Methods and systems for watermarking neural networks

Abstract

Disclosed herein is a system for watermarking a neural network, comprising memory; and at least one processor in communication with the memory; wherein the memory stores instructions for causing the at least one processor to carry out a method comprising: generating a trigger set by obtaining examples from a training set by random sampling from the training set, respective examples being associated with respective true classes of a plurality of classes; generating a set of adversarial examples by structured perturbation of the examples; generating, for each adversarial example, one or more adversarial class labels by passing the adversarial example to the neural network; and applying one or more trigger labels to each said adversarial example, wherein the one or more trigger labels are selected randomly from the plurality of classes, and wherein each trigger label is not a said true class label for the corresponding example or a said adversarial class label for the corresponding adversarial example; and storing the adversarial examples and corresponding trigger labels as the trigger set; and performing a tuning process to adjust parameters at each layer of the neural network using the trigger set, to thereby generate a watermarked neural network.