As deep neural networks (DNNs) enhance diverse applications, protecting their intellectual property via watermarking is critical. However, existing methods suffer from i) Incomplete protection to advanced watermark removal attacks; ii) Limited customization ability; and iii) Interference among watermark signals deteriorates customization ability. This customizability requirement is critical to MLaaS settings, where a provider must embed distinct watermarks into many distributed copies and later attribute a leaked model to its responsible users, even after removal attacks. To address the first two issues, we propose Unified Soft-label Perturbation (USP) for robust ownership verification and Customized Soft-label Perturbation (CSP) for model-specific watermarking. For the third issue, we formulate a new research problem for the customization-optimized watermark signal generation, named Spherical Code with Element-wise Bound (SCEB) problem, which aims to automatically generate diverse and non-interfering watermark signals under an element-wise bound to preserve main task functionality. We propose Customization Optimized Watermarks with Spherical Codes (CuSphere) to effec tively address the SCEB problem, which enables automatic signal generation via a conditional diffusion-based optimizer with data enhancement and efficient indexing. CuSphere significantly enhances the customization ability of the proposed CSP approach, with three proposed components, VDOpt, MaxD, and BallTree. VDOpt is an optimizer to generate high-quality candidate signal groups for the SCEB objective. MaxD is a data enhancer that expands and refines the candidate pool through iterative selection to improve solution quality. BallTree mitigates the MaxD computational bottleneck by integrating DVOrder and SBPrune strategies. These techniques prioritize promising candidates and prune subtrees incapable of improving the current best objective value. Experimental results show that our proposed USP and CSP resist all the watermark removal attacks. In addition, the proposed CSP with CuSphere achieves very promising watermark customization ability even after various watermark removal attacks, significantly outperforming the other state-of-the-art baselines.

As the excellent performance of deep neural networks (DNNs) enhances a wide spectrum of applications, the protection of intellectual property (IP) of DNNs receives increasing attention recently, and DNN watermarking approaches are thus proposed for ownership verification to avoid potential misuses or thefts of DNN models. However, we observe that existing DNN watermark methods suffer from two major weaknesses: i) Incomplete protection to advanced watermark removal attacks, such as fine-tune attack with large learning rates, re-train after pruning, and most importantly, the distillation attack; ii) Limited customization ability, where multiple watermarked models cannot be uniquely identified, especially after removal attacks. To address these critical issues, we propose two new DNN watermarking approaches, Unified Soft-label Perturbation (USP), which provides robust watermark to detect model thefts, and Customized Soft-label Perturbation (CSP), which is able to embed a different watermark in each copy of the DNN model to enable customized watermarking. Experimental results show that our proposed USP and CSP resist all the watermark removal attacks, especially for the distillation attack, and the proposed CSP achieves very promising watermark customization ability, significantly outperforming the other state-of-the-art baselines.