一句话：提出 DeepSigns，首个在深度学习模型训练中嵌入数字水印以保护模型知识产权的端到端框架。
深度学习模型通常依赖大量专有训练数据与算力构建，作为服务部署时面临严重的知识产权侵权风险。本文提出 DeepSigns，一个端到端的模型知识产权保护框架，允许开发者在分发模型前系统性地嵌入数字水印。DeepSigns 以高层封装形式实现，可集成于 TensorFlow、PyTorch 等主流深度学习框架。其核心思想是动态学习模型各层激活图的概率密度函数（pdf），利用模型中的低概率区域在训练过程中逐步嵌入所有者签名，从而在几乎不影响模型精度与训练开销的前提下完成水印植入。实验表明，DeepSigns 能够抵抗模型剪枝、模型微调、水印覆写等多种移除与变换攻击；作者在宽残差卷积网络、多层感知机与 LSTM 等多种架构上进行了评估，并提供了高度优化的配套 API，训练额外开销最低仅为 2.2%。
Deep Learning (DL) models have created a paradigm shift in our ability to comprehend raw data in various important fields, ranging from intelligence warfare and healthcare to autonomous transportation and automated manufacturing. A practical concern, in the rush to adopt DL models as a service, is protecting the models against Intellectual Property (IP) infringement. DL models are commonly built by allocating substantial computational resources that process vast amounts of proprietary training data. The resulting models are therefore considered to be an IP of the model builder and need to be protected to preserve the owner's competitive advantage. We propose DeepSigns, the first end-to-end IP protection framework that enables developers to systematically insert digital watermarks in the target DL model before distributing the model. DeepSigns is encapsulated as a high-level wrapper that can be leveraged within common deep learning frameworks including TensorFlow and PyTorch. The libraries in DeepSigns work by dynamically learning the Probability Density Function (pdf) of activation maps obtained in different layers of a DL model. DeepSigns uses the low probabilistic regions within the model to gradually embed the owner's signature (watermark) during DL training while minimally affecting the overall accuracy and training overhead. DeepSigns can demonstrably withstand various removal and transformation attacks, including model pruning, model fine-tuning, and watermark overwriting. We evaluate DeepSigns performance on a wide variety of DL architectures including wide residual convolution neural networks, multi-layer perceptrons, and long short-term memory models. Our extensive evaluations corroborate DeepSigns' effectiveness and applicability. We further provide a highly-optimized accompanying API to facilitate training watermarked neural networks with a training overhead as low as 2.2%.