Reproduce “FedIPR: Ownership Verification for Federated Deep Neural Network Models” on OpenResearch

About this paper

Bowen Li, Lixin Fan, Hanlin Gu, Jie Li, Qiang Yang

FedIPR introduces a framework for ownership verification in federated deep neural networks, enabling multiple clients to independently embed and verify private watermarks into a collaboratively trained model. It achieves high watermark detection rates while maintaining main task performance, and demonstrates robustness against common federated learning strategies and removal attacks.

Key insights

• Theoretical analysis demonstrates that multiple clients can embed watermarks into a shared model without significant conflict, providing guaranteed lower bounds for detection rates even when embedding capacity is exceeded.
• Normalization layer scale parameters (W_γ) are identified as a particularly robust location for watermark embedding, maintaining detectability against fine-tuning and pruning attacks.
• Both feature-based and backdoor-based watermarks can be integrated into the federated learning process, providing strong statistical evidence for ownership claims with minimal impact on the model's primary task performance.

Summary by alphaXiv.