Reversible Trigger Set for Copyright Protection of Neural Network

Existing backdoor-based watermarking methods for copyright protection of neural network (NN) typically rely on manually designed fixed triggers. These fixed triggers are perceptible, so they are vulnerable to detection and removal, which often lack verifiable ownership evidence. To address these limitations, this paper proposes a copyright protection method of NN based on stego trigger set. The proposed method selects some samples from the clean training data as carrier samples, embeds copyright data into these carrier samples via reversible data hiding, and generates stego triggers that are imperceptible and have high visual quality. These stego triggers constitute the trigger set during model training, enabling the implantation of verifiable watermark behaviors without significantly degrading the model’s accuracy. During the verification stage, ownership can be preliminarily confirmed in a black-box manner by querying the suspicious model with the stego trigger set and examining its output responses. Furthermore, the embedded copyright data can be extracted from the stego trigger set, and the carrier samples can be losslessly restored, forming a reproducible evidence chain through model response, copyright data extraction, and reversible restoration. Extensive experiments on the CIFAR datasets show that the proposed method achieves a trigger recognition accuracy of 100% or nearly 100%.