不修改模型就能给AI模型加水印，还能防篡改。
FreeMark: A Non-Invasive White-Box Watermarking for Deep Neural Networks
- 用梯度下降生成密钥，从模型激活值提取水印
- 能抵抗多种移除攻击，水印容量高且不降性能
- 适合保护商业模型版权，无需改动原始模型
深度神经网络（DNN）在实际应用中取得了显著成功，但其知识产权（IP）保护仍面临巨大挑战。现有的DNN水印技术通常需要修改模型，导致性能下降，实用性受限。本文提出FreeMark，一种基于密码学原理的新型DNN水印框架，无需修改原始主机模型，从而避免性能损失。与传统方法不同，FreeMark通过梯度下降从预生成的水印向量和主机模型中生成秘密密钥，这些密钥用于从模型激活值中提取水印，并由可信第三方安全存储，确保可疑模型中可可靠提取水印。大量实验表明，FreeMark能有效抵御多种水印移除攻击，同时保持较高的水印容量。
原文摘要 · Abstract (English)
Deep neural networks (DNNs) have achieved significant success in real-world applications. However, safeguarding their intellectual property (IP) remains extremely challenging. Existing DNN watermarking for IP protection often require modifying DNN models, which reduces model performance and limits their practicality. This paper introduces FreeMark, a novel DNN watermarking framework that leverages cryptographic principles without altering the original host DNN model, thereby avoiding any reduction in model performance. Unlike traditional DNN watermarking methods, FreeMark innovatively generates secret keys from a pre-generated watermark vector and the host model using gradient descent. These secret keys, used to extract watermark from the model's activation values, are securely stored with a trusted third party, enabling reliable watermark extraction from suspect models. Extensive experiments demonstrate that FreeMark effectively resists various watermark removal attacks while maintaining high watermark capacity.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。