TATTOOED: A Robust Deep Neural Network Watermarking Scheme based on
  Spread-Spectrum Channel Coding
  The proliferation of deep learning applications in several areas has led to
the rapid adoption of such solutions from an ever-growing number of
institutions and companies. These entities' deep neural network (DNN) models
are often trained on proprietary data. They require powerful computational
resources, with the resulting DNN models being incorporated in the company's
work pipeline or provided as a service. Being trained on proprietary
information, these models provide a competitive edge for the owner company. At
the same time, these models can be attractive to competitors (or malicious
entities), which can employ state-of-the-art security attacks to obtain and use
these models for their benefit. As these attacks are hard to prevent, it
becomes imperative to have mechanisms that enable an affected entity to verify
the ownership of its DNN with high confidence. This paper presents TATTOOED, a
robust and efficient DNN watermarking technique based on spread-spectrum
channel coding. TATTOOED has a negligible effect on the performance of the DNN
model and is robust against several state-of-the-art mechanisms used to remove
watermarks from DNNs. Our results show that TATTOOED is robust to such removal
techniques even in extreme scenarios. For example, if the removal techniques
such as fine-tuning and parameter pruning change as much as 99% of the model
parameters, the TATTOOED watermark is still present in full in the DNN model
and ensures ownership verification.
