# Ultrafast Control of Crystal Structure in a Topological Charge-Density-Wave
Material

Takeshi Suzuki1,∗ Yuya Kubota2 Natsuki Mitsuishi3 Shunsuke Akatsuka4 Jumpei
Koga4 Masato Sakano4 Satoru Masubuchi5 Yoshikazu Tanaka2 Tadashi Togashi2,6
Hiroyuki Ohsumi2 Kenji Tamasaku2 Makina Yabashi2,6 Hidefumi Takahashi7,8
Shintaro Ishiwata7,8 Tomoki Machida5 Iwao Matsuda1 Kyoko Ishizaka3,4 Kozo
Okazaki1,∗ 1Institute for Solid State Physics, The University of Tokyo,
Kashiwa, Chiba 277-8581, Japan
2 RIKEN SPring-8 Center, 1-1-1 Kouto, Sayo, Hyogo 679-5148, Japan
3 RIKEN Center for Emergent Matter Science (CEMS), Wako 351-0198, Japan
4 Quantum-Phase Electronics Center and Department of Applied Physics, The
University of Tokyo, Tokyo 113-8656, Japan
5 Institute of Industrial Science, The University of Tokyo, Meguro-ku, Tokyo
153–8505, Japan
6 Japan Synchrotron Radiation Research Institute (JASRI), 1-1-1 Kouto, Sayo,
Hyogo 679-5198, Japan
7 Division of Materials Physics and Center for Spintronics Research Network
(CSRN), Graduate School of Engineering Science, Osaka University, Toyonaka,
Osaka 560-8531, Japan
8 Spintronics Research Network Division, Institute for Open and
Transdisciplinary Research Initiatives, Osaka University, Yamadaoka 2-1,
Suita, Osaka 565-0871, Japan

###### Abstract

Optical control of crystal structures is a promising route to change physical
properties including topological nature of a targeting material. Time-resolved
X-ray diffraction measurements using the X-ray free-electron laser are
performed to study the ultrafast lattice dynamics of VTe2, which shows a
unique charge-density-wave (CDW) ordering coupled to the topological surface
states as a first-order phase transition. A significant oscillation of the CDW
amplitude mode is observed at a superlattice reflection as well as Bragg
reflections. The frequency of the oscillation is independent of the fluence of
the pumping laser, which is prominent to the CDW ordering of the first-order
phase transition. Furthermore, the timescale of the photoinduced
1$T^{\prime\prime}$ to 1$T$ phase transition is independent of the period of
the CDW amplitude mode.

Engineering crystal structures is one of the direct ways to change electronic,
optical, and mechanical properties in solid state materials. Many techniques
of a structural control have been developed including strain Kim_2018 ,
nanostructuring Marconnet_2013 , heterostructure layer stacking Liao_2019 ,
and twistronics Cao_2018a ; Cao_2018b . While these approaches are very
powerful, investigations are limited to equilibrium states, where all the
degrees of freedom are thermally balanced. On the other hand, the combination
of photoexcitation by ultrafast pulse laser and various probing techniques has
enabled us to study nonequilibrium states, where a specific subsystem is
selectively excited, by which a lot of exotic phenomena have been reported
Basov_2017 . Ultrafast optical pulses have also served as powerful tools to
engineer crystal structures, by which a variety of phases, including
superconductivity Fausti_2011 ; Mankowsky_2014 , ferroelectricity Nova_2019 ;
Li_2019 , and magnetism Radu_2011 , have been found to emerge.

Recently, controlling topological properties of a material by light has
attracted enormous interest because a topological insulator has robust
metallic surface states against impurities or disorder Roushan_2009 ;
Hasan_2010 , which is preferable for optical switching. While many approaches
to the ultrafast topological control have been demonstrated by such as Floquet
engineering Oka_2009 ; Wang_2013 ; Mahmood_2016 ; Mclver_2020 , controlling
crystal structures with light has also been employed to manipulate topological
properties Sie_2019 ; Disa_2021 . This methodology is also applicable to
charge-density-wave (CDW) materials having topological properties. A great
advantage of using CDW materials is the feasibility of flexibly tuning their
properties by external stimuli such as physical Sipos_2008 ; Kusmartseva_2009
or chemical pressure Ru_2008 ; Brouet_2008 , and electric Lee_1979 ;
DiCarlo_1993 ; Adelman_1995  or magnetic fields Chang_2016 .

For the optical control of CDW materials, a lot of studies have been reported
mainly in the context of collective-mode excitations or photoinduced phase
transitions. Since a CDW phase is a coupled phase between charge and lattice,
multiple ultrafast probing techniques have been employed to track different
degrees of freedom, including optical pump-probe spectroscopy Demsar_1999 ;
Demsar_2002 ; Yusupov_2010 , time- and angle-resolved photoemission
spectroscopy Perfetti_2006 ; Schmitt_2008 ; Hellmann_2012 ; Makler_2021 ,
ultrafast electron diffraction (UED) Eichberger_2010 ; Erasmus_2012 ;
Haupt_2016 ; Kogar_2020 , and time-resolved X-ray diffraction (TRXRD) Mohr-
Vorobeva_2011 ; Huber_2014 ; Laulhe_2017 ; Trigo_2019 ; Burian_2021 . These
reports have highlighted second-order CDW phase transition systems except for
1$T$-TaS2. On the other hand, a specific phase is preserved against the
external turbulence within the threshold in a first-order phase transition.
Such a robustness of the phase is great advantage over a second-order phase
transition, especially for the application of ultrafast devices such as an
optical switch or memory medium. In terms of fundamental physics, kinetics of
first-order photoinduced phase transitions shows many attractive phenomena
such as nucleation Sternbach_2021  or percolative dynamics Teitelbaum_2019 .
Thus, it is highly desired to study in detail the dynamical features of a
first-order photoinduced CDW phase transition system having intriguing
profiles.

In this Letter, we report ultrafast lattice dynamics in VTe2, which has a
first-order CDW phase transition and the topological surface states coupled to
the CDW phase, by performing the measurements of TRXRD using the X-ray free-
electron laser (XFEL). We directly observe the CDW amplitude mode in VTe2 as a
significant temporal oscillation, 1.5 THz in frequency, of a superlattice
reflection. We further study CDW melting dynamics by the pump-fluence
dependent measurements. Through the fitting analysis, we successfully reveal
the distinctive features of a first-order CDW phase transition. They are quite
different from many other CDW materials of second-order phase transitions. Our
findings provide detailed guidelines for the crystal structure control of
first-order CDW materials and an important step towards the manipulation of
topological surface states.

Figure 1:  (a) Crystal structure of VTe2. Above the phase transition
temperature of 480 K, VTe2 displays the 1$T$ ($P3\overline{m}1$) structure
while below 480 K it shows the 1$T^{\prime\prime}$ ($C2/m$) structure. The
double-zigzag bonds of the V atoms in the 1$T^{\prime\prime}$ phase are shown
as black-dashed lines and a unit cell for each phase is shown as blue-solid
box. (b) Schematic illustration of the time-resolved X-ray diffraction
measurement. The delay time between the near-infrared (NIR) pump and the hard
X-ray probe is shown as $\Delta t$. The diffracted signal is detected by the
multi-port charge-coupled-devises (MPCCD).

Figure 1(a) shows the crystal structure of VTe2 in the 1$T$
($P\overline{3}m1$, #164 trigonal) metallic and 1$T^{\prime\prime}$ ($C2/m$,
#12 monoclinic) CDW phases, where a unit cell for each phase is shown as blue-
solid box. With lowering temperature, VTe2 displays the CDW phase transition
at 480 K, accompanied by a formation of $3\times 1\times 3$ superstructure
characterized by the double-zigzag chain structure for the V atoms along the
$b$ direction, shown as the black-dashed lines in Fig. 1(a) Bronsema_1984 .
One of the most striking signatures is the significantly large contraction of
the V-V bonds ($\sim$ 9.1 %), which is larger than Ta-Ta bonds in the well-
known CDW material, 1$T$-TaS2 ($\sim$ 7.0 % Brouwer_1980 ). The hysteresis of
resistivity in VTe2 Ohtani_1981  also confirms that this CDW transition in
VTe2 is of first-order. Furthermore, the recent study of angle-resolved
photoemission spectroscopy revealed an intimate relationship between the
topological surface states and CDW order Mitsuishi_2020 , where two of three
Dirac surface states at the boundary of the 1st Brilluin zone in the 1$T$
metallic phase were found to disappear in the 1$T^{\prime\prime}$ CDW phase.
For the CDW melting dynamics, the UED measurements were performed to directly
observe the lattice dynamics of VTe2, and successfully observed the acoustic
phonons Nakamura_2018 ; Nakamura_2020 . However, due to the limitation of the
time resolution of $\sim$ 2 ps, the initial dynamics of the CDW melting has
remained uncovered. The optical pump-probe measurements with the sufficient
time resolution were performed to observe the multiple coherent phonons
Tanimura_2022  while a direct insight into the lattice dynamics is still
missing.

To directly track the lattice dynamics with high temporal resolution, we
perform the measurements of TRXRD at BL3 of the XFEL facility, SPring-8
Angstrom Compact free-electron LAser (SACLA) Ishikawa_2012  as schematically
shown in Fig. 1 (b). The experimental setup and bulk sample preparation are
written in Supplementary Materials for details Suppl . To minimize the
penetration-length mismatch between the NIR pump and X-ray probe (23 nm
Tanimura_2022  and $\sim$10 $\mu$m, respectively, for VTe2), we prepared the
samples with the thickness of $\sim$40 nm using mechanical exfoliation by
transparent adhesive tape and dry transfer onto the Si3N4 membrane Suppl . The
thickness of the sample was measured by both atomic force microscopy and
acoustic wave measurements Suppl . Integrated intensity of the diffracted
image $I_{hkl}$ is given by the structure factor $F_{hkl}$ as expressed by
$I_{hkl}\propto\left|F_{hkl}\right|^{2}$, and the structure factor is
determined by atomic positions in a unit cell as

$F_{hkl}=\sum_{n}f_{n}\exp\left(i\bm{G}_{hkl}\cdot\bm{r}_{n}\right),$ (1)

where $hkl$ is the Bragg reflection index, $f_{n}$ is the atomic form factor
of the $n$th atom, $\bm{G}_{hkl}$ is the reciprocal vector, and $\bm{r}_{n}$
is the atomic position of the $n$th atom. For the Bragg reflection indices in
the main text, we use the practical monoclinic lattice Nakamura_2020 ; Suppl .
The changes in diffraction angle of Bragg reflections reflect the changes in
lattice constants Suzuki_2021  while the changes in diffraction intensity
reflect the atomic displacements inside the unit cell.

Figure 2:  (a-c) Time-dependent $I_{\frac{2}{3}0\frac{11}{3}}$,
$I_{\text{$\overline{2}$05}}$, and $I_{\text{004}}$, at the pump fluence of
0.8, 1.2, and 1.0 mJ/cm2, respectively. The data are shown as marks and the
smoothing lines (smth) are shown as black solid lines. (d) Oscillatory
components of (a-c) deduced by subtracting smoothing lines from data. (e)
Power spectra of the oscillatory components (d).

Figure 2(a) shows the time dependence of the superlattice reflection intensity
$I_{\frac{2}{3}0\frac{11}{3}}$ obtained with the low pump fluence of 0.8
mJ/cm2. One can clearly see a significant oscillation.
$I_{\frac{2}{3}0\frac{11}{3}}$ is determined by the amount of the Peierls
distortion, $x$, as $I_{\frac{2}{3}0\frac{11}{3}}\propto|x|^{2}$ because the
structure factor of the superlattice reflection,
$F_{\frac{2}{3}0\frac{11}{3}}$, is proportional to $x$ in the leading order
Overhauser_1971 . Therefore, the modulation of the superlattice reflection
intensity can be attributed to the excitation of the CDW amplitude mode. The
previous studies using TRXRD on other CDW materials also linked the
oscillation of superlattice reflections to the CDW amplitude modes Huber_2014
; Trigo_2019 ; Burian_2021 . To further confirm this assignment, we also
measure the Bragg reflection intensities of $I_{\text{$\overline{2}$05}}$ and
$I_{\text{004}}$ as shown in Figs. 2(b) and 2(c). For both reflections,
oscillations can be recognized. To deduce the oscillatory components, we
subtract the backgrounds given by the smoothed lines shown as the black-solid
lines in Figs. 2(a)-2(c). The subtracted data are shown in Fig. 2 (d).
Interestingly, the oscillation phases of the Bragg reflections are opposite to
that of the superlattice reflection, i.e. while the
$I_{\frac{2}{3}0\frac{11}{3}}$ decreases in the first quarter cycle, the
$I_{\text{$\overline{2}$05}}$ and $I_{\text{004}}$ increase. Fourier
transforms are performed for the subtracted data and the power spectra are
shown in Fig. 2(e). One can find a single-peak structure at 1.5 THz in all the
diffraction intensities. This frequency corresponds to $f_{\text{AM}}$ in Eq.
(3) discussed later.

Table 1: Structure factors of VTe2 for 1$T$ and 1$T^{\prime\prime}$ phases | $F_{1T^{\prime\prime}}$ | $F_{1T}$ | $I_{1T}/I_{1T^{\prime\prime}}$
---|---|---|---
$\overline{2}$05 | 280+3$i$ | 408+5$i$ | 2.12
004 | 360+3$i$ | 514+6$i$ | 2.02

To understand the opposite oscillation phase between the superlattice and
Bragg reflections, we consider the origin of the intensity modulation of the
Bragg reflections in terms of the structure factors. While it is assumed that
the photoinduced phase cannot be simply expressed using the structures of 1$T$
and 1$T^{\prime\prime}$ phases, here we approximate the structure factor in
the photoinduced phase as the superposition of $F_{1T}$ and
$F_{1T^{\prime\prime}}$. $F_{\text{$\overline{2}$05}}$ and $F_{\text{004}}$
are calculated from Eq. (1) for both the 1$T$ and 1$T^{\prime\prime}$ phases
Suppl , and shown in Table I. Both $|F_{\text{$\overline{2}$05}}|$ and
$|F_{\text{004}}|$ for the 1$T$ phase are larger than those for the
1$T^{\prime\prime}$ phase. This is consistent with the increasing behavior in
the first quarter cycle and further supports the assignment of the CDW
amplitude mode. We note that the 1.5 THz coherent phonon was also confirmed by
the previous optical pump-probe measurement Tanimura_2022 .

In order to investigate the CDW melting dynamics in VTe2, we perform the
measurements with higher pump fluence. Figure 3 (a) shows the fluence-
dependent dynamics of $I_{\frac{2}{3}0\frac{11}{3}}$. While the CDW amplitude
mode is clearly observed at low fluences, it becomes strikingly suppressed
with increasing fluence. Furthermore, the intensity drop immediately after the
pump excitation increases, to the one tenth of the initial value at the
highest fluence, which corresponds to the modulation from a structure of the
1$T^{\prime\prime}$ CDW phase to that close to the 1$T$ metallic phase. Figure
3 (b) schematically shows these observations in terms of lattice dynamics in
real space. Under low fluences, the V atoms smoothly oscillate with small
displacements to new stable positions, the same mechanism as the displacive
excitation of coherent phonons (DECP) Zeiger_1992 . Under high fluences, on
the other hand, the V atoms are largely displaced from their original
positions while the damping is strong enough to prevent multi-cycle
oscillations. At the large delay time of 3-4 ps, the intensity decreases with
pump fluence and does not recover to the original value. To show this behavior
more clearly, we plot the corresponding values of the intensity as a function
of pump fluence in Fig. 3(c). Here $I_{\text{Slow}}$ represents the averaged
intensity during $\Delta t$ = [3-4] ps. $I_{\text{Slow}}$ decreases almost
monotonically but slightly nonlinearly with pump fluence. To highlight this
behavior, we linearly fit the data at the low ($<$ 1.5 mJ/cm2) and high
fluences ($\geq$ 2.5 mJ/cm2) and these lines are found to cross each other at
1.9 mJ/cm2. This value implies the threshold fluence of the CDW melting, and
we intensively discuss the melting dynamics in the following paragraphs.

Figure 3:  (a) Fluence-dependent dynamics of $I_{\frac{2}{3}0\frac{11}{3}}$.
The fluences are indicated in each panel. The data are shown as markers and
the total fits are shown as black-solid lines. The fits are composed of
$I_{1}(t)$ and $I_{2}(t)$, and they are shown as gray-dashed and gray-dotted
lines, respectively. (b) Schematic illustration of the fluence-dependent CDW
amplitude mode. (c) Averaged intensity at $\Delta t$ = [3-4] ps,
$I_{\text{Slow}}$, as a function of pump fluence $F$.  Figure 4:  (a)
Schematic picture of the energy potential and dynamics after photoexcitation
in a first-order phase transition system. (b) Schematic illustration of the
two-component distribution of the excitation along the depth direction.
Regions 1 and 2 are the photoinduced metallic and CDW phases, respectively.
(c) Summary of the fitting parameters as a function of pump fluence.

As we mentioned, VTe2 is a first-order CDW phase transition material like
1$T$-TaS2. The photoinduced phase transition, then, can be pictured by the
Landau potential for the first-order phase transition shown in Fig. 4(a)
Binder_1987 . Furthermore, the boundary between the 1$T^{\prime\prime}$ CDW
and 1$T$ metallic phases is rather well separated by a so-called phase
boundary, thus we assume the superlattice reflections during the photoinduced
phase transition can be approximated as two spatially separate components. Due
to the attenuation of pump excitation, the photoinduced 1$T$ phase is
triggered in a shallower region from the surface (Region 1) while the CDW
phase remains in a deeper region from the surface (Region 2). Figure 4(b)
schematically shows this situation, where the incident pump fluence at the
surface is denoted as $F_{0}$ and the threshold pump fluence for the CDW
melting is denoted as $F_{\text{th}}$ estimated to be 1.9 mJ/cm2 from Fig.
3(c). This value nearly agrees with the previous study of 1.21 mJ/cm2
Tanimura_2022 . Strictly speaking, the photoinduced phase is assumed to be
different from the 1$T$ or 1$T^{\prime\prime}$ phases that are defined in the
equilibrium state. Here, we approximately treat Regions 1 and 2 as 1$T$ or
1$T^{\prime\prime}$ phases, respectively.

We use the phenomenological two-component model composed of $I_{1}(t)$ and
$I_{2}(t)$ for the intensity of superlattice reflections from Regions 1 and 2,
respectively, shown below, in the same manner as the previous work on
1$T$-TaS2 Laulhe_2017 ,

$\displaystyle I_{1}(t)=\frac{1}{2}\left(1+\cos\frac{\pi
t}{T_{S}}\right)\qquad 0<t<T_{S}$ (2) $\displaystyle
I_{2}(t)=\left(1+A_{d}\left[\cos\left(2\pi
f_{\text{AM}}t\right)e^{-t/\tau_{\text{AM}}}-e^{-t/\tau_{\text{d}}}\right]\right)^{2}.$
(3)

$I_{1}(t)$ is a sigmoid-shaped function, where $T_{S}$ is the CDW melting
time. $I_{2}(t)$ stands for the square of the atomic displacement for DECP
dynamics. $A_{d}$, $f_{\text{AM}}$, and $\tau_{\text{AM}}$ are the amplitude,
frequency, and decay constant for the CDW amplitude modes, respectively,
$\tau_{\text{d}}$ is the relaxation time back to the initial potential for
Region 2. We fit our experimental data by
$I_{\text{Total}}(t)=rI_{1}(t)+(1-r)I_{2}(t)$, where $r$ is the volume
fraction of Region 1.

The total fitting results are shown as black-solid lines in Fig. 3(a), where
$I_{1}(t)$ and $I_{2}(t)$ are shown as gray-dashed and dotted lines,
respectively. Figure 4(c) shows the results of the fitting parameters. As for
the parameters for $I_{2}(t)$, $A_{d}$ increases, and $\tau_{\text{AM}}$
decreases with increasing fluence, corresponding to the large displacement and
stronger damping schematically shown in Fig. 3(b). The relaxation time
$\tau_{d}$ does not change noticeably. The small change of $f_{\text{AM}}$ is
a quite remarkable behavior and a stark difference from the CDW materials of
the second-order phase transitions Yusupov_2010 ; Huber_2014 ; Trigo_2019 ;
Burian_2021 ; Makler_2021 , where significant changes of $f_{\text{AM}}$ as a
function of pump fluence has been reported such as the dynamical slowing down
Zong_2019  or the overshooting behavior Huber_2014 . These observations have
been explained in terms of dynamics on the “Mexican-hat” potential in second-
order phase transitions. Thus our observation of $f_{\text{AM}}$ clearly marks
the robust curvature of potential below the threshold in the first-order case
(Fig. 4(a)).

As for the parameters for $I_{1}(t)$, we only show the result of $T_{S}$
between 0 and 1.0 ps, and the results at full scale are shown in Fig. S8 Suppl
. $T_{S}$ slightly decreases with fluence up to 3.3 mJ/cm2 and is larger than
the half period ($\sim$ 0.3 ps) of the CDW amplitude mode of 1.5 THz. This is
a stark contrast to the previous work on 1$T$-TaS2, where the CDW melting time
was determined to the half period of the CDW amplitude mode Hellmann_2012 .
However, the more recent work on 1$T$-TaS2 reported the independent value of
the CDW melting time from the CDW amplitude mode Laulhe_2017 , which is the
same conclusion as our current work. With further increasing the fluence to
4.9 mJ/cm2, $T_{S}$ significantly decreases. This behavior is intuitively
understood by considering the steeper gradient of the potential with the
higher fluence shown in Fig. 4(a). Although the microscopic mechanism
determining the CDW melting time is still elusive, we can stress that it is
not simply determined by the CDW amplitude mode. Further considerations of
dynamical electron-electron and electron-phonon interactions should be crucial
for a deeper understanding, because these intertwined interactions are
expected to play an important role especially for materials such as 1$T$-TaS2
and VTe2. Lastly, the volume fraction of Region 1, $r$, increases with pump
fluence and shows a threshold-like behavior at 1.8 mJ/cm2 from the linear fit
at the low ($<$ 1 mJ/cm2) and high fluences ($\geq$ 2.5 mJ/cm2) as shown in
Fig. 4(c), in close agreement with the value estimated in Fig. 3(c).

In summary, we investigated the CDW-amplitude-mode excitations and melting
dynamics in VTe2. The characteristic behaviors of the first-order phase
transition were revealed and our work provides valuable insight into the
dynamical control of the first-order CDW materials. Moreover, the topological
surface states controlled via CDW phase in VTe2 can further extend the
potential of applications Mitsuishi_2020 , and lead to the ultrafast surface
state switching.

###### Acknowledgements.

This work was supported by Grants-in-Aid for Scientific Research (KAKENHI)
(Grant No. JP18K13498, JP19H00659, JP19H01818, JP19H00651 JP18K14145,
JP19H02623, JP20H01834, and JP21H05235) from the Japan Society for the
Promotion of Science (JSPS), by JSPS KAKENHI on Innovative Areas “Quantum
Liquid Crystals” (Grant No. JP19H05826), by the Center of Innovation Program
from the Japan Science and Technology Agency, JST, the Research and Education
Consortium for Innovation of Advanced Integrated Science by JST, and by MEXT
Quantum Leap Flagship Program (MEXT Q-LEAP) (Grant No. JPMXS0118067246,
JPMXS0118068681), Japan, by a CREST project (No. JPMJCR20B4). This experiment
was performed at BL3 of SACLA with the approval of the Japan Synchrotron
Radiation Research Institute (JASRI) (Proposal No. 2022A8024). The synchrotron
radiation experiments were performed to evaluate the system at BL19LXU in
SPring-8 with the approval of RIKEN (Proposal No. 20220049). The authors would
like to acknowledge the support of members of the SACLA and SPring-8
facilities. The authors would like to acknowledge Dr. A. Nakamura for the
fruitful discussion. T. S. acknowledges the research grants from The Murata
Science Foundation, The Hattori Hokokai Foundation, and Toyota Riken Scholar.

## References

  * (1) H. -H. Kim, S. M. Souliou, M. E. Barber, E. Lefrançois, M. Minola, M. Tortora, R. Heid, N. Nandi, R. A. Borzi, G. Garbarino, et al., Science 362, 1040 (2018).
  * (2) A. M. Marconnet, M. A. Panzer, and K. E. Goodson, Rev. Mod. Phys. 85, 1295 (2013).
  * (3) W. Liao, Y. Huang, H. Wang, and H. Zhang, Appl. Mater. Today 16, 435 (2019).
  * (4) Y. Cao, V. Fatemi, S. Fang, K. Watanabe, T. Taniguchi, E. Kaxiras, and P. Jarillo-Herrero, Nature 556, 43 (2018).
  * (5) Y. Cao, V. Fatemi, A. Demir, S. Fang, S. L. Tomarken, J. Y. Luo, J. D. Sanchez-Yamagishi, K. Watanabe, T. Taniguchi, E. Kaxiras, et al., Nature 556, 80 (2018).
  * (6) D. N. Basov, R. D. Averitt, and D. Hsieh, Nat. Mat. 16, 1017 (2017).
  * (7) D. Fausti, R. I. Tobey, N. Dean, S. Kaiser, A. Dienst, M. C. Hoffmann, S. Pyon, T. Takayama, H. Takagi, A. Cavalleri, Science 331, 189 (2011).
  * (8) R. Mankowsky, A. Subedi, M. Först, S. O. Mariager, M. Chollet, H. T. Lemke, J. S. Robinson, J. M. Glownia, M. P. Minitti, A. Frano, et al., Nature 516, 71 (2014).
  * (9) T. F. Nova, A. S. Disa, M. Fechner, A. Cavalleri, Science 364, 1075 (2019).
  * (10) X. Li, T. Qiu, J. Zhang, E. Baldini, J. Lu, A. M. Rappe, K. A. Nelson, Science 364, 1079 (2019).
  * (11) I. Radu, K. Vahaplar, C. Stamm, T. Kachel, N. Pontius, H. A. Dürr, T. A. Ostler, J. Barker, R. F. L. Evans, R. W. Chantrell, textitet al., Nature 472, 205 (2011).
  * (12) P. Roushan, J. Seo, C. V. Parker, Y. S. Hor, D. Hsieh, D. Qian, A. Richardella, M. Z. Hasan, R. J. Cava, and A. Yazdani, Nature 460, 1106 (2009).
  * (13) M. Z. Hasan and C. L. Kane, Rev. Mod. Phys. 82, 3045 (2010).
  * (14) T. Oka and H. Aoki, Phys. Rev. B 79, 081406(R) (2009).
  * (15) Y. H. Wang, H. Steinberg, P. Jarillo-Herrero, and N. Gedik, Science, 342, 453 (2013,)
  * (16) F. Mahmood, C.-K. Chan, Z. Alpichshev, D. Gardner, Y. Lee, P. A. Lee, and N. Gedik, Nat. Phys. 12, 306 (2016).
  * (17) J. W. McIver, B. Schulte, F.-U. Stein, T. Matsuyama, G. Jotzu, G. Meier, and A. Cavalleri, Nat. Phys. 16, 38 (2020).
  * (18) E. J. Sie, C. M. Nyby, C. D. Pemmaraju, S. J. Park, X. Shen, J. Yang, M. C. Hoffmann, B. K. Ofori-Okai, R. Li, A. H. Reid, et al. Nature 565, 61 (2019).
  * (19) A. S. Disa, T. F. Nova, and A. Cavalleri, Nat. Phys. 17, 1087 (2021).
  * (20) B. Sipos, A. F. Kusmartseva, A. Akrap, H. Berger, L. Forró, and E. Tutiš, Nat. Matter. 7, 960 (2008).
  * (21) A. F. Kusmartseva, B. Sipos, H. Berger, L. Forró, and E. Tutiš, Phys. Rev. Lett. 103, 236401 (2009).
  * (22) N. Ru, C. L. Condron, G. Y. Margulis, K. Y. Shin, J. Laverock, S. B. Dugdale, M. F. Toney, and I. R. Fisher, Phys. Rev. B 77, 035114(2008).
  * (23) V. Brouet, W. L. Yang, X. J. Zhou, Z. Hussain, R. G. Moore, R. He, D. H. Lu, Z. X. Shen, J. Laverock,S. B. Dugdale, N. Ru, and I. R. Fisher, Phys. Rev. B 77, 235104 (2008).
  * (24) P. A. Lee and T. M. Rice, Phys. Rev. B 19, 3970 (1979).
  * (25) D. DiCarlo, E. Sweetland, M. Sutton, J. D. Brock, and R. E. Thorne, Phys. Rev. Lett. 70, 845 (1993).
  * (26) T. L. Adelman, S. V. Zaitsev-Zotov, and R. E. Thorne, Phys. Rev. Lett. 74, 5264 (1995).
  * (27) J. Chang, E. Blackburn, O. Ivashko, A.T. Holmes, N. B. Christensen, M. Hücker, R. Liang, D. A. Bonn, W. N. Hardy, U. Rütt, M. v. Zimmermann, E. M. Forgan, and S. M. Hayden, Nat. Commun. 7, 11494 (2016).
  * (28) J. Demsar, K. Biljaković, and D. Mihailovic, Phys. Rev. Lett. 83, 800 (1999).
  * (29) J. Demsar, L. Forró, H. Berger, and D. Mihailovic, Phys. Rev. B 66, 041101(R) (2002).
  * (30) R. Yusupov, T. Mertelj, V. V. Kabanov, S. Brazovskii, P. Kusar, J.-H. Chu, I. R. Fisher, and D. Mihailovic, Nat. Phys. 6, 681(2010).
  * (31) L. Perfetti, P. A. Loukakos, M. Lisowski, U. Bovensiepen, H. Berger, S. Biermann, P. S. Cornaglia, A. Georges, and M. Wolf, Phys. Rev. Lett. 97, 067402 (2006).
  * (32) F. Schmitt, P. S. Kirchmann, U. Bovensiepen, R. G. Moore, L. Rettig, M. Krenz, J.-H. Chu, N. Ru, L. Perfetti, D. H. Lu, M. Wolf, I. R. Fisher, and Z.-X. Shen, Science 321, 1649(2008).
  * (33) S. Hellmann, T. Rohwer, M. Kalläne, K. Hanff, C. Sohrt, A. Stange, A. Carr, M. M. Murnane, H. C. Kapteyn, L. Kipp, M. Bauer, and K. Rossnagel, Nat. Commun. 3, 1069 (2012).
  * (34) J. Maklar, Y. W. Windsor, C. W. Nicholson, M. Puppin, P. Walmsley, V. Esposito, M. Porer, J. Rittmann, D. Leuenberger, M. Kubli, M. Savoini, E. Abreu, S. L. Johnson, P. Beaud, G. Ingold, U. Staub, I. R. Fisher, R. Ernstorfer, M. Wolf, and L. Rettig, Nat. Commun. 12, 2499 (2021).
  * (35) M. Eichberger, H. Schäfer, M. Krumova, M. Beyer, J. Demsar, H. Berger, G. Moriena, G. Sciaini, and R. J. D. Miller, Nature 468, 799 (2010).
  * (36) N. Erasmus, M. Eichberger, K. Haupt, I. Boshoff, G. Kassier, R. Birmurske, H. Berger, J. Demsar, and H. Schwoerer, Phys. Rev. Lett. 109, 167402 (2012).
  * (37) K. Haupt, M. Eichberger, N. Erasmus, A. Rohwer, J. Demsar, K. Rossnagel, and H. Schwoerer, Phys. Rev. Lett. 116, 016402 (2016).
  * (38) A. Kogar, A. Zong, P. E. Dolgirev, X. Shen, J. Straquadine, Y. -Q. Bie, X. Wang, T. Rohwer, I-C. Tung, Y. Yang, R. Li, J. Yang, S. Weathersby, S. Park, M. E. Kozina, E. J. Sie, H. Wen, P. Jarillo-Herrero, I. R. Fisher, X. Wang, and N. Gedik, Nat. Phys. 16, 159 (2020).
  * (39) E. Möhr-Vorobeva, S. L. Johnson, P. Beaud, U. Staub, R. De Souza, C. Milne, G. Ingold, J. Demsar, H. Schaefer, and A. Titov, Phys. Rev. Lett. 107, 036403 (2011).
  * (40) T. Huber, S. O. Mariager, A. Ferrer, H. Schäfer, J. A. Johnson, S. Grübel, A. Lübcke, L. Huber, T. Kubacka, C. Dornes, C. Laulhe, S. Ravy, G. Ingold, P. Beaud, J. Demsar, and S. L. Johnson, Phys. Rev. Lett. 113, 026401 (2014).
  * (41) C. Laulhé, T. Huber, G. Lantz, A. Ferrer, S. O. Mariager, S. Grübel, J. Rittmann, J. A. Johnson, V. Esposito, A. Lübcke, L. Huber, M. Kubli, M. Savoini, V. L. R. Jacques, L. Cario, B. Corraze, E. Janod, G. Ingold, P. Beaud, S. L. Johnson, and S. Ravy, Phys. Rev. Lett. 118, 247401 (2017).
  * (42) M. Trigo, P. Giraldo-Gallo, M. E. Kozina, T. Henighan, M. P. Jiang, H. Liu, J. N. Clark, M. Chollet, J. M. Glownia, D. Zhu, T. Katayama, D. Leuenberger, P. S. Kirchmann, I. R. Fisher, Z. X. Shen, and D. A. Reis, Phys. Rev. B 99, 104111 (2019).
  * (43) M. Burian, M. Porer, J. R. L. Mardegan, V. Esposito, S. Parchenko, B. Burganov, N. Gurung, M. Ramakrishnan, V. Scagnoli, H. Ueda, S. Francoual, F. Fabrizi, Y. Tanaka, T. Togashi, Y. Kubota, M. Yabashi, K. Rossnagel, S. L. Johnson, and U. Staub, Phys. Rev. Research 3, 013128 (2021).
  * (44) A. J. Sternbach, F. L. Ruta, Y. Shi, T. Slusar, J. Schalch, G. Duan, A. S. McLeod, X. Zhang, M. Liu, A. J. Millis, H.-T. Kim, L.-Q. Chen, R. D. Averitt, and D. N. Basov, Nano Lett. 21, 9052 (2021).
  * (45) S. W. Teitelbaum, B. K. Ofori-Okai, Y.-H. Cheng, J. Zhang, F. Jin, W. Wu, R. D. Averitt, and K. A. Nelson, Phys. Rev. Lett. 123, 267201 (2019).
  * (46) K. D. Bronsema, G. W. Bus, and G. A. Wiegers, J. Solid State Chem. 53, 415 (1984)
  * (47) R. Brouwer, and F. Jellinek, Physica B 99, 51 (1980).
  * (48) T. Ohtani, K. Hayashi and M. Nakahira, and H. Nozaki, Solid State Commun. 40, 629 (1981).
  * (49) N. Mitsuishi, Y. Sugita, M. S. Bahramy, M. Kamitani, T. Sonobe, M. Sakano, T. Shimojima, H. Takahashi, H. Sakai, K. Horiba, H. Kumigashira, K. Taguchi, K. Miyamoto, T. Okuda, S. Ishiwata, Y. Motome, and K. Ishizaka, Nat. Commun. 11, 2466 (2020).
  * (50) A. Nakamura, T. Shimojima, M. Matsuura, Y. Chiashi, M. Kamitani, H. Sakai, S. Ishiwata, H. Li, A. Oshiyama, and K. Ishizaka Appl. Phys. Express 11, 092601 (2018).
  * (51) A. Nakamura, T. Shimojima, Y. Chiashi, M. Kamitani, H. Sakai, S. Ishiwata, H. Li, and K. Ishizaka, Nano Lett. 20, 4932 (2020).
  * (52) H. Tanimura, N. L. Okamoto, T. Homma, Y. Sato, A. Ishii, H. Takamura, and T. Ichitsubo, Phys. Rev. B 105, 245402 (2022).
  * (53) T. Ishikawa, H. Aoyagi, T. Asaka, Y. Asano, N. Azumi, T. Bizen, H. Ego, K. Fukami, T. Fukui, Y. Furukawa et al., Nat. Photonics 6, 540 (2012).
  * (54) See Supplemental Material at http://link.aps.org/supplemental/ for detail of the experimental setup and bulk sample preparation, flake sample preparation, estimation of the sample thickness, lattice vectors and Bragg reflection index, calculations of structure factors, and the results of the fitting parameters in full scale which includes additional Refs. [55] –[60].
  * (55) T. Togashi, S. Owada, Y. Kubota, K. Sueda, T. Katayama, H. Tomizawa, T. Yabuuchi, K. Tono, and M. Yabashi, Appl. Sci. 10, 7934 (2020).
  * (56) M. Yabashi, H. Tanaka, and T. Ishikawa, J. Synchrotron Radiat. 22, 477 (2015).
  * (57) T. Kameshima, S. Ono, T. Kudo, K. Ozaki, Y. Kirihara, K. Kobayashi, Y. Inubushi, M. Yabashi, T. Horigome, A. Holland, K. Holland, D. Burt, H. Murao, and T. Hatsui, Rev. Sci. Instrum. 85, 033110 (2014).
  * (58) M. Onodera, S. Masubuchi, R. Moriya, and T. Machida, Jpn. J. Appl. Phys. 59, 010101 (2020).
  * (59) International Tables for Crystallography, Volume C Mathematical, physical and chemical tables, edited by E. Prince (Willey, 2004).
  * (60) https://dx.doi.org/10.18434/T4HS32
  * (61) T. Suzuki, Y. Kubota, A. Nakamura, T. Shimojima, K. Takubo, S. Ito, K. Yamamoto, S. Michimae, H. Sato, H. Hiramatsu, H. Hosono, T. Togashi, M. Yabashi, H. Wadati, I. Matsuda, S. Shin, and K. Okazaki, Phys. Rev. Research 3, 033222 (2021).
  * (62) A. W. Overhauser Phys. Rev. B 3, 3173 (1971).
  * (63) H. J. Zeiger, J. Vidal, T. K. Cheng, E. P. Ippen, G. Dresselhaus, and M. S. Dresselhaus, Phys. Rev. B 45, 768 (1992).
  * (64) K. Binder, Rep. Prog. Phys. 50, 783 (1987).
  * (65) A. Zong, P. E. Dolgirev, A. Kogar, E. Ergecen, M. B. Yilmaz, Y.-Q. Bie, T. Rohwer, I-Cheng Tung, J. Straquadine, X. Wang, Y. Yang, X. Shen, R. Li, J. Yang, S. Park, M. C. Hoffmann, B. K. Ofori-Okai, M. E. Kozina, H. Wen, X. Wang, I. R. Fisher, P. Jarillo-Herrero, and N. Gedik, Phys. Rev. Lett. 123, 097601 (2019).


11institutetext: College of Cyber Security, Jinan University, Guangzhou
510632, China.

# Reversible Deep Neural Network Watermarking: Matching the Floating-point
Weights

Junren Qin  Fan Yang  Jiarui Deng and Shanxiang Lyu  The authors are with the
College of Cyber Security, Jinan University, Guangzhou 510632, China .
Corresponding author: Shanxiang Lyu (lsx07@jnu.edu.cn).

###### Abstract

Static deep neural network (DNN) watermarking embeds watermarks into the
weights of DNN model by irreversible methods, but this will cause permanent
damage to watermarked model and can not meet the requirements of integrity
authentication. For these reasons, reversible data hiding (RDH) seems more
attractive for the copyright protection of DNNs. This paper proposes a novel
RDH-based static DNN watermarking method by improving the non-reversible
quantization index modulation (QIM). Targeting the floating-point weights of
DNNs, the idea of our RDH method is to add a scaled quantization error back to
the cover object. Two schemes are designed to realize the integrity protection
and legitimate authentication of DNNs. Simulation results on training loss and
classification accuracy justify the superior feasibility, effectiveness and
adaptability of the proposed method over histogram shifting (HS).

###### Keywords:

deep neural network (DNN) watermarking reversible data hiding (RDH).

##  1 Introduction

Due to their remarkable performance, deep neural networks (DNNs) have been
widely applied in many fields, such as image steganography [19], signal
denoising [12], and so on. Watermarking DNNs is an important step in
protecting the intellectual property embedded in these models [1]. With the
increasing use of deep learning based systems, there is a risk that someone
can use or modify the model without providing attribution to the original
author. Watermarking adds an extra layer of security that allows the original
author to prove ownership of the model and protect it from unauthorized access
and use. Additionally, watermarking can be used to track the provenance of a
model, ensure the integrity of the weights and parameters, facilitate model
versioning and enable the identification of malicious models.

DNN watermarking is classified into static and dynamic watermarking depending
on where the watermark can be read from [11]. i) For static watermarking (see,
e.g., [22, 7, 10, 16]), the watermark can be read directly from the network
weights. The weights are determined during the training phase, and they are of
floating-point formats, which differs from the popular unsigned-integer format
of images. ii) For dynamic watermarking (see, e.g., [9, 3]), when fed with
some crafted inputs, a dynamic watermark can alter the behavior of the
network, which makes the watermark message visible in the model output.

An interesting research direction is to further endow a reversible property to
DNN watermarks. Reversible watermarking is a type of digital watermarking that
enables content owners to protect their digital data without causing any
permanent modifications [18, 5]. This type of watermarking allows the embedded
information to be retrieved from the host object without any data loss or
damage. Focusing on the unsigned integer format of images, many celebrated
reversible watermarking algorithms have been developed, such as difference
expansion (DE) [21], prediction-error expansion (PEE) [20, 23], histogram
shifting (HS) [15]. As the weights can be considered conventional multimedia
objects, reversible watermarking of DNN is akin to a further development of
static DNN watermarking, which embeds reversible watermarks over the weights.
Recently Guan et. al. [4] employed HS to watermark the weights of
convolutional neural networks (CNNs), where the weights are represented as the
multiplicative factor of the filters. Yet HS is not a good fit for the
floating-point weights. Actually [4] has to transform weights into integers
for the sake of deploying HS. Moreover, HS deteriorates if the host admits a
uniform or uniform-like distribution.

Against this background, it becomes tempting to design a reversible
watermarking scheme that matches the floating-point weights in DNNs. The
contributions of this paper, along with the highlights, are summarized as
follows.

  * •

First, without making assumptions on the distribution of the cover object, we
design a simple yet efficient reversible watermarking algorithm by improving
the celebrated quantization index modulation (QIM) [2], namely reversible QIM
(R-QIM). For floating-point or real-valued objects, QIM resembles a lattice
quantizer that maps input values from a large set (often a continuous set) to
output values in a countable smaller set with a finite number of elements [24,
13]. The quantization in QIM is naturally lossy; however, as the cover-object
is available while performing QIM, we can add a scaled version of the
difference vector backed to the quantized output values, which makes the cover
object reversible.

  * •

Second, we explain how to deploy R-QIM in DNN watermarking, and realize
integrity protection and legitimacy authentication via R-QIM based scheme. For
integrity protection, the owner or trusted third-party institution can verify
the occurrence of data tampering regardless of noiseless channel or known
noisy channel, which solves the unavailability existing scheme had in noisy
channel transmitting. For legitimacy authentication, the proposed scheme
provides an effective way to distinguish the legal and illegal using of target
DNNs. This provides a valuable layer of protection as it can help deter
attackers, as well as identifying the individuals responsible for the attack.
It also provides a means of verifying that a given DNN is authentic,
guaranteeing that the data it produces has not been compromised in any way.

  * •

Third, theoretical justifications and numerical simulations are both presented
to demonstrate the advantages of R-QIM. We analyze the signal to watermark
ratio (SWR) of R-QIM which serves capacity and fidelity, and the impact of
covers’ distributions in HS [4]. By analyzing the weights of multi-layer
perceptron (MLP) and visual geometry group (VGG) models, we compare the
training loss and classification accuracy of R-QIM and HS [4].

The rest of the paper is organized as follows. In Section 2, DNN watermarking
models and existing algorithms are introduced. In Section 3 and Section 4, we
present R-QIM along with theoretical analyses, as well as the applications of
R-QIM. Simulation results and conclusions are given respectively in Section 5
and Section 6.

##  2 Preliminaries

###  2.1 Reversible DNN Watermarking Basics

Like static DNN watermarking [22, 11], reversible DNN watermarking also embeds
the watermark into the weights of the DNN model. Such weights are determined
during the training phase and assume fixed values that do not depend on the
input of the network.

The mathematical model can be described as follows. Let $\mathbf{W}$ be the
whole weights in a general trained DNN model. For the watermark embedding,
appropriate weights in $\mathbf{W}$ are selected by a location sequence
$\mathbf{c}$ guided by a clue/key $cl$, which builds a cover sequence
$\mathbf{s}$. To embed the information sequence $\mathbf{m}$ into
$\mathbf{s}$, as well as ensuring the subsequent correct extraction, one
should judiciously design the following triplet:

$\left\\{\begin{aligned}
\mathbf{s}_{w}&=\textrm{Emb}(\mathbf{s},\mathbf{m})\\\
\hat{\mathbf{m}}&=\textrm{Ext}(\mathbf{s}_{w}+\mathbf{n})=\textrm{Ext}(\mathbf{y})\\\
\hat{\mathbf{s}}&=\textrm{Rec}(\mathbf{s}_{w}+\mathbf{n})=\textrm{Rec}(\mathbf{y})\\\
\end{aligned}\right.$ (1)

where $\textrm{Emb}(\cdot)$, $\textrm{Ext}(\cdot)$ and $\textrm{Rec}(\cdot)$
represent the embedding, extraction and recovering functions, respectively,
while $\mathbf{y}$ denotes the possibly noisy reception of the watermarked
sequence $\mathbf{s}_{w}$ (E.g., $\mathbf{y}=\mathbf{s}_{w}+\mathbf{n}$ for
the case of additive noises).

While reversible DNN watermarking is similar to reversible image watermarking,
they are different in terms of the cover formats, robustness and fidelity
requirements. The comparison is summarized in Table 1.

Table 1: The comparison of reversible image watermarking and reversible DNN
watermarking

Features |  Reversible image watermarking |  Reversible DNN watermarking
---|---|---
Format of covers |  Unsigned integers |  Floating-point numbers
Fidelity |  Higher quality of the host signal after watermark embedding |  Higher effectiveness of the host network after watermark embedding
Capacity |  The ability to embed watermark with a massive data/information
Security |  The ability to remain secret for unauthorized parties on watermark accessing, reading and modifying
Efficiency |  Higher speed for the embedding and extracting process of watermarking algorithm

###  2.2 Existing Methods

####  2.2.1 HS.

HS is a reversible watermarking algorithm for images, and has been recently
adjusted to deploy in CNNs[4]. The whole method is divided into three parts:
host sequence construction, data preprocessing and watermarking algorithm. The
host sequence construction implies the method to construct a host matrix from
a convolutional layer in CNN, which is irrelevant to this paper. In the data
preprocessing, each weight is defined as

$\omega=\pm
0.\underbrace{00...0}_{p~{}digits}n_{1}n_{2}...n_{c}n_{c+1}...n_{q},$ (2)

in which $q$ represents the whole length of digits for the weight. To meet the
requirements of integer host, the consecutive non-zero digit pairs
$(n_{c},n_{c+1})$ in $\omega$, corresponding to the minimum entropy, is chosen
as the significant digit pairs to construct the host sequence. Then, the
chosen pairs will add an adjustable integer parameter $V$ to adjust it for the
appropriate range $\left[-99,99\right]$.

For the watermarking algorithm, [4] chose HS [15] scheme as the embedding and
extracting strategy. By defining the histogram peak of the whole $\omega$ as
$\Omega_{\mathrm{max}}$ and the histogram valley $\Omega_{\mathrm{min}}$, the
$1$-bit HS embedding for the watermark $m$ can be described as

$\omega^{{}^{\prime}}=\left\\{\begin{aligned}
&\omega+m,&\omega=\Omega_{\mathrm{max}}\\\
&\omega+1,&\omega\in\left(\Omega_{\mathrm{max}},\Omega_{\mathrm{min}}\right)\\\
&\omega,&\omega\notin\left[\Omega_{\mathrm{max}},\Omega_{\mathrm{min}}\right)\\\
\end{aligned}\right..$ (3)

The histogram shift operation in this $1$-bit embedding process is depicted in
Fig. 1(a), where the bins more than $\Omega_{\mathrm{max}}$ are shifted
towards right by fixed $\Delta=1$ to create a vacant bin for embedding, and
the watermark $m$ of uniform distribution is embedded into the bin equal to
$\Omega_{\mathrm{max}}$ by HS. This divides the whole cover into three regions
depicted in Fig. 1 (c) , in which the covers smaller than
$\Omega_{\mathrm{max}}$ are referred to region i, the covers equal to
$\Omega_{\mathrm{max}}$ to region ii, and the covers larger than
$\Omega_{\mathrm{max}}$ to region iii. For each bit, $\omega$ changes by the
mapping rule depicted in Fig. 1 (b).

(a) Histogram shift (b) Mapping rule (c) Regions deviding

Figure 1: Illustration of the HS algorithm [4].

With the same process of host sequence construction and data preprocessing,
the extracting process can be described as

$\hat{m}=\left\\{\begin{aligned}
&1,&\omega^{{}^{\prime}}=\Omega_{\mathrm{max}}+1\\\
&0,&\omega^{{}^{\prime}}=\Omega_{\mathrm{max}}\\\ \end{aligned}\right.,$ (4)

and the recovering process

$\hat{\omega}=\left\\{\begin{aligned}
&\omega^{{}^{\prime}}-1,&\omega\in\left(\Omega_{\mathrm{max}},\Omega_{\mathrm{min}}\right)\\\
&\omega^{{}^{\prime}},&\omega\notin\left[\Omega_{\mathrm{max}},\Omega_{\mathrm{min}}\right)\\\
\end{aligned}\right..$ (5)

####  2.2.2 QIM.

QIM is a popular method for non-reversible watarmrking [14]. Its rationale can
be explained by the example in Fig. 2(a). The circle and cross positions of
Fig. 2(a) denote two sets $\Lambda_{0}$ and $\Lambda_{1}$, and they are
arranged alternately. Given a host/cover sample $s\in\mathbb{R}$ and a one-bit
message $m\in\\{0,1\\}$, the watermarked value is simply moving $s$ to the
nearest point in $\Lambda_{0}$ when $m=0$, and to the nearest point in
$\Lambda_{1}$ when $m=1$.

Figure 2: Embed one bit into a sample with different versions of QIM. (a)
Conventional QIM. (b) Reversible QIM.

Define $Q_{\Delta}(s)=\Delta\lfloor s/\Delta\rfloor$ with $\Delta$ being a
step-size parameter. Then the embedding process can be described as

$s_{\mathrm{QIM}}\triangleq
Q_{m}(s)=Q_{\Delta}(s-d_{m})+d_{m},~{}m\in\\{0,1\\},$ (6)

where $d_{0}=-(\Delta/4)$, $d_{1}=\Delta/4$,
$\Lambda_{0}=d_{0}+\Delta\mathbb{Z}$ and $\Lambda_{1}=d_{1}+\Delta\mathbb{Z}$.

Assume that the transmitted $s_{\mathrm{QIM}}$ has undergone the contamination
of an additive noise term $n$, then at the receiver’s side we have:
$y=s_{\mathrm{QIM}}+n$. A minimum distance decoder is therefore given as

$\hat{m}=\mathop{arg\min}_{m\in\\{0,1\\}}\left[\mathop{\min}_{s\in\Lambda_{m}}|y-s|\right].$
(7)

If $|n|<\Delta/4$, the $\hat{m}$ is correct.

Regarding the embedding distortion, as shown in Fig. 3(a), the maximum error
caused by embedding is $\Delta/2$. If the quantization errors are distributed
uniformly over $[-(\Delta/2),(\Delta/2)]$, then the mean-squared embedding
distortion is $D=\Delta^{2}/12$. Considering the capacity, QIM is almost $1$
bpps which means each sample of host cover can remain $1$ sample of watermark.

Figure 3: Selection of watermarked signal with given $s$ and $m\in\\{0,1\\}$
for Prototype symmetric function, $x=Q_{m}(s)$ with $m=0$, and $x=Q_{m}(s)$
with $m=1$ in different one-bit watermarking. (a) Conventional QIM. (b)
Reversible QIM with $\alpha=0.5$.

##  3 THE PROPOSED METHOD

Notice that floating-point arithmetic is arithmetic that represents real
numbers approximately. As QIM can work with the Euclidean domain, this section
presents a QIM-based RDH algorithm named reversible QIM (R-QIM), and elaborate
its advantages compared to [4].

###  3.1 R-QIM

We observe that there exists a quantization error $e$ between the cover vector
$s$ and its quantized watermarked vector $Q_{(m,k)}(s)$, i.e.,

$\displaystyle e=s-Q_{m}(s).$ (8)

Obviously the information about $e$ is lost if we only use $Q_{m}(s)$ as the
watermarked vector. Notice that QIM has certain error tolerance capability. If
we treat $e$ as the “beneficial noise” and add it back to $Q_{m}(s)$, then the
information about the cover $s$ can be maintained, and the scheme becomes
reversible. The tricky part about adding “beneficial noise” is that, they
should be properly scaled to meet several demands. First, the scaled $e$
should be small enough such that it does not go beyond the correct decoding
region. Second, the scaled $e$ should not be too small to avoid exceeding the
used representation accuracy of numbers.

The method incorporating the above ideas is referred to as R-QIM. Its
embedding operation is defined as

$s_{\rm{R-QIM}}\triangleq\alpha Q_{(m,k)}(s)+(1-\alpha)s,$ (9)

where $\alpha$ denotes a scaling factor satisfying
$\alpha\in\left(\frac{|\mathcal{M}|-1}{|\mathcal{M}|},1\right)$,
$Q_{(m,k)}(s)$ represents a encrypted quantizer defined as

$Q_{(m,k)}(s)\triangleq Q_{\Delta}(s-d_{m}-k)+d_{m}+k,m\in\mathcal{M}.$ (10)

In Eq. (10), $Q_{\Delta}(s)$ denotes the same $Q_{\Delta}(s)=\Delta\lfloor
s/\Delta\rfloor$ as conventional QIM, and $k$ a dithering component for
secrecy. With reference to Eqs. (9) (10), R-QIM can be regarded as a fast
version of our lattice-based method in [17].

Since $k$ and $\alpha$ respectively relate to the correctness of decoding and
recovering, they usually act as secret keys in a watermarking scheme. By
setting $k=0$ and $\alpha=0.5$, the $1$-bit embedding example of R-QIM is
depicted in Fig. 2(b), in which watermarked covers are distributed in the
green and red zone around the circle and cross positions, rather than the
positions of their points.

For receiver, the estimated watermark can be extracted from his received $y$
by

$\hat{d_{m}}\equiv
Q_{\frac{\Delta}{|\mathcal{M}|}+k}(y)=\left[Q_{\frac{\Delta}{|\mathcal{M}|}}(y-k)+k\right]\\{\Delta\\}.$
(11)

When the noise term $n$ is small enough to satisfy

$Q_{\frac{\Delta}{|\mathcal{M}|}+k}(n)=0,$ (12)

correct extraction $\hat{d_{m}}=d_{m}$ occurs, regardless in noiseless or
noisy channel.

To estimate the original weight $s$ from the received $y$, we have

$\hat{s}=\frac{y-\alpha Q_{\frac{\Delta}{|\mathcal{M}|}+k}(y)}{1-\alpha}.$
(13)

Notice that the correct restoration $\hat{s}=s$ occurs if and only if
$n=0,~{}s.t.,~{}y=s_{\rm{R-QIM}}$. If the channel is noisy, the error of
estimation is

$\hat{s}-s=\frac{n}{1-\alpha}.$ (14)

By setting $\alpha=0.5$ and $k=0$, the embedding distortion is depicted in
Fig. 3(b), whose maximum error is $\alpha\Delta/2=\Delta/4$. If the
quantization errors are distributed uniformly over $[-(\Delta/2),(\Delta/2)]$,
then the mean-squared embedding distortion is

$D=\frac{\alpha}{12}\Delta^{2}.$ (15)

Obviously, since $\bigcup_{m=0}^{|\mathcal{M}|-1}\Lambda_{m}=\mathbb{R}$ (as
shown in Fig. 2), each bit of watermark can embed into a sample of host with
any characteristic and distribution. Such features make R-QIM possessing
almost the same maximum length of available watermark as the number of host
samples.

###  3.2 Discussions

Compared to HS [4], R-QIM is more suitable for RDH-based static DNN
watermarking in terms of usability, capacity and imperceptibility. To confirm
this conclusion, respectively in this subsection, we analyze the HS-based
scheme in [4] and the theoretical advantages of R-QIM seriously. We consider
that all the host sequence constructed from the whole weights of DNN model is
a piece of real number bit flow of normal distribution.

In terms of usability, HS mismatches the host of uniform distribution for two
reasons:

  * i)

There are some obvious statistical characteristics of the watermarked sequence
produced from the uniform host, which is defenseless against the passive
attack.

  * ii)

The low capacity of HS becomes worse and unbearable in uniformly distributed
host.

Therefore, HS seems not feasible as the data preprocessing operation makes the
host sequence uniform rather than being normal distributed. For the data
preprocessing operation, different random $10000$ length data of normal
distribution are tested $1000$ times on skewness, kurtosis and
Kolmogorov–Smirnov (K-S) test, and one of them is tested by Quantile-Quantile
(Q-Q) plot. The results are depicted in Fig. 4 where the preprocessed data
become flatter, and disobey normal distribution in K-S test. In Fig. 4(d), (e)
and (f), the observations imply that the preprocessed data is consistent
distribution with the uniform random integer flow of the same range. Thus, HS
[4] lacks practical usability, while the R-QIM is feasible for data admitting
any distribution.

(a) Skewness (b) Kurtosis (c) K-S test result (d) Original versus normal
distribution when $c=3$ (e) Preprocessed versus normal distribution when $c=3$
(f) Preprocessed versus uniform distribution when $c=3$

Figure 4: Skewness, Kurtosis and K-S test results on normal distribute data,
and their respective Q-Q plots.

Regarding the theoretical advantages of R-QIM, we analyze the capacity and
imperceptibility for R-QIM and the HS. To evaluate the embedding capacity, we
consider a host sequence of length $L$ to analyze the maximum available
watermark length $C_{\rm{max}}$ by implementing R-QIM and HS. To evaluate the
imperceptibility, since the effectiveness of the host network is difficult to
measure in theory, we assume it is proportional to lower embedding distortion,
and this assumption is verified in the experiments. To evaluate the embedding
distortion, the popular signal to watermark ratio (SWR) is defined as

$\displaystyle\mathrm{SWR}~{}(\mathrm{dB})=10\times
lg\left(\frac{\sigma^{2}_{\mathbf{s}}}{\sigma^{2}_{\mathbf{w}}}\right),$ (16)

where $\sigma^{2}_{\mathbf{s}}$, $\sigma^{2}_{\mathbf{w}}$ represent the power
of the host and the additive watermark, respectively. Because of the same
host, a smaller $\sigma^{2}_{\mathbf{w}}$ leads to a higher SWR implied better
performance on imperceptibility. For the fairness of the distortion analysis,
we assume the same capacity and host distribution for both HS in [4] and
R-QIM, corresponding to embed watermark into the host equal to
$\Omega_{\mathrm{max}}$ which follows Gaussian distribution and depicts in
Fig. 1 (c).

Considering the embedding capacity, since the watermark only embeds into the
bin of $s=\Omega_{\mathrm{max}}$ via the HS method in [4], and the other bins
contain no information of watermarks, the maximum length of available
watermark in HS can be calculated by

$C_{\rm{max},HS}=\mathrm{Pr}(X\in Region~{}ii)\cdot L.$ (17)

However, in R-QIM, the whole host sequence can embed the watermark, which
implies that $C_{\rm{max},R-QIM}=L$. Obviously, for the same length of host
sequence, R-QIM has higher embedding capacity.

In terms of the embedding distortion, we have the following result.

###### Theorem 3.1

R-QIM has a larger SWR than HS when $\Delta\leq\sqrt{3}$.

###### Proof

Due to the symmetry of Gaussian distribution that $\mathrm{Pr}(X\in
Region~{}i)=\mathrm{Pr}(X\in Region~{}iii)$, we have $\mathrm{Pr}(X\in
Region~{}ii)=1-2\mathrm{Pr}(X\in Region~{}iii)$. With the same setting, the
$\sigma^{2}_{\mathbf{w}}$ of HS is

$\displaystyle\sigma^{2}_{\mathbf{w},\mathrm{HS}}=$
$\displaystyle\frac{1}{4}\mathrm{Pr}(X\in Region~{}ii)+\mathrm{Pr}(X\in
Region~{}iii)$ $\displaystyle=$
$\displaystyle\frac{1}{4}+\frac{1}{2}\mathrm{Pr}(X\in Region~{}iii),$ (18)

while $\sigma^{2}_{\mathbf{w}}$ of R-QIM is

$\displaystyle\sigma^{2}_{\mathbf{w},\mathrm{R-QIM}}=$
$\displaystyle\frac{\alpha\Delta^{2}}{12}\mathrm{Pr}(X\in Region~{}ii)$
$\displaystyle=$
$\displaystyle\frac{\alpha\Delta^{2}}{12}-\frac{\alpha\Delta^{2}}{6}\mathrm{Pr}(X\in
Region~{}iii).$ (19)

Based on Eqs. (3.2) and (3.2), we have

$\displaystyle\sigma^{2}_{\mathbf{w},\mathrm{HS}}-\sigma^{2}_{\mathbf{w},\mathrm{R-QIM}}=\frac{3-\alpha\Delta^{2}}{12}+\frac{3+\alpha\Delta^{2}}{6}\mathrm{Pr}(X\in
Region~{}iii).$ (20)

Since $0<\mathrm{Pr}(Region~{}iii)<1/2$, one has

$\displaystyle\frac{3-\alpha\Delta^{2}}{12}<\frac{3-\alpha\Delta^{2}}{12}+\frac{3+\alpha\Delta^{2}}{6}\mathrm{Pr}(X\in
Region~{}iii)<\frac{1}{2}.$ (21)

Eq. (20) is larger than $0$ when $\Delta\leq\sqrt{3}$, so the theorem is
proved.

According to Theorem 3.1, for the same fixed setting of $\Delta=1$ in HS [4],
we can observe that R-QIM obtains a lower embedding distortion, and better
fidelity based on aforementioned assumption. On the other hand, it also
indicates that the fidelity of R-QIM can be controlled. When
$\Delta>\sqrt{3}$, by setting parameters artificially, we can obtain flexible
performance of fidelity, regardless better or worse than HS. In the scheme
designing we will demonstrate the benefits of this.

##  4 Applications of R-QIM

In this section, we deploy R-QIM in static DNN watermarking. The proposed
scheme contains several algorithms realizing the embedding, extracting and
recovering process. Then, the concrete steps of some functions, including
integrity protection and infringement identification, are elaborated for
realizing via proposed scheme. The schematics of the two applications are
depicted in Fig 5. The owner of DNNs, legal user, illegal user and trusted
third-party institution are respectively named as "Alice", "Bob", "Mallory"
and "Institution" for the sake of simplicity.

###  4.1 Wrapping-up R-QIM

R-QIM should be additional wrapped-up for security concerns. Based on R-QIM,
the processes of watermarking, extracting and restoring are displayed by
pseudo-codes of Mark, Algorithm 1, Extract, Algorithm 2 and Restore, Algorithm
3. In these algorithms, some parameters included $cl$ and $k$ are set by a
pseudo random number generator (PRNG), and the others, like step size $\Delta$
and scaling factor $\alpha$, are set by the owner.

Algorithm 1 Mark

Input: Trained Model $\mathbf{W}$, Watermark $\mathbf{m}$, Scaling Factor
$\alpha$, Dithering Vector $k$, Embedding Clue $cl$, Step Size $\Delta$
Output: Watermarked Model $\mathbf{W}_{wtm}$, Watermark Information
$\mathbf{w\\_info}$, Secret Key $\mathbf{sk}$

1:$\left[~{}L,|\mathcal{M}|~{}\right]\leftarrow\mathrm{Info}(\mathbf{m})$

2:$\mathbf{c}\leftarrow\mathrm{Construction}(cl,L)$

3:$\mathbf{W}_{wtm}\leftarrow\mathbf{W}$, $i\leftarrow 0$

4:for $++i\leq L$ do

5: $s_{i}\leftarrow\mathbf{W}(\mathbf{c}(i))$

6: $m_{i}\leftarrow\mathbf{m}(i)$

7:
$\mathbf{W}_{wtm}(\mathbf{c}(i))\leftarrow\mathrm{Emb}(s_{i},m_{i},\alpha,k,\Delta)$

8:$\mathbf{w\\_info}\leftarrow\left[~{}L,|\mathcal{M}|~{}\right]$

9:$\mathbf{sk}\leftarrow\left[~{}k,cl,\Delta~{}\right]$

Algorithm 2 Extract

Input: Watermarked Model $\mathbf{W}_{wtm}$, Watermark Information
$\mathbf{w\\_info}$, Secret Key $\mathbf{sk}$
Output: Extracted Watermark $\hat{\mathbf{m}}$

1:$\left[~{}L,|\mathcal{M}|~{}\right]\leftarrow\mathbf{w\\_info}$

2:$\left[~{}\alpha,k,cl,\Delta~{}\right]\leftarrow\mathbf{sk}$

3:$\mathbf{c}\leftarrow\mathrm{Construction}(cl,L)$

4:$i\leftarrow 0$

5:for $++i\leq L$ do

6: $y_{i}\leftarrow\mathbf{W}_{wtm}(\mathbf{c}(i))$

7: $d_{i}\leftarrow\mathrm{Ext}(y_{i},k,\Delta,|\mathcal{M}|)$

8: $\hat{\mathbf{m}}(i)\leftarrow\mathrm{Codebook}(d_{i})$

Algorithm 3 Restore

Input: Watermarked Model $\mathbf{W}_{wtm}$, Watermark Information
$\mathbf{w\\_info}$, Secret Key $\mathbf{sk}$, Scaling Factor $\alpha$
Output: Recovered Model $\hat{\mathbf{W}}$

1:$\left[~{}L,|\mathcal{M}|~{}\right]\leftarrow\mathbf{w\\_info}$

2:$\left[~{}\alpha,k,cl,\Delta~{}\right]\leftarrow\mathbf{sk}$

3:$\mathbf{c}\leftarrow\mathrm{Construction}(cl,L)$

4:$\hat{\mathbf{W}}\leftarrow\mathbf{W}_{wtm}$, $i\leftarrow 0$

5:for $++i\leq L$ do

6: $y_{i}\leftarrow\mathbf{W}_{wtm}(\mathbf{c}(i))$

7:
$\hat{\mathbf{W}}(\mathbf{c}(i))\leftarrow\mathrm{Rec}(y_{i},k,\alpha,\Delta,|\mathcal{M}|)$

In Mark (Algorithm 1), trained model $\mathbf{W}$, watermark m and the
aforementioned parameters are regarded as the inputs to output the watermarked
model $\mathbf{W}_{wtm}$ and some side information which includes watermark
information $\mathbf{w\\_info}$ and secret key $\mathbf{sk}$. After selecting
a sequence $\mathbf{s}=[s_{0},s_{1},...,s_{L-1}]$ with the clue $cl$ and
obtaining some information ($L$ and $|\mathcal{M}|$) from m by $\mathrm{Info}$
function, each bit of watermark $m_{i}$ will be embedded into $s_{i}$ by
employing Eq. (9) as $\mathrm{Emb}(\cdot)$. Then, $L$ and $|\mathcal{M}|$ will
be combined as $\mathbf{w\\_info}$, and $cl$, $k$ and $\Delta$ as
$\mathbf{sk}$. To ensure the security properties of the embedded watermark,
DNN model’s owner should keep $\mathbf{w\\_info}$, $\mathbf{sk}$ and $\alpha$
in order not to divulge them.

Extract (Algorithm 2) realizes watermark extraction from the watermarked model
$\mathbf{W}_{wtm}$ produced by Mark. With the aid of watermark information
$\mathbf{w\\_info}$ and secret key $\mathbf{sk}$ kept by the owner, an
estimated $\hat{\mathbf{d}}$ is created by employing Eq. (11) as
$\mathrm{Ext}(\cdot)$ after the same selecting process as Mark. Then, guided
by watermark information in code book, Extract outputs an estimated watermark
$\hat{\mathbf{m}}$ from $\hat{\mathbf{d}}$. Significantly, since watermark
extraction need the assistance of secret key $\mathbf{sk}$ rather than
$\alpha$ related to the security of DNN model recovering, Extract should be
implemented by the DNN model owner or a trustworthy third-party institution
while ensuring the nondisclosure of scaling factor $\alpha$.

Restore (Algorithm 3) takes the watermarked model $\mathbf{W}_{wtm}$ as input
to recover it into its original type, in which the watermark information
$\mathbf{w\\_info}$, secret key $\mathbf{sk}$ and scaling factor $\alpha$ act
as the side information to aid the recovering process. After the same
selecting process as Mark, each sample $y_{i}$ is recovered to $s_{i}$ one by
one by employing Eq. (13) as $\mathrm{Rec}(\cdot)$. Since correct restoration
is related to noise term $n$, we can judge the tampering of watermarked model
under noiseless channel or known noisy channel, which makes reversible
watermarking to protect the integrity of watermarked model. Meanwhile, since
the watermark contained in watermarked DNN model no more exists in restored
model after Restore, we can evaluate the enforcement of recovering process by
verifying the existence of watermark in a DNN model.

(a) Integrity protection (b) Infringement identification

Figure 5: Schematics of using R-QIM for integrity protection and infringement
identification.

###  4.2 Integrity protection

For the reason of enabling a reversible property to DNN watermarks, [4] has
introduced the integrity protection of DNN model, in which a scheme has been
proposed to verify whether a DNN is tampered by comparing the bit difference
of weights between the restored and the original models. In a similar vein to
[4]’s, an integrity protection scheme employing R-QIM is depicted in Fig. 5
(a). In the figure, Alice embeds her watermarks into a commercialized DNN
model $\mathbf{W}$ via the Mark algorithm, and outputs a watermarked DNN model
$\mathbf{W}_{wtm}$. During the process of transmission, Mallory illegally
intercepts $\mathbf{W}_{wtm}$, tampers its weights, and shares it in profits.
For the sake of identifying tampering, we define two types of operations for
noiseless or noisy channels.

  * •

Noiseless channel. Since correct recovering is guaranteed, the tampered DNN
model is recovered by Restore to obtain an estimated model. Notably, since Eq.
(13) contains $Q_{\frac{\Delta}{|\mathcal{M}|}+k}(y)$, which can be regarded
as watermark extraction. Thus the Restore function can meet the demand of
perfect recovery after watermark extraction. At last, the weights between the
restored and the original models are compared via a difference function
$\mathrm{Diff(\cdot)}$, which outputs a difference ratio $b$. Due to the
sensitiveness of the recovering process, minor changes of $\mathbf{W}_{wtm}$
would lead to a difference on the weights of restored model. This feature
makes it possible for integrity judgment, in which $b=1$ (or $b=0$) implies
that $\mathbf{W}_{wtm}$ has (not) been tampered.

  * •

Noisy channel. Tampering of DNN models can be identified when the noise term
$n$ is small enough. Thanks to Eq. (14), we can measure the difference between
the restored and the original models in theory, such that the comparison in
$\mathrm{Diff(\cdot)}$ can proceed excluding the interference of noise term
$n$. In this scenario, we compute the theoretical difference between the
restored and the original models by Eq. (14), compare the theoretical
difference, and obtain a difference ratio $b$. When $b=1$ (or $b=0$), it
implies that $\mathbf{W}_{wtm}$ has (not) been tampered.

Summarizing the above, our proposed scheme seems more suitable for the
scenario of integrity protection when compared to [4]. In our scheme, the
fidelity of $\mathbf{W}_{wtm}$ is higher, which is justified by Theorem 3.1.
In addition, our scheme is perhaps the first one to protect the integrity of
$\mathbf{W}_{wtm}$ over noisy channels.

###  4.3 Infringement identification

In addition to integrity protection, reversible DNN watermarking can achieve
infringement identification for suspicious DNN models. Since recovering
operation removes the watermark contained in watermarked DNN models, there
exist no more watermark detected in the restored model. If a legal user holds
the restored model while the illegal user holds the watermarked one, it
becomes possible to distinguish them. Based on this idea, we propose a novel
scheme for the infringement identification of DNN models, in which a user
receives the secret key for recovering after legalization and obtains a
restored model. The whole process of the proposed scheme of legitimate
authentication are depicted in Fig. 5(b). For simplicity, the owner, legal
user, illegal user and trusted third-party institution are respectively named
as "Alice", "Bob", "Mallory" and "Institution".

In the proposed scheme, a commercialized DNN model $\mathbf{W}$, owned by
Alice, is sold via a online/offline platform, and employs our proposed scheme
to mark the ownership of $\mathbf{W}$. After Alice embeds a watermark into
$\mathbf{W}$ by Mark, the produced watermarked model $\mathbf{W}_{wtm}$ is
sent to the platform, and acts as an exhibit or trial product to promote
Alice’s model. Obviously, since the embedding process is deployed after model
training, the fidelity of $\mathbf{W}_{wtm}$ is worse so that its disclosure
does not damage Alice’s rights. Once the product has attracted Bob, both
$\mathbf{w\\_info}$, $\mathbf{sk}$ and $\alpha$ are sent from Alice to Bob,
and Bob can recover $\mathbf{W}_{wtm}$ into its original type via Restore. At
that time, the recovered model is the same as original model so that it has
the best effectiveness, and the watermark is removed totally so that the
watermark is undetected in the recovered model. When Mallory illegally steals
the DNN model on public platforms, Alice can initiate arbitration to an
Institution after being learned. To authenticate the legitimacy of the
suspicious model held by Mallory, Alice or the Institution can extract the
estimated watermark $\hat{\textbf{m}}$ from suspect model via Extract. Then,
$\hat{\textbf{m}}$ will be compared with Alice’s watermark via
$\mathrm{Diff(\cdot)}$ which outputs a difference ratio $b$ to detect the
existence of embedded watermark. When $b\leq 0.1$, the watermark is regarded
as detected, and Mallory is confirmed as illegal user.

To avoid damage Alice’s rights, the DNN watermarking scheme for infringement
identification should feature a small fidelity such that the effectiveness of
watermarked model is no better than the original one. Thanks to Theorem 3.1,
R-QIM enjoys a bigger distortion than HS [4] by setting $\Delta>\sqrt{3}$ and
a proper $\alpha$, which can infer that R-QIM is more adaptable for the
scenario of infringement identification.

##  5 SIMULATIONS

(a) Original MLP weigts versus normal distribution

(b) Preprocessed MLP weights versus normal distribution

(c) Preprocessed MLP weights versus uniform distribution

(d) Original VGG weigts versus normal distribution

(e) Preprocessed VGG weights versus normal distribution

(f) Preprocessed VGG weights versus uniform distribution

Figure 6: Q-Q plot on the original and preprocessed weights with $c=3$

In order to evaluate the effectiveness of the proposed R-QIM scheme,
simulations are divided into three parts: i) The usability of the HS method in
[4]. ii) The comparison between R-QIM and HS on the capacity and fidelity.
iii) The impact of parameters of R-QIM. The setups in these experiments are
summarized as follows.

Datasets and Models: In the experiments, MNIST [8] and CIFAR10 [6] are chosen
as the datasets to train the Multi-layer Perceptron (MLP) model and the Visual
Geometry Group (VGG) model respectively. MNIST is a handwritten digits data
set in which 60,000 training and 10,000 testing gray-scale images with a size
of 28$\times$28 pixels are divided into 10 classes. With the same 10 classes
of figures, CIFAR10 contains 50,000 training and 10,000 testing color images
of the size 32$\times$32 pixels. In the experiments, the models and datasets
are divided into two combinations, that is, the MLP model with MNIST, referred
to as group A, and the VGG model with CIFAR10, referred to as group B.

Parameters: A piece of text converted to the bit stream is selected as the
watermark. We set the step size $\Delta=1$, and choose the same scaling factor
$\alpha=0.8675$ and dithering value $k=0$.

Indicators: To evaluate the fidelity of the watermarked model, we apply
training loss and classification accuracy as the metrics, in which the former
measures the embedding damage, and the latter weighs the effectiveness of the
watermarked network. A lower training loss indicates less impact from
watermark embedding, while a higher classification accuracy reflects the
greater effectiveness of the watermarked network. To detect the existence of
copyright information and tampering detection, the bit error rate (BER) is
employed as the metric which is defined as

$BER=\dfrac{\sum_{k=1}^{N}(x_{k}\oplus x^{\prime}_{k})}{N},$ (22)

where $x_{k}$ and $x^{\prime}_{k}$ separately denote the $k$-th bit of the
original and estimated message. In copyright protection, information exists if
BER is not larger than $10\%$, otherwise not. For the detection of tampering,
a model is said to be untampered if BER equals to $0$.

###  5.1 Usability test

We have theoretically identified potential weakness of HS in section 3.2. To
support our claims, we conduct a numerical analysis of the weighs of DNN
models.

Table 2: The analysis of weights in different models Metric | MLP ($198656$ length) | VGG ($200000$ length)
---|---|---
Original | Preprocessed | Original | Preprocessed
Skewness | 0.0426 | -0.1059 | 34.8544 | -0.0028
Kurtosis | 2.8642 | 1.8324 | 1692.39 | 1.8276
$P\leq 5\%$ in K-S test |  $\times$ |  $\times$ |  $\times$ |  $\times$
$P\leq 5\%$ in J-B test |  $\times$ |  $\times$ |  $\times$ |  $\times$

Fig. 6 shows the Q-Q plot on the original and preprocessed weights of MLP and
VGG models versus normal and uniform distribution. The original weights of two
models have a closer shape to the normal distribution, and the preprocessed
weights of two models are obviously both the integer of uniform distribution
rather than normal distribution.

Additionally, we analyzed the skewness, kurtosis, K-S test, and Jarque-Bera
(J-B) test results for the original and preprocessed weights of MLP and VGG,
and summarized them in Table 2, indicating that: i) The data preprocessing
flattens the data distribution, resulting in lower kurtosis values for the
preprocessed weights. ii) Neither the original nor the preprocessed weights of
MLP and VGG pass the K-S and J-B tests. Above experiments demonstrate that
realistic DNN weights do not follow a normal distribution, but this does not
affect the validity of the data preprocessing method proposed in [4] for
transforming data from normal to uniform distribution. Nonetheless, this
highlights the limited usability of the [4] method.

Table 3: Maximum capacity versus the HS method in [4] Host length | MLP ($198656$ length) | VGG ($200000$ length)
---|---|---
R-QIM |  HS[4] | R-QIM |  HS[4]
$20$% | 39732 | 377 | 40000 | 396
$40$% | 79463 | 811 | 80000 | 760
$60$% | 119194 | 1187 | 120000 | 1177
$80$% | 158925 | 1565 | 160000 | 1604
$100$% | 198656 | 1969 | 200000 | 1982

###  5.2 Capacity and fidelity comparisons

Regarding the adaptability of two proposed schemes for capacity and fidelity,
we design several experiments to verify the superiority of R-QIM in two
applications. The first application, integrity protection, requires a
watermarking method with high embedding capacity and little embedding damage.
Thus, we compare the maximum available capacity, classification accuracy, and
training loss between our proposed scheme and [4]’s with the fixed $\Delta=1$.

Considering the maximum available capacity, table 3 shows a considerable
difference between R-QIM and HS. Regardless of group A or B, the table implies
that R-QIM has a higher embedding capability than the benchmark method, which
is consistent with our theoretical analysis.

(a) Loss in Group A (b) Accuracy in Group A (c) Loss in Group B (d) Accuracy
in Group B (e) Loss in Group A (f) Accuracy in Group A (g) Loss in Group B (h)
Accuracy in Group B

Figure 7: Loss and Accuracy versus HS [4] with different (a)-(d) epochs.
(e)-(h) $\alpha$ and $\Delta$.

As for fidelity, we compare the training loss and classification accuracy of
the watermarked model embedded in different epochs by R-QIM and HS. Some
results are presented in Fig. 7(a)-(d), where R-QIM outperforms the benchmark
method in both metrics for group A and B, and group B is more obvious than A.
Notably, observations in Fig. 7(a)-(d) also support our assumption that lower
embedding distortion leads to better fidelity of watermarked model.

Regarding infringement identification, according to theorem 3.1, R-QIM can
obtain a more obvious decline in fidelity than HS by setting
$\Delta>\sqrt{3}$. To verify this, the classification accuracy and training
loss of MLP and VGG model with different $\alpha$ and $\Delta$ are
respectively depicted in Fig. 7(e)-(h), in which we drwa the following
observations: i) As $\alpha$ and $\Delta$ increase, the loss of watermarked
model increases while the accuracy deceases, which aligns with our expectation
under the assumption between distortion and fidelity. ii) When
$\Delta=1<\sqrt{3}$ in R-QIM, it outperforms HS in terms of both loss and
accuracy for groups A and B.However, when $\Delta=3,~{}5>\sqrt{3}$, HS is
better than R-IQIM. This supports theorem 3.1, and demonstrates the
flexibility of performance of R-QIM which determines the applicability in
infringement identification.

###  5.3 Performance of R-QIM recovering

We construct several simulations to explore the performance of R-QIM
recovering, including the accuracy of recovered value and the presence of
watermarks. Notably, the watermarks in these experiments are converted to
uniform data consisting of $4264$ bits.

(a) Group A

(b) Group B

(c) Group A&B

(d) Group A (e) Group B

Figure 8: Simulations on recovering performance. (a) (b) Effects on recovering
operation while training for 60 epochs and embedding at epoch 30. (c)
Detecting results of watermark before and after recovering. (d) (e) Values
comparison on original, watermarked and recovered weights.

In the first experiment, we aim to compare the performance difference in
implementing reversible operations. We train two combinations from scratch
twice for 60 epochs and embed watermark at epoch 30 via the proposed scheme.
In first time (denoted by green line), reversible operation is applied
immediately after the embedding process, but not in second time (denoted by
red line). From Fig. 8(a), (b), we can obtain some notable observations. i)
After watermark embedding, the model’s accuracy sharply degrades due to the
parameter modification. However, with the implementation of the proposed
reversible operation, the reduced accuracy immediately restores. This shows
the effectiveness of the reversible operation in offsetting the damages caused
by the watermark embedding. ii) When reduced accuracy steps into a plateau
without reversible operation, the accuracy of two groups steps lower than
whose reversible operation applies. It indicates the incomplete compensation
of subsequent training for watermarked model using, but is complete by
reversible operation. iii) We observe that group A is affected severely than
group B after watermark embedding, and reaches a slower plateau in subsequent
training, implying higher effectiveness for reversible operation in group A.

To analyze the specific effects of the proposed method’s various processes, we
compare the values of original, watermarked and recovered weights for two
combinations in Fig. 8(c). In Fig.8(c), the point of original and recovered
cover (represented by horizontal line and vertical bar) are coincided at each
index of sample, indicating correct recovery. Meanwhile, the distribution of
watermarked weights (represented by cross) in Fig. 8(c) shows the impact on
the weights caused by watermark embedding.

Finally, as the legitimacy authentication function is related to determining
whether the restored DNN model contains a watermark, we compared the bit error
rate (BER) metric of the watermark with and without the reversible operation
depicted in Fig. 8(d), (e). The BER value of the watermarked model is
$0.0005$, whereas it is $0.43$ after applying reversible operation. This
confirms that the reversible operation can effectively remove the watermark
embedded in the host model, thereby demonstrating the validity of the
legitimacy authentication scheme.

##  6 CONCLUSIONS

In this paper, a new static DNN watermarking scheme, referred to as reversible
QIM (R-QIM), has been proposed. The watermarked DNN model enjoys higher
capacity and fidelity, and no weaknesses on the usability of host data under
any distribution. We have also proposed two R-QIM based schemes to realize
integrity protection and infringement identification of DNNs. The integrity
protection scheme allows the integrity of watermarked DNNs to be verified by
determining the difference between restored and original model. In
infringement identification, whether current user is legal can be confirmed by
detecting the existence of watermarks contained in the watermarked model.
Theoretical analyses and numerical simulations show that R-QIM is more
competitive than the method in [4], in terms of its more flexible fidelity
performance, high embedding capacity, and adaptability to the weights of
arbitrary distribution.

## References

  * [1] Barni, M., Pérez-González, F., Tondi, B.: DNN watermarking: Four challenges and a funeral. In: Borghys, D., Bas, P., Verdoliva, L., Pevný, T., Li, B., Newman, J. (eds.) IH&MMSec ’21: ACM Workshop on Information Hiding and Multimedia Security, Virtual Event, Belgium, June, 22-25, 2021. pp. 189–196. ACM (2021). https://doi.org/10.1145/3437880.3460399
  * [2] Chen, B., Wornell, G.W.: Quantization index modulation: A class of provably good methods for digital watermarking and information embedding. IEEE Trans. Inf. Theory 47(4), 1423–1443 (2001). https://doi.org/10.1109/18.923725
  * [3] Fei, J., Xia, Z., Tondi, B., Barni, M.: Supervised GAN watermarking for intellectual property protection. In: IEEE International Workshop on Information Forensics and Security, WIFS 2022, Shanghai, China, December 12-16, 2022. pp. 1–6. IEEE (2022). https://doi.org/10.1109/WIFS55849.2022.9975409
  * [4] Guan, X., Feng, H., Zhang, W., Zhou, H., Zhang, J., Yu, N.: Reversible watermarking in deep convolutional neural networks for integrity authentication. In: Proceedings of the 28th ACM International Conference on Multimedia. ACM (oct 2020). https://doi.org/10.1145/3394171.3413729
  * [5] Hua, G., Huang, J., Shi, Y.Q., Goh, J., Thing, V.L.L.: Twenty years of digital audio watermarking - a comprehensive review. Signal Process. 128, 222–242 (2016). https://doi.org/10.1016/j.sigpro.2016.04.005
  * [6] Krizhevsky, A., Hinton, G., et al.: Learning multiple layers of features from tiny images. Master’s thesis, University of Tront (2009)
  * [7] Kuribayashi, M., Tanaka, T., Suzuki, S., Yasui, T., Funabiki, N.: White-box watermarking scheme for fully-connected layers in fine-tuning model. In: Proceedings of the 2021 ACM Workshop on Information Hiding and Multimedia Security. pp. 165–170 (2021)
  * [8] LeCun, Y., Cortes, C.: "mnist handwritten digit database", http://yann.lecun.com/exdb/mnist/
  * [9] Li, Y., Abady, L., Wang, H., Barni, M.: A feature-map-based large-payload DNN watermarking algorithm. In: Zhao, X., Piva, A., Alfaro, P.C. (eds.) Digital Forensics and Watermarking - 20th International Workshop, IWDW 2021, Beijing, China, November 20-22, 2021, Revised Selected Papers. Lecture Notes in Computer Science, vol. 13180, pp. 135–148. Springer (2021). https://doi.org/10.1007/978-3-030-95398-0_10
  * [10] Li, Y., Tondi, B., Barni, M.: Spread-transform dither modulation watermarking of deep neural network. Journal of Information Security and Applications 63, 103004 (2021)
  * [11] Li, Y., Wang, H., Barni, M.: A survey of deep neural network watermarking techniques. Neurocomputing 461, 171–193 (2021)
  * [12] Lou, S., Deng, J., Lyu, S.: Chaotic signal denoising based on simplified convolutional denoising auto-encoder. Chaos, Solitons & Fractals 161, 112333 (2022). https://doi.org/https://doi.org/10.1016/j.chaos.2022.112333
  * [13] Lyu, S., Wang, Z., Ling, C., Chen, H.: Better lattice quantizers constructed from complex integers. IEEE Trans. Commun. 70(12), 7932–7940 (2022). https://doi.org/10.1109/TCOMM.2022.3215685
  * [14] Moulin, P., Koetter, R.: Data-hiding codes. Proc. IEEE 93(12), 2083–2126 (2005). https://doi.org/10.1109/JPROC.2005.859599
  * [15] Ni, Z., Shi, Y., Ansari, N., Su, W.: Reversible data hiding. IEEE Trans. Circuits Syst. Video Technol. 16(3), 354–362 (2006). https://doi.org/10.1109/TCSVT.2006.869964
  * [16] Pagnotta, G., Hitaj, D., Hitaj, B., Perez-Cruz, F., Mancini, L.V.: Tattooed: A robust deep neural network watermarking scheme based on spread-spectrum channel coding. arXiv preprint arXiv:2202.06091 (2022)
  * [17] Qin, J., Lyu, S., Deng, J., Liang, X., Xiang, S., Chen, H.: A lattice-based embedding method for reversible audio watermarking. arXiv preprint arXiv:2209.07066 (2022). https://doi.org/10.48550/ARXIV.2209.07066
  * [18] Shi, Y., Li, X., Zhang, X., Wu, H., Ma, B.: Reversible data hiding: Advances in the past two decades. IEEE Access 4, 3210–3237 (2016). https://doi.org/10.1109/ACCESS.2016.2573308
  * [19] Tang, W., Li, B., Barni, M., Li, J., Huang, J.: An automatic cost learning framework for image steganography using deep reinforcement learning. IEEE Trans. Inf. Forensics Secur. 16, 952–967 (2021). https://doi.org/10.1109/TIFS.2020.3025438
  * [20] Thodi, D.M., Rodríguez, J.J.: Prediction-error based reversible watermarking. In: Proceedings of the 2004 International Conference on Image Processing, ICIP 2004, Singapore, October 24-27, 2004. pp. 1549–1552. IEEE (2004)
  * [21] Tian, J.: Reversible data embedding using a difference expansion. IEEE Trans. Circuits Syst. Video Technol. 13(8), 890–896 (2003). https://doi.org/10.1109/TCSVT.2003.815962
  * [22] Uchida, Y., Nagai, Y., Sakazawa, S., Satoh, S.: Embedding watermarks into deep neural networks. In: Proceedings of the 2017 ACM on international conference on multimedia retrieval. pp. 269–277 (2017)
  * [23] Wu, X., Sun, W.: High-capacity reversible data hiding in encrypted images by prediction error. Signal Process. 104, 387–400 (2014). https://doi.org/10.1016/j.sigpro.2014.04.032
  * [24] Zamir, R.: Lattice Coding for Signals and Networks: A Structured Coding Approach to Quantization, Modulation, and Multiuser Information Theory. Cambridge University Press (2014)