SVD Mark: A Novel Black-Box Watermarking for Protecting Intellectual Property of Deep Neural Network Model

Abstract

With the rapid development of deep learning technology, more and more researchers have paid attention to protecting the intellectual property rights of the deep neural network (DNN) model. So far, various methods have been proposed to construct black-box watermarking copyright protection based on trigger sets. Since extant black-box watermarking methods are backdoor-based, the watermark embedding process inevitably distorts the decision boundary of the DNN model, which leads to a decline in the performance of the DNN model. We propose a novel scheme for constructing black-box watermarking based on Singular Value Decomposition (SVD) to compensate for shortcomings. We select an appropriate number of image samples as watermark key samples in the training dataset by employing the Mersenne-Twister algorithm, which strengthens the relevance of the process watermarking embedding to the original classification task and extends the perceptual domain of the DNN model. Subsequently, the SVD algorithm extracts the primary feature information of the watermark key samples, thereby constructing more stable and covert watermark samples. Next, the classification labels corresponding to the watermark samples are specified as the classification labels of their corresponding watermark key samples, which is unlike most existing DNN watermarking schemes. It can effectively reduce the distortion of the DNN model decision boundary caused by watermarking during the embedding process. As such, the proposed scheme has a low impact on the performance of the DNN model and is highly robust. We have validated the proposed watermarking scheme on two benchmark datasets. The experimental results show that our scheme, besides meeting the functional requirements of watermarking, also does not affect the test accuracy of the DNN model. Moreover, the proposed watermarking is robust to the common watermarking attacks.