To trace the copyright of deep neural networks, an owner can embed its identity information into its model as a watermark. The capacity of the watermark quantify the maximal volume of information that can be verified from the watermarked model. Current studies on capacity focus on the ownership verification accuracy under ordinary removal attacks and fail to capture the relationship between robustness and fidelity. This paper studies the capacity of deep neural network watermarks from an information theoretical perspective. We propose a new definition of deep neural network watermark capacity analogous to channel capacity, analyze its properties, and design an algorithm that yields a tight estimation of its upper bound under adversarial overwriting. We also propose a universal non-invasive method to secure the transmission of the identity message beyond capacity by multiple rounds of ownership verification. Our observations provide evidence for neural network owners and defenders that are curious about the tradeoff between the integrity of their ownership and the performance degradation of their products.

翻译：为了追踪深度神经网络的版权，所有者可以将其身份信息作为水印嵌入到模型中。水印容量量化了可以从加水印模型中验证的最大信息量。当前关于容量的研究侧重于普通移除攻击下的所有权验证准确性，未能捕捉鲁棒性与保真度之间的关系。本文从信息论的角度研究深度神经网络水印的容量。我们提出了一个与信道容量相类似的全新深度神经网络水印容量定义，分析了其性质，并设计了一种算法，能够在对抗性覆盖下对其上界进行紧密估计。我们还提出了一种通用的非侵入性方法，通过多轮所有权验证来保护超出容量的身份信息传输安全。我们的观察结果为好奇于自身产品所有权完整性与其性能衰减之间权衡的神经网络所有者和防御者提供了证据。