Embedding watermarks into models has been widely used to protect model
ownership in federated learning (FL). However, existing methods are inadequate
for protecting the ownership of personalized models acquired by clients in
personalized FL (PFL). This is due to the aggregation of the global model in
PFL, resulting in conflicts over clients' private watermarks. Moreover,
malicious clients may tamper with embedded watermarks to facilitate model
leakage and evade accountability. This paper presents a robust watermark
embedding scheme, named RobWE, to protect the ownership of personalized models
in PFL. We first decouple the watermark embedding of personalized models into
two parts: head layer embedding and representation layer embedding. The head
layer belongs to clients' private part without participating in model
aggregation, while the representation layer is the shared part for aggregation.
For representation layer embedding, we employ a watermark slice embedding
operation, which avoids watermark embedding conflicts. Furthermore, we design a
malicious watermark detection scheme enabling the server to verify the
correctness of watermarks before aggregating local models. We conduct an
exhaustive experimental evaluation of RobWE. The results demonstrate that RobWE
significantly outperforms the state-of-the-art watermark embedding schemes in
FL in terms of fidelity, reliability, and robustness.

该研究提出了一种名为 RobWE 的鲁棒性水印嵌入方案，用于保护个性化联邦学习（PFL）中个性化模型的所有权，其通过将水印嵌入分为头层和表示层，采用水印切片嵌入操作来避免嵌入冲突，并设计了一种恶意水印检测方案以确保水印的正确性，实验证明 RobWE 在忠实度、可靠性和鲁棒性方面明显优于现有的水印嵌入方案。

RobWE：个性化联邦学习模型所有权保护的鲁棒性水印嵌入

RobWE: Robust Watermark Embedding for Personalized Federated Learning  Model Ownership Protection

By and large, existing Intellectual Property (IP) protection on deep neural
networks typically i) focus on image classification task only, and ii) follow a
standard digital watermarking framework that was conventionally used to protect
the ownership of multimedia and video content. This paper demonstrates that the
current digital watermarking framework is insufficient to protect image
captioning tasks that are often regarded as one of the frontiers AI problems.
As a remedy, this paper studies and proposes two different embedding schemes in
the hidden memory state of a recurrent neural network to protect the image
captioning model. From empirical points, we prove that a forged key will yield
an unusable image captioning model, defeating the purpose of infringement. To
the best of our knowledge, this work is the first to propose ownership
protection on image captioning task. Also, extensive experiments show that the
proposed method does not compromise the original image captioning performance
on all common captioning metrics on Flickr30k and MS-COCO datasets, and at the
same time it is able to withstand both removal and ambiguity attacks. Code is
available at this https URL

本研究提出了两种不同的嵌入方案，以保护图像字幕模型的知识产权，并证明所提出的方法不会影响原始图像字幕的性能