Deep learning technologies, which are the key components of state-of-the-art Artificial Intelligence (AI) services, have shown great success in providing human-level capabilities for a variety of tasks, such as visual analysis, speech recognition, and natural language processing and etc. Building a production-level deep learning model is a non-trivial task, which requires a large amount of training data, powerful computing resources, and human expertises. Therefore, illegitimate reproducing, distribution, and the derivation of proprietary deep learning models can lead to copyright infringement and economic harm to model creators. Therefore, it is essential to devise a technique to protect the intellectual property of deep learning models and enable external verification of the model ownership. In this paper, we generalize the "digital watermarking'' concept from multimedia ownership verification to deep neural network (DNNs) models. We investigate three DNN-applicable watermark generation algorithms, propose a watermark implanting approach to infuse watermark into deep learning models, and design a remote verification mechanism to determine the model ownership. By extending the intrinsic generalization and memorization capabilities of deep neural networks, we enable the models to learn specially crafted watermarks at training and activate with pre-specified predictions when observing the watermark patterns at inference. We evaluate our approach with two image recognition benchmark datasets. Our framework accurately (100%) and quickly verifies the ownership of all the remotely deployed deep learning models without affecting the model accuracy for normal input data. In addition, the embedded watermarks in DNN models are robust and resilient to different counter-watermark mechanisms, such as fine-tuning, parameter pruning, and model inversion attacks.

Protecting Intellectual Property of Deep Neural Networks with Watermarking

This paper presents a chaotic encryption-based blind digital image watermarking technique applicable to both grayscale and color images. Discrete cosine transform (DCT) is used before embedding the watermark in the host image. The host image is divided into $8\times 8$ nonoverlapping blocks prior to DCT application, and the watermark bit is embedded by modifying difference between DCT coefficients of adjacent blocks. Arnold transform is used in addition to chaotic encryption to add double-layer security to the watermark. Three different variants of the proposed algorithm have been tested and analyzed. The simulation results show that the proposed scheme is robust to most of the image processing operations like joint picture expert group compression, sharpening, cropping, and median filtering. To validate the efficiency of the proposed technique, the simulation results are compared with certain state-of-art techniques. The comparison results illustrate that the proposed scheme performs better in terms of robustness, security, and imperceptivity. Given the merits of the proposed scheme, it can be used in applications like e-healthcare and telemedicine to robustly hide electronic health records in medical images.

Secure and Robust Digital Image Watermarking Using Coefficient Differencing and Chaotic Encryption

Watermarking is the process of embedding information into an image that can survive under distortions, while requiring the encoded image to have little or no perceptual difference with the original image. Recently, deep learning-based methods achieved impressive results in both visual quality and message payload under a wide variety of image distortions. However, these methods all require differentiable models for the image distortions at training time, and may generalize poorly to unknown distortions. This is undesirable since the types of distortions applied to watermarked images are usually unknown and non-differentiable. In this paper, we propose a new framework for distortion-agnostic watermarking, where the image distortion is not explicitly modeled during training. Instead, the robustness of our system comes from two sources: adversarial training and channel coding. Compared to training on a fixed set of distortions and noise levels, our method achieves comparable or better results on distortions available during training, and better performance overall on unknown distortions.

/pdf/distortion-agnostic-deep-watermarking-33gcmx4q7f.pdf

Distortion Agnostic Deep Watermarking

The proposed copyright protection scheme combines the discrete cosine transform (DCT) and singular value decomposition (SVD) using a control parameter to avoid the false-positive problem. In this article, we propose an efficient copyright protection scheme for e-government document images. First, we apply the discrete cosine transform (DCT) to the host image and use the zigzag space-filling curve (SFC) for the DCT coefficients. The DCT coefficients in the zigzag manner are then mapped into four areas with different frequencies in a rectangular shape. Then, we apply the singular value decomposition (SVD) operation to each area, and the host image is modified by the left singular vectors and the singular values of the DCT-transformed watermark to embed the watermark image. The left singular vectors and singular values are used as a control parameter to avoid the false-positive problem. Each area decides the scaling factor's optimal value using a genetic algorithm (GA) with the mean of the watermark's SVs. A scaling factor is simulated by chromosomes, and several optimization GA operators are used. After remapping each modified coefficient DCT back to the original position, the proposed inverse DCT produces the watermarked image. Our experimental results show that we can improve the image quality GA-based evolution and that this approach is robust under several kinds of attacks.

Copyright Protection for E-Government Document Images

Presently considerable amount of work has been done in tele-monitoring which involves the transmission of bio-signals and medical images in the wireless media. Intelligent exchange of bio-signals amongst hospitals needs efficient and reliable transmission. Watermarking adds ―ownership‖ information in multimedia contents to prove the authenticity, to verify signal integrity, or to achieve control over the copy process. This paper proposes a novel session based blind watermarking method with secret key by embedding binary watermark image into (Electrocardiogram) ECG signal. The ECG signal is a sensitive diagnostic tool that is used to detect various cardio-vascular diseases by measuring and recording the electrical activity of the heart in exquisite detail. The first part of this paper proposes a multi-resolution wavelet transform based system for detection ‗P',‗Q',‗R',‗S',‗T' peaks complex from original ECG signal of human being. ‗R-R' time lapse is an important component of the ECG signal that corresponds to the heartbeat of the concerned person. Abrupt increase in height of the ‗R' wave or changes in the measurement of the ‗R-R' interval denote various disorders of human heart. Similarly ‗P-P', ‗Q-Q', ‗S-S', ‗T-T' intervals also correspond to different disorders of heart and their peak amplitude envisages other cardiac diseases. In this proposed method the ‗P Q R S T'-peaks are marked and stored over the entire signal and the time interval between two consecutive ‗R'-peaks and other peaks interval are measured to detect anomalies in behavior of heart, if any. The peaks are achieved by the composition of Daubechies sub-bands wavelet of original ECG signal. The accuracy of the P, QRS and T components detection and interval measurement is achieved with high accuracy by processing and thresholding the original ECG signal. The second part of the paper proposes a Discrete Wavelet Transformation (DWT) and Spread Spectrum based watermarking technique. In this approach, the generated watermarked signal having an acceptable level of imperceptibility and distortion is compared to the Original ECG signal. Finally, a comparative study is done for the intervals of two consecutive ‗R-R' peaks, ‗P-R', ‗Q-T', ‗QTc', QRS duration, cardiac output between original P, QRS and T components detected ECG signal and the watermarked P,QRS and T components detected ECG signal.

/pdf/analysis-of-p-qrs-t-components-modified-by-blind-wa7bbf1vb8.pdf

Analysis of P-QRS-T Components Modified by Blind Watermarking Technique Within the Electrocardiogram Signal for Authentication in Wireless Telecardiology Using DWT

This paper introduces an algorithm of digital watermarking based on Discrete Cosine Transform(DCT) and Discrete Wavelet Transform(DWT). Accoring to the characters of human vision, in this algorithm, the information of digital watermarking which has been discrete Cosine transformed, is put into the high frequency band of the image which has been wavelet transformed. Then distills the digital watermarking with the help of the original image and the watermarking image. The simulation results show that this algorithm is invisible and has good robustness for some common image processing operations.

Mei Jiansheng

Papers

A Digital Watermarking Algorithm Based On DCT and DWT