Image processing networks have gained great success in many fields,and thus the issue of copyright protection for image processing networks hasbecome a focus of attention. Model watermarking techniques are widely used...Image processing networks have gained great success in many fields,and thus the issue of copyright protection for image processing networks hasbecome a focus of attention. Model watermarking techniques are widely usedin model copyright protection, but there are two challenges: (1) designinguniversal trigger sample watermarking for different network models is stilla challenge;(2) existing methods of copyright protection based on trigger swatermarking are difficult to resist forgery attacks. In this work, we propose adual model watermarking framework for copyright protection in image processingnetworks. The trigger sample watermark is embedded in the trainingprocess of the model, which can effectively verify the model copyright. And wedesign a common method for generating trigger sample watermarks based ongenerative adversarial networks, adaptively generating trigger sample watermarksaccording to different models. The spatial watermark is embedded intothe model output. When an attacker steals model copyright using a forgedtrigger sample watermark, which can be correctly extracted to distinguishbetween the piratical and the protected model. The experiments show that theproposed framework has good performance in different image segmentationnetworks of UNET, UNET++, and FCN (fully convolutional network), andeffectively resists forgery attacks.展开更多
Watermarking is a technique for labeling digital pictures by hiding secret information into images. Watermark embedding is a method to discourage unauthorized copying and identify the owner or distributor of digital d...Watermarking is a technique for labeling digital pictures by hiding secret information into images. Watermark embedding is a method to discourage unauthorized copying and identify the owner or distributor of digital data. In this paper, a new method is proposed. The watermark is processed as a visually recognizable pattern-binary image, which includes more information than the traditional symbol or ID number and is "extracted" instead of only "detected" to characterize the owner. The watermark is hidden in the host image by selectively modifying the middle-frequency part of the host image in conjunction with the human visual system(HVS) and the image discrete cosine transform(DCT). The experimental results show that this method can survive image cropping and image compression, and get better results, this is also a prospective method.展开更多
高精度联邦学习模型的训练需要消耗大量的用户本地资源,参与训练的用户能够通过私自出售联合训练的模型获得非法收益.为实现联邦学习模型的产权保护,利用深度学习后门技术不影响主任务精度而仅对少量触发集样本造成误分类的特征,构建一...高精度联邦学习模型的训练需要消耗大量的用户本地资源,参与训练的用户能够通过私自出售联合训练的模型获得非法收益.为实现联邦学习模型的产权保护,利用深度学习后门技术不影响主任务精度而仅对少量触发集样本造成误分类的特征,构建一种基于模型后门的联邦学习水印(federated learning watermark based on backdoor,FLWB)方案,能够允许各参与训练的用户在其本地模型中分别嵌入私有水印,再通过云端的模型聚合操作将私有后门水印映射到全局模型作为联邦学习的全局水印.之后提出分步训练方法增强各私有后门水印在全局模型的表达效果,使得FLWB方案能够在不影响全局模型精度的前提下容纳各参与用户的私有水印.理论分析证明了FLWB方案的安全性,实验验证分步训练方法能够让全局模型在仅造成1%主任务精度损失的情况下有效容纳参与训练用户的私有水印.最后,采用模型压缩攻击和模型微调攻击对FLWB方案进行攻击测试,其结果表明FLWB方案在模型压缩到30%时仍能保留80%以上的水印,在4种不同的微调攻击下能保留90%以上的水印,具有很好的鲁棒性.展开更多
基金supported by the National Natural Science Foundation of China under grants U1836208,by the Priority Academic Program Development of Jiangsu Higher Education Institutions (PAPD)fundby the Collaborative Innovation Center of Atmospheric Environment and Equipment Technology (CICAEET)fund,China.
文摘Image processing networks have gained great success in many fields,and thus the issue of copyright protection for image processing networks hasbecome a focus of attention. Model watermarking techniques are widely usedin model copyright protection, but there are two challenges: (1) designinguniversal trigger sample watermarking for different network models is stilla challenge;(2) existing methods of copyright protection based on trigger swatermarking are difficult to resist forgery attacks. In this work, we propose adual model watermarking framework for copyright protection in image processingnetworks. The trigger sample watermark is embedded in the trainingprocess of the model, which can effectively verify the model copyright. And wedesign a common method for generating trigger sample watermarks based ongenerative adversarial networks, adaptively generating trigger sample watermarksaccording to different models. The spatial watermark is embedded intothe model output. When an attacker steals model copyright using a forgedtrigger sample watermark, which can be correctly extracted to distinguishbetween the piratical and the protected model. The experiments show that theproposed framework has good performance in different image segmentationnetworks of UNET, UNET++, and FCN (fully convolutional network), andeffectively resists forgery attacks.
基金Acknowledgements： The work is supported by China＇s National Natural Science Foundation （No. 60573141）, China＇s Project 863 （No. 2004AA775053, No. 2005AA775050）, the High Technique Research Plan of Jiangsu Province （No. BG2005037） and ＂The Six Heights of Talent＂ Program of Jiangsu Province.
基金Supported by the National Natural Science Foundation of China(No.69973018)
文摘Watermarking is a technique for labeling digital pictures by hiding secret information into images. Watermark embedding is a method to discourage unauthorized copying and identify the owner or distributor of digital data. In this paper, a new method is proposed. The watermark is processed as a visually recognizable pattern-binary image, which includes more information than the traditional symbol or ID number and is "extracted" instead of only "detected" to characterize the owner. The watermark is hidden in the host image by selectively modifying the middle-frequency part of the host image in conjunction with the human visual system(HVS) and the image discrete cosine transform(DCT). The experimental results show that this method can survive image cropping and image compression, and get better results, this is also a prospective method.
文摘高精度联邦学习模型的训练需要消耗大量的用户本地资源,参与训练的用户能够通过私自出售联合训练的模型获得非法收益.为实现联邦学习模型的产权保护,利用深度学习后门技术不影响主任务精度而仅对少量触发集样本造成误分类的特征,构建一种基于模型后门的联邦学习水印(federated learning watermark based on backdoor,FLWB)方案,能够允许各参与训练的用户在其本地模型中分别嵌入私有水印,再通过云端的模型聚合操作将私有后门水印映射到全局模型作为联邦学习的全局水印.之后提出分步训练方法增强各私有后门水印在全局模型的表达效果,使得FLWB方案能够在不影响全局模型精度的前提下容纳各参与用户的私有水印.理论分析证明了FLWB方案的安全性,实验验证分步训练方法能够让全局模型在仅造成1%主任务精度损失的情况下有效容纳参与训练用户的私有水印.最后,采用模型压缩攻击和模型微调攻击对FLWB方案进行攻击测试,其结果表明FLWB方案在模型压缩到30%时仍能保留80%以上的水印,在4种不同的微调攻击下能保留90%以上的水印,具有很好的鲁棒性.
