Despite tremendous success in many application scenarios, deep learning faces serious intellectual property (IP) infringement threats. Considering the cost of designing and training a good model, infringements will significantly infringe the interests of the original model owner. Recently, many impressive works have emerged for deep model IP protection. However, they either are vulnerable to ambiguity attacks, or require changes in the target network structure by replacing its original normalization layers and hence cause significant performance drops. To this end, we propose a new passport-aware normalization formulation, which is generally applicable to most existing normalization layers and only needs to add another passport-aware branch for IP protection. This new branch is jointly trained with the target model but discarded in the inference stage.

Despite tremendous success in many application scenarios, deep learning faces serious intellectual property (IP) infringement threats.

Below we clarify each question and we hope reviewers can raise their scores based on the responses. L205), we have provided the detailed experiment settings. The default ratio value is 50%, i.e., train 1 iteration passport-aware branch after training every 1 iteration In this case, the theoretical computation cost will be 2x. More importantly, this will not introduce any extra cost for deployment . Then it can be viewed as a special case (i.e., only the nonlinear transform We adopt a similar setting as the trigger-set based method [10].

Below we clarify each question and we hope reviewers can raise their scores based on the responses. L205), we have provided the detailed experiment settings. The default ratio value is 50%, i.e., train 1 iteration passport-aware branch after training every 1 iteration In this case, the theoretical computation cost will be 2x. More importantly, this will not introduce any extra cost for deployment . Then it can be viewed as a special case (i.e., only the nonlinear transform We adopt a similar setting as the trigger-set based method [10].

Despite tremendous success in many application scenarios, deep learning faces serious intellectual property (IP) infringement threats. Considering the cost of designing and training a good model, infringements will significantly infringe the interests of the original model owner. Recently, many impressive works have emerged for deep model IP protection. However, they either are vulnerable to ambiguity attacks, or require changes in the target network structure by replacing its original normalization layers and hence cause significant performance drops. To this end, we propose a new passport-aware normalization formulation, which is generally applicable to most existing normalization layers and only needs to add another passport-aware branch for IP protection. This new branch is jointly trained with the target model but discarded in the inference stage.