Selective confusion attack: an attacking technique against DNN watermarking

• 1、Beijing University of Posts and Telecommunications,School of Cyberspace Security, Beijing 100876

Abstract：Deep learning models are widely used in business scenarios and have achieved some success. It usually needs time or computing consuming to build a production-level deep learning model. As a result, such models require copyright protection by watermarks. To judge the security of watermarks, Selective confusion attacking method is provided. In this method, some attack images with error labels are used in retraining to remove watermark. Simulation results show that our attacking method can break the existing black-box watermarking methods by with only 5 rounds of retraining. At the same time, we propose a watermarking method with autoencoder and it can resist Selective confusion to protect the legitimate rights of deep learning model owners.)

Keywords： cyberspace security deep learning model watermark error label sensitivity selective confusion autoencoder