用混沌序列在模型参数中嵌入版权信息,防篡改且不影响精度。
Protecting Deep Neural Network Intellectual Property with Chaos-Based White-Box Watermarking
- 通过逻辑映射生成敏感初始参数的混沌序列,注入中间层权重。
- 水印经微调后仍可检测,模型准确率损失小于0.5%。
- 适合需保护模型知识产权的工业场景,如图像分类部署。
深度神经网络(DNN)在多个领域快速普及,引发对其知识产权(IP)保护与模型滥用的担忧。训练好的DNN是高价值资产,常需大量投入。然而模型易被复制、分发或重用,亟需有效机制来声明和验证所有权。本文提出一种高效且鲁棒的白盒水印框架,利用混沌序列将所有权信息嵌入DNN内部参数。水印由著名的逻辑映射生成,其序列对初始参数高度敏感。该序列被注入选定中间层的权重中,无需修改模型结构且不降低预测性能。为验证所有权,引入基于遗传算法的恢复流程,通过优化提取与重构序列间的相似性,恢复原始混沌参数。在MNIST和CIFAR-10图像分类任务上的大量实验表明,水印在微调后仍可检测,模型准确率下降不足0.5%。除数值恢复外,还通过权重密度图可视化分析及构建基于激活的分类器,区分原始、带水印与被篡改模型。整体方法在白盒环境下提供灵活可扩展的模型所有权嵌入与验证方案,适用于知识产权保护至关重要的实际场景。
原文摘要 · Abstract (English)
The rapid proliferation of deep neural networks (DNNs) across several domains has led to increasing concerns regarding intellectual property (IP) protection and model misuse. Trained DNNs represent valuable assets, often developed through significant investments. However, the ease with which models can be copied, redistributed, or repurposed highlights the urgent need for effective mechanisms to assert and verify model ownership. In this work, we propose an efficient and resilient white-box watermarking framework that embeds ownership information into the internal parameters of a DNN using chaotic sequences. The watermark is generated using a logistic map, a well-known chaotic function, producing a sequence that is sensitive to its initialization parameters. This sequence is injected into the weights of a chosen intermediate layer without requiring structural modifications to the model or degradation in predictive performance. To validate ownership, we introduce a verification process based on a genetic algorithm that recovers the original chaotic parameters by optimizing the similarity between the extracted and regenerated sequences. The effectiveness of the proposed approach is demonstrated through extensive experiments on image classification tasks using MNIST and CIFAR-10 datasets. The results show that the embedded watermark remains detectable after fine-tuning, with negligible loss in model accuracy. In addition to numerical recovery of the watermark, we perform visual analyses using weight density plots and construct activation-based classifiers to distinguish between original, watermarked, and tampered models. Overall, the proposed method offers a flexible and scalable solution for embedding and verifying model ownership in white-box settings well-suited for real-world scenarios where IP protection is critical.
Thank you to arXiv for use of its open access interoperability. PaperDance 不是 arXiv 官方产品;中文卡片由大模型生成,请以原文为准。