Deep Serial Number: Computational Watermarking for DNN Intellectual Property Protection
This work addresses the problem of intellectual property protection for deep neural networks, offering a mechanism to prevent unauthorized use of stolen models for model owners.
This paper introduces Deep Serial Number (DSN), a watermarking algorithm for deep neural networks (DNNs) that embeds a serial number into student DNNs during knowledge distillation from a private teacher. The student DNNs only function correctly with a valid serial number, effectively preventing unauthorized usage without compromising performance.
In this paper, we present DSN (Deep Serial Number), a simple yet effective watermarking algorithm designed specifically for deep neural networks (DNNs). Unlike traditional methods that incorporate identification signals into DNNs, our approach explores a novel Intellectual Property (IP) protection mechanism for DNNs, effectively thwarting adversaries from using stolen networks. Inspired by the success of serial numbers in safeguarding conventional software IP, we propose the first implementation of serial number embedding within DNNs. To achieve this, DSN is integrated into a knowledge distillation framework, in which a private teacher DNN is initially trained. Subsequently, its knowledge is distilled and imparted to a series of customized student DNNs. Each customer DNN functions correctly only upon input of a valid serial number. Experimental results across various applications demonstrate DSN's efficacy in preventing unauthorized usage without compromising the original DNN performance. The experiments further show that DSN is resistant to different categories of watermark attacks.