  Federated learning (FL) is a distributed machine learning paradigm allowing
multiple clients to collaboratively train a global model without sharing their
local data. However, FL entails exposing the model to various participants.
This poses a risk of unauthorized model distribution or resale by the malicious
client, compromising the intellectual property rights of the FL group. To deter
such misbehavior, it is essential to establish a mechanism for verifying the
ownership of the model and as well tracing its origin to the leaker among the
FL participants. In this paper, we present FedTracker, the first FL model
protection framework that provides both ownership verification and
traceability. FedTracker adopts a bi-level protection scheme consisting of
global watermark mechanism and local fingerprint mechanism. The former
authenticates the ownership of the global model, while the latter identifies
which client the model is derived from. FedTracker leverages Continual Learning
(CL) principles to embed the watermark in a way that preserves the utility of
the FL model on both primitive task and watermark task. FedTracker also devises
a novel metric to better discriminate different fingerprints. Experimental
results show FedTracker is effective in ownership verification, traceability,
and maintains good fidelity and robustness against various watermark removal
attacks.
