提出一种抗微调的神经网络水印方法，利用卷积核频域特性实现鲁棒性。
Towards the Resistance of Neural Network Watermarking to Fine-tuning
- 基于傅里叶变换提取卷积核低频成分，确保微调时关键频率不变
- 实验验证水印在微调后仍可正确检测，鲁棒性强于传统方法
- 适合版权保护场景，尤其适用于模型微调后的所有权认证
本文提出一种新型神经网络水印方法，可有效抵抗微调攻击。研究证明：当卷积层输入特征仅含低频分量时，其卷积核的特定频域成分在微调过程中不会被梯度下降改变。为此，我们设计了一种改进的傅里叶变换，用于从卷积核中提取频域成分。同时，证明这些频域成分对权重缩放和权重排列具有等变性。基于此，构建水印模块将所有权信息编码至卷积核的特定频域成分中。初步实验表明该方法在微调后仍能有效检测水印，具备良好的鲁棒性。
原文摘要 · Abstract (English)
This paper proves a new watermarking method to embed the ownership information into a deep neural network (DNN), which is robust to fine-tuning. Specifically, we prove that when the input feature of a convolutional layer only contains low-frequency components, specific frequency components of the convolutional filter will not be changed by gradient descent during the fine-tuning process, where we propose a revised Fourier transform to extract frequency components from the convolutional filter. Additionally, we also prove that these frequency components are equivariant to weight scaling and weight permutations. In this way, we design a watermark module to encode the watermark information to specific frequency components in a convolutional filter. Preliminary experiments demonstrate the effectiveness of our method.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。