摘要
As deep neural networks (DNNs) enhance diverse applications, protecting their intellectual property via watermarking is critical. However, existing methods suffer from i) Incomplete protection to advanced watermark removal attacks ; ii) Limited customization ability ; and iii) Interference among watermark signals deteriorates customization ability . This customizability requirement is critical to MLaaS settings, where a provider must embed distinct watermarks into many distributed copies and later attribute a leaked model to its responsible users, even after removal attacks. To address the first two issues, we propose Unified Soft-label Perturbation (USP) for robust ownership verification and Customized Soft-label Perturbation (CSP) for model-specific watermarking. For the third issue, we formulate a new research problem for the customization-optimized watermark signal generation, named Spherical Code with Element-wise Bound (SCEB) problem, which aims to automatically generate diverse and non-interfering watermark signals under an element-wise bound to preserve main task functionality. We propose Customization-Optimized Watermarks with Spherical Codes (CuSphere) to effectively address the SCEB problem, which enables automatic signal generation via a conditional diffusion-based optimizer with data enhancement and efficient indexing. CuSphere significantly enhances the customization ability of the proposed CSP approach, with three proposed components, VDOpt , MaxD , and BallTree . VDOpt is an optimizer to generate high-quality candidate signal groups for the SCEB objective. MaxD is a data enhancer that expands and refines the candidate pool through iterative selection to improve solution quality. BallTree mitigates the MaxD computational bottleneck by integrating DVOrder and SBPrune strategies. These techniques prioritize promising candidates and prune subtrees incapable of improving the current best objective value. Experimental results show that our proposed USP and CSP resist all the watermark removal attacks. In addition, the proposed CSP with CuSphere achieves very promising watermark customization ability even after various watermark removal attacks, significantly outperforming the other state-of-the-art baselines.