A watermark-based framework to actively protect deep neural networks

Deep Neural Networks (DNNs) have made significant progress in the field of artificial intelligence, and machine learning as a service has become a service that can be profitable. Intellectual property protection for DNNs has become an important issue. These DNNs models may be misappropriated by third-party, thus causing financial losses to the model owners. In the existing white-box and black-box approaches, protected models cannot be actively verified for ownership, and they can only be verified by sending a specific sample after the model has been stolen. In this work, a black-box DNNs watermark protection framework is proposed for protecting intellectual property of image classification models, which embeds watermarks in DNNs models. The proposed framework is applicable to models for image classification, and only images containing secret watermarks can be correctly recognized by the model. Besides, the proposed framework can correctly identify the ownership of the model, resist pruning operations of the model, and resist malicious tampering of the input image. Experimental results show that the watermarking framework is robust and effective.