 |
First, select parameter tensor T to embed the watermark in the host network, then flatten T and trim it to a length of N squared. The trimmed T is reshaped to NĄżN, which is Tsq.
Next, we generate watermark W. The elements of Tsq are shuffled based on Key, an arbitrary positive integer, and then the discrete cosine transformed (DCT). After DCT, we compute the largest and smallest value from the embedded area (Ea), the mid-frequency domain of the DCT matrix. Ea consists of M coefficients. We generate Pmark, a sequence of uniformly distributed pseudo-random numbers in the range of Min(Ea) and Max(Ea), get the embedded watermark by subtracting Pmark from Ea.
Finally, we embed W into network parameters. Replace the mid-frequency domain with Ea+w, perform inverse DCT, and reorder by Key. Put Tsq+w back into T and replace the host network parameters.
To embed two or more watermarks, we repeat the embedding algorithm while changing Key. |
IEEE/ICACT20220108 Slide.08
[Big Slide]