A high-load DNN watermarking scheme based on optimal embedding position

Watermarking is crucial for protecting the intellectual property of deep learning models, yet existing watermark embedding schemes fail to meet practical needs. Most white-box watermarking schemes directly select certain model parameters for embedding, lacking flexibility, while black-box watermarking schemes are inefficient and cannot provide sufficient watermark capacity for certain scenarios. Inspired by model compression theory, this paper proposes an efficient DNN watermark embedding scheme based on important weights. First, a small set of inputs is used to identify feature maps with high information content, and the weights corresponding to these feature maps often play a key role in the overall model performance. Then, the watermark is embedded into the model through regularization parameters, allowing real-time embedding during training. Experiments on multiple pre-trained models and related datasets show that this watermarking scheme can effectively resist various attacks, including model pruning and fine-tuning, with a watermark extraction rate of 100%, while maintaining the original model’s classification accuracy at the pre-watermark level. The results also demonstrate that if the original accuracy loss is limited to less than 0.5%, the watermark payload capacity can be significantly increased, providing an effective solution for scenarios requiring the embedding of a large amount of copyright information.