For the protection of trained deep neural network(DNN) models, embedding watermarks into the weights of the DNN model have been considered. However, the amount of change in the weights is large in the conventional methods, and it is reported that the existence of hidden watermark can be detected from the analysis of weight variance. This helps attackers to modify the watermark by effectively adding noise to the weight. In this paper, we focus on the fully-connected layers of fine-tuning models and apply a quantization-based watermarking method to the weights sampled from the layers. The advantage of the proposed method is that the change caused by watermark embedding is much smaller and the distortion converges gradually without using any loss function. The validity of the proposed method was evaluated by varying the conditions during the training of DNN model. The results shows the impact of training for DNN model, effectiveness of the embedding method, and high robustness against pruning attacks.

A previously proposed optimal detector for bias-based fingerprinting codes such as Tardos and Nuida requires two kinds of important information: the number of colluders and the collusion strategy used to generate the pirated codeword. An estimator has now been derived for these two parameters. The bias in the pirated codeword is measured by observing the number of zeros and ones and compared with possible bias patterns calculated using information about the collusion strategy and number of colluders. Computer simulation demonstrated that the collusion strategy and number of colluders can be estimated with high probability and that the traceability of a detector using the proposed estimator is extremely close to being optimal.