{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,2,10]],"date-time":"2026-02-10T13:43:29Z","timestamp":1770731009703,"version":"3.49.0"},"reference-count":60,"publisher":"Springer Science and Business Media LLC","issue":"13","license":[{"start":{"date-parts":[[2024,2,21]],"date-time":"2024-02-21T00:00:00Z","timestamp":1708473600000},"content-version":"tdm","delay-in-days":0,"URL":"https:\/\/www.springernature.com\/gp\/researchers\/text-and-data-mining"},{"start":{"date-parts":[[2024,2,21]],"date-time":"2024-02-21T00:00:00Z","timestamp":1708473600000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/www.springernature.com\/gp\/researchers\/text-and-data-mining"}],"content-domain":{"domain":["link.springer.com"],"crossmark-restriction":false},"short-container-title":["Neural Comput & Applic"],"published-print":{"date-parts":[[2024,5]]},"DOI":"10.1007\/s00521-024-09469-5","type":"journal-article","created":{"date-parts":[[2024,2,21]],"date-time":"2024-02-21T13:02:38Z","timestamp":1708520558000},"page":"7421-7438","update-policy":"https:\/\/doi.org\/10.1007\/springer_crossmark_policy","source":"Crossref","is-referenced-by-count":7,"title":["Deep neural networks watermark via universal deep hiding and metric learning"],"prefix":"10.1007","volume":"36","author":[{"given":"Zhicheng","family":"Ye","sequence":"first","affiliation":[]},{"given":"Xinpeng","family":"Zhang","sequence":"additional","affiliation":[]},{"given":"Guorui","family":"Feng","sequence":"additional","affiliation":[]}],"member":"297","published-online":{"date-parts":[[2024,2,21]]},"reference":[{"key":"9469_CR1","doi-asserted-by":"crossref","unstructured":"He K, Zhang X, Ren S, Sun J (2016) Deep residual learning for image recognition. In: Proceedings of the IEEE conference on computer vision and pattern recognition, pp. 770\u2013778","DOI":"10.1109\/CVPR.2016.90"},{"key":"9469_CR2","first-page":"1","volume":"2","author":"Y Ding","year":"2022","unstructured":"Ding Y, Hua L, Li S (2022) Research on computer vision enhancement in intelligent robot based on machine learning and deep learning. Neural Comput Appl 2:1\u201313","journal-title":"Neural Comput Appl"},{"key":"9469_CR3","doi-asserted-by":"publisher","first-page":"12","DOI":"10.1155\/2018\/7068349","volume":"2018","author":"A Voulodimos","year":"2018","unstructured":"Voulodimos A, Doulamis N, Doulamis A, Protopapadakis E (2018) Deep learning for computer vision: a brief review. Comput Intell Neurosci 2018:12","journal-title":"Comput Intell Neurosci"},{"issue":"10","key":"9469_CR4","doi-asserted-by":"publisher","first-page":"1533","DOI":"10.1109\/TASLP.2014.2339736","volume":"22","author":"O Abdel-Hamid","year":"2014","unstructured":"Abdel-Hamid O, Mohamed A-R, Jiang H, Deng L, Penn G, Yu D (2014) Convolutional neural networks for speech recognition. IEEE\/ACM Trans Audio Speech Lang Process 22(10):1533\u20131545","journal-title":"IEEE\/ACM Trans Audio Speech Lang Process"},{"key":"9469_CR5","doi-asserted-by":"publisher","first-page":"9089","DOI":"10.1007\/s00521-020-05672-2","volume":"33","author":"BF Zaidi","year":"2021","unstructured":"Zaidi BF, Selouani SA, Boudraa M, Sidi Yakoub M (2021) Deep neural network architectures for dysarthric speech analysis and recognition. Neural Comput Appl 33:9089\u20139108","journal-title":"Neural Comput Appl"},{"key":"9469_CR6","first-page":"603","volume":"12","author":"K Chowdhary","year":"2020","unstructured":"Chowdhary K (2020) Natural language processing. Fundam Artif Intell 12:603\u2013649","journal-title":"Fundam Artif Intell"},{"key":"9469_CR7","unstructured":"Devlin J, Chang M-W, Lee K, Toutanova K (2018) Bert: pre-training of deep bidirectional transformers for language understanding. arXiv preprint arXiv:1810.04805"},{"key":"9469_CR8","doi-asserted-by":"publisher","first-page":"325","DOI":"10.1007\/s00521-008-0181-7","volume":"17","author":"C Sun","year":"2008","unstructured":"Sun C, Yu W (2008) Neural networks for control, robotics and diagnostics. Neural Comput Appl 17:325\u2013326","journal-title":"Neural Comput Appl"},{"issue":"13","key":"9469_CR9","doi-asserted-by":"publisher","first-page":"9029","DOI":"10.1007\/s00521-019-04412-5","volume":"32","author":"E Bayraktar","year":"2020","unstructured":"Bayraktar E, Yigit CB, Boyraz P (2020) Object manipulation with a variable-stiffness robotic mechanism using deep neural networks for visual semantics and load estimation. Neural Comput Appl 32(13):9029\u20139045","journal-title":"Neural Comput Appl"},{"key":"9469_CR10","doi-asserted-by":"crossref","unstructured":"Orekondy T, Schiele B, Fritz M (2019) Knockoff nets: stealing functionality of black-box models. In: Proceedings of the IEEE\/CVF conference on computer vision and pattern recognition, pp 4954\u20134963","DOI":"10.1109\/CVPR.2019.00509"},{"key":"9469_CR11","unstructured":"Tram\u00e8r F, Zhang F, Juels A, Reiter MK, Ristenpart T (2016) Stealing machine learning models via prediction $$\\{$$APIs$$\\}$$. In: 25th USENIX security symposium (USENIX Security 16), pp 601\u2013618"},{"key":"9469_CR12","doi-asserted-by":"crossref","unstructured":"Chen H, Rouhani BD, Fu C, Zhao J, Koushanfar F (2019) Deepmarks: a secure fingerprinting framework for digital rights management of deep learning models. In: Proceedings of the 2019 on international conference on multimedia retrieval, pp 105\u2013113","DOI":"10.1145\/3323873.3325042"},{"key":"9469_CR13","doi-asserted-by":"crossref","unstructured":"Darvish\u00a0Rouhani B, Chen H, Koushanfar F (2019) Deepsigns: an end-to-end watermarking framework for ownership protection of deep neural networks. In: Proceedings of the twenty-fourth international conference on architectural support for programming languages and operating systems, pp 485\u2013497","DOI":"10.1145\/3297858.3304051"},{"key":"9469_CR14","first-page":"20","volume":"32","author":"L Fan","year":"2019","unstructured":"Fan L, Ng KW, Chan CS (2019) Rethinking deep neural network ownership verification: embedding passports to defeat ambiguity attacks. Adv Neural Inf Process Syst 32:20","journal-title":"Adv Neural Inf Process Syst"},{"key":"9469_CR15","doi-asserted-by":"crossref","unstructured":"Uchida Y, Nagai Y, Sakazawa S, Satoh S (2017) Embedding watermarks into deep neural networks. In: Proceedings of the 2017 ACM on international conference on multimedia retrieval, pp 269\u2013277","DOI":"10.1145\/3078971.3078974"},{"key":"9469_CR16","doi-asserted-by":"crossref","unstructured":"Wang T, Kerschbaum F (2021) Riga: covert and robust white-box watermarking of deep neural networks. In: Proceedings of the web conference 2021, pp 993\u20131004","DOI":"10.1145\/3442381.3450000"},{"key":"9469_CR17","doi-asserted-by":"crossref","unstructured":"Zhao X, Yao Y, Wu H, Zhang X (2021) Structural watermarking to deep neural networks via network channel pruning. In: 2021 IEEE international workshop on information forensics and security (WIFS). IEEE, pp 1\u20136","DOI":"10.1109\/WIFS53200.2021.9648376"},{"key":"9469_CR18","volume":"63","author":"Y Li","year":"2021","unstructured":"Li Y, Tondi B, Barni M (2021) Spread-transform dither modulation watermarking of deep neural network. J Inf Secur Appl 63:103004","journal-title":"J Inf Secur Appl"},{"key":"9469_CR19","doi-asserted-by":"crossref","unstructured":"Ribeiro M, Grolinger K, Capretz MA (2015) Mlaas: machine learning as a service. In: 2015 IEEE 14th international conference on machine learning and applications (ICMLA). IEEE, pp 896\u2013902","DOI":"10.1109\/ICMLA.2015.152"},{"key":"9469_CR20","unstructured":"Adi Y, Baum C, Cisse M, Pinkas B, Keshet J (2018) Turning your weakness into a strength: watermarking deep neural networks by backdooring. In: 27th USENIX security symposium (USENIX Security 18), pp 1615\u20131631"},{"key":"9469_CR21","doi-asserted-by":"crossref","unstructured":"Guo J, Potkonjak M (2018) Watermarking deep neural networks for embedded systems. In: 2018 IEEE\/ACM international conference on computer-aided design (ICCAD). IEEE, pp 1\u20138","DOI":"10.1145\/3240765.3240862"},{"key":"9469_CR22","unstructured":"Jia H, Choquette-Choo CA, Chandrasekaran V, Papernot N (2021) Entangled watermarks as a defense against model extraction. In: 30th USENIX security symposium (USENIX Security 21), pp 1937\u20131954"},{"issue":"13","key":"9469_CR23","doi-asserted-by":"publisher","first-page":"9233","DOI":"10.1007\/s00521-019-04434-z","volume":"32","author":"E Le Merrer","year":"2020","unstructured":"Le Merrer E, Perez P, Tr\u00e9dan G (2020) Adversarial frontier stitching for remote neural network watermarking. Neural Comput Appl 32(13):9233\u20139244","journal-title":"Neural Comput Appl"},{"key":"9469_CR24","doi-asserted-by":"crossref","unstructured":"Li Z, Hu C, Zhang Y, Guo S (2019) How to prove your model belongs to you: a blind-watermark based framework to protect intellectual property of DNN. In: Proceedings of the 35th annual computer security applications conference, pp 126\u2013137","DOI":"10.1145\/3359789.3359801"},{"key":"9469_CR25","first-page":"1","volume":"5","author":"M Xue","year":"2022","unstructured":"Xue M, Sun S, Zhang Y, Wang J, Liu W (2022) Active intellectual property protection for deep neural networks through stealthy backdoor and users\u2019 identities authentication. Appl Intell 5:1\u201315","journal-title":"Appl Intell"},{"key":"9469_CR26","doi-asserted-by":"crossref","unstructured":"Zhang J, Gu Z, Jang J, Wu H, Stoecklin MP, Huang H, Molloy I (2018) Protecting intellectual property of deep neural networks with watermarking. In: Proceedings of the 2018 on asia conference on computer and communications security, pp 159\u2013172","DOI":"10.1145\/3196494.3196550"},{"key":"9469_CR27","doi-asserted-by":"publisher","DOI":"10.1016\/j.patcog.2023.109844","volume":"144","author":"G Hua","year":"2023","unstructured":"Hua G, Teoh ABJ (2023) Deep fidelity in DNN watermarking: a study of backdoor watermarking for classification models. Pattern Recogn 144:109844","journal-title":"Pattern Recogn"},{"key":"9469_CR28","doi-asserted-by":"crossref","unstructured":"Li Y, Zhu L, Jia X, Jiang Y, Xia S-T, Cao X (2022) Defending against model stealing via verifying embedded external features. In: Proceedings of the AAAI conference on artificial intelligence, vol 36, pp 1464\u20131472","DOI":"10.1609\/aaai.v36i2.20036"},{"key":"9469_CR29","doi-asserted-by":"crossref","unstructured":"Cao X, Jia J, Gong NZ (2021) IPGuard: protecting intellectual property of deep neural networks via fingerprinting the classification boundary. In: Proceedings of the 2021 ACM asia conference on computer and communications security, pp 14\u201325","DOI":"10.1145\/3433210.3437526"},{"key":"9469_CR30","unstructured":"Lukas N, Zhang Y, Kerschbaum F (2019) Deep neural network fingerprinting by conferrable adversarial examples. arXiv preprint arXiv:1912.00888"},{"key":"9469_CR31","doi-asserted-by":"crossref","unstructured":"Peng Z, Li S, Chen G, Zhang C, Zhu H, Xue M (2022) Fingerprinting deep neural networks globally via universal adversarial perturbations. In: Proceedings of the IEEE\/CVF conference on computer vision and pattern recognition, pp 13430\u201313439","DOI":"10.1109\/CVPR52688.2022.01307"},{"key":"9469_CR32","doi-asserted-by":"crossref","unstructured":"Wang S, Chang C-H (2021) Fingerprinting deep neural networks\u2014a deepfool approach. In: 2021 IEEE international symposium on circuits and systems (ISCAS). IEEE, pp 1\u20135","DOI":"10.1109\/ISCAS51556.2021.9401119"},{"key":"9469_CR33","doi-asserted-by":"publisher","first-page":"488","DOI":"10.1016\/j.comcom.2019.12.016","volume":"150","author":"J Zhao","year":"2020","unstructured":"Zhao J, Hu Q, Liu G, Ma X, Chen F, Hassan MM (2020) AFA: adversarial fingerprinting authentication for deep neural networks. Comput Commun 150:488\u2013497","journal-title":"Comput Commun"},{"key":"9469_CR34","doi-asserted-by":"publisher","first-page":"2977","DOI":"10.1109\/TIFS.2022.3198267","volume":"17","author":"Y Zheng","year":"2022","unstructured":"Zheng Y, Wang S, Chang C-H (2022) A DNN fingerprint for non-repudiable model ownership identification and piracy detection. IEEE Trans Inf Forensics Secur 17:2977\u20132989","journal-title":"IEEE Trans Inf Forensics Secur"},{"key":"9469_CR35","doi-asserted-by":"crossref","unstructured":"Gao Y, Xu C, Wang D, Chen S, Ranasinghe DC, Nepal S (2019) Strip: a defence against trojan attacks on deep neural networks. In: Proceedings of the 35th annual computer security applications conference, pp 113\u2013125","DOI":"10.1145\/3359789.3359790"},{"key":"9469_CR36","doi-asserted-by":"crossref","unstructured":"Wang B, Yao Y, Shan S, Li H, Viswanath B, Zheng H, Zhao BY (2019) Neural cleanse: identifying and mitigating backdoor attacks in neural networks. In: 2019 IEEE symposium on security and privacy (SP). IEEE, pp 707\u2013723","DOI":"10.1109\/SP.2019.00031"},{"key":"9469_CR37","doi-asserted-by":"crossref","unstructured":"Hitaj D, Hitaj B, Mancini LV (2019) Evasion attacks against watermarking techniques found in MLaaS systems. In: 2019 Sixth international conference on software defined systems (SDS). IEEE, pp 55\u201363","DOI":"10.1109\/SDS.2019.8768572"},{"key":"9469_CR38","doi-asserted-by":"crossref","unstructured":"Namba R, Sakuma J (2019) Robust watermarking of neural network with exponential weighting. In: Proceedings of the 2019 ACM asia conference on computer and communications security, pp 228\u2013240","DOI":"10.1145\/3321705.3329808"},{"key":"9469_CR39","doi-asserted-by":"crossref","unstructured":"Neeta D, Snehal K, Jacobs D (2006) Implementation of LSB steganography and its evaluation for various bits. In: 2006 1st International conference on digital information management. IEEE, pp 173\u2013178","DOI":"10.1109\/ICDIM.2007.369349"},{"key":"9469_CR40","first-page":"1","volume":"5","author":"L Zhang","year":"2023","unstructured":"Zhang L, Lu Y, Li J, Chen F, Lu G, Zhang D (2023) Deep adaptive hiding network for image hiding using attentive frequency extraction and gradual depth extraction. Neural Comput Appl 5:1\u201319","journal-title":"Neural Comput Appl"},{"key":"9469_CR41","unstructured":"Zhang C, Lin C, Benz P, Chen K, Zhang W, Kweon IS (2021) A brief survey on deep learning based data hiding, steganography and watermarking. arXiv e-prints 2103"},{"key":"9469_CR42","unstructured":"Madry A, Makelov A, Schmidt L, Tsipras D, Vladu A (2017) Towards deep learning models resistant to adversarial attacks. arXiv preprint arXiv:1706.06083"},{"issue":"6","key":"9469_CR43","doi-asserted-by":"publisher","first-page":"908","DOI":"10.1109\/TAI.2021.3133824","volume":"3","author":"M Xue","year":"2021","unstructured":"Xue M, Zhang Y, Wang J, Liu W (2021) Intellectual property protection for deep learning models: taxonomy, methods, attacks, and evaluations. IEEE Trans Artif Intell 3(6):908\u2013923","journal-title":"IEEE Trans Artif Intell"},{"key":"9469_CR44","doi-asserted-by":"crossref","unstructured":"Chen X, Wang W, Bender C, Ding Y, Jia R, Li B, Song D (2021) Refit: a unified watermark removal framework for deep learning systems with limited data. In: Proceedings of the 2021 ACM asia conference on computer and communications security, pp 321\u2013335","DOI":"10.1145\/3433210.3453079"},{"key":"9469_CR45","doi-asserted-by":"crossref","unstructured":"Liu X, Li F, Wen B, Li Q (2021) Removing backdoor-based watermarks in neural networks with limited data. In: 2020 25th International conference on pattern recognition (ICPR). IEEE, pp 10149\u201310156","DOI":"10.1109\/ICPR48806.2021.9412684"},{"key":"9469_CR46","doi-asserted-by":"crossref","unstructured":"Shafieinejad M, Lukas N, Wang J, Li X, Kerschbaum F (2021) On the robustness of backdoor-based watermarking in deep neural networks. In: Proceedings of the 2021 ACM workshop on information hiding and multimedia security, pp 177\u2013188","DOI":"10.1145\/3437880.3460401"},{"key":"9469_CR47","unstructured":"Zhu M, Gupta S (2017) To prune, or not to prune: exploring the efficacy of pruning for model compression. arXiv preprint arXiv:1710.01878"},{"issue":"1","key":"9469_CR48","first-page":"6869","volume":"18","author":"I Hubara","year":"2017","unstructured":"Hubara I, Courbariaux M, Soudry D, El-Yaniv R, Bengio Y (2017) Quantized neural networks: training neural networks with low precision weights and activations. J Mach Learn Res 18(1):6869\u20136898","journal-title":"J Mach Learn Res"},{"key":"9469_CR49","unstructured":"Jagielski M, Carlini N, Berthelot D, Kurakin A, Papernot N (2020) High accuracy and high fidelity extraction of neural networks. In: 29th USENIX security symposium (USENIX Security 20), pp 1345\u20131362"},{"key":"9469_CR50","doi-asserted-by":"crossref","unstructured":"Selvaraju RR, Cogswell M, Das A, Vedantam R, Parikh D, Batra D (2017) Grad-cam: visual explanations from deep networks via gradient-based localization. In: Proceedings of the IEEE international conference on computer vision, pp 618\u2013626","DOI":"10.1109\/ICCV.2017.74"},{"key":"9469_CR51","doi-asserted-by":"crossref","unstructured":"Doan BG, Abbasnejad E, Ranasinghe DC (2020) Februus: input purification defense against trojan attacks on deep neural network systems. In: Annual computer security applications conference, pp 897\u2013912","DOI":"10.1145\/3427228.3427264"},{"key":"9469_CR52","first-page":"10223","volume":"33","author":"C Zhang","year":"2020","unstructured":"Zhang C, Benz P, Karjauv A, Sun G, Kweon IS (2020) Udh: universal deep hiding for steganography, watermarking, and light field messaging. Adv Neural Inf Process Syst 33:10223\u201310234","journal-title":"Adv Neural Inf Process Syst"},{"issue":"4","key":"9469_CR53","doi-asserted-by":"publisher","first-page":"600","DOI":"10.1109\/TIP.2003.819861","volume":"13","author":"Z Wang","year":"2004","unstructured":"Wang Z, Bovik AC, Sheikh HR, Simoncelli EP (2004) Image quality assessment: from error visibility to structural similarity. IEEE Trans Image Process 13(4):600\u2013612","journal-title":"IEEE Trans Image Process"},{"key":"9469_CR54","doi-asserted-by":"crossref","unstructured":"Schroff F, Kalenichenko D, Philbin J (2015) Facenet: a unified embedding for face recognition and clustering. In: Proceedings of the IEEE conference on computer vision and pattern recognition, pp 815\u2013823","DOI":"10.1109\/CVPR.2015.7298682"},{"key":"9469_CR55","unstructured":"Krizhevsky A, Hinton G et al (2009) Learning multiple layers of features from tiny images"},{"key":"9469_CR56","doi-asserted-by":"crossref","unstructured":"Stallkamp J, Schlipsing M, Salmen J, Igel C (2011) The German traffic sign recognition benchmark: a multi-class classification competition. In: The 2011 international joint conference on neural networks. IEEE, pp 1453\u20131460","DOI":"10.1109\/IJCNN.2011.6033395"},{"issue":"7","key":"9469_CR57","first-page":"3","volume":"7","author":"Y Le","year":"2015","unstructured":"Le Y, Yang X (2015) Tiny imagenet visual recognition challenge. CS231N 7(7):3","journal-title":"CS231N"},{"key":"9469_CR58","first-page":"54","volume":"32","author":"A Paszke","year":"2019","unstructured":"Paszke A, Gross S, Massa F, Lerer A, Bradbury J, Chanan G, Killeen T, Lin Z, Gimelshein N, Antiga L et al (2019) Pytorch: an imperative style, high-performance deep learning library. Adv Neural Inf Process Syst 32:54","journal-title":"Adv Neural Inf Process Syst"},{"key":"9469_CR59","unstructured":"Chou E, Tram\u00e8r F, Pellegrino G, Boneh D (2018) Sentinet: detecting physical attacks against deep learning systems. arXiv preprint arXiv:1812.00292"},{"issue":"346","key":"9469_CR60","doi-asserted-by":"publisher","first-page":"383","DOI":"10.1080\/01621459.1974.10482962","volume":"69","author":"FR Hampel","year":"1974","unstructured":"Hampel FR (1974) The influence curve and its role in robust estimation. J Am Stat Assoc 69(346):383\u2013393","journal-title":"J Am Stat Assoc"}],"container-title":["Neural Computing and Applications"],"original-title":[],"language":"en","link":[{"URL":"https:\/\/link.springer.com\/content\/pdf\/10.1007\/s00521-024-09469-5.pdf","content-type":"application\/pdf","content-version":"vor","intended-application":"text-mining"},{"URL":"https:\/\/link.springer.com\/article\/10.1007\/s00521-024-09469-5\/fulltext.html","content-type":"text\/html","content-version":"vor","intended-application":"text-mining"},{"URL":"https:\/\/link.springer.com\/content\/pdf\/10.1007\/s00521-024-09469-5.pdf","content-type":"application\/pdf","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2024,3,21]],"date-time":"2024-03-21T13:19:10Z","timestamp":1711027150000},"score":1,"resource":{"primary":{"URL":"https:\/\/link.springer.com\/10.1007\/s00521-024-09469-5"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2024,2,21]]},"references-count":60,"journal-issue":{"issue":"13","published-print":{"date-parts":[[2024,5]]}},"alternative-id":["9469"],"URL":"https:\/\/doi.org\/10.1007\/s00521-024-09469-5","relation":{},"ISSN":["0941-0643","1433-3058"],"issn-type":[{"value":"0941-0643","type":"print"},{"value":"1433-3058","type":"electronic"}],"subject":[],"published":{"date-parts":[[2024,2,21]]},"assertion":[{"value":"4 July 2023","order":1,"name":"received","label":"Received","group":{"name":"ArticleHistory","label":"Article History"}},{"value":"14 January 2024","order":2,"name":"accepted","label":"Accepted","group":{"name":"ArticleHistory","label":"Article History"}},{"value":"21 February 2024","order":3,"name":"first_online","label":"First Online","group":{"name":"ArticleHistory","label":"Article History"}},{"order":1,"name":"Ethics","group":{"name":"EthicsHeading","label":"Declarations"}},{"value":"The authors declare that they have no conflict of interest.","order":2,"name":"Ethics","group":{"name":"EthicsHeading","label":"Conflict of interest"}}]}}