Research map / Architectures and efficiency / RNNs and normalization
Resource Efficient Deep Learning Hardware Watermarks with Signature Alignment
Read the paperCheck your idea against 108,967 papers
AI-extracted summary. Written by AI from the paper's full text. Numbers and claims can be wrong or missing context, so check the paper before you cite or build on it.
Proposes a signature-aligned method for embedding watermarks in deep learning hardware that co-optimizes key samples and hardware modifications, reducing modified operations and hardware overhead versus DeepHardMark.
Problem
Hardware watermarks for deep learning accelerators must embed reliable ownership signatures while minimizing hardware modifications and altering the device's algorithmic behavior, but prior work chose key samples randomly, ignoring their effect on watermark efficiency.
Approach
Co-optimize the key sample (a small perturbation of a training image, constrained to keep the original label under the key DNN) together with a sparse binary mask of targeted hardware operations and the latent perturbation, using an ADMM-style alternating optimization so that the key sample is aligned with the watermark signature.
Key results
- Signature-aligned watermarks achieve 100% ESR on CIFAR-10, CIFAR-100 and ImageNet ResNet18 versus DeepHardMark, with |η| of 7.16e-3, 1.05e-2 and 5.95e-5 vs 1.80e-1, 1.29e0 and 1.50e-1.
- Average ESR of 92.6% across ImageNet classifiers (ResNet, VGG, DenseNet, ViT) with zero accuracy and fidelity change.
- On TinyTPU, the proposed method's area and cell overhead is about 0.001% and 0.003% versus 0.144% and 0.119% for DeepHardMark.
Measured effects reported in the paper
| What was changed | Where | Measured | Effect |
|---|---|---|---|
| Align key samples with the watermark signature rather than using randomly selected samples | DeepHardMark hardware watermarking · Cifar10 | |η|%: 1.80e−1 -> 7.16e−3 | Helped |
| Align key samples with the watermark signature rather than using randomly selected samples | DeepHardMark hardware watermarking · Cifar100 | |η|%: 1.29e0 -> 1.05e−2 | Helped |
| Align key samples with the watermark signature rather than using randomly selected samples | DeepHardMark hardware watermarking · ImageNet | |η|%: 1.50e−1 -> 5.95e−5 | Helped |
| Align key samples with the watermark signature rather than using randomly selected samples | DeepHardMark hardware watermarking · Cifar10 | Acc∆%: 0.68 -> 0.00 | Helped |
| Align key samples with the watermark signature rather than using randomly selected samples | DeepHardMark hardware watermarking · Cifar100 | Acc∆%: 0.30 -> 0.00 | Helped |
| Align key samples with the watermark signature rather than using randomly selected samples | DeepHardMark hardware watermarking · ImageNet | Acc∆%: 0.67 -> 0.00 | Helped |
| Use signature-aligned key samples and hardware modifications | DeepHardMark hardware watermarking · TinyTPU | Area: 0.144% -> 0.001% | Helped |
Surprising findings
- Selecting an average-performing key sample rather than a poor one can improve watermark performance by up to 70% at the same cardinality constraint.
Limitations
- Hardware evaluation limited to a 32x32 ASIC design with TinyTPU and a custom MMU; simulation-based results.
- Watermark embedding relies on a sparsity-constrained optimization that sacrifices some ESR when the cardinality bound is decreased.
- Only image classifiers evaluated; no robustness or ambiguity-attack analysis reported.
Experimental setup
Datasets: CIFAR-10 CIFAR-100 ImageNet
Benchmarks: CIFAR-10 CIFAR-100 ImageNet
Metrics: Embedding Success Rate Change in Accuracy Change in Fidelity Triggering Error number of targeted modifications area cells power timing
Baselines: DeepHardMark
Builds on: DeepHardMark l_p-ADMM Hardware Trojan-style activator/perturber circuits
Closest papers by meaning
- Lightweight-Mark: Rethinking Deep Learning-Based Watermarking (ICML 2025 · similarity 0.86)
- EntropyMark: Towards More Harmless Backdoor Watermark via Entropy-based Constraint for Open-source Dataset Copyright Protection (CVPR 2025 · similarity 0.85)
- ZeroMark: Towards Dataset Ownership Verification without Disclosing Watermark (NeurIPS 2024 · similarity 0.85)
- Revisiting the Information Capacity of Neural Network Watermarks: Upper Bound Estimation and Beyond (AAAI 2024 · similarity 0.85)
- IPRemover: A Generative Model Inversion Attack against Deep Neural Network Fingerprinting and Watermarking (AAAI 2024 · similarity 0.83)
- Safe and Robust Watermark Injection with a Single OoD Image (ICLR 2024 · similarity 0.82)
Writing a paper in this area? scime draft is a free LaTeX editor with AI included, real-time co-authors and a check of your references and venue rules before you submit. It also imports OpenAI Prism projects.