PCPT and ACPT: Copyright Protection and Traceability Scheme for DNN Models

Abstract--Deep neural networks (DNNs) have achieved tremendous success in artificial intelligence (AI) fields. However, DNN models can be easily illegally copied, redistributed, or abused by criminals, seriously damaging the interests of model inventors. Because the existing traceability mechanisms are used for models without watermarks, a small number of false-positives are generated. Existing black-box active protection schemes have loose authorization control and are vulnerable to forgery attacks. This framework uses the authorization control center constructed by the detector and verifier. This approach realizes stricter authorization control, which establishes a strong connection between users and model owners, improves the framework security, and supports traceability verification. Internet companies, such as Microsoft, Baidu, and Google, have deployed DNN models in their products and services to provide intelligent and high-quality services. In contrast to traditional multimedia data, the cost of training a good DNN model is considerable. It requires the use of large-scale datasets, huge computing resources, and large labor costs. However, according to the literature, only the KeyNet framework proposed by Jebreel et al. [12] has addressed the problem of traceability after the DNN model is illegally stolen and distributed. However, when the KeyNet framework is used for models without watermarks, a small number of falsepositives are produced. For example, the VGG16 and ResNet18 networks yield 7.92% and 18.92% false-positive rates, respectively. Since PCPT uses additional classes as the trigger set, the distortion of the original decision boundary is minimized (or even eliminated), thus realizing a zero false-positive rate in the unlabeled model. After a video is framed, several trigger sets are constructed according to the different subjects in the video.