|
Watermarking techniques for neural networks are classified based on the accessible information at the time of watermark extraction: white box and black box paradigm. The white box paradigm provides access to all parameters in a host network, allowing information to be embedded into the parameters. In contrast, the black box paradigm can only access the output of the final layer, so some researchers have proposed training networks to deliberately produce incorrect output for a specific input, and use it as a watermark.
Our proposed method is categorized into the white box. |