ICACT20220108 Slide.18
[Big slide for presentation]
|
Chrome Text-to-Speach Click!! |
 |
As I have explained in today’s presentation, we proposed the DNN watermarking method that can embed multiple watermarks without collusion. The evaluation results show that our method has minimal impact on image classification task and robustness to pruning attack.
That’s all for my presentation. Thank you for your attention. I’m looking forward to your comments and questions and I respond as best as I can.
|
|
ICACT20220108 Slide.17
[Big slide for presentation]
|
Chrome Text-to-Speach Click!! |
 |
Figures 5 and 6 show the detector responses from the networks that prune 90% of the weights watermark embedded. Even if almost watermarked parameters are cut off, all embedded watermarks are detected.
|
|
ICACT20220108 Slide.16
[Big slide for presentation]
|
Chrome Text-to-Speach Click!! |
 |
Figures 3 and 4 show the classification accuracy for different pruning rates. As can be seen in Figure 3, the 5-layer CNN maintains nearly the same accuracy from no pruning to 90% pruning; however, it sharply decreases when 100% weights are cut off. ResNet-50 also shows a decrease in classification accuracy when pruning 100% weights.
|
|
ICACT20220108 Slide.15
[Big slide for presentation]
|
Chrome Text-to-Speach Click!! |
 |
Model compression is one of the attacks against neural network watermarking because it changes the parameters of the network and thus affects the embedded watermark. In this study, we evaluated the robustness of the watermark against model compression, particularly against weight pruning. In pruning, p% of the watermarked weights with low absolute values were set to zero. p is the pruning rate.
|
|
ICACT20220108 Slide.14
[Big slide for presentation]
|
Chrome Text-to-Speach Click!! |
 |
The results of the correlation detection are shown in Figures 1 and 2. In both the 5-layers CNN and ResNet-50, only the correct keys show strong correlations. Even when multiple watermarks were embedded, the key number corresponding to each watermark was detected independently.
|
|
ICACT20220108 Slide.13
[Big slide for presentation]
|
Chrome Text-to-Speach Click!! |
 |
As shown in Table 2, there is no loss of accuracy after watermark embedding in either network. The number of watermarks embedded in the weights has little effect on accuracy. These results confirmed that our watermark has little effect on the classification task.
|
|
ICACT20220108 Slide.12
[Big slide for presentation]
|
Chrome Text-to-Speach Click!! |
 |
We evaluated the proposed method from two perspectives; classification accuracy of the host model and watermark detection accuracy. Classification accuracy shows how much the embedding of the watermark affects the accuracy of the original task, and watermark detection accuracy checks whether the embedded watermark can be detected correctly.
|
|
ICACT20220108 Slide.11
[Big slide for presentation]
|
Chrome Text-to-Speach Click!! |
 |
On evaluation, we set the target parameters and test datasets as shown in the slides. Please refer to the paper on other settings.
|
|
ICACT20220108 Slide.10
[Big slide for presentation]
|
Chrome Text-to-Speach Click!! |
 |
We evaluated our proposed method with two different neural networks for classification tasks: a 5-layers CNN described in Table 1 trained on MNIST, and ResNet-50 pre-trained on ImageNet and retrained on CIFAR-10. ResNet-50 is a CNN, which is 50 layers deep; we used the pre-trained version released by MathWorks as the base of transfer learning.
|
|
ICACT20220108 Slide.09
[Big slide for presentation]
|
Chrome Text-to-Speach Click!! |
 |
In watermark detection, we first compute the mid-frequency domain of DCT coefficients E’a+w from the watermark embedded network, using the same processes used for watermark embedding. Then, calculate the correlation value between E’a+w and P’mark while changing x, the seed value of P’mark. If x equals Key, the random value used in the embedding process, the two values show a strong correlation.
|
|
ICACT20220108 Slide.08
[Big slide for presentation]
|
Chrome Text-to-Speach Click!! |
 |
First, select parameter tensor T to embed the watermark in the host network, then flatten T and trim it to a length of N squared. The trimmed T is reshaped to N×N, which is Tsq.
Next, we generate watermark W. The elements of Tsq are shuffled based on Key, an arbitrary positive integer, and then the discrete cosine transformed (DCT). After DCT, we compute the largest and smallest value from the embedded area (Ea), the mid-frequency domain of the DCT matrix. Ea consists of M coefficients. We generate Pmark, a sequence of uniformly distributed pseudo-random numbers in the range of Min(Ea) and Max(Ea), get the embedded watermark by subtracting Pmark from Ea.
Finally, we embed W into network parameters. Replace the mid-frequency domain with Ea+w, perform inverse DCT, and reorder by Key. Put Tsq+w back into T and replace the host network parameters.
To embed two or more watermarks, we repeat the embedding algorithm while changing Key.
|
|
ICACT20220108 Slide.07
[Big slide for presentation]
|
Chrome Text-to-Speach Click!! |
 |
Proposed method includes two algorithms; watermark embedding and detecting.
|
|
ICACT20220108 Slide.06
[Big slide for presentation]
|
Chrome Text-to-Speach Click!! |
 |
Our proposed method enables to embed multiple watermarks with no collusion. It also archives minimal impact on an original task, such as image classification and data analysis, and high robustness against pruning attack.
|
|
ICACT20220108 Slide.05
[Big slide for presentation]
|
Chrome Text-to-Speach Click!! |
 |
Watermarking techniques for neural networks are classified based on the accessible information at the time of watermark extraction: white box and black box paradigm. The white box paradigm provides access to all parameters in a host network, allowing information to be embedded into the parameters. In contrast, the black box paradigm can only access the output of the final layer, so some researchers have proposed training networks to deliberately produce incorrect output for a specific input, and use it as a watermark.
Our proposed method is categorized into the white box.
|
|
ICACT20220108 Slide.04
[Big slide for presentation]
|
Chrome Text-to-Speach Click!! |
 |
Deep learning has been used in many fields, such as image classification and data analysis. Training a high-performance model is expensive, such as large amounts of training data, machine resources, and a significant amount of time; thus, its property value is high.
|
|
ICACT20220108 Slide.03
[Big slide for presentation]
|
Chrome Text-to-Speach Click!! |
 |
Digital watermarking is a widely used technology for protecting the copyright of digital content by embedding data in it. These digital contents are expressed as numerical matrices as shown in the figure. Machine learning and deep learning networks also represented as numerical matrices with coupling weights and biases, watermarking technology can be applied to them as well.
|
|
ICACT20220108 Slide.02
[Big slide for presentation]
|
Chrome Text-to-Speach Click!! |
 |
In this presentation, first, I will talk about the introduction, and then I’ll state our proposed method. After that, I will share with you the evaluation results. And finally, I will make a brief summary.
|
|
ICACT20220108 Slide.01
[Big slide for presentation]
[YouTube] |
Chrome Text-to-Speach Click!! |
 |
Hello everyone. My name is Sayoko Kakikura and I am a student at Tokyo University of Science. Today, I’d like to talk about collusion resistant watermarking for deep learning models protection.
|
