论文标题
关于神经网络模型水印的系统评价
A Systematic Review on Model Watermarking for Neural Networks
论文作者
论文摘要
机器学习（ML）模型应用于越来越多的域。大量数据和计算资源的可用性鼓励了越来越复杂和有价值的模型的发展。这些模型被认为是训练有素的合法政党的知识产权，这使他们免受窃取，非法重新分配和未经授权的应用程序的保护是迫切需要的。数字水印提出了标记模型所有权的强大机制，从而为这些威胁提供了保护。这项工作提出了一种分类法，以识别和分析ML模型的不同类别的水印方案。它引入了统一的威胁模型，以允许在不同情况下的水印方法的有效性进行结构化推理和比较。此外，它将预期的安全要求和针对ML模型水印的攻击系统化。基于该框架，对该领域的代表文献进行了调查，以说明分类学。最后，讨论了现有方法的缺点和一般局限性，并给出了未来研究方向的前景。
Machine learning (ML) models are applied in an increasing variety of domains. The availability of large amounts of data and computational resources encourages the development of ever more complex and valuable models. These models are considered intellectual property of the legitimate parties who have trained them, which makes their protection against stealing, illegitimate redistribution, and unauthorized application an urgent need. Digital watermarking presents a strong mechanism for marking model ownership and, thereby, offers protection against those threats. This work presents a taxonomy identifying and analyzing different classes of watermarking schemes for ML models. It introduces a unified threat model to allow structured reasoning on and comparison of the effectiveness of watermarking methods in different scenarios. Furthermore, it systematizes desired security requirements and attacks against ML model watermarking. Based on that framework, representative literature from the field is surveyed to illustrate the taxonomy. Finally, shortcomings and general limitations of existing approaches are discussed, and an outlook on future research directions is given.
