Spread-Transform Dither Modulation Watermarking of Deep Neural Network
This work addresses the problem of protecting the Intellectual Property Rights of Deep Neural Networks for model developers, offering an incremental improvement over existing spread spectrum methods.
This paper proposes a new DNN watermarking algorithm based on Spread Transform Dither Modulation (ST-DM) to protect the Intellectual Property Rights of DNN models. The method achieves a higher payload with a lower impact on network accuracy compared to a baseline conventional Spread Spectrum (SS) method, while maintaining satisfactory robustness.
DNN watermarking is receiving an increasing attention as a suitable mean to protect the Intellectual Property Rights associated to DNN models. Several methods proposed so far are inspired to the popular Spread Spectrum (SS) paradigm according to which the watermark bits are embedded into the projection of the weights of the DNN model onto a pseudorandom sequence. In this paper, we propose a new DNN watermarking algorithm that leverages on the watermarking with side information paradigm to decrease the obtrusiveness of the watermark and increase its payload. In particular, the new scheme exploits the main ideas of ST-DM (Spread Transform Dither Modulation) watermarking to improve the performance of a recently proposed algorithm based on conventional SS. The experiments we carried out by applying the proposed scheme to watermark different models, demonstrate its capability to provide a higher payload with a lower impact on network accuracy than a baseline method based on conventional SS, while retaining a satisfactory level of robustness.