Protecting Intellectual Property of Deep Learning Models: A Structured Literature Review with Taxonomy of Watermarking Approaches

In recent years, machine learning (ML) techniques such as deep learning (DL) have played a vital role in many important applications in our lives, including but not limited to education, social media, and healthcare. Learning a model from scratch requires expensive hardware, considerable effort, specialized expertise, and a significant amount of time. The performance of these models depends on the quality and quantity of data (training data) provided to the model. Collecting and labeling data requires a significant amount of effort and time. Hence, training data is a valuable asset, and this makes us recognize that the ML model is a valuable IP while considering all ways to protect these models and ensure their use in compliance with applicable legislation and ethical rules related to privacy.

The idea of watermarking has been applied to multimedia content for decades to provide content authentication, tamper detection, and copyright protection [1, 2]. The basic watermarking techniques introduce covert information into the media and then use the information to verify ownership [3]. But these traditional approaches are not easily transferable to DNNs because they are fundamentally different from static media files and are multi-layered with millions of trainable parameters.

Several methods have emerged to protect model ownership verification, such as blockchain and hashing technologies, where the evidence is created when the parameters are given. In the previous technologies [4], a model plagiarizer may also generate evidence by using the same technologies, perhaps before the legitimate owner records the proof of ownership. The owner should create the evidence early during the learning process when the parameters of the model are yet to be defined [5].

The structured literature review (SLR) proposes a multiple-perspective taxonomy based on five attributes to classify and compare the most important existing works. The embedding phase is the primary direction in our taxonomy due to the lack of attention paid to it in previous works. However, the embedding phase is a foundation element and can determine many aspects of the watermarking scheme.

The remainder of SLR is organized as follows: Section 2 provides an overview of the preliminaries of deep neural network (DNN). Section 3 presents the requirements of DNN watermarking techniques. Section 4 presents the proposed taxonomy. Section 5 reviews the related works according to the proposed taxonomy. Section 6 introduces the challenges and suggestions for the future outlook. Section 7 is the conclusion.

Designing an effective digital watermark for protecting the IP of DNNs is a challenging task. Besides the fundamental trade-off between robustness, fidelity, and capacity, several other functional requirements must be considered.

Robustness: means the ability to correctly extract the embedded watermark even when the host model encounters a modification scenario. The modification may involve optimization or malicious purposes, and in both cases, the robustness must ensure the watermark persists. Below are two types of modifications that watermarking should be robust against.

1. Network pruning refers to a common strategy that includes element-wise pruning (weight pruning) and structural pruning (neuron pruning). Weight pruning is achieved by removing values below a certain threshold value, while neuron pruning aims to remove some neurons that are considered less important. Reducing overall complexity is always the goal behind this strategy to improve the efficiency of the models and make them more suitable for deployment in low-power devices [14].
2. Model adaptation is a broad term that includes both fine-tuning and transfer learning, two related but different concepts in DL. Fine-tuning, the model weights are partially or completely updated to adapt to a new task using a new dataset, while transfer learning can be called the reuse of knowledge across tasks, i.e., exploiting the knowledge embedded in a previously trained model for a new, different but related task rather than training it from scratch [15].

Fidelity: is an important factor that guarantees the presence of a watermark does not significantly affect the model performance, so high fidelity means imperceptibility for the watermark. Since DL models are important in many aspects of real life, if the protection scheme leads to a large deviation, it may affect the performance of the model and thus affect usability and reliability, so it is important to consider this property when designing watermarking schemes [16].

Capacity: means embedding watermark information into the host; high capacity is one of the most important factors in model protection and ownership verification, but this property can conflict with accuracy and robustness. Depending on the verification scheme, when only the watermark information is verified, this indicates a single-bit system, whereas when detailed information is extracted, it is a multi-bit system. Researchers have made many efforts in this area, for example, in the study [17], the authors designed a dual-embedded watermark model for efficient location identification and achieved a good result from the perspective of capacity, fidelity and robustness.

In the study [18], the authors proposed a watermarking scheme depending on optimal embedding locations by identifying the important weights that affect the model functions and using them for embedding during the training phase.

Security: The watermark does not leave noticeable imprints in the target model, so an unauthorized individual cannot identify the watermarked model from the unwatermarked one [19].

Generality: The watermarking scheme should apply to various architectures, datasets, verification scenarios, and computing platforms [20].

Integrity: Watermark integrity guarantees that unmarked models are not falsely identified as watermarked, consequently preventing misuse or false claims of ownership [21].

Efficiency: The computational cost of watermark embedding and extraction operations should be minimal and fast [20].

Reliability: The watermarking scheme should ensure accurate and consistent detection as well as prevent ownership disputes or false claims [19].

5.1 Embedding phase

5.1.1 Pre-training

In our classification, we consider any alteration in the data training or the model architecture before the training phase to be a pre-training phase, although we know that watermarking only becomes effective after training, and this provides a complementary perspective to existing taxonomies. The authors [22] propose a key-based protection method that involves block-wise pixel shuffling of the input images in the preprocessing stage. As a result, the model becomes unusable with an incorrect key. In the study [23], the authors propose a method to protect the IP of DNNs based on the chaotic encryption method by exchanging the positions of weights within the fully connected layer, instead of encrypting the weight values, while maintaining the model's accuracy and returning incorrect predictions when accessed without valid decryption keys. In the study [24], the authors propose a method to protect DNNs against forgery attacks by generating a series of specifically labeled trigger samples using a one-way watermark hash function. Then, during training, the model learns to associate the set of triggers with specific outputs, making it hard for an attacker to forge these trigger samples. In the study [25], the authors propose a method to protect the IP of DNN by converting the training image into a block-wise encrypted version with a secret key to embed the watermark information. This method is resistant to piracy attacks and does not require a special watermark trigger set.

We can conclude that these four previously mentioned works use data encryption as the core of their security strategy, with each of these methods using a secret-driven transformation to bind the model's behavior to the private key, while the following three works represent the change in the model architecture. The authors [26] propose a passport-based method to verify DNN ownership by adding a passport layer after each convolution layer. This method allows the model to perform well when verifying the passport; otherwise, the model's performance deteriorates. This method is robust against network tampering and ambiguity attacks, but the passport layer can impose an overhead. In the study [27], the authors propose a structure-based watermarking method by leveraging DNN channel pruning to embed the watermark instead of changing the parameters. To this end, watermark bits are split into several segments used to control a pruning rate and then applied to the convolutional layers model. By analyzing the channel pruning rate, the watermark can be retrieved for verification purposes. In the study [28], the authors propose a watermarking method by training a neural network called HufuNet, which is divided into two parts. The left part is embedded in the target model using a secret key and serves as a watermark, while the right part is kept by the owner and then combined with the extracted watermark to verify ownership. The final work in this section [29] is considered as a hash-based mechanism, and the authors present an approach for protecting the IP of image captioning models using two different embedding schemes by embedding the key in the hidden memory state of a recurrent neural network (RNN), Their embedding process ensures a paralyzed model with a forged key and resistance to removal and ambiguity attacks.

5.1.2 Training

Watermark embedding occurs during the model's initial training. To achieve this, labels, gradients, or specially designed loss functions must be modified, in which case the watermark becomes part of the model's internal behavior or parameters. The straightforward idea is to exploit the over-parameterized property in DNNs to embed the watermark. The first attempt to implement digital watermarking in a DNN model for protection purposes was made by Uchida et al. [20]. Their algorithm allows for embedding watermarks in the parameters and training the model with an additional regularization loss term. The authors [30] improve Uchida et al.’s method by using the host neural network and the independent neural network and trained them together. The second network is used to embed the watermark information in the host network; the watermarked network is released, while the independent network is kept secret. This work can’t avoid the ambiguity attack. In the study [31], the authors propose a method based on choosing a random set of model parameters as a watermark and during training, the weights/parameters are frozen. In this work, the loss function is intended to maximize the network's sensitivity to changes in the watermarked weights, which leads to increased capacity and robustness, which is the advantage of this method. In the study [32], the authors introduce an adversarial training to embed a robust and covert watermarking approach for a white-box scenario. They construct an automated approach through two-party competition, where the generator performs the watermarking process using an adversarial learning network, and the discriminator is a watermark detector. Instead of direct weight modification, authors [33] use the transformed weight modification in fully-connected layers of fine-tuned models to embed the watermark information using discrete cosine transform (DCT) and a quantization index modulation (QIM) instead of a loss function, and their method ensures less weight value modification and less impact on model performance. In the study [19], the authors propose a watermarking framework named DeepSigns based on dynamic content (activations), which is both data and model-dependent and supports both white-box and black-box scenarios to protect the IP of DNNs. During training, DeepSigns embeds the watermark gradually using the probability density functions of the activation set. Access to model parameters is required in white-box verification, while in the second scenario, a set of inputs is used to trigger the watermark information remotely.

Depending on the properties of DNN, which is represented by the non-convex optimization problem and the over-parameterization, which leads to more than one solution, the authors [34] propose a method that is the first to exploit the gradient of the cross-entropy cost function to embed the owner’s signature. This method is considered a black-box verification since it allows remote verification of the watermark using a prediction API. In the study [35], the authors present a method to verify model ownership by inserting external features based on style transfer instead of training image features as trigger input; their approach cannot be used in a real-world API because the set of triggers uses abstract patterns instead of valid images, which is a constraint. In the study [36], the authors propose watermarking framework for image transformation network where both the inputs and the outputs are images, the host neural network and the watermark extraction network are trained together using a combined loss function, the output from the watermarked model also includes a watermark, so in this method in addition to identifies the copyright of the original neural network it also verifies whether the image is generated by original neural network. In addition to the above techniques, the backdooring technique is commonly used for embedding a watermark into a behavioral model's response to a carefully designed trigger set. This method is hidden during normal use and can be activated later to verify ownership. The works below in this section are backdoor-based watermarking. In the study [37], the authors propose a method to implant and learn three types of watermark key generation at the training phase, which are then used as the watermark trigger set. The key generation algorithm involves training data with additional meaningful content, choosing irrelevant images from another dataset, and overlaying images with random noise. In the study [38], the authors propose a method to resist autoencoders that can remove critical samples. Their method uses unmodified training images as a key but gives them different labels than the original prediction. To overcome the modification processing, they use exponential weights in their work, where the predictions are based on large absolute values.

To overcome watermarking techniques that are represented by inserting outlier input-output pairs as a watermark into a model, the authors in the study [39] propose a technique called entangled watermarking embedding (EWE), which allows the model to learn the classification task with watermarks encoding together, and as a result, any attempt to remove the watermarks degrades the performance of the model. In the study [40], the authors propose a method to protect the IP of DNNs where trigger samples at the classification boundary are automatically generated using conditional generative adversarial networks (CGAN) and leverage chaotic automatic annotation for labeling in the training phase. during verification, the predictions on the trigger set are matched to the chaotic label. Their method is resistant to various attacks and maintains the model's performance.

5.1.3 Post-training

The "post-training" phrase refers to applying watermarking techniques after a model has already been trained, and this is done through weight modification, fine-tuning, or parameter encryption. This approach is compatible with pre-trained or externally sourced models, allowing for efficient and flexible integration without the need to retrain models from scratch. One mechanism used in post-training is backdoors, where this technique, as in all watermarking techniques, consists of two stages: embedding and verification. In the first stage, the owner embeds the backdoor and maintains the functionality of the model, while in the second stage, the validation samples can be used in the verification stage. The authors in the study [41] present an example of watermarking-based backdoors in post-training to protect the IP of DNNs where the embedding process is applied at the API level to predict by changing a small portion of the query responses which results in the watermark being embedded in any surrogate models trained through the API query, and the model owner can confirm the presence of the watermark in any suspected surrogate method by querying it and comparing the prediction to backdoor tags.

In the study [42], the authors propose a robust DNN watermarking framework based on a bi-level optimization approach. The inner loop produces robust watermark exemplars while the outer loop maintains the model functionality by optimizing the model parameters using a masked adaptive approach. Their work focuses on modifying a small subset of parameters to minimize the watermarking overhead.

In other works, the authors also exploit fine-tuning as a post-training technique by slightly updating a pre-trained model with a small set of tailored inputs.  Embedding is performed by changing the model's behavior and maintaining its performance without retraining it from scratch. To protect the IP of generative adversarial networks (GANs), the authors in the study [43] propose a supervised watermarking method to ensure that all images generated by GANs include an invisible watermark and can be extracted for verification purposes through pre-trained decoders. The embedding is done by fine-tuning a fully pre-trained GAN instead of retraining it from scratch; this results in reduced computation, the model retains its performance, and it is scalable to complex models. In the study [44], the authors introduce watermarking approach using adversarial examples as the watermark key and this lead an alteration in classifier decision boundary to specific shape when attaching a small perturbation to the input example and as a result an incorrect prediction is the output of the modified example. In the study [45], the authors propose a Pivotal Tuning watermarking method for a pre-trained image generator such as StyleGAN2 and StyleGAN3 as a post-processing step, which reduces the time compared to retraining from scratch. In the study [46], the authors utilize encryption as a technique to encode a few parameters with the most significant impact on model performance using adversarial perturbation. During encryption, a secret key is generated and only authorized users are allowed to decrypt and use the model. In the study [47], the authors propose a framework to protect the IP of the model and resist attacks from surrogate models using spatial invisible watermarks to embed watermarks into the resulting images using sub-networks for embedding and extraction. In the study [48], the authors propose an embedding method by encoding and spreading the trained model’s weight information through a wide range of weights. Code division multiple access (CDMA) is used to embed the watermark information directly into the model weights.

5.2 Scenario

5.2.1 Whit-Box

This scenario allows the verifier to verify or extract watermarks by directly examining the model's internal parameters. Many works rely on directly embedding recognizable values into the model parameters, requiring these parameters to be examined to retrieve watermarks, as introduced in the studies [27, 31, 48]. Other works are key-based methods that rely on secret encryption or decryption keys to protect and verify ownership, as in the study [23]. Other types are extractor-based methods that involve an extractor trained with the host model to learn for extraction, as shown in the studies [30, 32].

Most works in this scenario are multi-bit watermarks and are verified by extracting a message containing bits, while in zero-bit watermarks [23], verification is achieved by a binary decision to confirm the presence of a specific watermark. Although this scenario forms a powerful foundation for ownership verification, it requires the verifier to access internal model parameters, making it difficult to implement in real life, such as in a cloud-based application where the model is accessed via APIs.

5.2.2 Black-Box

In this scenario, the verifier can only interact with the model via its prediction API and observe the model's responses to specific queries, which means that the verifier does not have access to the internal model’s parameters or architecture. The idea behind this scenario is to embed watermarks by initializing specific trigger sets. Pairs of inputs and labels are uniquely designed to derive specific, variable outputs, and then these trigger sets are used for verification remotely.

Black-box techniques range from label modification as in the studies [24, 40, 41] to label transformation within training data [22, 25] and injecting adversarial or synthetic inputs as in the studies [37, 42, 44].

5.2.3 Gray-Box

A hybrid approach to watermarking and a dual-level integration between white-box embedding and black-box validation, it combines characteristics from two scenarios, making use of the white box access to embed a watermark directly in the model's internal structure, and relying on black-box access to verify ownership by querying the model externally and observing the model's behavior. Unlike the traditional black-box scenario, which relies on creating external trigger sets for validation, the gray-box encodes the watermark into the model's behavior, and validation is achieved through patterns in output predictions or statistical analysis. The best example of this scenario is the work in the study [28], where the authors use two neural network slices and rely on model reconstruction and accuracy comparison as a new verification methodology that differs from the methodology used in the black-box scenario. Many works functionally perform a hybrid approach, but not all are classified as gray-box since they often use traditional backdoors and trigger sets. The work in the study [34] is an example of work that can be considered a gray-box functionally.

5.2.4 No-Box

This is an emerging scenario in IP protection. This model allows verification of ownership without direct interaction with the model itself and does not require internal access or API queries. This model can be seen in the studies [45, 46], where the verification in these works is no-Box.

5.3 Type

The widespread use of DNNs in many vital sectors of our daily lives has raised concerns about their IP protection. A well-trained model is considered a significant investment of resources, including the massive data used in training, computational power, and expert knowledge. Therefore, safeguarding these models against illegal copying and redistribution has become a vital challenge at present. IP protection of DNNs can be categorized into active and passive, and each type is subdivided as shown in Figure 4.

5.3.1 Active DNN IP protection

Active IP protection for DNNs refers to a proactive mechanism designed to prevent and directly influence the model's behavior under unauthorized use. This type of protection can be divided into DNN authentication and inference perturbation. The former focuses on authorized use of the model, ensuring legitimate users have a valid authentication key, while preventing unauthorized users, significantly degrading model performance, as in the studies [22, 23, 26, 29].

Unlike DNN authentication, inference perturbation introduces controlled noise or distortions into API outputs during inference, to degrade the stolen model's performance and defend deployed models from extraction attacks. This type is suitable in an MLaaS setting, as in the study [41].

5.3.2 Passive DNN IP protection

Passive IP protection for DNNs refers to a reactive mechanism focusing on ownership verification after IP violation is observed, rather than actively blocking unauthorized usage during deployment. It embeds hidden proofs into the model's parameter or functional behavior, and depending on the embedding location, this type of protection can be divided into static and dynamic. In static passive protection, the ownership information is embedded into fixed elements such as weight or internal parameters, as in the studies [20, 27, 28, 30, 33, 40, 44, 48]. In contrast, in dynamic passive protection, the embedding is performed into the model's behavior as in the studies [19, 24, 25, 34, 37].

Table 1. Attribute combination matrix: Verification scenario vs. Active/Passive

The passive type is suitable for supporting robust legal evidence in cases of IP violation. Active and passive protection are independent of verification scenarios; any combination is possible, demonstrating that these attributes are orthogonal dimensions, as shown in Table 1.

5.4 Capacity

Depending on the accessibility that allows extracting embedded information from the model's parameters in a white-box setting that supports high watermark capacity. In contrast, black-box verification is often a zero-bit watermarking scheme. As shown in Table 2, many of the works that are based on black-box verification are zero-bit watermarking, and this is due to limited access in this scenario to only the API, and mostly depend on trigger-based or behavior-based watermarking. However, some progressive methods have proven that it is possible to extract multiple bits of a watermark in a black-box scenario, such as in [24, 36, 37, 47].

Table 2. Comparison of existing IP protection methods for deep neural network (DNN) models

5.5 Protected content

The objective model for most watermarking methods is often a classification model, as shown in Table 2; despite that, many works support various targets such as image processing models, image captioning models, and image generation models.

The authors of the study [29] introduce a method for protecting an image captioning model by embedding a secret key in the hidden memory state of the RNN. a task-agnostic frameworks in two works [36, 47] present progress in IP protection for generative and transformation models that perform image processing tasks by embedding a watermark directly into the resulting image. For protecting image synthesis models, the authors [43, 45] introduce strategies for ownership verification via image-based watermark extraction.

With the increasing innovation of DNNs in AI-driven industries, protecting DNNs is still a crucial matter, especially when MLaaS is deployed. Hence, IP protection of DNN models becomes an important issue. This SLR's proposed taxonomy has been created on the basis of a five-attribute taxonomy: the embedding phase, verification scenario, protection type, capacity, and protected content. The taxonomy is structured mainly at the embedding phase, as this is the main concept of the taxonomy.

From Table 2, many of the existing methods are white-box watermarking methods and passive, and classification models. There are still several crucial limitations to consider, such as the absence of proactive protection mechanisms and insufficient multi-bit support in a black-box setting, as well as limited generative models and image processing networks. Based on this taxonomic analysis, we list three concrete research directions: (1) new active protection strategies that can prevent the use of the content without authorization, a task different from verification of ownership; (2) in black-box situations, using multi-bit watermarking with probability distribution encoding, ensemble trigger subsets, and gradient-free optimization; (3) extending watermarking to non-classification models, such as generative adversarial networks and large language models.