标题： 基于触发的黑盒模型水印的防御者与攻击者之间的博弈 显示英文标题

标题： A Game Between the Defender and the Attacker for Trigger-based Black-box Model Watermarking

摘要： 水印技术在深度神经网络（DNN）模型中近年来引起了广泛关注和兴趣，这是由于对保护DNN模型的知识产权的需求不断增加。 许多实用算法已被提出，通过参数/结构调制或针对攻击者知识产权侵权的后门技术，将秘密水印隐蔽地嵌入到给定的DNN模型中，同时保持模型在原始任务上的性能。 尽管这些方法表现出色，但基础研究的缺乏限制了算法设计只能采用基于试验的方法或数据驱动的技术。 这促使本文作者引入了一个模型攻击者和模型防御者之间的博弈，用于基于触发器的黑盒模型水印技术。 对于每个玩家，我们构建了收益函数并确定了最优反应，这丰富了模型水印的理论基础，并可能启发我们在未来开发新的方案。 显示英文摘要

摘要： Watermarking deep neural network (DNN) models has attracted a great deal of attention and interest in recent years because of the increasing demand to protect the intellectual property of DNN models. Many practical algorithms have been proposed by covertly embedding a secret watermark into a given DNN model through either parametric/structural modulation or backdooring against intellectual property infringement from the attacker while preserving the model performance on the original task. Despite the performance of these approaches, the lack of basic research restricts the algorithmic design to either a trial-based method or a data-driven technique. This has motivated the authors in this paper to introduce a game between the model attacker and the model defender for trigger-based black-box model watermarking. For each of the two players, we construct the payoff function and determine the optimal response, which enriches the theoretical foundation of model watermarking and may inspire us to develop novel schemes in the future.