DeepAW: A Customized DNN Watermarking Scheme Against Unreliable Participants

Training DNNs requires large amounts of labeled data, costly computational resources, and tremendous human effort, resulting in such models being a valuable commodity. In collaborative learning scenarios, unreliable participants are widespread due to data collected from a diverse set of end-users that differ in quality and quantity. It is important to note that failure to take into account the contributions of all participants in the collaborative model training process when sharing the model with them could potentially result in a deterioration in collaborative efforts. In this paper, we propose a customized DNN watermarking scheme to safeguard the model ownership, namely <italic xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">DeepAW</i>, achieving robustness to model stealing attacks and collaborative fairness in the presence of unreliable participants. Specifically, <italic xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">DeepAW</i> leverages the tightly binding between the embedded watermarking and the model performance to defend against the model stealing attacks, resulting in the sharp decline of the model performance encountering any attempt at watermarking modification. <italic xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">DeepAW</i> achieves collaborative fairness by detecting unreliable participants and customizing the model performance according to the participants' contributions. Furthermore, we set up three model stealing attacks and four types of unreliable participants. The experimental results demonstrate the effectiveness, robustness, and collaborative fairness of <italic xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">DeepAW</i>.