.","title":"Distilling the knowledge in a neural network","authors":"Geoffrey Hinton, Oriol Vinyals, Jeffrey Dean","year":"2015","venue":"NIPS Deep Learning and Representation Learning Workshop","doi":null,"url":null,"internal_url":null},{"position":14,"raw":"[Huang et al., 2022] Yanjun Huang, Jiatong Du, Ziru Yang, Zewei Zhou, Lin Zhang, and Hong Chen. A survey on trajectory-prediction methods for autonomous driving. IEEE Transactions on Intelligent Vehicles, 7(3):652-674, 2022.","title":"A survey on trajectory-prediction methods for autonomous driving","authors":"Yanjun Huang, Jiatong Du, Ziru Yang, Zewei Zhou, Lin Zhang, Hong Chen","year":"2022","venue":"IEEE Transactions on Intelligent Vehicles","doi":null,"url":null,"internal_url":null},{"position":15,"raw":"[Jia et al., 2021] Hengrui Jia, Christopher A Choquette- Choo, Varun Chandrasekaran, and Nicolas Papernot. En- tangled watermarks as a defense against model extraction. In 30th USENIX Security Symposium (USENIX Security 21), pages 1937-1954, 2021.","title":"Entangled watermarks as a defense against model extraction","authors":"Jia","year":"2021","venue":"30th USENIX Security Symposium (USENIX Security 21)","doi":null,"url":null,"internal_url":null},{"position":16,"raw":"[Kim et al., 2023] Byungjoo Kim, Suyoung Lee, Seanie Lee, Sooel Son, and Sung Ju Hwang. Margin-based neural net- work watermarking. In International Conference on Ma- chine Learning, pages 16696-16711. PMLR, 2023.","title":"Margin-based neural network watermarking","authors":"Kim","year":"2023","venue":"International Conference on Machine Learning","doi":null,"url":null,"internal_url":null},{"position":17,"raw":"[Krizhevsky et al., 2009] Alex Krizhevsky, Geoffrey Hinton, et al. Learning multiple layers of features from tiny im- ages. 2009.","title":"Learning multiple layers of features from tiny images","authors":"Alex Krizhevsky, Geoffrey Hinton","year":"2009","venue":null,"doi":null,"url":null,"internal_url":null},{"position":18,"raw":"[Le Merrer et al., 2020] Erwan Le Merrer, Patrick Pérez, and Gilles Trédan. Adversarial frontier stitching for remote neural network watermarking. Neural Computing and Ap- plications, 32(13):9233-9244, Jul 2020.","title":"Adversarial frontier stitching for remote neural network watermarking","authors":"Erwan Le Merrer, Patrick Pérez, Gilles Trédan","year":"2020","venue":"Neural Computing and Applications","doi":null,"url":null,"internal_url":null},{"position":19,"raw":"[Li et al., 2019] Zheng Li, Chengyu Hu, Yang Zhang, and Shanqing Guo. How to prove your model belongs to you. In David Balenson, editor, Proceedings of the 35th Annual Computer Security Applications Conference on -ACSAC '19, pages 126-137. ACM Press, 2019.","title":"How to prove your model belongs to you","authors":"Zheng Li, Chengyu Hu, Yang Zhang, Shanqing Guo","year":"2019","venue":"Proceedings of the 35th Annual Computer Security Applications Conference on -ACSAC '19","doi":null,"url":null,"internal_url":null},{"position":20,"raw":"[Li et al., 2021] Yue Li, Hongxia Wang, and Mauro Barni. A survey of deep neural network watermarking techniques. Neurocomputing, 461:171-193, 2021.","title":"A survey of deep neural network watermarking techniques","authors":"Yue Li, Hongxia Wang, Mauro Barni","year":"2021","venue":"Neurocomputing","doi":null,"url":null,"internal_url":null},{"position":21,"raw":"[Liu et al., 2023] Yiheng Liu, Tianle Han, Siyuan Ma, Jiayue Zhang, Yuanyuan Yang, Jiaming Tian, Hao He, Antong Li, Mengshen He, Zhengliang Liu, et al. Summary of chatgpt- related research and perspective towards the future of large language models. Meta-Radiology, page 100017, 2023.","title":"Summary of chatgptrelated research and perspective towards the future of large language models","authors":"Liu","year":"2023","venue":"Meta-Radiology","doi":null,"url":null,"internal_url":null},{"position":22,"raw":"[Lukas et al., 2021] Nils Lukas, Yuxuan Zhang, and Florian Kerschbaum. Deep neural network fingerprinting by con- ferrable adversarial examples. In International Conference on Learning Representations, 2021.","title":"Deep neural network fingerprinting by conferrable adversarial examples","authors":"Nils Lukas, Yuxuan Zhang, Florian Kerschbaum","year":"2021","venue":"International Conference on Learning Representations","doi":null,"url":null,"internal_url":null},{"position":23,"raw":"[Ma et al., 2018] Ningning Ma, Xiangyu Zhang, Hai-Tao Zheng, and Jian Sun. Shufflenet v2: Practical guidelines for efficient cnn architecture design. In Proceedings of the European conference on computer vision (ECCV), pages 116-131, 2018.","title":"Shufflenet v2: Practical guidelines for efficient cnn architecture design","authors":"Ningning Ma, Xiangyu Zhang, Hai-Tao Zheng, Jian Sun","year":"2018","venue":"Proceedings of the European conference on computer vision (ECCV)","doi":null,"url":null,"internal_url":null},{"position":24,"raw":"[Netzer et al., 2011] Yuval Netzer, Tao Wang, Adam Coates, Alessandro Bissacco, Bo Wu, and Andrew Y Ng. Reading digits in natural images with unsupervised feature learn- ing. 2011.","title":"Reading digits in natural images with unsupervised feature learning","authors":"Yuval Netzer, Tao Wang, Adam Coates, Alessandro Bissacco, Bo Wu, Andrew Y Ng","year":"2011","venue":null,"doi":null,"url":null,"internal_url":null},{"position":25,"raw":"[Parekh et al., 2022] Darsh Parekh, Nishi Poddar, Aakash Rajpurkar, Manisha Chahal, Neeraj Kumar, Gyanen- dra Prasad Joshi, and Woong Cho. A review on au- tonomous vehicles: Progress, methods and challenges. Electronics, 11(14):2162, 2022.","title":"A review on autonomous vehicles: Progress, methods and challenges","authors":"Darsh Parekh, Nishi Poddar, Aakash Rajpurkar, Manisha Chahal, Neeraj Kumar, Gyanendra Prasad Joshi, Woong Cho","year":"2022","venue":"Electronics","doi":null,"url":null,"internal_url":null},{"position":26,"raw":"[Sandler et al., 2018] Mark Sandler, Andrew Howard, Men- glong Zhu, Andrey Zhmoginov, and Liang-Chieh Chen. Mobilenetv2: Inverted residuals and linear bottlenecks. In Proceedings of the IEEE conference on computer vision and pattern recognition, pages 4510-4520, 2018.","title":"Mobilenetv2: Inverted residuals and linear bottlenecks","authors":"Mark Sandler, Andrew Howard, Menglong Zhu, Andrey Zhmoginov, Liang-Chieh Chen","year":"2018","venue":"Proceedings of the IEEE conference on computer vision and pattern recognition","doi":null,"url":null,"internal_url":null},{"position":27,"raw":"[Shafieinejad et al., 2021] Masoumeh Shafieinejad, Nils Lukas, Jiaqi Wang, Xinda Li, and Florian Kerschbaum. On the robustness of backdoor-based watermarking in deep neural networks. In Proceedings of the 2021 ACM Workshop on Information Hiding and Multimedia Security, pages 177-188, 2021.","title":"On the robustness of backdoor-based watermarking in deep neural networks","authors":"Masoumeh Shafieinejad, Nils Lukas, Jiaqi Wang, Xinda Li, Florian Kerschbaum","year":"2021","venue":"Proceedings of the 2021 ACM Workshop on Information Hiding and Multimedia Security","doi":null,"url":null,"internal_url":null},{"position":28,"raw":"[Simonyan and Zisserman, 2015] Karen Simonyan and An- drew Zisserman. Very deep convolutional networks for large-scale image recognition. In 3rd International Con- ference on Learning Representations, ICLR 2015, San Diego, CA, USA, May 7-9, 2015, Conference Track Pro- ceedings, 2015.","title":"Very deep convolutional networks for large-scale image recognition","authors":"Karen Simonyan, Andrew Zisserman","year":"2015","venue":"3rd International Conference on Learning Representations, ICLR 2015","doi":null,"url":null,"internal_url":null},{"position":29,"raw":"[Subramanian et al., 2021] Nandhini Subramanian, Omar Elharrouss, Somaya Al-Maadeed, and Ahmed Bouridane. Image steganography: A review of the recent advances. IEEE Access, 9:23409-23423, 2021.","title":"Image steganography: A review of the recent advances","authors":"Nandhini Subramanian, Omar Elharrouss, Somaya Al-Maadeed, Ahmed Bouridane","year":"2021","venue":"IEEE Access","doi":null,"url":null,"internal_url":null},{"position":30,"raw":"[Tang et al., 2022] Jiajia Tang, Kang Li, Ming Hou, Xuanyu Jin, Wanzeng Kong, Yu Ding, and Qibin Zhao. Mmt: Multi-way multi-modal transformer for multimodal learn- ing. In IJCAI, pages 3458-3465, 2022.","title":"Mmt: Multi-way multi-modal transformer for multimodal learning","authors":"Jiajia Tang, Kang Li, Ming Hou, Xuanyu Jin, Wanzeng Kong, Yu Ding, Qibin Zhao","year":"2022","venue":"IJCAI","doi":null,"url":null,"internal_url":"/proceedings/2022/480"},{"position":31,"raw":"[Tramèr et al., 2016] Florian Tramèr, Fan Zhang, Ari Juels, Michael K. Reiter, and Thomas Ristenpart. Stealing ma- chine learning models via prediction apis. In Proceedings of the 25th USENIX Conference on Security Symposium, SEC'16, page 601-618, USA, 2016. USENIX Associa- tion. Vaswani et al., 2017]","title":"Stealing machine learning models via prediction apis","authors":"Florian Tramèr, Fan Zhang, Ari Juels, Michael K Reiter, Thomas Ristenpart","year":"2016","venue":"Proceedings of the 25th USENIX Conference on Security Symposium, SEC'16","doi":null,"url":null,"internal_url":null},{"position":32,"raw":"Ashish Vaswani, Noam Shazeer, Niki Parmar, Jakob Uszkoreit, Llion Jones, Aidan N Gomez, Łukasz Kaiser, and Illia Polosukhin. Attention is all you need. Advances in Neural Information Processing Sys- tems, 30, 2017.","title":"Attention is all you need","authors":"Ashish Vaswani, Noam Shazeer, Niki Parmar, Jakob Uszkoreit, Llion Jones, Aidan N Gomez, Łukasz Kaiser, Illia Polosukhin","year":"2017","venue":"Advances in Neural Information Processing Systems","doi":null,"url":null,"internal_url":null},{"position":33,"raw":"[Zagoruyko and Komodakis, 2016] Sergey Zagoruyko and Nikos Komodakis. Wide residual networks. In Richard C. Wilson, Edwin R. Hancock, and William A. P. Smith, editors, Proceedings of the British Machine Vision Con- ference 2016, BMVC 2016, York, UK, September 19-22, 2016. BMVA Press, 2016.","title":"Wide residual networks","authors":"Sergey Zagoruyko, Nikos Komodakis","year":"2016","venue":"Proceedings of the British Machine Vision Conference 2016, BMVC 2016","doi":null,"url":null,"internal_url":null},{"position":34,"raw":"[Zhang et al., 2018a] Hongyi Zhang, Moustapha Cissé, Yann N. Dauphin, and David Lopez-Paz. mixup: Beyond empirical risk minimization. In 6th International Confer- ence on Learning Representations, ICLR 2018, Vancouver, BC, Canada, April 30 -May 3, 2018, Conference Track Proceedings, 2018.","title":"mixup: Beyond empirical risk minimization","authors":"Zhang","year":"2018","venue":"6th International Conference on Learning Representations, ICLR 2018","doi":null,"url":null,"internal_url":null},{"position":35,"raw":"[Zhang et al., 2018b] Jialong Zhang, Zhongshu Gu, Jiyong Jang, Hui Wu, Marc Ph Stoecklin, Heqing Huang, and Ian Molloy. Protecting intellectual property of deep neural net- works with watermarking. In Proceedings of the 2018 on Asia Conference on Computer and Communications Secu- rity, pages 159-172, 2018.","title":"Protecting intellectual property of deep neural networks with watermarking","authors":"Zhang","year":"2018","venue":"Proceedings of the 2018 on Asia Conference on Computer and Communications Security","doi":null,"url":null,"internal_url":null},{"position":36,"raw":"[Zhao et al., 2020] Jingjing Zhao, Qingyue Hu, Gaoyang Liu, Xiaoqiang Ma, Fei Chen, and Mohammad Mehedi Hassan. Afa: Adversarial fingerprinting authentica- tion for deep neural networks. Comput. Commun., 150(C):488-497, jan 2020.","title":"Afa: Adversarial fingerprinting authentication for deep neural networks","authors":"Jingjing Zhao, Qingyue Hu, Gaoyang Liu, Xiaoqiang Ma, Fei Chen, Mohammad Mehedi, Hassan","year":"2020","venue":"Comput. Commun","doi":null,"url":null,"internal_url":null}],"license_note":"Copyright International Joint Conferences on Artificial Intelligence."}