DMC-Watermark: A backdoor richer watermark for dual identity verification by dynamic mask covering

Abstract

With the increasing use of neural networks, the importance of copyright protection for these models has gained significant attention. Backdoor watermarking is one of the key methods for protecting copyright. However, on the one hand, most existing backdoor watermarks are triggered by visual images, making them easily detectable, and therefore vulnerable to various attacks. On the other hand, it is difficult for these methods to carry information related to the creator’s identity which can easily lead to fraudulent claims of ownership. These factors contribute to the vulnerability and limitations of backdoor watermarking. In this paper, we propose DMC-Watermark, a backdoor richer watermarking method that uses dynamic mask-covered image structures as triggers. Leveraging the semantic preservation of image structure in transformation attacks, we select image structure as triggers. Furthermore, we convert the author-related information into an array of color information and apply it as a mask to the extracted image structures, allowing it to serve as a second layer of verification during the validation phase to resist fraudulent claims of ownership. The final trigger pattern, embedded with author-related image structures, is applied to the selected images in the trigger set, generating a final trigger set that is trained together with clean samples to produce a protected model. The experiments show that the proposed DMC-Watermark performs well in terms of fidelity, invisibility, undetectability, functionality, dual verification and robustness on three different datasets and four representative DNNs, and it has wide applicability and excellent results in high-resolution images.