On the Robustness of Backdoor-based Watermarking in Deep Neural Networks
Open accessAbstract
Watermarking algorithms have been introduced in the past years to protect deep learning models against unauthorized re-distribution. We investigate the robustness and reliability of state-of-the-art deep neural network watermarking schemes. We focus on backdoor-based watermarking and propose two simple yet effective attacks -- a black-box and a white-box -- that remove these watermarks without any labeled data from the ground truth. Our black-box attack steals the model and removes the watermark with only API access to the labels. Our white-box attack proposes an efficient watermark removal when the parameters of the marked model are accessible, and improves the time to steal a model up to twenty times over the time to train a model from scratch. We conclude that these watermarking algorithms are insufficient to defend against redistribution by a motivated attacker.
The claims and statistics of this paper haven’t been checked yet.
Run the check — free, no account needed. It reads the open-access text and checks the sources it cites.
Integrity signals
Registry
Cites
Statistics
Claims the paper makes
The claims and statistics of this paper haven’t been checked yet.
Run the check — free, no account needed. It reads the open-access text and checks the sources it cites.
Claims other papers make about this one
Each is checked against this paper’s own text: does it say what the citing paper says it does?
In the local model training phase, backdoor attacks can be conducted by manipulating the model parameters during the training process or modifying the training algorithm.
“In the local model training phase, the backdoor attacks can be conducted by manipulating the model parameters during the training process or modifying the training algorithm [126], [177].”
From Data and model poisoning backdoor attacks on wireless federated learning, and the defense mechanisms: A comprehensive survey (2024) · cites this paper as [177]
Self-check
Percentages, sums and reported differences re-computed from the paper’s own numbers.
The self-check needs the paper’s full text.
Cites
Deep Residual Learning for Image Recognition
He, K., Zhang, X., Ren, S., & Sun, J. (2016) · 2016 IEEE Conference on Computer Vision and Pattern Recognition (CVPR) · doi:10.1109/cvpr.2016.90 · Cited by 235,474 · see citing works
ImageNet classification with deep convolutional neural networks
Krizhevsky, A., Sutskever, I., & Hinton, G. E. (2017) · Communications of the ACM · doi:10.1145/3065386 · Cited by 112,155 · see citing works
Very Deep Convolutional Networks for Large-Scale Image Recognition
Simonyan, K., & Zisserman, A. (2014) · arXiv · doi:10.48550/arxiv.1409.1556 · Cited by 74,248 · see citing works
Sequence to Sequence Learning with Neural Networks
Sutskever, I., Vinyals, O., & Le, Q. V. (2014) · arXiv · doi:10.48550/arxiv.1409.3215 · Cited by 17,766 · see citing works
Speech recognition with deep recurrent neural networks
Graves, A., Mohamed, A.-R., & Hinton, G. (2013) · 2013 IEEE International Conference on Acoustics, Speech and Signal Processing · doi:10.1109/icassp.2013.6638947 · Cited by 8,893 · see citing works
A Neural Probabilistic Language Model
Bengio, Y., Ducharme, R., Vincent, P., & Janvin, C. (2003) · Journal of machine learning research · doi:10.1162/153244303322533223 · Cited by 8,257 · see citing works
(2006) · Springer eBooks · Cited by 8,123 · see citing works
Zagoruyko, S., & Komodakis, N. (2016) · Procedings of the British Machine Vision Conference 2016 · doi:10.5244/c.30.87 · Cited by 7,244 · see citing works
Membership Inference Attacks Against Machine Learning Models
Shokri, R., Stronati, M., Song, C., & Shmatikov, V. (2017) · 2017 IEEE Symposium on Security and Privacy (SP) · doi:10.1109/sp.2017.41 · Cited by 4,754 · see citing works
Practical Black-Box Attacks against Machine Learning
Papernot, N., McDaniel, P., Goodfellow, I., Jha, S., Celik, Z. B., & Swami, A. (2017) · Proceedings of the 2017 ACM on Asia Conference on Computer and Communications Security · doi:10.1145/3052973.3053009 · Cited by 3,495 · see citing works
Deep Neural Networks for Acoustic Modeling in Speech Recognition
Hinton, G. E., Deng, L., Yu, D., Dahl, G. E., Mohamed, A., Jaitly, N., Senior, A., Vanhoucke, V., Nguyen, P., Sainath, T. N., et al. (2012) · Cited by 1,839 · see citing works
word2vec Explained: deriving Mikolov et al.'s negative-sampling word-embedding methodPreprint
Goldberg, Y., & Levy, O. (2014) · arXiv (Cornell University) · doi:10.48550/arxiv.1402.3722 · Cited by 1,577 · see citing works
Neural Cleanse: Identifying and Mitigating Backdoor Attacks in Neural Networks
Wang, B., Yao, Y., Shan, S., Li, H., Viswanath, B., Zheng, H.-T., & Zhao, B. Y. (2019) · IEEE Symposium on Security and Privacy (S&P) · doi:10.1109/sp.2019.00031 · Cited by 1,486 · see citing works
Trojaning Attack on Neural Networks
Liu, Y., Ma, S., Aafer, Y., Lee, W.-C., Zhai, J., Wang, W., & Zhang, X. (2018) · Proceedings 2018 Network and Distributed System Security Symposium · doi:10.14722/ndss.2018.23291 · Cited by 1,270 · see citing works
A Primer on Neural Network Models for Natural Language Processing
Goldberg, Y. (2016) · Journal of Artificial Intelligence Research · doi:10.1613/jair.4992 · Cited by 1,259 · see citing works
BadNets: Identifying Vulnerabilities in the Machine Learning Model Supply Chain
Gu, T., Dolan-Gavitt, B., & Garg, S. (2017) · arXiv · doi:10.48550/arxiv.1708.06733 · Cited by 1,061 · see citing works
Fine-Pruning: Defending Against Backdooring Attacks on Deep Neural Networks
Liu, K., Dolan-Gavitt, B., & Garg, S. (2018) · Lecture Notes in Computer Science · doi:10.1007/978-3-030-00470-5_13 · Cited by 1,055 · see citing works
Targeted Backdoor Attacks on Deep Learning Systems Using Data Poisoning
Chen, X., Liu, C., Li, B., Lu, K., & Song, D. (2017) · arXiv · doi:10.48550/arxiv.1712.05526 · Cited by 1,039 · see citing works
Multimedia data-embedding and watermarking technologies
Swanson, M. D., Kobayashi, M., & Tewfik, A. H. (1998) · Proceedings of the IEEE · doi:10.1109/5.687830 · Cited by 924 · see citing works
Watermarking digital image and video data. A state-of-the-art overview
Langelaar, G. C., Setyawan, I., & Lagendijk, R. L. (2000) · IEEE Signal Processing Magazine · doi:10.1109/79.879337 · Cited by 849 · see citing works
Gao, Y., Xu, C., Wang, D., Chen, S., Ranasinghe, D. C., & Nepal, . (2019) · Annual Computer Security Applications Conference · doi:10.1145/3359789.3359790 · Cited by 719 · see citing works
Embedding Watermarks into Deep Neural Networks
Uchida, Y., Nagai, Y., Sakazawa, S., & Satoh, S. (2017) · International Conference on Multimedia Retrieval · doi:10.1145/3078971.3078974 · Cited by 709 · see citing works
Protecting Intellectual Property of Deep Neural Networks with Watermarking
Zhang, J., Gu, Z., Jang, J., Wu, H., Stoecklin, M. P., Huang, H., & Molloy, I. (2018) · ACM Asia Conference on Computer and Communications Security (ASIA CCS) · doi:10.1145/3196494.3196550 · Cited by 556 · see citing works
Knockoff Nets: Stealing Functionality of Black-Box Models
Orekondy, T., Schiele, B., & Fritz, M. (2019) · 2019 IEEE/CVF Conference on Computer Vision and Pattern Recognition (CVPR) · doi:10.1109/cvpr.2019.00509 · Cited by 549 · see citing works
Stealing Hyperparameters in Machine Learning
Wang, B., & Gong, N. Z. (2018) · IEEE Symposium on Security and Privacy (S&P) · doi:10.1109/sp.2018.00038 · Cited by 491 · see citing works
Ganju, K., Wang, Q., Yang, W., Gunter, C. A., & Borisov, N. (2018) · Proceedings of the 2018 ACM SIGSAC Conference on Computer and Communications Security · doi:10.1145/3243734.3243834 · Cited by 475 · see citing works
PRADA: Protecting Against DNN Model Stealing Attacks
Juuti, M., Szyller, S., Marchal, S., & Asokan, N. (2019) · 2019 IEEE European Symposium on Security and Privacy (EuroS&P) · doi:10.1109/eurosp.2019.00044 · Cited by 440 · cited 2× · see citing works
“[13], higher complexity models increase the prediction accuracy until they are as complex as the source model.”
BackgroundResultAdversarial frontier stitching for remote neural network watermarking
Merrer, E. L., Pérez, P., & Trédan, G. (2019) · Neural Computing and Applications · doi:10.1007/s00521-019-04434-z · Cited by 342 · see citing works
Towards Reverse-Engineering Black-Box Neural Networks
Oh, S. J., Schiele, B., & Fritz, M. (2019) · Lecture Notes in Computer Science · doi:10.1007/978-3-030-28954-6_7 · Cited by 291 · see citing works
SentiNet: Detecting Localized Universal Attacks Against Deep Learning Systems
Chou, E., Tramer, F., & Pellegrino, G. (2020) · 2020 IEEE Security and Privacy Workshops (SPW) · doi:10.1109/spw50608.2020.00025 · Cited by 281 · see citing works
Liu, Y., Xie, Y., & Srivastava, A. (2017) · 2017 IEEE International Conference on Computer Design (ICCD) · doi:10.1109/iccd.2017.16 · Cited by 241 · see citing works
Watermarking deep neural networks for embedded systems
Guo, J., & Potkonjak, M. (2018) · doi:10.1145/3240765.3240862 · Cited by 169 · see citing works
Digital watermarking for deep neural networks
Nagai, Y., Uchida, Y., Sakazawa, S., & Satoh, S. (2018) · International Journal of Multimedia Information Retrieval · doi:10.1007/s13735-018-0147-1 · Cited by 152 · see citing works
Robust Watermarking of Neural Network with Exponential Weighting
Namba, R., & Sakuma, J. (2019) · ACM Asia Conference on Computer and Communications Security (ASIA CCS) · doi:10.1145/3321705.3329808 · Cited by 150 · see citing works
How to prove your model belongs to you
Li, Z., Hu, C., Zhang, Y., & Guo, S. (2019) · Annual Computer Security Applications Conference · doi:10.1145/3359789.3359801 · Cited by 145 · see citing works
STRIP: A Defence Against Trojan Attacks on Deep Neural NetworksPreprint
Gao, Y., Xu, C., Wang, D., Chen, S., Ranasinghe, D. C., & Nepal, . (2019) · arXiv (Cornell University) · doi:10.48550/arxiv.1902.06531 · Cited by 127 · see citing works
Superset Disassembly: Statically Rewriting x86 Binaries Without Heuristics
Bauman, E., Lin, Z., & Hamlen, K. W. (2018) · Network and Distributed System Security Symposium · doi:10.14722/ndss.2018.23300 · Cited by 88 · see citing works
Attacks on Digital Watermarks for Deep Neural Networks
Wang, T., & Kerschbaum, F. (2019) · IEEE International Conference on Acoustics Speech and Signal Processing · doi:10.1109/icassp.2019.8682202 · Cited by 83 · see citing works
Self-citationLiu, Y., Xie, Y., & Srivastava, A. (2017) · IEEE International Conference on Computer Design: VLSI in Computers and Processors (ICCD) · Cited by 81 · see citing works
DeepSigns: A Generic Watermarking Framework for IP Protection of Deep Learning ModelsPreprint
Rouhani, B. D., Chen, H., & Koushanfar, F. (2018) · arXiv (Cornell University) · doi:10.48550/arxiv.1804.00750 · Cited by 80 · see citing works
SentiNet: Detecting Physical Attacks Against Deep Learning SystemsPreprint
Chou, E., Tramèr, F., Pellegrino, G., & Boneh, D. (2018) · arXiv (Cornell University) · Cited by 76 · see citing works
A Survey of Digital Watermarking Techniques and its ApplicationsPreprint
Saini, L. K., & Shrivastava, V. (2014) · arXiv (Cornell University) · doi:10.48550/arxiv.1407.4735 · Cited by 49 · see citing works
DeepMarks: A Digital Fingerprinting Framework for Deep Neural NetworksPreprint
Chen, H., Rohani, B. D., & Koushanfar, F. (2018) · arXiv (Cornell University) · doi:10.48550/arxiv.1804.03648 · Cited by 42 · see citing works
Towards Reverse-Engineering Black-Box Neural NetworksPreprint
Oh, S. J., Augustin, M., Schiele, B., & Fritz, M. (2017) · arXiv (Cornell University) · doi:10.48550/arxiv.1711.01768 · Cited by 42 · see citing works
BlackMarks: Blackbox Multibit Watermarking for Deep Neural NetworksPreprint
Chen, H., Rouhani, B. D., & Koushanfar, F. (2019) · arXiv (Cornell University) · doi:10.48550/arxiv.1904.00344 · Cited by 40 · see citing works
Have You Stolen My Model? Evasion Attacks Against Deep Neural Network Watermarking TechniquesPreprint
Hitaj, D., & Mancini, L. V. (2018) · arXiv (Cornell University) · doi:10.48550/arxiv.1809.00615 · Cited by 39 · see citing works
Fine-Pruning: Defending Against Backdooring Attacks on Deep Neural NetworksPreprint
Liu, K., Dolan-Gavitt, B., & Garg, S. (2018) · arXiv (Cornell University) · doi:10.48550/arxiv.1805.12185 · Cited by 35 · see citing works
A Survey of Digital Watermarking Techniques and its Applications
Kumari, K. P. (2013) · Cited by 33 · see citing works
PRADA: Protecting against DNN Model Stealing AttacksPreprint
Juuti, M., Szyller, S., Marchal, S., et al. (2018) · arXiv (Cornell University) · doi:10.48550/arxiv.1805.02628 · Cited by 32 · see citing works
Robust and Undetectable White-Box Watermarks for Deep Neural Networks.
Wang, T., & Kerschbaum, F. (2019) · Cited by 24 · see citing works
Self-citationPerformance Comparison of Contemporary DNN Watermarking TechniquesPreprint
Chen, H., Rouhani, B. D., Fan, X., Kilinc, O. C., & Koushanfar, F. (2018) · arXiv (Cornell University) · doi:10.48550/arxiv.1811.03713 · Cited by 16 · see citing works
Robust Watermarking of Neural Network with Exponential WeightingPreprint
Namba, R., & Sakuma, J. (2019) · arXiv (Cornell University) · doi:10.48550/arxiv.1901.06151 · Cited by 14 · see citing works
DeepStego: Protecting Intellectual Property of Deep Neural Networks by SteganographyPreprint
Li, Z., Han, G., Guo, S., & Hu, C. (2019) · arXiv (Cornell University) · Cited by 2 · see citing works
(2014) · doi:10.4230/oasics.slate.2021.16 · Cited by 1 · see citing works
Flagged first, then by citations
Research works printed but not linked: 6
- Yossi Adi, Carsten Baum, Moustapha Cisse, Benny Pinkas, and Joseph Keshet. Turning your weakness into a strength: Watermarking deep neural networks by back- dooring. In 27th USENIX Security Symposium (USENIX Security 18), pages 1615-1631, Baltimore, MD, 2018. USENIX Association.
- Xinyun Chen, Wenxiao Wang, Yiming Ding, Bender Chries, Jia Ruoxi, and Dawn Song. Leveraging unla- beled data for watermark removal of deep neural net- works. In ICML workshop on Security and Privacy of Machine Learning, 2019.
- K. He, X. Zhang, S. Ren, and J. Sun. Deep residual learn- ing for image recognition. In 2016 IEEE Conference on Computer Vision and Pattern Recognition (CVPR), pages 770-778, June 2016.
- Gil Press. Cleaning big data: Most time-consuming, least enjoyable data science task, survey says, Mar 2016.
- Florian Tramèr, Fan Zhang, Ari Juels, Michael K. Re- iter, and Thomas Ristenpart. Stealing machine learning models via prediction api. In Proceedings of the 25th USENIX Conference on Security Symposium, SEC'16, pages 601-618, Berkeley, CA, USA, 2016. USENIX Association.
- Manzil Zaheer, Satwik Kottur, Siamak Ravanbakhsh, Barnabas Poczos, Russ R Salakhutdinov, and Alexan- der J Smola. Deep sets. In I. Guyon, U. V. Luxburg, S. Bengio, H. Wallach, R. Fergus, S. Vishwanathan, and R. Garnett, editors, Advances in Neural Information Pro- cessing Systems 30, pages 3391-3401.
Cited by
Sorted by citations
Watermarking Neural Networks With Watermarked Images
Wu, H., Liu, G., Yao, Y., & Zhang, X. (2020) · IEEE Transactions on Circuits and Systems for Video Technology · doi:10.1109/tcsvt.2020.3030671 · Cited by 191 · see citing works
A survey of Deep Neural Network watermarking techniques
Li, Y., Wang, H., & Barni, M. (2021) · Neurocomputing · doi:10.1016/j.neucom.2021.07.051 · Cited by 177 · see citing works
Wan, Y., Qu, Y., Ni, W., Xiang, Y., Gao, L., & Hossain, E. (2024) · IEEE Communications Surveys & Tutorials · doi:10.1109/comst.2024.3361451 · Cited by 152 · see citing works
“It has been discovered that the probability that the trained model correctly classifies the normal inputs (Clean ACC) is proportional to the probability that the trained model misclassifies the backdoored inputs (Backdoor ACC).”
BackgroundRIGA: Covert and Robust White-Box Watermarking of Deep Neural Networks
Wang, T., & Kerschbaum, F. (2021) · International World Wide Web Conference (WWW) · doi:10.1145/3442381.3450000 · Cited by 131 · see citing works
Self-citationEluding Secure Aggregation in Federated Learning via Model Inconsistency
Pasquini, D., Francati, D., & Ateniese, G. (2022) · ACM SIGSAC Conference on Computer and Communications Security (CCS) · doi:10.1145/3548606.3560557 · Cited by 112 · see citing works
Deep Neural Network Fingerprinting by Conferrable Adversarial ExamplesPreprint
Lukas, N., Zhang, Y., & Kerschbaum, F. (2019) · arXiv (Cornell University) · doi:10.48550/arxiv.1912.00888 · Cited by 96 · see citing works
Self-citationA Systematic Review on Model Watermarking for Neural Networks
Boenisch, F. (2021) · Frontiers in Big Data · doi:10.3389/fdata.2021.729663 · Cited by 91 · see citing works
WAFFLE: Watermarking in Federated Learning
Tekgul, B. G. A., Xia, Y., Marchal, S., & Asokan, N. (2021) · IEEE Symposium on Reliable Distributed Systems (SRDS) · doi:10.1109/srds53918.2021.00038 · Cited by 96 · see citing works
Fingerprinting Deep Neural Networks Globally via Universal Adversarial Perturbations
Peng, Z., Li, S., Chen, G., Zhang, C., Zhu, H., & Xue, M. (2022) · IEEE Computer Society Conference on Computer Vision and Pattern Recognition/Proceedings - IEEE Computer Society Conference on Computer Vision and Pattern Recognition/Proceedings · doi:10.1109/cvpr52688.2022.01307 · Cited by 84 · see citing works
SoK: How Robust is Image Classification Deep Neural Network Watermarking?
Lukas, N., Jiang, E., Li, X., & Kerschbaum, F. (2022) · IEEE Symposium on Security and Privacy (S&P) · doi:10.1109/sp46214.2022.9833693 · Cited by 93 · see citing works
Self-citationNeural network laundering: Removing black-box backdoor watermarks from deep neural networks
Aiken, W., Kim, H., Woo, S. S., & Ryoo, J. (2021) · Computers & Security · doi:10.1016/j.cose.2021.102277 · Cited by 79 · see citing works
Xue, M., Zhang, Y., Wang, J., & Liu, W. (2021) · IEEE Transactions on Artificial Intelligence · doi:10.1109/tai.2021.3133824 · Cited by 75 · see citing works
Self-citationA Robustness-Assured White-Box Watermark in Neural Networks
Lv, P., Li, P., Zhang, S., Chen, K., Liang, R., Ma, H., Zhao, Y., & Li, Y. (2023) · IEEE Transactions on Dependable and Secure Computing · doi:10.1109/tdsc.2023.3242737 · Cited by 64 · see citing works
ModelDiff: testing-based DNN similarity comparison for model reuse detection
Li, Y., Zhang, Z., Liu, B., Yang, Z., & Liu, Y. (2021) · ACM SIGSOFT International Symposium on Software Testing and Analysis (ISSTA) · doi:10.1145/3460319.3464816 · Cited by 55 · see citing works
Removing Backdoor-Based Watermarks in Neural Networks with Limited Data
Liu, X., Li, F., Wen, B., & Li, Q. (2021) · 2020 25th International Conference on Pattern Recognition (ICPR) · doi:10.1109/icpr48806.2021.9412684 · Cited by 49 · see citing works
Watermarking in Secure Federated Learning: A Verification Framework Based on Client-Side Backdooring
Yang, W., Shao, S., Yang, Y., Liu, X., Liu, X., Xia, Z., Schaefer, G., & Fang, H. (2023) · ACM Transactions on Intelligent Systems and Technology · doi:10.1145/3630636 · Cited by 45 · see citing works
Regazzoni, F., Palmieri, P., Smailbegovic, F., Cammarota, R., & Polian, I. (2021) · CAAI Transactions on Intelligence Technology · doi:10.1049/cit2.12029 · Cited by 42 · see citing works
Planting Undetectable Backdoors in Machine Learning Models : [Extended Abstract]
Goldwasser, S., Kim, M. P., Vaikuntanathan, V., & Zamir, O. (2022) · 2022 IEEE 63rd Annual Symposium on Foundations of Computer Science (FOCS) · doi:10.1109/focs54457.2022.00092 · Cited by 41 · see citing works
Structural Watermarking to Deep Neural Networks via Network Channel Pruning
Zhao, X., Yao, Y., Wu, H., & Zhang, X. (2021) · IEEE International Workshop on Information Forensics and Security · doi:10.1109/wifs53200.2021.9648376 · Cited by 40 · see citing works
Dataset Inference: Ownership Resolution in Machine LearningPreprint
Maini, P., Yaghini, M., & Papernot, N. (2021) · arXiv (Cornell University) · doi:10.48550/arxiv.2104.10706 · Cited by 57 · see citing works
Deep Neural Network Watermarking against Model Extraction Attack
Tan, J., Zhong, N., Qian, Z., Zhang, X., & Li, S. (2023) · ACM International Conference on Multimedia (ACM MM) · doi:10.1145/3581783.3612515 · Cited by 38 · see citing works
Lederer, I., Mayer, R. L., & Rauber, A. (2023) · IEEE Transactions on Neural Networks and Learning Systems · doi:10.1109/tnnls.2023.3270135 · Cited by 35 · see citing works
Li, M., Zhong, Q., Zhang, L. Y., Du, Y., Zhang, J., & Xiang, Y. (2020) · IEEE International Conference on Trust, Security and Privacy in Computing and Communications (TrustCom) · doi:10.1109/trustcom50675.2020.00062 · Cited by 34 · see citing works
Xue, M., Sun, S., Zhang, Y., Wang, J., & Liu, W. (2022) · Applied Intelligence · doi:10.1007/s10489-022-03339-0 · Cited by 34 · see citing works
Self-citationMengara, O., Avila, A. R., & Falk, T. H. (2024) · IEEE Access · doi:10.1109/access.2024.3355816 · Cited by 32 · see citing works
FedRight: An effective model copyright protection for federated learning
Chen, J., Li, M.-J., Cheng, Y., & Zheng, H. (2023) · Computers & Security · doi:10.1016/j.cose.2023.103504 · Cited by 29 · see citing works
DNN Intellectual Property Protection
Xue, M., Wang, J., & Liu, W. (2021) · ACM Great Lakes Symposium on VLSI (GLSVLSI) · doi:10.1145/3453688.3461752 · Cited by 28 · see citing works
Self-citationFine-tuning Is Not Enough: A Simple yet Effective Watermark Removal Attack for DNN Models
Guo, S., Zhang, T., Qiu, H., Zeng, Y., Xiang, T., & Liu, Y. (2021) · International Joint Conference on Artificial Intelligence · doi:10.24963/ijcai.2021/500 · Cited by 33 · see citing works
When deep learning meets watermarking: A survey of application, attacks and defenses
Chen, H., Liu, C., Zhu, T., & Zhou, W. (2024) · Computer Standards & Interfaces · doi:10.1016/j.csi.2023.103830 · Cited by 27 · see citing works
Intellectual property protection of DNN models
Peng, S., Chen, Y., Xu, J., Chen, Z., Wang, C., & Jia, X. (2022) · World Wide Web · doi:10.1007/s11280-022-01113-3 · Cited by 24 · see citing works
Survey on deep learning applications in digital image security
Bao, Z., & Xue, R. (2021) · Optical Engineering · doi:10.1117/1.oe.60.12.120901 · Cited by 22 · see citing works
Don't Knock! Rowhammer at the Backdoor of DNN Models
Tol, M. C., Islam, S., Adiletta, A., Sunar, B., & Zhang, Z. (2023) · International Conference on Dependable Systems & Networks/Proceedings · doi:10.1109/dsn58367.2023.00023 · Cited by 22 · see citing works
Evaluating the Robustness of Trigger Set-Based Watermarks Embedded in Deep Neural Networks
Lee, S., Song, W., Jana, S., Cha, M., & Son, S. (2022) · IEEE Transactions on Dependable and Secure Computing · doi:10.1109/tdsc.2022.3196790 · Cited by 21 · see citing works
Robust Black-box Watermarking for Deep Neural Network using Inverse Document Frequency
Yadollahi, M. M., Shoeleh, F., Dadkhah, S., & Ghorbani, A. A. (2021) · IEEE Intl Conf on Dependable, Autonomic and Secure Computing, Intl Conf on Pervasive Intelligence and Computing, Intl Conf on Cloud and Big Data Computing, Intl Conf on Cyber Science and Technology Congress (DASC/PiCom/CBDCom/CyberSciTech) · doi:10.1109/dasc-picom-cbdcom-cyberscitech52372.2021.00100 · Cited by 20 · see citing works
Ownership Verification of DNN Architectures via Hardware Cache Side Channels
Lou, X., Guo, S., Li, J., & Zhang, T. (2022) · IEEE Transactions on Circuits and Systems for Video Technology · doi:10.1109/tcsvt.2022.3184644 · Cited by 21 · see citing works
Xue, M., Wu, Z., He, C., Wang, J., & Liu, W. (2020) · IEEE International Conference on Trust, Security and Privacy in Computing and Communications (TrustCom) · doi:10.1109/trustcom50675.2020.00130 · Cited by 17 · see citing works
Self-citationDefense Against Model Extraction Attacks on Recommender Systems
Zhang, S., Yin, H., Chen, H., & Long, C. (2024) · ACM International Conference on Web Search and Data Mining (WSDM) · doi:10.1145/3616855.3635751 · Cited by 14 · see citing works
Cracking White-box DNN Watermarks via Invariant Neuron Transforms
Pan, X., Zhang, M., Yan, Y., Wang, Y., & Yang, M. (2023) · ACM SIGKDD Conference on Knowledge Discovery and Data Mining (KDD) · doi:10.1145/3580305.3599291 · Cited by 14 · see citing works
Differential Analysis of Triggers and Benign Features for Black-Box DNN Backdoor Detection
Fu, H., Krishnamurthy, P., Garg, S., & Khorrami, F. (2023) · IEEE Transactions on Information Forensics and Security · doi:10.1109/tifs.2023.3297056 · Cited by 13 · see citing works
Towards Robust Model Watermark via Reducing Parametric Vulnerability
Gan, G., Li, Y., Wu, D., & Xia, S. (2023) · IEEE/CVF International Conference on Computer Vision (ICCV) · doi:10.1109/iccv51070.2023.00438 · Cited by 13 · see citing works
A Feature-Based On-Line Detector to Remove Adversarial-Backdoors by Iterative Demarcation
Fu, H., Veldanda, A. K., Krishnamurthy, P., Garg, S., & Khorrami, F. (2022) · IEEE Access · doi:10.1109/access.2022.3141077 · Cited by 13 · see citing works
CITS-MEW: Multi-Party Entangled Watermark in Cooperative Intelligent Transportation System
Wu, T., Li, X., Miao, Y., Xu, M., Zhang, H., Liu, X., & Choo, K. R. (2022) · IEEE Transactions on Intelligent Transportation Systems · doi:10.1109/tits.2022.3225116 · Cited by 12 · see citing works
Self-citationOn the Effectiveness of Dataset Watermarking
Tekgul, B. G. A., & Asokan, N. (2022) · ACM International Workshop on Security and Privacy Analytics (IWSPA) · doi:10.1145/3510548.3519376 · Cited by 12 · see citing works
TATTOOED: A Robust Deep Neural Network Watermarking Scheme based on Spread-Spectrum Channel Coding
Pagnotta, G., Hitaj, D., Hitaj, B., Pérez‐Cruz, F., & Mancini, L. V. (2024) · Annual Computer Security Applications Conference · doi:10.1109/acsac63791.2024.00099 · Cited by 11 · see citing works
Multi-bit, Black-box Watermarking of Deep Neural Networks in Embedded Applications
Leroux, S., Vanassche, S., & Simoens, P. (2024) · IEEE/CVF Conference on Computer Vision and Pattern Recognition Workshops (CVPRW) · doi:10.1109/cvprw63382.2024.00217 · Cited by 11 · see citing works
On Function-Coupled Watermarks for Deep Neural Networks
Wen, X., Li, Y., Jiang, W., & Xu, Q. (2024) · IEEE Journal on Emerging and Selected Topics in Circuits and Systems · doi:10.1109/jetcas.2024.3476386 · Cited by 11 · see citing works
Rethinking the Vulnerability of DNN Watermarking
Wang, R., Li, H., Mu, L., Ren, J., Guo, S., Liu, L., Fang, L., Chen, J., & Wang, L. (2022) · ACM International Conference on Multimedia (ACM MM) · doi:10.1145/3503161.3548390 · Cited by 10 · see citing works
Detect and Remove Watermark in Deep Neural Networks via Generative Adversarial Networks
Sun, S., Wang, H., Xue, M., Zhang, Y., Wang, J., & Liu, W. (2021) · Lecture notes in computer science · doi:10.1007/978-3-030-91356-4_18 · Cited by 10 · see citing works
Self-citationCopyright protection framework for federated learning models against collusion attacks
Luo, Y., Li, Y., Qin, S., Fu, Q., & Liu, J. (2024) · Information Sciences · doi:10.1016/j.ins.2024.121161 · Cited by 10 · see citing works
WAFFLE: Watermarking in Federated LearningPreprint
Atli, B. G., Xia, Y., Marchal, S., & Asokan, N. (2020) · arXiv (Cornell University) · doi:10.48550/arxiv.2008.07298 · Cited by 9 · see citing works
The Hidden Vulnerability of Watermarking for Deep Neural Networks.Preprint
Guo, S., Zhang, T., Qiu, H., Zeng, Y., Xiang, T., & Liu, Y. (2020) · arXiv (Cornell University) · Cited by 9 · see citing works
Secure Watermark for Deep Neural Networks with Multi-task LearningPreprint
Li, F., & Wang, S. (2021) · arXiv (Cornell University) · doi:10.48550/arxiv.2103.10021 · Cited by 9 · see citing works
Deep neural networks watermark via universal deep hiding and metric learning
Ye, Z., Zhang, X., & Feng, G. (2024) · Neural Computing and Applications · doi:10.1007/s00521-024-09469-5 · Cited by 8 · see citing works
Xue, M., Wang, X., Wu, Y., Ni, S., Zhang, L. Y., Zhang, Y., & Liu, W. (2024) · IEEE Transactions on Artificial Intelligence · doi:10.1109/tai.2024.3388389 · Cited by 7 · see citing works
Yang, X., Li, G., Zhou, K., Li, J., Lin, X., & Liu, Y. (2025) · IEEE Open Journal of Vehicular Technology · doi:10.1109/ojvt.2025.3550411 · Cited by 7 · see citing works
Attention Distraction: Watermark Removal Through Continual Learning with Selective Forgetting
Zhong, Q., Zhang, L. Y., Hu, S., Gao, L., Zhang, J., & Xiang, Y. (2022) · IEEE International Conference on Multimedia and Expo (ICME) · doi:10.1109/icme52920.2022.9858930 · Cited by 7 · see citing works
Persistence of Backdoor-Based Watermarks for Neural Networks: A Comprehensive Evaluation
Ngo, A. T., Heng, C. S., Chattopadhyay, N., & Chattopadhyay, A. (2025) · IEEE Transactions on Neural Networks and Learning Systems · doi:10.1109/tnnls.2025.3565170 · Cited by 6 · see citing works
SoK: How Robust is Image Classification Deep Neural Network Watermarking? (Extended Version)Preprint
Lukas, N., Jiang, E., Li, X., & Kerschbaum, F. (2021) · arXiv (Cornell University) · doi:10.48550/arxiv.2108.04974 · Cited by 6 · see citing works
Self-citationRobust Watermarking for Neural Network Models Using Residual Network
Wang, L., Wang, Z., Li, X., & Qin, C. (2022) · IEEE International Workshop on Multimedia Signal Processing (MMSP) · doi:10.1109/mmsp55362.2022.9949601 · Cited by 5 · see citing works
Self-citationModel authentication hashing: Identifying pirated neural network models
Xiong, C., Feng, G., Sun, Y., Qian, Z., Yao, H., & Qin, C. (2025) · Expert Systems with Applications · doi:10.1016/j.eswa.2025.127706 · Cited by 5 · see citing works
When NAS Meets Watermarking: Ownership Verification of DNN Models via Cache Side Channels.Preprint
Lou, X., Guo, S., Zhang, T., Zhang, Y., & Liu, Y. (2021) · arXiv (Cornell University) · Cited by 5 · see citing works
Invisible DNN Watermarking Against Model Extraction Attack
Xi, Z., Qu, Z., Lu, W., Luo, X., & Cao, X. (2024) · IEEE Transactions on Cybernetics · doi:10.1109/tcyb.2024.3514838 · Cited by 4 · see citing works
Enhancing Model Intellectual Property Protection With Robustness Fingerprint Technology
Yan, A., Ren, H., Mo, K., Zhang, Z., Wang, S., & Li, J. (2025) · IEEE Transactions on Information Forensics and Security · doi:10.1109/tifs.2025.3602244 · Cited by 4 · see citing works
A framework for deep neural network multiuser authorization based on channel pruning
Wang, L., Song, Y., Zhu, Y., Xia, D., & Han, G. (2023) · Concurrency and Computation Practice and Experience · doi:10.1002/cpe.7708 · Cited by 4 · see citing works
Watermark Removal Scheme Based on Neural Network Model Pruning
Gu, W. (2022) · International Conference on Machine Learning and Natural Language Processing (MLNLP) · doi:10.1145/3578741.3578832 · Cited by 4 · see citing works
RemovalNet: DNN Fingerprint Removal Attacks
Yao, H., Li, Z., Huang, K., Lou, J., Qin, Z., & Ren, K. (2023) · IEEE Transactions on Dependable and Secure Computing · doi:10.1109/tdsc.2023.3315064 · Cited by 4 · see citing works
Ogundokun, R. O., Abikoye, O. C., Sahu, A. K., Akinrotimi, A. O., Babatunde, A. N., Sadiku, P. O., & Olabode, O. J. (2024) · Springer eBooks · doi:10.1007/978-981-99-9803-6_1 · Cited by 4 · see citing works
Protecting Deep Learning Model Copyrights With Adversarial Example-Free Reuse Detection
Luan, X., Zhang, X., Wang, J., & Sun, M. (2025) · IEEE Transactions on Neural Networks and Learning Systems · doi:10.1109/tnnls.2025.3578664 · Cited by 3 · see citing works
Self-citationWatermarking PLMs on Classification Tasks by Combining Contrastive Learning with Weight Perturbation
Gu, C., Zheng, X., Xu, J., Wu, M., Zhang, C., Huang, C., Cai, H., & Huang, X. (2023) · Findings of the Association for Computational Linguistics: EMNLP (Findings of EMNLP) · doi:10.18653/v1/2023.findings-emnlp.239 · Cited by 3 · see citing works
Xue, M., Chen, K., Zhang, L. Y., Zhang, Y., & Liu, W. (2025) · IEEE Transactions on Information Forensics and Security · doi:10.1109/tifs.2025.3567915 · Cited by 3 · see citing works
MasterFace Watermarking for IPR Protection of Siamese Network for Face Verification
Guo, W., Tondi, B., & Barni, M. (2022) · Lecture notes in computer science · doi:10.1007/978-3-030-95398-0_13 · Cited by 3 · see citing works
Multipurpose Watermarking Approach for Copyright and Integrity of Steganographic Autoencoder Models
Wei, G., Chang, C., Bai, Y., Fan, Y., Tao, L., & Li, L. (2021) · Security and Communication Networks · doi:10.1155/2021/9936661 · Cited by 3 · see citing works
RetractedDeep Watermarking for Deep Intellectual Property Protection: A Comprehensive SurveyPreprint
Sun, Y., Liu, L., Yu, N., Liu, Y., Tian, Q. C., & Guo, D. (2024) · SSRN Electronic Journal · doi:10.2139/ssrn.4697020 · Cited by 3 · see citing works
Deep Neural Network Piration without Accuracy Loss
Ray, A., Jia, J., Saha, S., Chaudhuri, J., Gong, N. Z., & Chakrabarty, K. (2022) · International Conference on Machine Learning and Applications · doi:10.1109/icmla55696.2022.00172 · Cited by 2 · see citing works
Are you copying my prompt? Protecting the copyright of vision prompt for VPaaS via watermarking
Ren, H., Yan, A., Li, L., Zhang, Z., Li, N., & Gao, C.-Z. (2025) · Computer Standards & Interfaces · doi:10.1016/j.csi.2025.103992 · Cited by 2 · see citing works
Hiding Needles in a Haystack: Towards Constructing Neural Networks that Evade Verification
Berta, Á., Danner, G., Hegedűs, I., & Jelasity, M. (2022) · ACM Workshop on Information Hiding and Multimedia Security (IH&MMSec) · doi:10.1145/3531536.3532966 · Cited by 2 · see citing works
A watermark-based framework to actively protect deep neural networks
Luo, Y., Li, Y., Zhang, S., Liu, J., & Qin, S. (2024) · International Joint Conference on Neural Networks (IJCNN) · doi:10.1109/ijcnn60899.2024.10649924 · Cited by 1 · see citing works
Securing On-device Transformer with Hardware Binding and Reversible Obfuscation
Hua, P., Zhang, H., Li, T., & Zheng, Y. (2025) · Annual Computer Security Applications Conference · doi:10.1109/acsac67867.2025.00079 · Cited by 1 · see citing works
PlugMark: A Plug-In Zero-Watermarking Framework for Diffusion Models
Chen, P., Liu, Y., Gu, X., liu, E., Shang, Z., Ji, X., & Liu, W. T. (2025) · IEEE/CVF International Conference on Computer Vision (ICCV) · doi:10.1109/iccv51701.2025.01610 · Cited by 1 · see citing works
Medical Image Video Watermarking Using Deep Neural Network Technique
Jayamalar, T., & Krishnaveni, N. (2024) · International Conference on Emerging Trends in Information Technology and Engineering (ICETITE) · doi:10.1109/ic-etite58242.2024.10493610 · Cited by 1 · see citing works
Diffense: Defense Against Backdoor Attacks on Deep Neural Networks With Latent Diffusion
Hu, B., & Chang, C.-H. (2024) · IEEE Journal on Emerging and Selected Topics in Circuits and Systems · doi:10.1109/jetcas.2024.3469377 · Cited by 1 · see citing works
A Novel Watermarking Mechanism for Deep Learning Models based on Chaotic Boundaries
Huang, Z., Zhang, Y., & Jia, Y. (2021) · International Symposium on Medical Information and Communication Technology · doi:10.1109/ismict51748.2021.9434906 · Cited by 1 · see citing works
Data Protection in Big Data Analysis
Shafieinejad, M. (2021) · UWSpace (University of Waterloo)
Self-citationÇevik, M., Çakan, E. B., Şentürk, E. S., Çakmak, U. A., & Abdulkareem, M. I. (2023) · Advances in information security · doi:10.1007/978-3-031-49803-9_9
An Effective Model Copyright Protection for Federated Learning
Chen, J., Zhang, X., & Zheng, H. (2024) · Springer eBooks · doi:10.1007/978-981-97-0425-5_14
Data-free fingerprinting technology for biometric classifiers
Ren, Z., Duan, Y., Qi, Q., & Luo, L. (2025) · Computers & Security · doi:10.1016/j.cose.2025.104386
Trigger-Based Fragile Model Watermarking for Image Transformation Networks
Robinette, P. K., Nguyen, T., Sasaki, S., & Johnson, T. T. (2025) · Lecture notes in computer science · doi:10.1007/978-3-032-07884-1_18
Cross-Model Watermarking via Discriminative Samples for Secure Authentication
Zhao, J., Sun, Y., Yang, Z., Xu, C. X., Chen, H., Zhang, F., & Li, J. (2025) · ACM International Conference on Multimedia (ACM MM) · doi:10.1145/3746027.3755177
Efficient Binarized Neural Network Intellectual Property Protection
Chen, B., Zhang, J., Sun, Y., & Liu, L. (2025) · IEEE International Conference on Multimedia and Expo (ICME) · doi:10.1109/icme59968.2025.11210209
Beyond Robustness: On the Unforgeability Trade-offs in Statistical DNN Watermarking
Bui, P.-D., & Tran, T.-D. (2025) · International Conference on Cryptography and Information Security (VCRIS) · doi:10.1109/vcris68011.2025.11250570
Signature Feature Sequence for Model Reuse Detection
Zhang, W., Ye, Z., Liu, X., Wu, J., Feng, Z., & Lei, J. (2026) · Lecture notes in computer science · doi:10.1007/978-981-95-5693-9_29
Deep Embedding of QR Code Watermarks Using Dynamic-Scale Residual Fusion
Zhang, L., Shen, T., Jiang, T., & Wang, B. (2025) · International Symposium on Computer Engineering and Intelligent Communications (ISCEIC) · doi:10.1109/isceic67854.2025.11405559
Enhancing Copyright Protection in Federated Learning: A Hierarchical Watermarking Approach
Hou, W., Ge, Y., Zhang, W., & Li, Y. (2026) · IEEE Transactions on Emerging Topics in Computing · doi:10.1109/tetc.2026.3708428
Formal Foundations of Trigger-Based Watermarking
Calzavara, S., Cazzaro, L., Lucchese, C., & Orlando, S. (2026) · IEEE European Symposium on Security and Privacy · doi:10.1109/eurosp68448.2026.00088
SEW: Strengthening Robustness of Black-box DNN Watermarking via Specificity Enhancement
Qiu, H., Zhang, M., Sun, J., Chen, P., Zhang, X., & Yang, M. (2026) · ACM SIGKDD Conference on Knowledge Discovery and Data Mining (KDD) · doi:10.1145/3770854.3780272
Ma, Z., Xin, Z., Lu, Y., He, K., Li, Y., & Han, M. (2026) · IEEE International Conference on Software Services Engineering (SSE) · doi:10.1109/sse72781.2026.00034
Efficient and robust DNN model fingerprint with decision difference regions identification
Luo, T., Yang, Z., Dai, X., Wang, B., & Wang, W. (2026) · Applied Intelligence · doi:10.1007/s10489-026-07440-6
- Authors
- Shafieinejad, M., Lukas, N., Wang, J., Li, X., & Kerschbaum, F.
- Affiliations
- University of Waterloo (CA)
- Venue
- Proceedings of the 2021 ACM Workshop on Information Hiding and Multimedia Security
- Publisher
- ACM
- Published
- 2021-06-17
- Pages
- 177-188
- OpenAlex
- W2952348804
- Cited by
- 98
- References
- 51
- Citations by year
- 2026: 6 · 2025: 16 · 2024: 17 · 2023: 13 · 2022: 18 · 2021: 22 · 2020: 5 · 2019: 1
- FWCI
- 8.09
- Type
- conference paper
- Language
- en
- Open access
- green
- arxiv.org
- Locations
- ACM Workshop on Information Hiding and Multimedia Security (IH&MMSec) (publishedVersion)
- arXiv (Cornell University) (submittedVersion, cc-by)
- arXiv (Cornell University) (submittedVersion)
- arXiv (Cornell University) (cc-by)
- Topics
- Physical Sciences › Computer Science › Artificial Intelligence › Adversarial Robustness in Machine Learning
- Physical Sciences › Computer Science › Computer Vision and Pattern Recognition › Advanced Steganography and Watermarking Techniques
- Physical Sciences › Computer Science › Hardware and Architecture › Physical Unclonable Functions (PUFs) and Hardware Security
- Keywords
- deep neural network watermarking, watermark removal attacks, black-box attacks, white-box attacks, model theft
About these checks
Registry, retraction, Cites and statistics results are computed, not judged, with one exception: a printed reference that no index lists is read once by a model before it counts as a citation error. Claims are extracted by a model and kept only when their quote appears verbatim in the text; each cited source is then checked, with a model’s help, for whether it says what the claim relies on. Those verdicts can be wrong — read the claim’s quote and the cited source before relying on one.
Statistics and arithmetic are recomputed, not judged.
Confidence bands are shown only for fields calibrated on our annotated test set. None is calibrated yet, so no band is shown.
What counts as a claim ›How we measure confidence ›How we check this ›
Are you an author, or do you see a problem with this page? Request a review
