Turning Your Weakness Into a Strength: Watermarking Deep Neural Networks by Backdooring
summary
Proposes a watermarking method that hides a secret trigger set — unrelated input-label pairs — inside a classifier so ownership can be proven via black-box verification or a zero-knowledge proof. Implements on convolutional architectures (ResNet-18) and datasets including ImageNet and smaller vision sets, showing primary accuracy stays the same while watermarks embedded during training survive fine-tuning and compression, whereas watermarks added after training are wiped by full fine-tuning; ownership survives transfer in roughly 60–70% of trials.
AI-written summary · about
chapters (14)
- 0:00Intro
- 0:36Machine Learning is Everywhere
- 1:48(Deep) Neural Networks
- 3:44Machine Learning as a Service
- 5:20Problem Setting Stable Watermark?
- 6:48Our idea: Turning your weakness into a strength
- 8:37Backdooring a DNN
- 10:04Formal Approach
- 13:41Desired Properties
- 16:16Watermarking Neural Networks
- 16:47Results - Functionality Preserving
- 19:21Proving Ownership
- 20:04Future Directions
- 20:45Summing up
related talks
27mUnderstanding Deep Neural Networks
36mAdversarial Attacks on Deep Learning
44mDigital watermarking for generative AI
36mAdversarial Machine Learning: How Secure Is ML?
34mNeural networks: insane in the membrane
59mStudying Failure Modes of Deep Learning and Ways To Fix Them
25mTricking Neural Networks : Explore Adversarial Attacks
38mUsing adversarial samples to robustify your Neural Network Models