Protecting the Intellectual Properties of Deep Neural Networks with an
  Additional Class and Steganographic Images
  Recently, the research on protecting the intellectual properties (IP) of deep
neural networks (DNN) has attracted serious concerns. A number of DNN copyright
protection methods have been proposed. However, most of the existing
watermarking methods focus on verifying the copyright of the model, which do
not support the authentication and management of users' fingerprints, thus can
not satisfy the requirements of commercial copyright protection. In addition,
the query modification attack which was proposed recently can invalidate most
of the existing backdoor-based watermarking methods. To address these
challenges, in this paper, we propose a method to protect the intellectual
properties of DNN models by using an additional class and steganographic
images. Specifically, we use a set of watermark key samples to embed an
additional class into the DNN, so that the watermarked DNN will classify the
watermark key sample as the predefined additional class in the copyright
verification stage. We adopt the least significant bit (LSB) image
steganography to embed users' fingerprints into watermark key images. Each user
will be assigned with a unique fingerprint image so that the user's identity
can be authenticated later. Experimental results demonstrate that, the proposed
method can protect the copyright of DNN models effectively. On Fashion-MNIST
and CIFAR-10 datasets, the proposed method can obtain 100% watermark accuracy
and 100% fingerprint authentication success rate. In addition, the proposed
method is demonstrated to be robust to the model fine-tuning attack, model
pruning attack, and the query modification attack. Compared with three existing
watermarking methods (the logo-based, noise-based, and adversarial frontier
stitching watermarking methods), the proposed method has better performance on
watermark accuracy and robustness against the query modification attack.
