用哈希水印过滤参数，防篡改和覆盖攻击。
Hashed Watermark as a Filter: Defeating Forging and Overwriting Attacks in Weight-based Neural Network Watermarking
- 用密钥生成哈希二值水印，仅嵌入匹配参数
- 13种架构测试中均有效抵抗篡改和微调攻击
- 适合需要强版权保护的模型部署场景
深度神经网络作为有价值的数字资产，亟需可靠的版权保护。权重型水印方法因简洁实用广受青睐，但易受伪造和覆盖攻击。为此，我们提出NeuralMark，核心是基于哈希的水印过滤器：通过哈希函数从密钥生成不可逆的二值水印，用作筛选嵌入参数的过滤器。该设计将嵌入参数与哈希水印强耦合，有效防御伪造和覆盖攻击。同时引入平均池化以抵御微调和剪枝攻击。可无缝集成至多种神经网络架构，具备广泛适用性。理论分析了其安全边界，实证验证了在13种卷积与Transformer架构上的有效性，涵盖五项图像分类任务及一项文本生成任务。源码已公开于https://github.com/AIResearch-Group/NeuralMark。
原文摘要 · Abstract (English)
As valuable digital assets, deep neural networks necessitate robust ownership protection, positioning neural network watermarking (NNW) as a promising solution. Among various NNW approaches, weight-based methods are favored for their simplicity and practicality; however, they remain vulnerable to forging and overwriting attacks. To address those challenges, we propose NeuralMark, a robust method built around a hashed watermark filter. Specifically, we utilize a hash function to generate an irreversible binary watermark from a secret key, which is then used as a filter to select the model parameters for embedding. This design cleverly intertwines the embedding parameters with the hashed watermark, providing a robust defense against both forging and overwriting attacks. An average pooling is also incorporated to resist fine-tuning and pruning attacks. Furthermore, it can be seamlessly integrated into various neural network architectures, ensuring broad applicability. Theoretically, we analyze its security boundary. Empirically, we verify its effectiveness and robustness across 13 distinct Convolutional and Transformer architectures, covering five image classification tasks and one text generation task. The source codes are available at https://github.com/AIResearch-Group/NeuralMark.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。