DeepiSign-G: Generic Watermark to Stamp Hidden DNN Parameters for Self-contained Tracking

Neural networks are parametrised functions $f_{\theta}:\mathbb{R}^{n}\mapsto\mathbb{R}^{m}$ map** a set of inputs $\mathcal{X}\in\mathbb{R}^{n}$ to a set of outputs $\mathcal{Y}\in\mathbb{R}^{m}$. The input and output dimensions depend on the model’s specified task. For example, neural networks have been widely applied for image classification problems. To classify images with 1024 features into 10 classes, the neural network would be a function map** $\mathbb{R}^{1024}\mapsto\mathbb{R}^{10}$. Typically, the parameters $\theta$ are learned through an iterative optimisation process such that the actual outputs of the network $\mathcal{Y}$ minimise an objective function $\mathcal{L}$ which compares $\mathcal{Y}$ to some desired output distribution $\hat{\mathcal{Y}}$. A large body of research exists surrounding this problem [32, 33].

Deep neural networks are functions built up of many layers, modelled loosely on the communication between neurons. Each layer $l_{i}$ consists of $n_{i}$ neurons, which receive input from neurons in the previous layer and produce an output. Broadly speaking, neurons from the previous layer are related to the neurons in the current layer by a set of weights $w_{i}$, and the outputs (also called activations) $a_{i}$ of the neurons at layer $i$ are calculated as $a_{i}=\phi(w_{i}a_{i-1}+b_{i})$, where $b_{i}$ is called the bias term and $\phi$ is a non-linear function such as the sigmoid function.

The exact way the neurons of different layers may be more complicated than the simple feedforward network we have just outlined. Convolutional neural networks (CNNs) [34, 35, 32, 36, 37] use the convolution operation in place of regular matrix multiplication. They share the weights that are applied to different parts of the output of the previous layer, which has proven to be powerful in capturing image features particularly. Recurrent neural networks (RNNs) model temporal relationships between objects in sequence inputs by maintaining a state vector which captures the history of all past elements in the sequence [32]. They perform particularly well for text domain tasks.

However, central to our approach in this paper is that DNNs can always be represented as operations between matrices of parameters. That is, a DNN is fully defined by its parameters and the structure between them.

The Walsh-Hadamard transform, which is widely studied in signal processing [38, 39] and data compression, decomposes a signal of $2^{m}$ numbers into a new domain, in a similar manner to the discrete Fourier transform. The resultant transform coefficients allow the original signal to be written as a superposition of Walsh functions, which are rectangular waves with values $+1$ or $-1$, each having unique sequency values, where sequency is half the average number of zero crossing per unit time  [40]. Thus, the Walsh-Hadamard transform breaks down the input signal into its constituent sequencies/frequencies in a similar manner to the Fourier transform breaking down signals into constituent frequencies. In particular, this transform is linear and symmetric, and maps $2^{m}$ real numbers $x$ into $2^{m}$ real numbers $y$ for some $m\in\mathbb{N}$. Thus, the transform can be represented as a $2^{m}\times 2^{m}$ matrix, which is called the Hadamard matrix $H_{m}$. $H_{m}$ can be defined recursively.

Since the transform is symmetric, the inverse Walsh-Hadamard transform is the same transform with rescaling.

Similar to the fast Fourier transform (FFT), there exists a Fast Walsh-Hadamard transform (FWHT) which operates in $O(n\log{n})$ time by breaking down the transform into two smaller transforms using the recursive definition above. Fast in-place implementations of the FWHT are also possible [41] [42]. The FWHT is desirable over the FFT for some applications as it requires less storage space and is faster to calculate because it only requires real additions and subtractions  [40].

In DeepiSign-G’s application framework, our primary scenario envisions a dynamic between a trusted DNN model vendor and a consumer. Here, the premise is that the vendor, utilizing their computational resources, trains the model, which upon deployment to the consumer, should remain unaltered by third parties. Essentially, only the vendor should have the right to make changes to the model. Within this context, it is imperative for the consumer to ascertain the model’s integrity and authenticity both before and during its operational lifecycle. Given the potential scenario where the vendor may lack direct access to the model post-deployment, verification processes need to be localized and automated on the consumer’s end.

This study investigates potential adversarial threats targeting the integrity of DNNs, which could manifest if an adversary gains access to the model. Such access could occur through insider manipulation of training data or direct modification of model parameters. Additionally, threats could arise from compromises on the consumer side. Such attacks could potentially alter the model’s intended behavior or diminish its performance which have been widely demonstrated in the literature [12, 13, 30, 31]. Our experiments, detailed in section VI, explore the spectrum of attacks that vary in complexity and control level over the model. This includes manipulation of training data, retraining capabilities, and direct modifications to model parameters, mirroring the assumption of comprehensive model access as suggested in prior research by Liu et al. [12].

We begin by outlining our design requirements, followed by a comprehensive overview of DeepiSign-G’s two main stages: embedding and retrieval/verification, as shown in Figure 2. The embedding stage consists of the following five key steps as depicted in Figure 3. (1) Preprocessing and randomly assigning parameters to transform blocks, (2) Walsh-Hadamard transform, (3) Integer representation of the Walsh-Hadamard, (4) Randomly choosing hiding locations, (5) Hiding bits and reversing the transformations. In the retrieval and verification stage, we elucidate the process of reversing the embedding stage. Additionally, we propose two innovative applications for DeepiSign-G in verification scenarios. (a) Its use as an integrity verification mechanism, (b) Its use as a self-contained metadata tracking mechanism. The following subsections provide a detailed explanation of each stage and its components.

The crucial requirement in designing a fragile watermarking technique is that the DNN performance is not impaired while being able to effectively detect modification to any parameters. Furthermore, given that we also propose DeepiSign-G as a self-contained mechanism to track model metadata by embedding it within the model itself, we aim to have sufficient capacity to hide a meaningful amount of information within the model. Here, we clearly define the desired qualities of our verification mechanism.

• •

  Integrity: Highly sensitive to any model modifications.

• •

  Tracking: The origin of the model and its training process can be verified from the watermark.

• •

  Capacity: A large amount of information can be embedded and distributed inside the model, allowing useful information to be stored.

• •

  Accuracy: There is no measurable depreciation in the model’s performance due to the embedded watermark.

• •

  Confidentiality: Only authorised parties should be able to retrieve the embedded watermark from the DNN using a key.

• •

  Invisibility: The watermark should be undetectable within the model parameters, ensuring the watermarked model utility while maintaining the same quality as the original.

• •

  Generalisability The mechanism should be independent of the neural network or task and should be broadly applicable.

With these design requirements in mind, we propose the following invisible watermarking mechanism that is fragile by design to be able to detect any modification. Broadly, the algorithm involves: (1) randomly assigning the model parameters to transform blocks; (2) randomly choosing which coefficients and which bits within coefficients to hide bits of the data to be embedded; (3) taking the Walsh-Hadamard transform and converting the Walsh-Hadamard coefficients to integers, (4) hiding the bits in the chosen places; (5) reversing the conversion by converting the coefficients back to floats before taking the inverse Walsh-Hadamard transform to obtain the new model parameters with the hidden data embedded. Each stage of the process is elaborated upon below.

To retrieve the hidden metadata, we perfectly reproduce the transform blocks and hiding locations as outlined in sections IV-C1, IV-C2, IV-C3, and IV-C4 above using the watermark key $k$. However, instead of hiding bits in the coefficients, we read the bits to reconstruct the hidden data. This retrieved information can be used to verify the model as well as the metadata of the model as follows.

We showcase the generalisability of DeepiSign-G by applying it to a range of models and datasets. Specifically, we test DeepiSign-G on several computer vision CNN models to highlight its effectiveness. Additionally, we demonstrate how DeepiSign-G can protect a text sentiment classifier model from text trojan attacks without any change to DeepiSign-G procedures. In the following, we provide a brief overview of the datasets and models utilized in our experiments.

We implemented the mechanism described in Section IV using the PyTorch [45] framework, such that it can be used on the wide range of models built from PyTorch parameters. In the following experiments, we utilised a maximum transform block size of 2048 for all models (detailed in Section IV-C1), and retained 5 significant figures of precision in the coefficient values throughout the process, which we found to be reasonable given that our models are using 32 bit floating point parameters. The hiding space for the embedded data was chosen to be the least significant 4 bits of the integer representation of the Walsh-Hadamard coefficients. To examine the concept, our implementation utilised a simple Mersenne-Twister PRNG-based scrambling algorithm to choose hiding spots for the message; however, as discussed in Section IV-C4, a more sophisticated algorithm could also be utilised. We chose to hide a bit in approximately 1% of coefficients, regardless of the model, relying on the properties discussed in Section IV-C2, and found empirically that this provided sufficient sensitivity to changes in model parameters. That is, the size of the embedded message was changed depending on the number of parameters in the model.

This section provides an overview of related works on attacks and defenses targeting DNN model integrity.

Watermarking for Integrity: Ensuring the integrity and authenticity of DNN models is critical. While IP watermarking focuses on ownership, methods for tracking model integrity are lacking. Our prior work [28] introduced the first fragile watermark for safeguarding the integrity and authenticity of models in computer vision tasks. He et al. [29] also investigated using generated sensitive samples to assess computer vision model integrity. However, both studies leave unanswered questions: i) are these methods applicable to other domains? ii) If so, how efficient are they? Our investigation suggests that these methods are tailored to computer vision, limiting their effectiveness in other domains, such as Natural language processing (RNN). This underscores the need for more generic and secure watermarking schemes independent of specific model architectures to accommodate a broader range of neural networks.