Deep learning techniques have made tremendous progress in a variety of
challenging tasks, such as image recognition and machine translation, during
the past decade. Training deep neural networks is computationally expensive and
requires both human and intellectual resources. Therefore, it is necessary to
protect the intellectual property of the model and externally verify the
ownership of the model. However, previous studies either fail to defend against
the evasion attack or have not explicitly dealt with fraudulent claims of
ownership by adversaries. Furthermore, they can not establish a clear
association between the model and the creator's identity.
To fill these gaps, in this paper, we propose a novel intellectual property
protection (IPP) framework based on blind-watermark for watermarking deep
neural networks that meet the requirements of security and feasibility. Our
framework accepts ordinary samples and the exclusive logo as inputs, outputting
newly generated samples as watermarks, which are almost indistinguishable from
the origin, and infuses these watermarks into DNN models by assigning specific
labels, leaving the backdoor as the basis for our copyright claim. We evaluated
our IPP framework on two benchmark datasets and 15 popular deep learning
models. The results show that our framework successfully verifies the ownership
of all the models without a noticeable impact on their primary task. Most
importantly, we are the first to successfully design and implement a
blind-watermark based framework, which can achieve state-of-art performances on
undetectability against evasion attack and unforgeability against fraudulent
claims of ownership. Further, our framework shows remarkable robustness and
establishes a clear association between the model and the author's identity.

本研究提出了一种基于盲水印的知识产权保护（IPP）框架，通过将特定标签赋予普通样本并将其与独占标志组合生成水印来保护深度神经网络模型的知识产权，并成功验证了其安全性、可行性和鲁棒性，与创建者身份建立了明确的联系，有效应对了逃避攻击和恶意主张的问题。