基于水印神经网络的可溯源DNN模型保护方法

针对深度神经网络（deep neural networks, DNN）模型安全与版权认证的问题，提出了一种多用户溯源的水印神经网络模型，通过密钥驱动生成水印图像，将其不可见地嵌入待保护目标模型的输出图像中，实现DNN模型的知识产权保护和版权追踪。在待保护的DNN模型中添加一种编解码器网络实现水印的嵌入，并使用双流篡改检测网络作为判别器，解决了模型的输出图像中可能出现的水印残留问题，提升了水印嵌入过程的不可感知性，减少了对DNN模型性能的影响，增强了安全性。此外，通过本文设计的双阶段训练法针对不同用户分发不同的含水印模型，当发生版权纠纷时，使用另一个残差网络可以从输出图像中提取水印图像。实验证明，本方法分发含水印的模型效率较高，并且即使对多个用户分发了嵌入相似水印图像的DNN模型，水印神经网络依然可以成功对模型进行溯源。

Traceable DNN Model Protection Based on Watermark Neural Network

This paper proposes a multi-user traceability watermarking neural network approach to model security and copyright certification for deep neural networks (DNN). The watermark is generated by the key driver and embedded invisibly in the output images of the DNN model, hence realizing the intellectual property protection and copyright tracking of DNN model. A codec network is added to the DNN model to embed the watermark, and a two-stream tamper detection network is used as the discriminator. Thus, the problem of residual watermark in the output images of the model is solved, which, reduces the impact on the performance of DNN model and enhances the security. In addition, a two-stage training method is proposed in this paper to distribute different watermarked models to different users. When copyright disputes occur, another residual network can be used to extract the watermark image from the output image. Experiments show that the proposed method is efficient in distributing watermarked models, and is able to trace the source of DNN models embedded with similar watermarked images for multiple users.