Neural network watermarking
Training a neural network and embedding a watermark in the network to prove ownership. The network includes a plurality of trainable parameters associated with network nodes in which the plurality of trainable parameters is split into a first set of trainable parameters and a second set of trainable parameters. A first set of training samples is input to the network and the network is trained by iterating the first set of samples through the network to update the first set of parameters and hindering the second set of parameters to be updated during iteration of the first set of samples. A second set of samples is input and the watermark is embedded by iterating the second set of samples through the network to update the second set of parameters and hindering the first set of parameters to be updated during iteration of the second set of samples.
1. A method for training a neural network and embedding a watermark in the neural network, the watermark for proving ownership of the neural network, the neural network comprising a plurality of trainable parameters associated with a number of network nodes, the method comprising:
splitting the plurality of trainable parameters into a first set of trainable parameters and a second set of trainable parameters;
inputting a first set of training samples to the neural network;
training the neural network by iterating the first set of training samples through a neural self learning network to update the first set of trainable parameters and preventing the second set of trainable parameters from being updated during iteration of the first set of training samples;
inputting a second set of training samples, to the neural network; and
embedding the watermark by iterating the second set of training samples through the neural network to update the second set of trainable parameters and preventing the first set of trainable parameters from being updated during iteration of the second set of training samples.
2. The method according to claim 1 , wherein the first set of trainable parameters and the second set of trainable parameters form parallel layers in the neural network, and wherein the method further comprises iterating the first set of training samples and the second set of training samples through the respective set of trainable parameters in sequence.
3. The method according to claim 1 , further comprising:
choosing the second set of training samples to comprise a first number of training samples; and
choosing the second set of trainable parameters to comprise a second number of trainable parameters, wherein the first number is smaller than the second number.
4. The method according to claim 1 , wherein the first set of training samples comprises general training samples for training the neural network, and wherein the second set of training samples comprises training samples for watermarking.
5. The method according to claim 4 , further comprising training the neural network to associate the training samples for watermarking of the second set of training samples with an unexpected class.
6. The method according to claim 1 , wherein the second set of training samples comprises training samples from the first set of training samples.
7. The method according to claim 1 , wherein the second set of training samples comprises training samples from the first set of training samples that have been misclassified by the neural network during iteration of the first set of training samples.
8. The method according to claim 1 , wherein the second set of training samples comprises training samples unrelated to the first set of training samples.
9. The method according to claim 1 , wherein the second set of training samples comprises training samples formed by noise.
10. The method according to claim 1 , further comprising iterating the second set of training samples through the second set of trainable parameters until a classification confidence associated with the second set of training samples is above a confidence threshold.
11. The method according to claim 1 , further comprising extracting the embedded watermark by:
inputting at least one key sample to the neural network, wherein the at least one key sample is associated with the embedded watermark; and
evaluating an output from the neural network by performing at least one of:
determining that a confidence value associated with the output of the at least one key sample inputted to the neural network is above a confidence threshold; and
determining that a predetermined subset of network nodes of the number of network nodes are activated when the at least one key sample is inputted to the neural network.
12. A non-transitory computer readable storage medium having stored thereon a computer program comprising program instructions configured to be loadable into a data-processing unit, comprising a processor and a memory associated with or integral to the data-processing unit, when loaded into the data-processing unit, the computer program is configured to be stored in the memory, the computer program, when loaded into and run by the processor is configured to perform a method for training a neural network and embedding a watermark in the neural network, the watermark for proving ownership of the neural network, the neural network comprising a plurality of trainable parameters associated with a number of network nodes, the method comprising:
splitting the plurality of trainable parameters into a first set of trainable parameters and a second set of trainable parameters;
inputting a first set of training samples to the neural network;
training the neural network by iterating the first set of training samples through the neural self learning network to update the first set of trainable parameters and preventing the second set of trainable parameters from being updated during iteration of the first set of training samples;
inputting a second set of training samples, to the neural network; and
embedding the watermark by iterating the second set of training samples through the neural network to update the second set of trainable parameters and preventing the first set of trainable parameters from being updated during iteration of the second set of training samples.
13. An apparatus for training a neural network and embedding a watermark in the neural network, the watermark for proving ownership of the neural network, the neural network comprising a plurality of trainable parameters associated with a number of network nodes, the apparatus comprising a controller configured to cause:
splitting of the plurality of trainable parameters into a first set of trainable parameters and a second set of trainable parameters;
inputting of a first set of training samples to the neural network;
training of the neural network by iteration of the first set of training samples through the neural self learning network to update the first set of trainable parameters and preventing the second set of trainable parameters from being updated during iteration of the first set of training samples;
inputting of a second set of training samples, to the neural network; and
embedding of the watermark by iteration of the second set of training samples through the neural network to update the second set of trainable parameters and preventing the first set of trainable parameters from being updated during iteration of the second set of training samples.
14. The apparatus according to claim 13 , wherein the first set of trainable parameters and the second set of trainable parameters form parallel layers in the neural network and wherein the controller is further configured to cause iteration of the first set of training samples and the second set of training samples through the respective set of trainable parameters in sequence.
15. The apparatus according to claim 13 , wherein the controller is further configured to cause:
choosing of the second set of training samples to comprise a first number of training samples; and
choosing of the second set of trainable parameters to comprise a second number of trainable parameters, wherein the first number is smaller than the second number.
16. The apparatus according to claim 13 , wherein the first set of training samples comprises general training samples for training the neural network, and wherein the second set of training samples comprises training samples for watermarking.
17. The apparatus according to claim 13 , wherein the controller is further configured to cause training of the neural network to associate the training samples for watermarking of the second set of training samples with an unexpected class.
18. The apparatus according to claim 13 , wherein the second set of training samples comprises training samples from the first set of training samples.
19. The apparatus according to claim 13 , wherein the second set of training samples comprises training samples from the first set of training samples that have been misclassified by the neural network during iteration of the first set of training samples.
20. The apparatus according to claim 13 , wherein the second set of training samples comprises training samples unrelated to the first set of training samples.
21. The apparatus according to claim 13 , wherein the second set of training samples comprises training samples formed by noise.
22. The apparatus according to claim 13 , wherein the controller is further configured to cause iteration of the second set of training samples through the second set of trainable parameters until a classification confidence associated with the second set of training samples is above a confidence threshold.
23. The apparatus according to claim 13 , wherein the controller is further configured to cause inputting of at least one key sample to the neural network, wherein the at least one key sample is associated with the embedded watermark and to evaluate an output from the neural network by performing at least one of:
determination of that a confidence value associated with the output of the at least one key sample inputted to the neural network is above a confidence threshold; and
determination of that a predetermined subset of network nodes of the number of network nodes are activated when the at least one key sample is inputted to the neural network.