标题： 基于哈希的水印作为过滤器：在基于权重的神经网络水印中击败伪造和覆盖攻击 显示英文标题

标题： Hashed Watermark as a Filter: Defeating Forging and Overwriting Attacks in Weight-based Neural Network Watermarking

摘要： 作为有价值的数字资产，深度神经网络需要强大的所有权保护，这使得神经网络水印（NNW）成为一种有前景的解决方案。 在各种NNW方法中，基于权重的方法因其简单性和实用性而受到青睐；然而，它们仍然容易受到伪造和覆盖攻击。 为了解决这些挑战，我们提出了NeuralMark，这是一种围绕哈希水印滤波器构建的鲁棒方法。 具体来说，我们使用哈希函数从一个秘密密钥生成不可逆的二进制水印，然后将其用作滤波器来选择用于嵌入的模型参数。 这种设计巧妙地将嵌入参数与哈希水印结合在一起，提供了对伪造和覆盖攻击的鲁棒防御。 还集成了平均池化以抵抗微调和剪枝攻击。 此外，它可以无缝集成到各种神经网络架构中，确保广泛的应用性。 理论上，我们分析了其安全边界。 在实践中，我们在13种不同的卷积和Transformer架构上验证了其有效性和鲁棒性，涵盖了五个图像分类任务和一个文本生成任务。 源代码可在https://github.com/AIResearch-Group/NeuralMark获取。 显示英文摘要

摘要： As valuable digital assets, deep neural networks necessitate robust ownership protection, positioning neural network watermarking (NNW) as a promising solution. Among various NNW approaches, weight-based methods are favored for their simplicity and practicality; however, they remain vulnerable to forging and overwriting attacks. To address those challenges, we propose NeuralMark, a robust method built around a hashed watermark filter. Specifically, we utilize a hash function to generate an irreversible binary watermark from a secret key, which is then used as a filter to select the model parameters for embedding. This design cleverly intertwines the embedding parameters with the hashed watermark, providing a robust defense against both forging and overwriting attacks. An average pooling is also incorporated to resist fine-tuning and pruning attacks. Furthermore, it can be seamlessly integrated into various neural network architectures, ensuring broad applicability. Theoretically, we analyze its security boundary. Empirically, we verify its effectiveness and robustness across 13 distinct Convolutional and Transformer architectures, covering five image classification tasks and one text generation task. The source codes are available at https://github.com/AIResearch-Group/NeuralMark.