A Novel Weights-less Watermark Embedding Method for Neural Network Models

Deep learning-based Artificial Intelligence (AI) technology has been extensively used recently. AI model theft is a regular occurrence. As a result, many academics focus their efforts on safeguarding the Intellectual Property (IP) of trained Neural Network (NN) models. The majority of the most recent white-box setting watermark embedding methods rely on modifying model weights. Weights updated for the NN model during training must take into account the initial task as well as the embedding of watermarks. As a result, the accuracy of the initial task will be affected, necessitating more training time. This research proposes a novel weights-less watermark embedding method for deep neural networks to address this issue. Without actually embedding the watermark within the NN model weights, it uses a principle of code matching between the watermark and the weights. The proposed method requires less time than existing white-box setting watermark embedding methods, and the accuracy of the original task is not much diminished. Additionally, since the NN model weights are left alone, their statistical distribution will remain unchanged, giving the model increased resistance to watermark detection. The experiments in this paper demonstrate the effectiveness, efficiency, and robustness of our method.

I. Introduction

Artificial Intelligence (AI) is used widely in fields like Computer Vision (CV) [1] and Natural Language Processing (NLP) [2] thanks to advances in machine learning and deep learning. Deep neural networks are the primary training method for AI models. It costs money to train AI models since it requires a lot of computing power in addition to enormous datasets. For instance, it is estimated that it costs tens of millions of dollars to train the currently popular ChatGPT model [3]. Therefore, the AI model is highly valuable to the owner, and its IP should be secured [4]. While making models open source is beneficial for advancing deep learning research and development, malevolent people frequently utilize NN models without authorization. They are frequently employed for commercial endeavors, resulting in enormous financial gains, which gravely jeopardizes the IP rights and legal advantages of the NN model owners. Therefore, it is essential and urgent to design a method that can effectively secure the NN model’s copyright ownership.