RobWE: Robust Watermark Embedding for Personalized Federated Learning Model Ownership Protection
Fuente:
arXiv
Salvato in:
| Autori principali: | , , , , , , , , |
|---|---|
| Natura: | Preprint |
| Pubblicazione: |
2024
|
| Soggetti: | |
| Accesso online: | |
| Tags: |
Aggiungi Tag
Nessun Tag, puoi essere il primo ad aggiungerne!!
|
| _version_ | 1866911786377150464 |
|---|---|
| author | Xu, Yang Tan, Yunlin Zhang, Cheng Chi, Kai Sun, Peng Yang, Wenyuan Ren, Ju Jiang, Hongbo Zhang, Yaoxue |
| author_facet | Xu, Yang Tan, Yunlin Zhang, Cheng Chi, Kai Sun, Peng Yang, Wenyuan Ren, Ju Jiang, Hongbo Zhang, Yaoxue |
| contents | Embedding watermarks into models has been widely used to protect model ownership in federated learning (FL). However, existing methods are inadequate for protecting the ownership of personalized models acquired by clients in personalized FL (PFL). This is due to the aggregation of the global model in PFL, resulting in conflicts over clients' private watermarks. Moreover, malicious clients may tamper with embedded watermarks to facilitate model leakage and evade accountability. This paper presents a robust watermark embedding scheme, named RobWE, to protect the ownership of personalized models in PFL. We first decouple the watermark embedding of personalized models into two parts: head layer embedding and representation layer embedding. The head layer belongs to clients' private part without participating in model aggregation, while the representation layer is the shared part for aggregation. For representation layer embedding, we employ a watermark slice embedding operation, which avoids watermark embedding conflicts. Furthermore, we design a malicious watermark detection scheme enabling the server to verify the correctness of watermarks before aggregating local models. We conduct an exhaustive experimental evaluation of RobWE. The results demonstrate that RobWE significantly outperforms the state-of-the-art watermark embedding schemes in FL in terms of fidelity, reliability, and robustness. |
| format | Preprint |
| id |
arxiv_https___arxiv_org_abs_2402_19054 |
| institution | arXiv |
| publishDate | 2024 |
| record_format | arxiv |
| spellingShingle | RobWE: Robust Watermark Embedding for Personalized Federated Learning Model Ownership Protection Xu, Yang Tan, Yunlin Zhang, Cheng Chi, Kai Sun, Peng Yang, Wenyuan Ren, Ju Jiang, Hongbo Zhang, Yaoxue Cryptography and Security Artificial Intelligence Embedding watermarks into models has been widely used to protect model ownership in federated learning (FL). However, existing methods are inadequate for protecting the ownership of personalized models acquired by clients in personalized FL (PFL). This is due to the aggregation of the global model in PFL, resulting in conflicts over clients' private watermarks. Moreover, malicious clients may tamper with embedded watermarks to facilitate model leakage and evade accountability. This paper presents a robust watermark embedding scheme, named RobWE, to protect the ownership of personalized models in PFL. We first decouple the watermark embedding of personalized models into two parts: head layer embedding and representation layer embedding. The head layer belongs to clients' private part without participating in model aggregation, while the representation layer is the shared part for aggregation. For representation layer embedding, we employ a watermark slice embedding operation, which avoids watermark embedding conflicts. Furthermore, we design a malicious watermark detection scheme enabling the server to verify the correctness of watermarks before aggregating local models. We conduct an exhaustive experimental evaluation of RobWE. The results demonstrate that RobWE significantly outperforms the state-of-the-art watermark embedding schemes in FL in terms of fidelity, reliability, and robustness. |
| title | RobWE: Robust Watermark Embedding for Personalized Federated Learning Model Ownership Protection |
| topic | Cryptography and Security Artificial Intelligence |
| url | https://arxiv.org/abs/2402.19054 |