Deep learning has been achieving top performance in many tasks. Since
training of a deep learning model requires a great deal of cost, we need to
treat neural network models as valuable intellectual properties. One concern in
such a situation is that some malicious user might redistribute the model or
provide a prediction service using the model without permission. One promising
solution is digital watermarking, to embed a mechanism into the model so that
the owner of the model can verify the ownership of the model externally. In
this study, we present a novel attack method against watermark, query
modification, and demonstrate that all of the existing watermark methods are
vulnerable to either of query modification or existing attack method (model
modification). To overcome this vulnerability, we present a novel watermarking
method, exponential weighting. We experimentally show that our watermarking
method achieves high verification performance of watermark even under a
malicious attempt of unauthorized service providers, such as model modification
and query modification, without sacrificing the predictive performance of the
neural network model.

本研究提出了一种新的数字水印方法（指数加权法），以解决神经网络模型在预测性能不受影响的情况下，在未经授权的服务提供商（如模型修改和查询修改）的恶意企图下高效验证水印。