Wiki Home

DAWN: Dynamic Adversarial Watermarking of Neural Networks

Paper: ACM MM 2021

High-level overview

A trained model exposed through a prediction API can be copied by model extraction: an adversary queries the API, collects the returned labels, and trains a surrogate that reproduces the victim’s functionality. Existing model watermarking schemes embed an ownership marker into the model at training time. Against extraction they fail, because the adversary, not the owner, trains the surrogate, and nothing the owner placed in the original model carries over.

This work introduces DAWN (Dynamic Adversarial Watermarking of Neural Networks), a watermarking approach for deterring intellectual-property theft via model extraction. DAWN is a component placed in front of the prediction API rather than a change to the protected model. For a small fraction of incoming queries (under 0.5%), it returns a deliberately altered label instead of the model’s true prediction. Whether a given query is one of them is decided by a keyed function of the query and the protected model, so the same input always draws the same response no matter who submits it. If a client trains a surrogate on its query responses, those altered query-label pairs become a backdoor trigger set the surrogate learns, and the owner can later query a suspect model and check whether the planted responses reappear. The owner records, for each client, which of that client’s own queries were altered, and registers that set as the client’s watermark, so one altered query can sit in the registered set of every client that submitted it. Verifying a suspect model against a registered set therefore names a client whose responses went into training it. Here the watermark is embedded by the adversary who trains the surrogate rather than by the defender, inverting the usual watermarking setup.

The paper reports that DAWN watermarks every surrogate produced by two extraction attacks, including the functionality-stealing attack of Knockoff Nets (Orekondy et al., 2019), lets the owner demonstrate ownership with high confidence, and costs honest clients a negligible drop in accuracy (0.03 to 0.5%).

Threat Model: The adversary mounts model extraction against a victim’s prediction API over black-box query access: it submits inputs (natural or synthetic), reads back labels, and treats each returned label as ground truth, having no prior expectation of what any single query’s correct label should be. It chooses its own surrogate architecture, training data, and training process, and it serves the resulting surrogate through its own prediction API (a surrogate kept for purely private use is out of scope, since ownership demonstration needs query access to the suspect). The adversary may try to remove or evade the mark: discarding queries it suspects are watermarked, adding noise to its training inputs, probing for the watermarking decision boundary, or splitting the extraction across several colluding clients. The defender operates the API and need not be the model’s trainer; it cannot alter the protected model’s training and cannot choose trigger inputs from the whole input space, only from what clients actually submit. Its claim is that any surrogate accurate enough to be useful necessarily carries an embedded watermark that links it to the clients whose query responses trained it, which the owner can verify through a trusted judge and a public commitment establishing priority, while honest clients see almost no loss of accuracy.

Basic Background

Model extraction and prediction-API access

Model extraction (model stealing) reproduces an asset of a deployed model from external access, usually the black-box query interface of a prediction API, where inputs go in and labels or probability vectors come back. The variant DAWN addresses is functionality stealing: training a surrogate model that matches the victim’s task accuracy, trained on the victim’s own responses to the adversary’s queries. The adversary may use natural or synthetic query data and is free to pick a surrogate architecture different from the victim’s.

Image classification with convolutional networks

The protected models and surrogates are convolutional neural networks (CNNs) for image classification, each mapping an image to a probability distribution over a fixed set of classes. The evaluation spans standard image datasets and backbones (for example ResNet and DenseNet), covering both small networks and larger pretrained ones.

Model watermarking

Model watermarking embeds an owner-verifiable marker in a model so the owner can later claim ownership of a copy. White-box schemes hide the marker in the weights; black-box schemes verify it through the prediction API. The black-box schemes relevant here verify ownership by querying a secret trigger set and checking that the model returns the planted responses. The alternative family, model fingerprinting, embeds nothing and identifies a model by properties it already has, such as how it labels inputs near its decision boundary.

Backdoors and model overcapacity

A black-box watermark is a backdoor: a model trained to return chosen, incorrect outputs on a trigger set while behaving normally elsewhere. Backdoors embed because deep networks have the capacity to memorize a subset of inputs with arbitrary labels without harming the primary task. The same effect is what makes a small set of deliberately mislabeled query responses stick in a surrogate trained on them.

Proving ownership: commitments and a trusted verifier

Demonstrating ownership needs more than a matching trigger set; it needs proof that the claimant held the model first. A cryptographic commitment published on a public, time-stamped bulletin board (such as a blockchain) fixes the owner’s model and per-client secrets before any dispute, giving proof of priority. A trusted judge, which can be realized inside a trusted execution environment (an isolated hardware enclave that runs verification code with integrity and confidentiality guarantees), runs the verification on the secret values and the suspect API and reports the verdict.

Reading guidance

• Section 3.2 (Assumptions): the adversary has no prior expectation about any query’s correct label and takes returned labels as ground truth. This is where the indistinguishability argument of Section 4.1.3 starts; note what else that argument needs.
• Section 4 with Figure 2 and Equation 3: how a watermark is embedded in the responses themselves, and the relationship between trigger-set size and verification confidence.
• Section 7.2, Table 6: DAWN against PRADA and Knockoff Nets, as the surrogate’s watermark accuracy set against its test accuracy. The price honest clients pay is not in that table; it is the watermarked-query ratio and resulting victim accuracy in Table 5. Note the size of that second number.