无需重训练即可给视觉模型加水印和锁，防抄袭且性能几乎不变。
Staining and locking computer vision models without retraining
- 直接修改少量权重实现模型水印与锁定，无需微调或重训练。
- 锁住的模型需输入特定触发贴片才能使用，否则无法工作。
- 水印和锁有可证明的误报率上限，适合保护模型知识产权。
我们提出新的计算机视觉模型水印与锁定方法，以保护模型所有者的知识产权。水印（又称打标）将秘密行为嵌入模型，后续可用于识别模型归属；锁定则使模型在未接收到秘密触发信号时无法使用。与现有方法不同，我们的算法可直接应用于预训练模型，无需微调或重新训练，并提供可计算、可证明的最坏情况误报率上限。水印与锁定通过直接修改模型中少量权重实现，对模型正常性能影响极小。解锁只需在输入图像角落添加一个微小的‘触发贴片’。实验结果验证了方法的有效性，并展示了其在多种视觉模型上的实际表现。
原文摘要 · Abstract (English)
We introduce new methods of staining and locking computer vision models, to protect their owners' intellectual property. Staining, also known as watermarking, embeds secret behaviour into a model which can later be used to identify it, while locking aims to make a model unusable unless a secret trigger is inserted into input images. Unlike existing methods, our algorithms can be used to stain and lock pre-trained models without requiring fine-tuning or retraining, and come with provable, computable guarantees bounding their worst-case false positive rates. The stain and lock are implemented by directly modifying a small number of the model's weights and have minimal impact on the (unlocked) model's performance. Locked models are unlocked by inserting a small `trigger patch' into the corner of the input image. We present experimental results showing the efficacy of our methods and demonstrating their practical performance on a variety of computer vision models.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品；中文卡片由大模型生成，请以原文为准。