DeepEclipse: How to Break White-Box DNN-Watermarking Schemes
Alessandro Pegoraro Carlotta Segna Kavita Kumari Ahmad-Reza Sadeghi
Deep Learning (DL) models have become crucial in digital transformation, thus
raising concerns about their intellectual property rights. Different
watermarking techniques have been developed to protect Deep Neural Networks
(DNNs) from IP infringement, creating a competitive field for DNN watermarking
and removal methods. The predominant watermarking schemes use white-box
techniques, which involve modifying weights by adding a unique signature to
specific DNN layers. On the other hand, existing attacks on white-box
watermarking usually require knowledge of the specific deployed watermarking
scheme or access to the underlying data for further training and fine-tuning.
We propose DeepEclipse, a novel and unified framework designed to remove
white-box watermarks. We present obfuscation techniques that significantly
differ from the existing white-box watermarking removal schemes. DeepEclipse
can evade watermark detection without prior knowledge of the underlying
watermarking scheme, additional data, or training and fine-tuning. Our
evaluation reveals that DeepEclipse excels in breaking multiple white-box
watermarking schemes, reducing watermark detection to random guessing while
maintaining a similar model accuracy as the original one. Our framework
showcases a promising solution to address the ongoing DNN watermark protection
and removal challenges.