Black-box Lossless Fragile Watermarking Based on Hidden Space Search for DNN Integrity Authentication
Gejian Zhao, Chuan Qin · 2023
A lossless and fragile watermarking scheme based on black-box with hidden space search is proposed for DNN. This is a publicized remote verification scheme, any authorized party can generate and verify the watermark of the target model without knowing the internal situation of the model and only by the model ground-truth input and output results. Specifically, we generate some sensitive samples near the decision boundary of the target model and exploit these samples as the fingerprints of the model. Once these target models are attacked or tampered to a certain extent, the labels corresponding to these sensitive samples will be flipped, thus accomplishing the purpose of authentication. Experimental results show that the proposed scheme is sensitive to the some current common model attack schemes, and only a small number of sensitive samples are needed to efficiently identify whether the watermarked model is intact or not.