Robust and Large-Payload DNN Watermarking via Fixed, Distribution-Optimized, Weights

• URL: http://arxiv.org/abs/2208.10973v3
• Date: Wed, 17 Jan 2024 13:50:09 GMT
• Title: Robust and Large-Payload DNN Watermarking via Fixed, Distribution-Optimized, Weights
• Abstract summary: We propose a white-box, multi-bit watermarking method achieving very large payload and strong robustness against network modification. The proposed method can achieve outstanding performance, with no significant impact on network accuracy, including robustness against network modifications, retraining and transfer learning.
• Score: 20.114672756850307
• License: http://arxiv.org/licenses/nonexclusive-distrib/1.0/
• Abstract: The design of an effective multi-bit watermarking algorithm hinges upon finding a good trade-off between the three fundamental requirements forming the watermarking trade-off triangle, namely, robustness against network modifications, payload, and unobtrusiveness, ensuring minimal impact on the performance of the watermarked network. In this paper, we first revisit the nature of the watermarking trade-off triangle for the DNN case, then we exploit our findings to propose a white-box, multi-bit watermarking method achieving very large payload and strong robustness against network modification. In the proposed system, the weights hosting the watermark are set prior to training, making sure that their amplitude is large enough to bear the target payload and survive network modifications, notably retraining, and are left unchanged throughout the training process. The distribution of the weights carrying the watermark is theoretically optimised to ensure the secrecy of the watermark and make sure that the watermarked weights are indistinguishable from the non-watermarked ones. The proposed method can achieve outstanding performance, with no significant impact on network accuracy, including robustness against network modifications, retraining and transfer learning, while ensuring a payload which is out of reach of state of the art methods achieving a lower - or at most comparable - robustness.

Related papers

• More Haste, Less Speed: Weaker Single-Layer Watermark Improves Distortion-Free Watermark Ensembles [58.941305935872265]
  We show that strong watermarks significantly reduce the entropy of the token distribution.<n>We propose a framework that utilizes weaker single-layer watermarks to preserve the entropy required for effective multi-layer ensembling.
  arXiv  Detail & Related papers  (2026-02-12T10:18:16Z)
• OSI: One-step Inversion Excels in Extracting Diffusion Watermarks [56.210696479553945]
  We propose One-step Inversion (OSI), a significantly faster and more accurate method for extracting Gaussian Shading style watermarks.<n>OSI reformulates watermark extraction as a learnable sign classification problem, which eliminates the need for precise regression of the initial noise.<n>Our OSI substantially outperforms the multi-step diffusion inversion method: it is 20x faster, achieves higher extraction accuracy, and doubles the watermark payload capacity.
  arXiv  Detail & Related papers  (2026-02-10T07:43:16Z)
• SEW: Strengthening Robustness of Black-box DNN Watermarking via Specificity Enhancement [19.10516412427928]
  We introduce Specificity-Enhanced Watermarking (SEW), a new method that improves specificity by reducing the association between the watermark and approximate keys.<n>SEW effectively defends against six state-of-the-art removal attacks, while maintaining model usability and watermark verification performance.
  arXiv  Detail & Related papers  (2026-02-03T10:55:27Z)
• StableGuard: Towards Unified Copyright Protection and Tamper Localization in Latent Diffusion Models [55.05404953041403]
  We propose a novel framework that seamlessly integrates a binary watermark into the diffusion generation process.<n>We show that StableGuard consistently outperforms state-of-the-art methods in image fidelity, watermark verification, and tampering localization.
  arXiv  Detail & Related papers  (2025-09-22T16:35:19Z)
• TAG-WM: Tamper-Aware Generative Image Watermarking via Diffusion Inversion Sensitivity [68.95168727940973]
  Tamper-Aware Generative image WaterMarking method named TAG-WM.<n>This paper proposes a Tamper-Aware Generative image WaterMarking method named TAG-WM.
  arXiv  Detail & Related papers  (2025-06-30T03:14:07Z)
• WMCopier: Forging Invisible Image Watermarks on Arbitrary Images [21.17890218813236]
  We propose WMCopier, an effective watermark forgery attack that operates without requiring prior knowledge of or access to the target watermarking algorithm.<n>Our approach first models the target watermark distribution using an unconditional diffusion model, and then seamlessly embeds the target watermark into a non-watermarked image.<n> Experimental results demonstrate that WMCopier effectively deceives both open-source and closed-source watermark systems.
  arXiv  Detail & Related papers  (2025-03-28T11:11:19Z)
• Robust Watermarks Leak: Channel-Aware Feature Extraction Enables Adversarial Watermark Manipulation [21.41643665626451]
  We propose an attack framework that extracts leakage of watermark patterns using a pre-trained vision model. Unlike prior works requiring massive data or detector access, our method achieves both forgery and detection evasion with a single watermarked image. Our work exposes the robustness-stealthiness paradox: current "robust" watermarks sacrifice security for distortion resistance, providing insights for future watermark design.
  arXiv  Detail & Related papers  (2025-02-10T12:55:08Z)
• Watermarking Visual Concepts for Diffusion Models [43.35783380047233]
  Personalization techniques generate images with specific concepts.<n> malicious users can generate unauthorized content and disinformation relevant to a target concept.<n>Model watermarking is an effective solution to trace the malicious generated images and safeguard their copyright.
  arXiv  Detail & Related papers  (2024-11-18T16:11:25Z)
• An Efficient Watermarking Method for Latent Diffusion Models via Low-Rank Adaptation [21.058231817498115]
  We propose an efficient watermarking method for latent diffusion models (LDMs) based on Low-Rank Adaptation (LoRA) We show that the proposed method ensures fast watermark embedding and maintains a very low bit error rate of the watermark, a high-quality of the generated image, and a zero false negative rate (FNR) for verification.
  arXiv  Detail & Related papers  (2024-10-26T15:23:49Z)
• IWN: Image Watermarking Based on Idempotency [0.0]
  This paper explores the prospects of introducing idempotency into image watermark processing. The proposed model, which focuses on enhancing the recovery quality of color image watermarks, leverages idempotency to ensure superior image reversibility.
  arXiv  Detail & Related papers  (2024-09-29T01:29:34Z)
• WaterMAS: Sharpness-Aware Maximization for Neural Network Watermarking [11.717546811674884]
  WaterMAS is a substitutive, white-box neural network watermarking method that improves the trade-off among robustness, imperceptibility, and computational complexity. The robustness is ensured by limiting the attack's strength. The imperceptibility is ensured by inserting the watermark during the training process.
  arXiv  Detail & Related papers  (2024-09-05T20:22:01Z)
• DeepEclipse: How to Break White-Box DNN-Watermarking Schemes [60.472676088146436]
  We present obfuscation techniques that significantly differ from the existing white-box watermarking removal schemes. DeepEclipse can evade watermark detection without prior knowledge of the underlying watermarking scheme. Our evaluation reveals that DeepEclipse excels in breaking multiple white-box watermarking schemes.
  arXiv  Detail & Related papers  (2024-03-06T10:24:47Z)
• Safe and Robust Watermark Injection with a Single OoD Image [90.71804273115585]
  Training a high-performance deep neural network requires large amounts of data and computational resources. We propose a safe and robust backdoor-based watermark injection technique. We induce random perturbation of model parameters during watermark injection to defend against common watermark removal attacks.
  arXiv  Detail & Related papers  (2023-09-04T19:58:35Z)
• Reversible Quantization Index Modulation for Static Deep Neural Network Watermarking [57.96787187733302]
  Reversible data hiding (RDH) methods offer a potential solution, but existing approaches suffer from weaknesses in terms of usability, capacity, and fidelity. We propose a novel RDH-based static DNN watermarking scheme using quantization index modulation (QIM) Our scheme incorporates a novel approach based on a one-dimensional quantizer for watermark embedding.
  arXiv  Detail & Related papers  (2023-05-29T04:39:17Z)
• Exploring Structure Consistency for Deep Model Watermarking [122.38456787761497]
  The intellectual property (IP) of Deep neural networks (DNNs) can be easily stolen'' by surrogate model attack. We propose a new watermarking methodology, namely structure consistency'', based on which a new deep structure-aligned model watermarking algorithm is designed.
  arXiv  Detail & Related papers  (2021-08-05T04:27:15Z)
• Robust Watermarking using Diffusion of Logo into Autoencoder Feature Maps [10.072876983072113]
  In this paper, we propose to use an end-to-end network for watermarking. We use a convolutional neural network (CNN) to control the embedding strength based on the image content. Different image processing attacks are simulated as a network layer to improve the robustness of the model.
  arXiv  Detail & Related papers  (2021-05-24T05:18:33Z)
• Reversible Watermarking in Deep Convolutional Neural Networks for Integrity Authentication [78.165255859254]
  We propose a reversible watermarking algorithm for integrity authentication. The influence of embedding reversible watermarking on the classification performance is less than 0.5%. At the same time, the integrity of the model can be verified by applying the reversible watermarking.
  arXiv  Detail & Related papers  (2021-04-09T09:32:21Z)
• Fine-tuning Is Not Enough: A Simple yet Effective Watermark Removal Attack for DNN Models [72.9364216776529]
  We propose a novel watermark removal attack from a different perspective. We design a simple yet powerful transformation algorithm by combining imperceptible pattern embedding and spatial-level transformations. Our attack can bypass state-of-the-art watermarking solutions with very high success rates.
  arXiv  Detail & Related papers  (2020-09-18T09:14:54Z)

This list is automatically generated from the titles and abstracts of the papers in this site.

This site does not guarantee the quality of this site (including all information) and is not responsible for any consequences.