RobWE: Robust Watermark Embedding for Personalized Federated Learning Model Ownership Protection
This addresses model ownership protection for clients in personalized federated learning, which is an incremental advancement over existing watermarking methods.
The paper tackles the problem of protecting ownership of personalized models in federated learning by proposing RobWE, a robust watermark embedding scheme that decouples embedding into head and representation layers and includes a detection mechanism, achieving significant improvements in fidelity, reliability, and robustness over state-of-the-art methods.
Embedding watermarks into models has been widely used to protect model ownership in federated learning (FL). However, existing methods are inadequate for protecting the ownership of personalized models acquired by clients in personalized FL (PFL). This is due to the aggregation of the global model in PFL, resulting in conflicts over clients' private watermarks. Moreover, malicious clients may tamper with embedded watermarks to facilitate model leakage and evade accountability. This paper presents a robust watermark embedding scheme, named RobWE, to protect the ownership of personalized models in PFL. We first decouple the watermark embedding of personalized models into two parts: head layer embedding and representation layer embedding. The head layer belongs to clients' private part without participating in model aggregation, while the representation layer is the shared part for aggregation. For representation layer embedding, we employ a watermark slice embedding operation, which avoids watermark embedding conflicts. Furthermore, we design a malicious watermark detection scheme enabling the server to verify the correctness of watermarks before aggregating local models. We conduct an exhaustive experimental evaluation of RobWE. The results demonstrate that RobWE significantly outperforms the state-of-the-art watermark embedding schemes in FL in terms of fidelity, reliability, and robustness.