Abstract
This paper proves a new watermarking method to embed the ownership information into a deep neural network (DNN), which is robust to fine-tuning. Specifically, we prove that when the input feature of a convolutional layer only contains low-frequency components, specific frequency components of the convolutional filter will not be changed by gradient descent during the fine-tuning process, where we propose a revised Fourier transform to extract frequency components from the convolutional filter. Additionally, we also prove that these frequency components are equivariant to weight scaling and weight permutations. In this way, we design a watermark module to encode the watermark information to specific frequency components in a convolutional filter. Preliminary experiments demonstrate the effectiveness of our method.
Abstract (translated)
本文提出了一种新的水印技术，可以将所有权信息嵌入到深度神经网络（DNN）中，并且这种水印在微调过程中是鲁棒的。具体而言，我们证明了当卷积层的输入特征仅包含低频分量时，在梯度下降过程中的微调阶段，该层的卷积滤波器的特定频率成分不会发生变化。为此，我们提出了一种修订版的傅里叶变换方法来从卷积滤波器中提取这些频率成分。此外，我们也证明了这些频率成分对于权重缩放和权重置换是等变（equivariant）的。通过这种方式，我们设计了一个水印模块，可以将水印信息编码到卷积滤波器的特定频率分量中。初步实验表明我们的方法的有效性。
URL
https://arxiv.org/abs/2505.01007
