{"status":"ok","message-type":"work","message-version":"1.0.0","message":{"indexed":{"date-parts":[[2025,10,31]],"date-time":"2025-10-31T08:08:26Z","timestamp":1761898106367,"version":"build-2065373602"},"reference-count":48,"publisher":"MDPI AG","issue":"7","license":[{"start":{"date-parts":[[2025,7,8]],"date-time":"2025-07-08T00:00:00Z","timestamp":1751932800000},"content-version":"vor","delay-in-days":0,"URL":"https:\/\/creativecommons.org\/licenses\/by\/4.0\/"}],"content-domain":{"domain":[],"crossmark-restriction":false},"short-container-title":["Symmetry"],"abstract":"<jats:p>Because neural networks pervade many industrial domains and are increasingly complex and accurate, the trained models themselves have become valuable intellectual properties. Developing highly accurate models demands increasingly higher investments of time, capital, and expertise. Many of these models are commonly deployed in cloud services and on resource-constrained edge devices. Consequently, safeguarding them is critically important. Neural network watermarking offers a practical solution to address this need by embedding a unique signature, either as a hidden bit-string or as a distinctive response to specially crafted \u201ctrigger\u201d inputs. This allows owners to subsequently prove model ownership even if an adversary attempts to remove the watermark through attacks. In this manuscript, we adapt three state-of-the-art watermarking methods to \u201ctiny\u201d neural networks deployed on edge platforms by exploiting symmetry-related properties that ensure robustness and efficiency. In the context of machine learning, \u201ctiny\u201d is broadly used as a term referring to artificial intelligence techniques deployed in low-energy systems in the mW range and below, e.g., sensors and microcontrollers. We evaluate the robustness of the selected techniques by simulating attacks aimed at erasing the watermark while preserving the model\u2019s original performances. The results before and after attacks demonstrate the effectiveness of these watermarking schemes in protecting neural network intellectual property without degrading the original accuracy.<\/jats:p>","DOI":"10.3390\/sym17071094","type":"journal-article","created":{"date-parts":[[2025,7,8]],"date-time":"2025-07-08T07:31:57Z","timestamp":1751959917000},"page":"1094","update-policy":"https:\/\/doi.org\/10.3390\/mdpi_crossmark_policy","source":"Crossref","is-referenced-by-count":1,"title":["Robust Watermarking of Tiny Neural Networks by Fine-Tuning and Post-Training Approaches"],"prefix":"10.3390","volume":"17","author":[{"given":"Riccardo","family":"Adorante","sequence":"first","affiliation":[{"name":"System Research and Applications, STMicroelectronics, I-20007 Cornaredo, Italy"},{"name":"Faculty of Engineering, University of Pavia, I-27100 Pavia, Italy"}]},{"ORCID":"https:\/\/orcid.org\/0009-0004-5952-8165","authenticated-orcid":false,"given":"Alessandro","family":"Carra","sequence":"additional","affiliation":[{"name":"System Research and Applications, STMicroelectronics, I-20007 Cornaredo, Italy"}]},{"ORCID":"https:\/\/orcid.org\/0000-0003-0062-6049","authenticated-orcid":false,"given":"Marco","family":"Lattuada","sequence":"additional","affiliation":[{"name":"System Research and Applications, STMicroelectronics, I-20007 Cornaredo, Italy"}]},{"ORCID":"https:\/\/orcid.org\/0000-0003-1585-2313","authenticated-orcid":false,"given":"Danilo Pietro","family":"Pau","sequence":"additional","affiliation":[{"name":"System Research and Applications, STMicroelectronics, I-20864 Agrate Brianza, Italy"}]}],"member":"1968","published-online":{"date-parts":[[2025,7,8]]},"reference":[{"key":"ref_1","doi-asserted-by":"crossref","unstructured":"Schmidhuber, J. (2014). Deep Learning in Neural Networks: An Overview. arXiv.","DOI":"10.1016\/j.neunet.2014.09.003"},{"key":"ref_2","unstructured":"Sun, Y., Liu, T., Hu, P., Liao, Q., Fu, S., Yu, N., Guo, D., Liu, Y., and Liu, L. (2023). Deep Intellectual Property Protection: A Survey. arXiv."},{"key":"ref_3","doi-asserted-by":"crossref","first-page":"8","DOI":"10.1109\/MCAS.2023.3302182","article-title":"Tiny Machine Learning: Progress and Futures [Feature]","volume":"23","author":"Lin","year":"2023","journal-title":"IEEE Circuits Syst. Mag."},{"key":"ref_4","doi-asserted-by":"crossref","unstructured":"Chen, Z., Gao, Y., and Liang, J. (2023, January 26\u201328). A Self-Powered Sensing System with Embedded TinyML for Anomaly Detection. Proceedings of the IEEE 3rd International Conference on Industrial Electronics for Sustainable Energy Systems (IESES), Shanghai, China.","DOI":"10.1109\/IESES53571.2023.10253705"},{"key":"ref_5","doi-asserted-by":"crossref","unstructured":"Wang, J., Wu, Y., Liu, H., Yuan, B., Chamberlain, R., and Zhang, N. (2023, January 9\u201313). IP Protection in TinyML. Proceedings of the 2023 60th ACM\/IEEE Design Automation Conference (DAC), San Francisco, CA, USA.","DOI":"10.1109\/DAC56929.2023.10247898"},{"key":"ref_6","unstructured":"Wadhera, S., Kamra, D., Rajpal, A., Jain, A., and Jain, V. (2022). A Comprehensive Review on Digital Image Watermarking. arXiv."},{"key":"ref_7","unstructured":"Alon, G., and Dar, Y. (2025). How Does Overparameterization Affect Machine Unlearning of Deep Neural Networks?. arXiv."},{"key":"ref_8","unstructured":"Krizhevsky, A., Nair, V., and Hinton, G. (2025, July 07). CIFAR-10 and CIFAR-100 Datasets. Available online: https:\/\/www.cs.toronto.edu\/~kriz\/cifar.html."},{"key":"ref_9","unstructured":"Chowdhery, A., Warden, P., Shlens, J., Howard, A., and Rhodes, R. (2019). Visual Wake Words Dataset. arXiv."},{"key":"ref_10","unstructured":"Rouhani, B., Chen, H., and Koushanfar, F. (2019, January 13\u201317). DeepSigns: An End-to-End Watermarking Framework for Ownership Protection of Deep Neural Networks. Proceedings of the Twenty-Fourth International Conference on Architectural Support for Programming Languages and Operating Systems, Providence, RI, USA."},{"key":"ref_11","doi-asserted-by":"crossref","unstructured":"Pagnotta, G., Hitaj, D., Hitaj, B., Perez-Cruz, F., and Mancini, L.V. (2024). TATTOOED: A Robust Deep Neural Network Watermarking Scheme based on Spread-Spectrum Channel Coding. arXiv.","DOI":"10.1109\/ACSAC63791.2024.00099"},{"key":"ref_12","doi-asserted-by":"crossref","first-page":"56","DOI":"10.5815\/ijigsp.2017.04.07","article-title":"A Review on Digital Image Watermarking Techniques","volume":"9","author":"Dixit","year":"2017","journal-title":"Int. J. Image Graph. Signal Process."},{"key":"ref_13","doi-asserted-by":"crossref","unstructured":"Li, Y., Wang, H., and Barni, M. (2021). A survey of deep neural network watermarking techniques. arXiv.","DOI":"10.1016\/j.neucom.2021.07.051"},{"key":"ref_14","doi-asserted-by":"crossref","unstructured":"Chen, H., Rouhani, B., Fu, C., Zhao, J., and Koushanfar, F. (2019, January 10\u201313). DeepMarks: A Secure Fingerprinting Framework for Digital Rights Management of Deep Learning Models. Proceedings of the 2019 on International Conference on Multimedia Retrieval, Ottawa, ON, Canada.","DOI":"10.1145\/3323873.3325042"},{"key":"ref_15","unstructured":"Rouhani, B.D., Chen, H., and Koushanfar, F. (2018). DeepSigns: A Generic Watermarking Framework for IP Protection of Deep Learning Models. arXiv."},{"key":"ref_16","doi-asserted-by":"crossref","unstructured":"Furon, T. (2006). A constructive and unifying framework for zero-bit watermarking. arXiv.","DOI":"10.1109\/TIFS.2007.897272"},{"key":"ref_17","doi-asserted-by":"crossref","unstructured":"Nagai, Y., Uchida, Y., Sakazawa, S., and Satoh, S. (2018). Digital Watermarking for Deep Neural Networks. arXiv.","DOI":"10.1007\/s13735-018-0147-1"},{"key":"ref_18","doi-asserted-by":"crossref","unstructured":"Wang, R., Ren, J., Li, B., She, T., Lin, C., Fang, L., Chen, J., Shen, C., and Wang, L. (2022). Free Fine-tuning: A Plug-and-Play Watermarking Scheme for Deep Neural Networks. arXiv.","DOI":"10.1145\/3581783.3612331"},{"key":"ref_19","first-page":"797","article-title":"Digital Piracy","volume":"2","author":"Sadiku","year":"2021","journal-title":"Int. J. Sci. Adv."},{"key":"ref_20","unstructured":"Tirkel, A., Rankin, G., van Schyndel, R., Ho, W., Mee, N., and Osborne, C. (1993, January 8\u201310). Electronic watermark. Proceedings of the Digital Image Computing, Technology and Applications (DICTA\u201993), Sydney, Australia."},{"key":"ref_21","doi-asserted-by":"crossref","unstructured":"Alanzy, M., Alomrani, R., Alqarni, B., and Almutairi, S. (2023). Image Steganography Using LSB and Hybrid Encryption Algorithms. Appl. Sci., 13.","DOI":"10.3390\/app132111771"},{"key":"ref_22","doi-asserted-by":"crossref","first-page":"54","DOI":"10.1016\/j.csi.2009.06.004","article-title":"Improving the robustness of DCT-based image watermarking against JPEG compression","volume":"32","author":"Lin","year":"2010","journal-title":"Comput. Stand. Interfaces"},{"key":"ref_23","doi-asserted-by":"crossref","unstructured":"Tao, P., and Eskicioglu, A.M. (2004, January 25\u201328). A robust multiple watermarking scheme in the discrete wavelet transform domain. Proceedings of the SPIE Internet Multimedia Management Systems V, Philadelphia, PA, USA.","DOI":"10.1117\/12.569641"},{"key":"ref_24","first-page":"37","article-title":"An overview of transform domain robust digital image watermarking algorithms","volume":"2","author":"Gunjal","year":"2010","journal-title":"J. Emerg. Trends Comput. Inf. Sci."},{"key":"ref_25","doi-asserted-by":"crossref","first-page":"2442","DOI":"10.1016\/j.asoc.2012.02.021","article-title":"An SVD-based image watermarking in wavelet domain using SVR and PSO","volume":"12","author":"Tsai","year":"2012","journal-title":"Appl. Soft Comput."},{"key":"ref_26","first-page":"13","article-title":"Digital Watermarking","volume":"1","author":"Vadana","year":"2013","journal-title":"Int. J. Technol. Res. Eng."},{"key":"ref_27","first-page":"14","article-title":"Modern Neural Networks","volume":"36","author":"Najmi","year":"2022","journal-title":"APL Tech. Dig."},{"key":"ref_28","doi-asserted-by":"crossref","unstructured":"Uchida, Y., Nagai, Y., Sakazawa, S., and Satoh, S. (2017). Embedding Watermarks into Deep Neural Networks. arXiv.","DOI":"10.1145\/3078971.3078974"},{"key":"ref_29","doi-asserted-by":"crossref","unstructured":"Zhang, J., Gu, Z., Jang, J., Wu, H., Stoecklin, M.P., Huang, H., and Molloy, I. (2018, January 4). Protecting Intellectual Property of Deep Neural Networks with Watermarking. Proceedings of the 2018 on Asia Conference on Computer and Communications Security, New York, NY, USA.","DOI":"10.1145\/3196494.3196550"},{"key":"ref_30","doi-asserted-by":"crossref","unstructured":"Ong, D.S., Chan, C.S., Ng, K.W., Fan, L., and Yang, Q. (2021, January 20\u201325). Protecting Intellectual Property of Generative Adversarial Networks From Ambiguity Attacks. Proceedings of the IEEE\/CVF Conference on Computer Vision and Pattern Recognition (CVPR), Nashville, TN, USA.","DOI":"10.1109\/CVPR46437.2021.00363"},{"key":"ref_31","unstructured":"Hubara, I., Courbariaux, M., Soudry, D., El-Yaniv, R., and Bengio, Y. (2016). Quantized Neural Networks: Training Neural Networks with Low Precision Weights and Activations. arXiv."},{"key":"ref_32","unstructured":"Zhu, M., and Gupta, S. (2017). To prune, or not to prune: Exploring the efficacy of pruning for model compression. arXiv."},{"key":"ref_33","unstructured":"Trias, C.D.S., Mitrea, M., Fiandrotti, A., Cagnazzo, M., Chaudhuri, S., and Tartaglione, E. (2024). WaterMAS: Sharpness-Aware Maximization for Neural Network Watermarking. arXiv."},{"key":"ref_34","unstructured":"Shafieinejad, M., Wang, J., Lukas, N., Li, X., and Kerschbaum, F. (2019). On the Robustness of the Backdoor-based Watermarking in Deep Neural Networks. arXiv."},{"key":"ref_35","doi-asserted-by":"crossref","unstructured":"Liu, K., Dolan-Gavitt, B., and Garg, S. (2018). Fine-Pruning: Defending Against Backdooring Attacks on Deep Neural Networks. arXiv.","DOI":"10.1007\/978-3-030-00470-5_13"},{"key":"ref_36","unstructured":"Hinton, G., Vinyals, O., and Dean, J. (2015). Distilling the Knowledge in a Neural Network. arXiv."},{"key":"ref_37","unstructured":"Tram\u00e8r, F., Zhang, F., Juels, A., Reiter, M.K., and Ristenpart, T. (2016). Stealing Machine Learning Models via Prediction APIs. arXiv."},{"key":"ref_38","doi-asserted-by":"crossref","unstructured":"Orekondy, T., Schiele, B., and Fritz, M. (2018). Knockoff Nets: Stealing Functionality of Black-Box Models. arXiv.","DOI":"10.1109\/CVPR.2019.00509"},{"key":"ref_39","doi-asserted-by":"crossref","unstructured":"Wang, T., and Kerschbaum, F. (2021). RIGA: Covert and Robust White-Box Watermarking of Deep Neural Networks. arXiv.","DOI":"10.1145\/3442381.3450000"},{"key":"ref_40","unstructured":"Fan, L., Ng, K., and Chan, C.S. (2019). Digital Passport: A Novel Technological Strategy for Intellectual Property Protection of Convolutional Neural Networks. arXiv."},{"key":"ref_41","first-page":"133","article-title":"Robust Deep Image Watermarking: A Survey","volume":"81","author":"Luo","year":"2024","journal-title":"Comput. Mater. Contin."},{"key":"ref_42","unstructured":"(2025, July 07). MLCommons\u2014Better AI for Everyone. Available online: https:\/\/mlcommons.org\/."},{"key":"ref_43","doi-asserted-by":"crossref","unstructured":"He, K., Zhang, X., Ren, S., and Sun, J. (2015). Deep Residual Learning for Image Recognition. arXiv.","DOI":"10.1109\/CVPR.2016.90"},{"key":"ref_44","doi-asserted-by":"crossref","unstructured":"Lin, T., Maire, M., Belongie, S.J., Bourdev, L.D., Girshick, R.B., Hays, J., Perona, P., Ramanan, D., Doll\u00e1r, P., and Zitnick, C.L. (2014). Microsoft COCO: Common Objects in Context. arXiv.","DOI":"10.1007\/978-3-319-10602-1_48"},{"key":"ref_45","unstructured":"Howard, A.G., Zhu, M., Chen, B., Kalenichenko, D., Wang, W., Weyand, T., Andreetto, M., and Adam, H. (2017). MobileNets: Efficient Convolutional Neural Networks for Mobile Vision Applications. arXiv."},{"key":"ref_46","doi-asserted-by":"crossref","unstructured":"Qi, C., and Su, F. (2017). Contrastive-center loss for deep neural networks. arXiv.","DOI":"10.1109\/ICIP.2017.8296803"},{"key":"ref_47","doi-asserted-by":"crossref","first-page":"5393","DOI":"10.30534\/ijatcse\/2020\/175942020","article-title":"Binary cross entropy with deep learning technique for Image classification","volume":"9","author":"Ruby","year":"2020","journal-title":"Int. J. Adv. Trends Comput. Sci. Eng."},{"key":"ref_48","unstructured":"Adi, Y., Baum, C., Ciss\u00e9, M., Pinkas, B., and Keshet, J. (2018). Turning Your Weakness Into a Strength: Watermarking Deep Neural Networks by Backdooring. arXiv."}],"container-title":["Symmetry"],"original-title":[],"language":"en","link":[{"URL":"https:\/\/www.mdpi.com\/2073-8994\/17\/7\/1094\/pdf","content-type":"unspecified","content-version":"vor","intended-application":"similarity-checking"}],"deposited":{"date-parts":[[2025,10,9]],"date-time":"2025-10-09T18:06:29Z","timestamp":1760033189000},"score":1,"resource":{"primary":{"URL":"https:\/\/www.mdpi.com\/2073-8994\/17\/7\/1094"}},"subtitle":[],"short-title":[],"issued":{"date-parts":[[2025,7,8]]},"references-count":48,"journal-issue":{"issue":"7","published-online":{"date-parts":[[2025,7]]}},"alternative-id":["sym17071094"],"URL":"https:\/\/doi.org\/10.3390\/sym17071094","relation":{},"ISSN":["2073-8994"],"issn-type":[{"type":"electronic","value":"2073-8994"}],"subject":[],"published":{"date-parts":[[2025,7,8]]}}}