{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2026,4,7]],"date-time":"2026-04-07T16:50:19Z","timestamp":1775580619396,"version":"3.50.1"},"reference-count":25,"publisher":"Springer Science and Business Media LLC","issue":"1","license":[{"start":{"date-parts":[[2024,7,30]],"date-time":"2024-07-30T00:00:00Z","timestamp":1722297600000},"content-version":"tdm","delay-in-days":0,"URL":"https:\/\/creativecommons.org\/licenses\/by\/4.0"},{"start":{"date-parts":[[2024,7,30]],"date-time":"2024-07-30T00:00:00Z","timestamp":1722297600000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/creativecommons.org\/licenses\/by\/4.0"}],"funder":[{"name":"The National Key Research and Development Program of China","award":["2022YFB2703303"],"award-info":[{"award-number":["2022YFB2703303"]}]},{"DOI":"10.13039\/501100004750","name":"Aeronautical Science Foundation","doi-asserted-by":"crossref","award":["2022Z0660M1001"],"award-info":[{"award-number":["2022Z0660M1001"]}],"id":[{"id":"10.13039\/501100004750","id-type":"DOI","asserted-by":"crossref"}]},{"DOI":"10.13039\/501100021171","name":"Basic and Applied Basic Research Foundation of Guangdong Province","doi-asserted-by":"publisher","award":["2024A1515011887"],"award-info":[{"award-number":["2024A1515011887"]}],"id":[{"id":"10.13039\/501100021171","id-type":"DOI","asserted-by":"publisher"}]},{"name":"Guangdong Major Project of Basic and Applied Basic Research","award":["2023B0303000010"],"award-info":[{"award-number":["2023B0303000010"]}]},{"name":"Opening Project of Guangdong Province Key Laboratory of Information Security Technology","award":["2020B1212060078"],"award-info":[{"award-number":["2020B1212060078"]}]}],"content-domain":{"domain":["link.springer.com"],"crossmark-restriction":false},"short-container-title":["Vis. Intell."],"abstract":"<jats:title>Abstract<\/jats:title><jats:p>As the demand for shared pre-trained deep neural network models continues to rise, safeguarding the intellectual property of models is also increasingly significant. While existing studies predominantly concentrate on protecting pre-trained image recognition models, limited research covers pre-trained speech recognition models. In this paper, we propose the black-box watermark method to authenticate the ownership of speech recognition models. This method can mitigate the risk of unauthorized AI services being created by attackers who gain access to the pre-trained model. Accordingly, we present three watermarking methods: Gaussian noise watermark, extreme frequency Gaussian noise watermark, and unrelated audio watermark. These generated watermarks, embedded into models through training or fine-tuning, exhibit remarkable fidelity and effectiveness, backed by rigorous experimental validation. Furthermore, our experiments reveal that the extreme frequency noise backdoor enhances the robustness of the watermark compared to the Gaussian noise and unrelated audio watermark.<\/jats:p>","DOI":"10.1007\/s44267-024-00055-w","type":"journal-article","created":{"date-parts":[[2024,7,30]],"date-time":"2024-07-30T09:01:34Z","timestamp":1722330094000},"update-policy":"https:\/\/doi.org\/10.1007\/springer_crossmark_policy","source":"Crossref","is-referenced-by-count":4,"title":["Imperceptible backdoor watermarks for speech recognition model copyright protection"],"prefix":"10.1007","volume":"2","author":[{"given":"Junpei","family":"Liao","sequence":"first","affiliation":[]},{"given":"Liang","family":"Yi","sequence":"additional","affiliation":[]},{"given":"Wenxin","family":"Shi","sequence":"additional","affiliation":[]},{"ORCID":"https:\/\/orcid.org\/0000-0003-0046-5994","authenticated-orcid":false,"given":"Wenyuan","family":"Yang","sequence":"additional","affiliation":[]},{"given":"Yanmei","family":"Fang","sequence":"additional","affiliation":[]},{"given":"Xin","family":"Yang","sequence":"additional","affiliation":[]}],"member":"297","published-online":{"date-parts":[[2024,7,30]]},"reference":[{"key":"55_CR1","first-page":"269","volume-title":"Proceedings of the ACM international conference on multimedia retrieval","author":"Y. Uchida","year":"2017","unstructured":"Uchida, Y., Nagai, Y., Sakazawa, S., & Satoh, S. (2017). Embedding watermarks into deep neural networks. In Proceedings of the ACM international conference on multimedia retrieval (pp. 269\u2013277). New York: ACM."},{"key":"55_CR2","first-page":"485","volume-title":"Proceedings of the 24th international conference on architectural support for programming languages and operating systems","author":"B. D. Rouhani","year":"2019","unstructured":"Rouhani, B. D., Chen, H., & Koushanfar, F. (2019). Deepsigns: an end-to-end watermarking framework for ownership protection of deep neural networks. In Proceedings of the 24th international conference on architectural support for programming languages and operating systems (pp. 485\u2013497). New York: ACM."},{"key":"55_CR3","first-page":"993","volume-title":"Proceedings of the web conference","author":"T. Wang","year":"2021","unstructured":"Wang, T., & Kerschbaum, F. (2021). Riga: covert and robust white-box watermarking of deep neural networks. In Proceedings of the web conference (pp. 993\u20131004). New York: ACM."},{"key":"55_CR4","unstructured":"Shao, S., Yang, W., Gu, H., Qin, Z., Fan, L., Yang, Q., et\u00a0al. (2022). Fedtracker: furnishing ownership verification and traceability for federated learning model. arXiv preprint. arXiv:2211.07160."},{"key":"55_CR5","first-page":"1615","volume-title":"Proceedings of the 27th USENIX security symposium","author":"Y. Adi","year":"2018","unstructured":"Adi, Y., Baum, C., Cisse, M., Pinkas, B., & Keshet, J. (2018). Turning your weakness into a strength: watermarking deep neural networks by backdooring. In Proceedings of the 27th USENIX security symposium (pp. 1615\u20131631). Berkeley: USENIX Association."},{"key":"55_CR6","first-page":"159","volume-title":"Proceedings of the Asia conference on computer and communications security","author":"J. Zhang","year":"2018","unstructured":"Zhang, J., Gu, Z., Jang, J., Wu, H., Stoecklin, M. P., Huang, H., et al. (2018). Protecting intellectual property of deep neural networks with watermarking. In Proceedings of the Asia conference on computer and communications security (pp. 159\u2013172). New York: ACM."},{"key":"55_CR7","doi-asserted-by":"publisher","first-page":"126","DOI":"10.1145\/3359789.3359801","volume-title":"Proceedings of the annual computer security applications conference","author":"Z. Li","year":"2019","unstructured":"Li, Z., Hu, C., Zhang, Y., & Guo, S. (2019). How to prove your model belongs to you: a blind-watermark based framework to protect intellectual property of DNN. In Proceedings of the annual computer security applications conference (pp. 126\u2013137). New York: ACM."},{"key":"55_CR8","unstructured":"Chen, H., Rouhani, B. D., & Koushanfar, F. (2019). Blackmarks: blackbox multibit watermarking for deep neural networks. arXiv preprint. arXiv:1904.00344."},{"issue":"13","key":"55_CR9","doi-asserted-by":"publisher","first-page":"9233","DOI":"10.1007\/s00521-019-04434-z","volume":"32","author":"E. Le Merrer","year":"2020","unstructured":"Le Merrer, E., Perez, P., & Tr\u00e9dan, G. (2020). Adversarial frontier stitching for remote neural network watermarking. Neural Computing & Applications, 32(13), 9233\u20139244.","journal-title":"Neural Computing & Applications"},{"key":"55_CR10","doi-asserted-by":"publisher","first-page":"488","DOI":"10.1016\/j.comcom.2019.12.016","volume":"150","author":"J. Zhao","year":"2020","unstructured":"Zhao, J., Hu, Q., Liu, G., Ma, X., Chen, F., & Hassan, M. M. (2020). AFA: adversarial fingerprinting authentication for deep neural networks. Computer Communications, 150, 488\u2013497.","journal-title":"Computer Communications"},{"key":"55_CR11","doi-asserted-by":"publisher","first-page":"4417","DOI":"10.1145\/3474085.3475591","volume-title":"Proceedings of the 29th ACM international conference on multimedia","author":"S. Szyller","year":"2021","unstructured":"Szyller, S., Atli, B. G., Marchal, S., & Asokan, N. (2021). Dawn: dynamic adversarial watermarking of neural networks. In Proceedings of the 29th ACM international conference on multimedia (pp. 4417\u20134425). New York: ACM."},{"key":"55_CR12","first-page":"1937","volume-title":"Proceedings of the 30th USENIX security symposium","author":"H. Jia","year":"2021","unstructured":"Jia, H., Choquette-Choo, C. A., Chandrasekaran, V., & Papernot, N. (2021). Entangled watermarks as a defense against model extraction. In Proceedings of the 30th USENIX security symposium (pp. 1937\u20131954). Berkeley: USENIX Association."},{"issue":"10","key":"55_CR13","doi-asserted-by":"publisher","first-page":"6122","DOI":"10.1109\/TPAMI.2021.3088846","volume":"44","author":"L. Fan","year":"2021","unstructured":"Fan, L., Ng, K. W., Chan, C. S., & Yang, Q. (2021). Deepipr: deep neural network ownership verification with passports. IEEE Transactions on Pattern Analysis and Machine Intelligence, 44(10), 6122\u20136139.","journal-title":"IEEE Transactions on Pattern Analysis and Machine Intelligence"},{"key":"55_CR14","first-page":"1464","volume-title":"Proceedings of the 36nd AAAI conference on artificial intelligence","author":"Y. Li","year":"2022","unstructured":"Li, Y., Zhu, L., Jia, X., Jiang, Y., Xia, S. T., & Cao, X. (2022). Defending against model stealing via verifying embedded external features. In Proceedings of the 36nd AAAI conference on artificial intelligence (pp. 1464\u20131472). Palo Alto: AAAI Press."},{"key":"55_CR15","first-page":"13430","volume-title":"Proceedings of the IEEE\/CVF conference on computer vision and pattern recognition","author":"Z. Peng","year":"2022","unstructured":"Peng, Z., Li, S., Chen, G., Zhang, C., Zhu, H., & Xue, M. (2022). Fingerprinting deep neural networks globally via universal adversarial perturbations. In Proceedings of the IEEE\/CVF conference on computer vision and pattern recognition (pp. 13430\u201313439). Piscataway: IEEE."},{"key":"55_CR16","first-page":"776","volume-title":"Proceedings of the 31st international joint conference on artificial intelligence","author":"K. Yang","year":"2022","unstructured":"Yang, K., Wang, R., & Wang, L. (2022). Metafinger: fingerprinting the deep neural networks with meta-training. In Proceedings of the 31st international joint conference on artificial intelligence (pp. 776\u2013782). Cham: Springer."},{"key":"55_CR17","first-page":"787","volume-title":"Proceedings of the IEEE symposium on security and privacy","author":"N. Lukas","year":"2022","unstructured":"Lukas, N., Jiang, E., Li, X., & Kerschbaum, F. (2022). Sok: how robust is image classification deep neural network watermarking? In Proceedings of the IEEE symposium on security and privacy (pp. 787\u2013804). Piscataway: IEEE."},{"issue":"3","key":"55_CR18","doi-asserted-by":"publisher","DOI":"10.3390\/sym14030619","volume":"14","author":"Y. Wang","year":"2022","unstructured":"Wang, Y., & Wu, H. (2022). Protecting the intellectual property of speaker recognition model by black-box watermarking in the frequency domain. Symmetry, 14(3), 619.","journal-title":"Symmetry"},{"key":"55_CR19","doi-asserted-by":"publisher","first-page":"462","DOI":"10.1007\/978-3-030-47436-2_35","volume-title":"Proceedings of advances in knowledge discovery and data mining","author":"Q. Zhong","year":"2020","unstructured":"Zhong, Q., Zhang, L. Y., Zhang, J., Gao, L., & Xiang, Y. (2020). Protecting IP of deep neural networks with watermarking: a new label helps. In Proceedings of advances in knowledge discovery and data mining (pp. 462\u2013474). Cham: Springer."},{"key":"55_CR20","first-page":"1","volume-title":"Proceedings of the IEEE\/ACM international conference on computer-aided design","author":"J. Guo","year":"2018","unstructured":"Guo, J., & Potkonjak, M. (2018). Watermarking deep neural networks for embedded systems. In Proceedings of the IEEE\/ACM international conference on computer-aided design (pp. 1\u20138). Piscataway: IEEE."},{"key":"55_CR21","first-page":"2414","volume-title":"Proceedings of the IEEE international conference on systems, man, and cybernetics","author":"X. Liu","year":"2021","unstructured":"Liu, X., Shao, S., Yang, Y., Wu, K., Yang, W., & Fang, H. (2021). Secure federated learning model verification: a client-side backdoor triggered watermarking scheme. In Proceedings of the IEEE international conference on systems, man, and cybernetics (pp. 2414\u20132419). Piscataway: IEEE."},{"issue":"1","key":"55_CR22","doi-asserted-by":"publisher","first-page":"1","DOI":"10.1145\/3630636","volume":"15","author":"W. Yang","year":"2023","unstructured":"Yang, W., Shao, S., Yang, Y., Liu, X., Liu, X., Xia, Z., et al. (2023). Watermarking in secure federated learning: a verification framework based on client-side backdooring. ACM Transactions on Intelligent Systems and Technology, 15(1), 1\u201325.","journal-title":"ACM Transactions on Intelligent Systems and Technology"},{"key":"55_CR23","doi-asserted-by":"crossref","unstructured":"Garofolo, J. S., Lamel, L. F., Fisher, W. M., Fiscus, J. Q., & Pallett, D. S. (1993). Darpa TIMIT acoustic-phonetic continous speech corpus CD-ROM. NIST speech disc 1-1.1. Technical report, NASA.","DOI":"10.6028\/NIST.IR.4930"},{"key":"55_CR24","doi-asserted-by":"publisher","first-page":"1041","DOI":"10.1145\/2647868.2655045","volume-title":"Proceedings of the 22nd ACM international conference on multimedia","author":"J. Salamon","year":"2014","unstructured":"Salamon, J., Jacoby, C., & Bello, J. P. (2014). A dataset and taxonomy for urban sound research. In Proceedings of the 22nd ACM international conference on multimedia (pp. 1041\u20131044). New York: ACM."},{"key":"55_CR25","first-page":"1021","volume-title":"Proceedings of the IEEE spoken language technology workshop","author":"M. Ravanelli","year":"2018","unstructured":"Ravanelli, M., & Bengio, Y. (2018). Speaker recognition from raw waveform with sincnet. In Proceedings of the IEEE spoken language technology workshop (pp. 1021\u20131028). Piscataway: IEEE."}],"container-title":["Visual Intelligence"],"original-title":[],"language":"en","link":[{"URL":"https:\/\/link.springer.com\/content\/pdf\/10.1007\/s44267-024-00055-w.pdf","content-type":"application\/pdf","content-version":"vor","intended-application":"text-mining"},{"URL":"https:\/\/link.springer.com\/article\/10.1007\/s44267-024-00055-w\/fulltext.html","content-type":"text\/html","content-version":"vor","intended-application":"text-mining"},{"URL":"https:\/\/link.springer.com\/content\/pdf\/10.1007\/s44267-024-00055-w.pdf","content-type":"application\/pdf","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2024,7,30]],"date-time":"2024-07-30T09:15:59Z","timestamp":1722330959000},"score":1,"resource":{"primary":{"URL":"https:\/\/link.springer.com\/10.1007\/s44267-024-00055-w"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2024,7,30]]},"references-count":25,"journal-issue":{"issue":"1","published-online":{"date-parts":[[2024,12]]}},"alternative-id":["55"],"URL":"https:\/\/doi.org\/10.1007\/s44267-024-00055-w","relation":{},"ISSN":["2731-9008"],"issn-type":[{"value":"2731-9008","type":"electronic"}],"subject":[],"published":{"date-parts":[[2024,7,30]]},"assertion":[{"value":"31 October 2023","order":1,"name":"received","label":"Received","group":{"name":"ArticleHistory","label":"Article History"}},{"value":"1 July 2024","order":2,"name":"revised","label":"Revised","group":{"name":"ArticleHistory","label":"Article History"}},{"value":"1 July 2024","order":3,"name":"accepted","label":"Accepted","group":{"name":"ArticleHistory","label":"Article History"}},{"value":"30 July 2024","order":4,"name":"first_online","label":"First Online","group":{"name":"ArticleHistory","label":"Article History"}},{"order":1,"name":"Ethics","group":{"name":"EthicsHeading","label":"Declarations"}},{"value":"The authors have no relevant financial or non-financial interests to disclose.","order":2,"name":"Ethics","group":{"name":"EthicsHeading","label":"Competing interests"}}],"article-number":"23"}}