Method for watermarking a machine learning model

A method for watermarking a machine learning model (ML), the method comprising:

• selecting a labeled set of ML training samples of a predetermined class to train the ML model;
• selecting a first subset of the labeled set of ML training samples for use in generating a watermark into the ML model;
• selecting a first pixel pattern;
• inserting the first pixel pattern into each sample of the first subset of the labeled ML training data samples, wherein one or more of a location and transformation of the first pixel pattern is varied for each of the samples of the first subset, wherein a range of locations is determined from a base location and an offset from the base location, and wherein the base location is determined randomly;
• relabeling each sample of the first subset of labeled ML training data samples to have a different label than the first subset had before relabeling;
• training the ML model with the labeled set of ML training samples and the first subset of relabeled ML training samples having the first pixel pattern to produce a trained ML model;
• selecting a second subset of samples for use in detecting the watermark;
• inserting the first pixel pattern into each sample of the second subset, wherein the first pixel pattern is inserted into a same location of each sample of the second subset;
• and
• during inference operation of an ML model to be tested for the watermark, inputting the second subset having the first pixel pattern into the ML model being tested, wherein the watermark is determined to be present in the ML model being tested if the ML model outputs results consistent with the training to create the watermark.

A method for watermarking a machine learning (ML) model, the method comprising:

• providing a labeled set of ML training samples to use for training the ML model;
• selecting a first subset of the labeled set of ML training samples for use in generating a watermark in the ML model, wherein the first subset is of a predetermined class of images;
• providing a first pixel pattern for the watermark;
• inserting the first pixel pattern into each sample of the first subset of the labeled ML training data samples;
• relabeling each sample of the first subset of the labeled set of ML training samples with a different label;
• selecting a second subset of samples from the ML training samples in the predetermined class of images;
• providing a plurality of pixel patterns, wherein each pixel pattern of the plurality of pixel patterns is different from the first pixel pattern in at least one aspect;
• inserting a pixel pattern of the plurality of pixel patterns in each sample of the second subset of samples;
• and
• training the ML model with the labeled set of ML training samples to produce a trained and watermarked ML model.