Ensuring the legal usage of deep models is crucial to promoting trustable,
accountable, and responsible artificial intelligence innovation. Current
passport-based methods that obfuscate model functionality for license-to-use
and ownership verifications suffer from capacity and quality constraints, as
they require retraining the owner model for new users. They are also vulnerable
to advanced Expanded Residual Block ambiguity attacks. We propose
Steganographic Passport, which uses an invertible steganographic network to
decouple license-to-use from ownership verification by hiding the user's
identity images into the owner-side passport and recovering them from their
respective user-side passports. An irreversible and collision-resistant hash
function is used to avoid exposing the owner-side passport from the derived
user-side passports and increase the uniqueness of the model signature. To
safeguard both the passport and model's weights against advanced ambiguity
attacks, an activation-level obfuscation is proposed for the verification
branch of the owner's model. By jointly training the verification and
deployment branches, their weights become tightly coupled. The proposed method
supports agile licensing of deep models by providing a strong ownership proof
and license accountability without requiring a separate model retraining for
the admission of every new user. Experiment results show that our
Steganographic Passport outperforms other passport-based deep model protection
methods in robustness against various known attacks.

确保深度模型的合法使用对于推动可信、可问责和负责任的人工智能创新至关重要。我们提出了隐写护照方法，通过在护照中隐藏用户的身份图像，并从各自的用户端护照中恢复，将使用许可与所有权验证分离开来。该方法支持深度模型的灵活许可，提供强有力的所有权证明和许可责任，而无需为每个新用户的准入重新训练模型。实验结果表明，我们的隐写护照在对抗各种已知攻击方面优于其他基于护照的深度模型保护方法。