Robust Retraining-free GAN Fingerprinting via Personalized Normalization
Jianwei Fei Zhihua Xia Benedetta Tondi Mauro Barni
In recent years, there has been significant growth in the commercial
applications of generative models, licensed and distributed by model developers
to users, who in turn use them to offer services. In this scenario, there is a
need to track and identify the responsible user in the presence of a violation
of the license agreement or any kind of malicious usage. Although there are
methods enabling Generative Adversarial Networks (GANs) to include invisible
watermarks in the images they produce, generating a model with a different
watermark, referred to as a fingerprint, for each user is time- and
resource-consuming due to the need to retrain the model to include the desired
fingerprint. In this paper, we propose a retraining-free GAN fingerprinting
method that allows model developers to easily generate model copies with the
same functionality but different fingerprints. The generator is modified by
inserting additional Personalized Normalization (PN) layers whose parameters
(scaling and bias) are generated by two dedicated shallow networks (ParamGen
Nets) taking the fingerprint as input. A watermark decoder is trained
simultaneously to extract the fingerprint from the generated images. The
proposed method can embed different fingerprints inside the GAN by just
changing the input of the ParamGen Nets and performing a feedforward pass,
without finetuning or retraining. The performance of the proposed method in
terms of robustness against both model-level and image-level attacks is also
superior to the state-of-the-art.