{"id":"https://openalex.org/W4323345707","doi":"https://doi.org/10.1109/tnnls.2023.3250210","title":"Unambiguous and High-Fidelity Backdoor Watermarking for Deep Neural Networks","display_name":"Unambiguous and High-Fidelity Backdoor Watermarking for Deep Neural Networks","publication_year":2023,"publication_date":"2023-03-06","ids":{"openalex":"https://openalex.org/W4323345707","doi":"https://doi.org/10.1109/tnnls.2023.3250210","pmid":"https://pubmed.ncbi.nlm.nih.gov/37028031"},"language":"en","primary_location":{"id":"doi:10.1109/tnnls.2023.3250210","is_oa":false,"landing_page_url":"https://doi.org/10.1109/tnnls.2023.3250210","pdf_url":null,"source":{"id":"https://openalex.org/S4210175523","display_name":"IEEE Transactions on Neural Networks and Learning Systems","issn_l":"2162-237X","issn":["2162-237X","2162-2388"],"is_oa":false,"is_in_doaj":false,"is_core":true,"host_organization":"https://openalex.org/P4310319808","host_organization_name":"Institute of Electrical and Electronics Engineers","host_organization_lineage":["https://openalex.org/P4310319808"],"host_organization_lineage_names":["Institute of Electrical and Electronics Engineers"],"type":"journal"},"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"IEEE Transactions on Neural Networks and Learning Systems","raw_type":"journal-article"},"type":"article","indexed_in":["crossref","pubmed"],"open_access":{"is_oa":true,"oa_status":"green","oa_url":"https://figshare.com/articles/journal_contribution/Unambiguous_and_High-Fidelity_Backdoor_Watermarking_for_Deep_Neural_Networks/22406416","any_repository_has_fulltext":true},"authorships":[{"author_position":"first","author":{"id":"https://openalex.org/A5068604294","display_name":"Guang Hua","orcid":"https://orcid.org/0000-0001-5184-4359"},"institutions":[{"id":"https://openalex.org/I115228651","display_name":"Agency for Science, Technology and Research","ror":"https://ror.org/036wvzt09","country_code":"SG","type":"government","lineage":["https://openalex.org/I115228651"]},{"id":"https://openalex.org/I3005327000","display_name":"Institute for Infocomm Research","ror":"https://ror.org/053rfa017","country_code":"SG","type":"facility","lineage":["https://openalex.org/I115228651","https://openalex.org/I3005327000","https://openalex.org/I91275662"]},{"id":"https://openalex.org/I37461747","display_name":"Wuhan University","ror":"https://ror.org/033vjfk17","country_code":"CN","type":"education","lineage":["https://openalex.org/I37461747"]}],"countries":["CN","SG"],"is_corresponding":false,"raw_author_name":"Guang Hua","raw_affiliation_strings":["School of Electronic Information, Wuhan University, Wuhan, China","Institute for Infocomm Research (I2R), Agency for Science, Technology and Research (A*STAR), Singapore, Singapore"],"raw_orcid":"https://orcid.org/0000-0001-5184-4359","affiliations":[{"raw_affiliation_string":"School of Electronic Information, Wuhan University, Wuhan, China","institution_ids":["https://openalex.org/I37461747"]},{"raw_affiliation_string":"Institute for Infocomm Research (I2R), Agency for Science, Technology and Research (A*STAR), Singapore, Singapore","institution_ids":["https://openalex.org/I115228651","https://openalex.org/I3005327000"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5051093782","display_name":"Andrew Beng Jin Teoh","orcid":"https://orcid.org/0000-0001-5063-9484"},"institutions":[{"id":"https://openalex.org/I193775966","display_name":"Yonsei University","ror":"https://ror.org/01wjejq96","country_code":"KR","type":"education","lineage":["https://openalex.org/I193775966"]}],"countries":["KR"],"is_corresponding":false,"raw_author_name":"Andrew Beng Jin Teoh","raw_affiliation_strings":["School of Electrical and Electronic Engineering, College of Engineering, Yonsei University, Seoul, South Korea","College of Engineering, School of Electrical and Electronic Engineering, Yonsei University, Seoul, South Korea"],"raw_orcid":"https://orcid.org/0000-0001-5063-9484","affiliations":[{"raw_affiliation_string":"School of Electrical and Electronic Engineering, College of Engineering, Yonsei University, Seoul, South Korea","institution_ids":["https://openalex.org/I193775966"]},{"raw_affiliation_string":"College of Engineering, School of Electrical and Electronic Engineering, Yonsei University, Seoul, South Korea","institution_ids":["https://openalex.org/I193775966"]}]},{"author_position":"middle","author":{"id":"https://openalex.org/A5051297830","display_name":"Yong Xiang","orcid":"https://orcid.org/0000-0003-3545-7863"},"institutions":[{"id":"https://openalex.org/I149704539","display_name":"Deakin University","ror":"https://ror.org/02czsnj07","country_code":"AU","type":"education","lineage":["https://openalex.org/I149704539"]}],"countries":["AU"],"is_corresponding":false,"raw_author_name":"Yong Xiang","raw_affiliation_strings":["School of Information Technology, Deakin University, Burwood, VIC, Australia"],"raw_orcid":"https://orcid.org/0000-0003-3545-7863","affiliations":[{"raw_affiliation_string":"School of Information Technology, Deakin University, Burwood, VIC, Australia","institution_ids":["https://openalex.org/I149704539"]}]},{"author_position":"last","author":{"id":"https://openalex.org/A5100616426","display_name":"Hao Jiang","orcid":"https://orcid.org/0000-0002-8533-1612"},"institutions":[{"id":"https://openalex.org/I37461747","display_name":"Wuhan University","ror":"https://ror.org/033vjfk17","country_code":"CN","type":"education","lineage":["https://openalex.org/I37461747"]}],"countries":["CN"],"is_corresponding":false,"raw_author_name":"Hao Jiang","raw_affiliation_strings":["School of Electronic Information, Wuhan University, Wuhan, China"],"raw_orcid":"https://orcid.org/0000-0002-8533-1612","affiliations":[{"raw_affiliation_string":"School of Electronic Information, Wuhan University, Wuhan, China","institution_ids":["https://openalex.org/I37461747"]}]}],"institutions":[],"countries_distinct_count":4,"institutions_distinct_count":5,"corresponding_author_ids":[],"corresponding_institution_ids":[],"apc_list":null,"apc_paid":null,"fwci":4.5829,"has_fulltext":false,"cited_by_count":35,"citation_normalized_percentile":{"value":0.95781369,"is_in_top_1_percent":false,"is_in_top_10_percent":true},"cited_by_percentile_year":{"min":96,"max":100},"biblio":{"volume":"35","issue":"8","first_page":"11204","last_page":"11217"},"is_retracted":false,"is_paratext":false,"is_xpac":false,"primary_topic":{"id":"https://openalex.org/T11689","display_name":"Adversarial Robustness in Machine Learning","score":1.0,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},"topics":[{"id":"https://openalex.org/T11689","display_name":"Adversarial Robustness in Machine Learning","score":1.0,"subfield":{"id":"https://openalex.org/subfields/1702","display_name":"Artificial Intelligence"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T10036","display_name":"Advanced Neural Network Applications","score":0.9900000095367432,"subfield":{"id":"https://openalex.org/subfields/1707","display_name":"Computer Vision and Pattern Recognition"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}},{"id":"https://openalex.org/T10775","display_name":"Generative Adversarial Networks and Image Synthesis","score":0.9668999910354614,"subfield":{"id":"https://openalex.org/subfields/1707","display_name":"Computer Vision and Pattern Recognition"},"field":{"id":"https://openalex.org/fields/17","display_name":"Computer Science"},"domain":{"id":"https://openalex.org/domains/3","display_name":"Physical Sciences"}}],"keywords":[{"id":"https://openalex.org/keywords/backdoor","display_name":"Backdoor","score":0.9861393570899963},{"id":"https://openalex.org/keywords/computer-science","display_name":"Computer science","score":0.6981672644615173},{"id":"https://openalex.org/keywords/digital-watermarking","display_name":"Digital watermarking","score":0.6651204228401184},{"id":"https://openalex.org/keywords/artificial-intelligence","display_name":"Artificial intelligence","score":0.5135517120361328},{"id":"https://openalex.org/keywords/deep-learning","display_name":"Deep learning","score":0.5065735578536987},{"id":"https://openalex.org/keywords/ambiguity","display_name":"Ambiguity","score":0.5061065554618835},{"id":"https://openalex.org/keywords/embedding","display_name":"Embedding","score":0.44078612327575684},{"id":"https://openalex.org/keywords/mnist-database","display_name":"MNIST database","score":0.4368151128292084},{"id":"https://openalex.org/keywords/high-fidelity","display_name":"High fidelity","score":0.4326176345348358},{"id":"https://openalex.org/keywords/machine-learning","display_name":"Machine learning","score":0.42401784658432007},{"id":"https://openalex.org/keywords/deep-neural-networks","display_name":"Deep neural networks","score":0.4184098243713379},{"id":"https://openalex.org/keywords/theoretical-computer-science","display_name":"Theoretical computer science","score":0.33702537417411804},{"id":"https://openalex.org/keywords/computer-security","display_name":"Computer security","score":0.16575077176094055},{"id":"https://openalex.org/keywords/image","display_name":"Image (mathematics)","score":0.12528255581855774}],"concepts":[{"id":"https://openalex.org/C2781045450","wikidata":"https://www.wikidata.org/wiki/Q254569","display_name":"Backdoor","level":2,"score":0.9861393570899963},{"id":"https://openalex.org/C41008148","wikidata":"https://www.wikidata.org/wiki/Q21198","display_name":"Computer science","level":0,"score":0.6981672644615173},{"id":"https://openalex.org/C150817343","wikidata":"https://www.wikidata.org/wiki/Q875932","display_name":"Digital watermarking","level":3,"score":0.6651204228401184},{"id":"https://openalex.org/C154945302","wikidata":"https://www.wikidata.org/wiki/Q11660","display_name":"Artificial intelligence","level":1,"score":0.5135517120361328},{"id":"https://openalex.org/C108583219","wikidata":"https://www.wikidata.org/wiki/Q197536","display_name":"Deep learning","level":2,"score":0.5065735578536987},{"id":"https://openalex.org/C2780522230","wikidata":"https://www.wikidata.org/wiki/Q1140419","display_name":"Ambiguity","level":2,"score":0.5061065554618835},{"id":"https://openalex.org/C41608201","wikidata":"https://www.wikidata.org/wiki/Q980509","display_name":"Embedding","level":2,"score":0.44078612327575684},{"id":"https://openalex.org/C190502265","wikidata":"https://www.wikidata.org/wiki/Q17069496","display_name":"MNIST database","level":3,"score":0.4368151128292084},{"id":"https://openalex.org/C113364801","wikidata":"https://www.wikidata.org/wiki/Q26674","display_name":"High fidelity","level":2,"score":0.4326176345348358},{"id":"https://openalex.org/C119857082","wikidata":"https://www.wikidata.org/wiki/Q2539","display_name":"Machine learning","level":1,"score":0.42401784658432007},{"id":"https://openalex.org/C2984842247","wikidata":"https://www.wikidata.org/wiki/Q197536","display_name":"Deep neural networks","level":3,"score":0.4184098243713379},{"id":"https://openalex.org/C80444323","wikidata":"https://www.wikidata.org/wiki/Q2878974","display_name":"Theoretical computer science","level":1,"score":0.33702537417411804},{"id":"https://openalex.org/C38652104","wikidata":"https://www.wikidata.org/wiki/Q3510521","display_name":"Computer security","level":1,"score":0.16575077176094055},{"id":"https://openalex.org/C115961682","wikidata":"https://www.wikidata.org/wiki/Q860623","display_name":"Image (mathematics)","level":2,"score":0.12528255581855774},{"id":"https://openalex.org/C127413603","wikidata":"https://www.wikidata.org/wiki/Q11023","display_name":"Engineering","level":0,"score":0.0},{"id":"https://openalex.org/C199360897","wikidata":"https://www.wikidata.org/wiki/Q9143","display_name":"Programming language","level":1,"score":0.0},{"id":"https://openalex.org/C119599485","wikidata":"https://www.wikidata.org/wiki/Q43035","display_name":"Electrical engineering","level":1,"score":0.0}],"mesh":[],"locations_count":3,"locations":[{"id":"doi:10.1109/tnnls.2023.3250210","is_oa":false,"landing_page_url":"https://doi.org/10.1109/tnnls.2023.3250210","pdf_url":null,"source":{"id":"https://openalex.org/S4210175523","display_name":"IEEE Transactions on Neural Networks and Learning Systems","issn_l":"2162-237X","issn":["2162-237X","2162-2388"],"is_oa":false,"is_in_doaj":false,"is_core":true,"host_organization":"https://openalex.org/P4310319808","host_organization_name":"Institute of Electrical and Electronics Engineers","host_organization_lineage":["https://openalex.org/P4310319808"],"host_organization_lineage_names":["Institute of Electrical and Electronics Engineers"],"type":"journal"},"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"IEEE Transactions on Neural Networks and Learning Systems","raw_type":"journal-article"},{"id":"pmid:37028031","is_oa":false,"landing_page_url":"https://pubmed.ncbi.nlm.nih.gov/37028031","pdf_url":null,"source":{"id":"https://openalex.org/S4306525036","display_name":"PubMed","issn_l":null,"issn":null,"is_oa":false,"is_in_doaj":false,"is_core":false,"host_organization":"https://openalex.org/I1299303238","host_organization_name":"National Institutes of Health","host_organization_lineage":["https://openalex.org/I1299303238"],"host_organization_lineage_names":[],"type":"repository"},"license":null,"license_id":null,"version":"publishedVersion","is_accepted":true,"is_published":true,"raw_source_name":"IEEE transactions on neural networks and learning systems","raw_type":null},{"id":"pmh:oai:figshare.com:article/22406416","is_oa":true,"landing_page_url":"https://figshare.com/articles/journal_contribution/Unambiguous_and_High-Fidelity_Backdoor_Watermarking_for_Deep_Neural_Networks/22406416","pdf_url":null,"source":{"id":"https://openalex.org/S4377196282","display_name":"Figshare","issn_l":null,"issn":null,"is_oa":false,"is_in_doaj":false,"is_core":false,"host_organization":"https://openalex.org/I4210132348","host_organization_name":"Figshare (United Kingdom)","host_organization_lineage":["https://openalex.org/I4210132348"],"host_organization_lineage_names":[],"type":"repository"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"submittedVersion","is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"Text"}],"best_oa_location":{"id":"pmh:oai:figshare.com:article/22406416","is_oa":true,"landing_page_url":"https://figshare.com/articles/journal_contribution/Unambiguous_and_High-Fidelity_Backdoor_Watermarking_for_Deep_Neural_Networks/22406416","pdf_url":null,"source":{"id":"https://openalex.org/S4377196282","display_name":"Figshare","issn_l":null,"issn":null,"is_oa":false,"is_in_doaj":false,"is_core":false,"host_organization":"https://openalex.org/I4210132348","host_organization_name":"Figshare (United Kingdom)","host_organization_lineage":["https://openalex.org/I4210132348"],"host_organization_lineage_names":[],"type":"repository"},"license":"cc-by","license_id":"https://openalex.org/licenses/cc-by","version":"submittedVersion","is_accepted":false,"is_published":false,"raw_source_name":null,"raw_type":"Text"},"sustainable_development_goals":[],"awards":[{"id":"https://openalex.org/G3009946070","display_name":null,"funder_award_id":"U19B2004","funder_id":"https://openalex.org/F4320321001","funder_display_name":"National Natural Science Foundation of China"}],"funders":[{"id":"https://openalex.org/F4320321001","display_name":"National Natural Science Foundation of China","ror":"https://ror.org/01h0zpd94"}],"has_content":{"pdf":false,"grobid_xml":false},"content_urls":null,"referenced_works_count":52,"referenced_works":["https://openalex.org/W2068223370","https://openalex.org/W2108598243","https://openalex.org/W2194775991","https://openalex.org/W2520774990","https://openalex.org/W2579318729","https://openalex.org/W2603766943","https://openalex.org/W2745565856","https://openalex.org/W2765424254","https://openalex.org/W2768064608","https://openalex.org/W2806082141","https://openalex.org/W2899585792","https://openalex.org/W2901114541","https://openalex.org/W2919115771","https://openalex.org/W2935349488","https://openalex.org/W2947942370","https://openalex.org/W2952608669","https://openalex.org/W2964128659","https://openalex.org/W2964137095","https://openalex.org/W2990980946","https://openalex.org/W2994624247","https://openalex.org/W2996800219","https://openalex.org/W2997717738","https://openalex.org/W3022293880","https://openalex.org/W3025612445","https://openalex.org/W3034412497","https://openalex.org/W3035584216","https://openalex.org/W3042368254","https://openalex.org/W3053555102","https://openalex.org/W3081073185","https://openalex.org/W3083615244","https://openalex.org/W3092793669","https://openalex.org/W3096810773","https://openalex.org/W3102733833","https://openalex.org/W3103557498","https://openalex.org/W3132481243","https://openalex.org/W3133747496","https://openalex.org/W3135872251","https://openalex.org/W3138669064","https://openalex.org/W3185788529","https://openalex.org/W4205687621","https://openalex.org/W4206244849","https://openalex.org/W4287684426","https://openalex.org/W6687483927","https://openalex.org/W6728622933","https://openalex.org/W6747838042","https://openalex.org/W6762718338","https://openalex.org/W6766821575","https://openalex.org/W6770411749","https://openalex.org/W6774150056","https://openalex.org/W6778883912","https://openalex.org/W6782327882","https://openalex.org/W6790534320"],"related_works":["https://openalex.org/W3093748630","https://openalex.org/W3206218040","https://openalex.org/W4206776436","https://openalex.org/W4385524141","https://openalex.org/W4297776111","https://openalex.org/W3018979822","https://openalex.org/W3026616975","https://openalex.org/W2989784533","https://openalex.org/W4288018014","https://openalex.org/W2996058201"],"abstract_inverted_index":{"The":[0],"unprecedented":[1],"success":[2],"of":[3,13,32,49,56,69,93,112,133,144,163,220,243],"deep":[4,33],"learning":[5],"could":[6],"not":[7],"be":[8,212],"achieved":[9],"without":[10],"the":[11,29,46,57,77,91,104,110,131,142,150,160,194,221,241,244],"synergy":[12],"big":[14,67],"data,":[15],"computing":[16],"power,":[17],"and":[18,79,86,98,138,185,189,200,229,235],"human":[19],"knowledge,":[20],"among":[21],"which":[22,37],"none":[23],"is":[24,166],"free.":[25],"This":[26],"calls":[27],"for":[28],"copyright":[30],"protection":[31],"neural":[34],"networks":[35],"(DNNs),":[36],"has":[38],"been":[39,54],"tackled":[40],"via":[41,130,179],"DNN":[42,70],"watermarking.":[43],"Due":[44],"to":[45,154,174],"special":[47],"structure":[48],"DNNs,":[50],"backdoor":[51,113,127,164,191,209],"watermarks":[52,114],"have":[53],"one":[55],"popular":[58],"solutions.":[59],"In":[60],"this":[61,121],"article,":[62],"we":[63,107,123,172,206],"first":[64],"present":[65],"a":[66],"picture":[68],"watermarking":[71,128],"scenarios":[72],"with":[73,169],"rigorous":[74],"definitions":[75],"unifying":[76],"black-":[78],"white-box":[80],"concepts":[81],"across":[82],"watermark":[83],"embedding,":[84],"attack,":[85],"verification":[87],"phases.":[88],"Then,":[89],"from":[90,149],"perspective":[92],"data":[94,182],"diversity,":[95],"especially":[96],"adversarial":[97],"open":[99],"set":[100],"examples":[101],"overlooked":[102],"in":[103],"existing":[105,151,161],"works,":[106],"rigorously":[108,176],"reveal":[109],"vulnerability":[111],"against":[115],"black-box":[116],"ambiguity":[117,145],"attacks.":[118],"To":[119],"solve":[120],"problem,":[122],"propose":[124,173],"an":[125],"unambiguous":[126],"scheme":[129],"design":[132],"deterministically":[134],"dependent":[135],"trigger":[136],"samples":[137],"labels,":[139],"showing":[140],"that":[141,159,208],"cost":[143],"attacks":[146],"will":[147],"increase":[148],"linear":[152],"complexity":[153],"exponential":[155],"complexity.":[156],"Furthermore,":[157],"noting":[158],"definition":[162],"fidelity":[165,178,210],"solely":[167],"concerned":[168],"classification":[170,237],"accuracy,":[171],"more":[175],"evaluate":[177],"examining":[180],"training":[181],"feature":[183],"distributions":[184],"decision":[186],"boundaries":[187],"before":[188],"after":[190],"embedding.":[192],"Incorporating":[193],"proposed":[195,245],"prototype":[196],"guided":[197],"regularizer":[198],"(PGR)":[199],"fine-tune":[201],"all":[202],"layers":[203],"(FTAL)":[204],"strategy,":[205],"show":[207],"can":[211],"substantially":[213],"improved.":[214],"Experimental":[215],"results":[216],"using":[217],"two":[218],"versions":[219],"basic":[222],"ResNet18,":[223],"advanced":[224],"wide":[225],"residual":[226],"network":[227],"(WRN28_10)":[228],"EfficientNet-B0,":[230],"on":[231],"MNIST,":[232],"CIFAR-10,":[233],"CIFAR-100,":[234],"FOOD-101":[236],"tasks,":[238],"respectively,":[239],"illustrate":[240],"advantages":[242],"method.":[246]},"counts_by_year":[{"year":2026,"cited_by_count":11},{"year":2025,"cited_by_count":10},{"year":2024,"cited_by_count":11},{"year":2023,"cited_by_count":3}],"updated_date":"2026-07-29T09:40:50.615796","created_date":"2025-10-10T00:00:00"}