Neural network watermarking

A non-transitory computer readable storage medium having stored thereon a computer program comprising program instructions configured to be loadable into a data-processing unit, comprising a processor and a memory associated with or integral to the data-processing unit, when loaded into the data-processing unit, the computer program is configured to be stored in the memory, the computer program, when loaded into and run by the processor is configured to perform a method for training a neural network and embedding a watermark in the neural network, the watermark for proving ownership of the neural network, the neural network comprising a plurality of trainable parameters associated with a number of network nodes, the method comprising:

• splitting the plurality of trainable parameters into a first set of trainable parameters and a second set of trainable parameters;
• inputting a first set of training samples to the neural network;
• training the neural network by iterating the first set of training samples through the neural self learning network to update the first set of trainable parameters and hindering the second set of trainable parameters to be updated during iteration of the first set of training samples;
• inputting a second set of training samples, to the neural network;
• and
• embedding the watermark by iterating the second set of training samples through the neural network to update the second set of trainable parameters and hindering the first set of trainable parameters to be updated during iteration of the second set of training samples.

An apparatus for training a neural network and embedding a watermark in the neural network, the watermark for proving ownership of the neural network, the neural network comprising a plurality of trainable parameters associated with a number of network nodes, the apparatus comprising a controller configured to cause:

• splitting of the plurality of trainable parameters into a first set of trainable parameters and a second set of trainable parameters;
• inputting of a first set of training samples to the neural network;
• training of the neural network by iteration of the first set of training samples through the neural self learning network to update the first set of trainable parameters and hindering the second set of trainable parameters to be updated during iteration of the first set of training samples;
• inputting of a second set of training samples, to the neural network;
• and
• embedding of the watermark by iteration of the second set of training samples through the neural network to update the second set of trainable parameters and hindering the first set of trainable parameters to be updated during iteration of the second set of training samples.