In recent years, there has been significant growth in the commercial
applications of generative models, licensed and distributed by model developers
to users, who in turn use them to offer services. In this scenario, there is a
need to track and identify the responsible user in the presence of a violation
of the license agreement or any kind of malicious usage. Although there are
methods enabling Generative Adversarial Networks (GANs) to include invisible
watermarks in the images they produce, generating a model with a different
watermark, referred to as a fingerprint, for each user is time- and
resource-consuming due to the need to retrain the model to include the desired
fingerprint. In this paper, we propose a retraining-free GAN fingerprinting
method that allows model developers to easily generate model copies with the
same functionality but different fingerprints. The generator is modified by
inserting additional Personalized Normalization (PN) layers whose parameters
(scaling and bias) are generated by two dedicated shallow networks (ParamGen
Nets) taking the fingerprint as input. A watermark decoder is trained
simultaneously to extract the fingerprint from the generated images. The
proposed method can embed different fingerprints inside the GAN by just
changing the input of the ParamGen Nets and performing a feedforward pass,
without finetuning or retraining. The performance of the proposed method in
terms of robustness against both model-level and image-level attacks is also
superior to the state-of-the-art.

通过插入个性化归一化 (PN) 层以及训练水印解码器，本文提出了一种无需重新训练的生成对抗网络（GAN）水印方法，使模型开发者可以轻松生成具有相同功能但不同指纹的模型副本，该方法在模型级攻击和图像级攻击的鲁棒性方面优于现有技术。