A simultaneous dual watermarking scheme for deep learning models

Watermarking technology has become the prime approach for protecting intellectual property (IP) rights of deep learning models (DLM). However, the existing methods only focus on the single watermark format, which cannot simultaneously protect the IP rights of both buyers (users) and sellers (developers). After the model has been redistributed or customized, if the traded model only contains the seller’s watermark, the buyer cannot prove their ownership of the model. Conversely, if the model only contains the buyer’s watermark, it is difficult to trace its source when the model is stolen or illegally distributed. Therefore, we proposed a simultaneous dual watermarking scheme. Dual watermarks consist of two different trigger sets. Two trigger sets and original datasets are used together as the training set. In particular, the features among the three datasets exhibit a perpendicular relationship. Therefore, this relationship will not affect the model performance. In the proposed scheme, the two trigger sets are constructed by annotation with different chaotic sequences. Due to the sensitivity to the initial value, unpredictability, and non-periodicity of chaos, different initial values produce significantly different chaotic sequences. It guarantees a vertical relationship between features of the three dataset. Statistical analysis indicates that the watermark does not affect the decision boundaries of the DLM and does not show significant statistical characteristics. The experimental results indicate that, compared to other methods, the proposed scheme has superior effectiveness, fidelity, integrity, and robustness against fine-tuning attacks, overwriting attacks, and fraudulent ownership claim attacks.