Non-Transferable Learning: A New Approach for Model Ownership Verification and Applicability Authorization

1 INTRODUCTION . Deep Learning ( DL ) is the backbone of Artificial Intelligence as a Service ( AIaaS ) ( Ribeiro et al. , 2015 ) , which is being provided in a wide range of applications including music composition ( Briot et al. , 2020 ) , autonomous driving ( Li et al. , 2021a ) , smart building ( Xu et al. , 2020a ) , etc . However , a good model can be expensive to obtain : it often requires dedicated architecture design ( He et al. , 2016 ) , a large amount of high-quality data ( Deng et al. , 2009 ) , lengthy training on professional devices ( Zoph & Le , 2016 ) , and expert tuning ( Zhang et al. , 2019 ) . Thus , well-trained DL models are valuable intellectual property ( IP ) to the model owners and need protection . Generally speaking , there are two aspects in protecting an IP in AIaaS , verifying who owns the model and authorizing how the model can be used . These two aspects led to the development of two types of protection techniques : ownership verification and usage authorization . For ownership verification , prior works proposed approaches such as embedding watermarks into network parameters ( Song et al. , 2017 ) , learning special behaviors for pre-defined triggers ( Fan et al. , 2019 ) , and extracting fingerprints from the model ( Le Merrer et al. , 2020 ) . However , they are vulnerable to state-of-art watermark removal approaches that are based on model fine-tuning or retraining ( Chen et al. , 2019 ) , watermark overwriting and model pruning ( Rouhani et al. , 2018 ) . For model usage authorization , most prior works were built on encrypting neural network parameters with a secret key ( Alam et al. , 2020 ; Chakraborty et al. , 2020 ) and ensuring that models can only be used by users with this key . However , authorized users may use the model on any data without restriction . We believe that for comprehensive IP protection , the goal of usage authorization is not only who is allowed to use the model , but also what data can the model be used on . We thus consider a new data-centric aspect of usage authorization in this work , i.e. , authorizing models to certain data for preventing their usage on unauthorized data . We call this applicability authorization . Note that applicability authorization goes far beyond IP protection . It can also be viewed as a way to “ control ” how machine learning models are used in general . One example would be a company Data space Reduced model generalization bound Source domain Source-Only NTL Source domain Outside of source domain . Data space Target Target-Specified NTL Source domain Generalization bound Data space Supervised Learning Figure 1 : A visualization of the generalization bound trained with different approaches . The left figure shows Supervised Learning in the source domain , which can derive a wide generalization area . When Target-Specified NTL is applied ( middle ) , the target domain is removed from the generalization area . As for Source-Only NTL ( right ) , the generalization area is significantly reduced . ( e.g. , Facebook ) trains a model from adult data and uses applicability authorization to prevent the model from being used for teenagers . Our Approach and Contribution . In this work , we propose Non-Transferable Learning ( NTL ) , a novel approach that can robustly verify the model ownership and authorize the model applicability on certain data . Intuitively , NTL goes against the current research trend of improving the generalization ability of models across various domains , e.g. , domain generalization and adaptation ( Li et al. , 2020 ; Zhou et al. , 2020 ) . Instead , NTL tries to make the generalization bound of DL models more explicit and narrower , by optimizing the model to learn domain-dependent features and thereby making the model exclusive to certain domains . More specifically , we consider two domains : the source domain where we want the models to perform well , and the auxiliary domain where we aim to degrade the model performance . And if the model trained with NTL is applied to a target domain similar to the auxiliary one , the performance should also be poor . As shown in Figure 1 , we have developed two types of NTL approaches : Target-Specified NTL and Source-Only NTL . • Target-Specified NTL assumes that the source and target domains are both known . We then treat the target domain as the auxiliary domain and enlarge the distance of representations between the source and auxiliary domains . Target-Specified NTL can be used to verify the model ownership by triggering misclassification . While previous model watermarks can often be easily removed because the model memorization of such watermarks encounters catastrophic forgetting ( Kemker et al. , 2018 ) during watermark removal , our NTL-based verification is resistant to state-of-art watermark removal approaches , because the misclassification behavior is dependent on the overall target-private features that have little correlation with the source-private features for the main task . • In Source-Only NTL , the target domain is unknown and thus our approach relies solely on the source domain , aiming to degrade the performance in all other domains . In this case , NTL generates the auxiliary domain from a novel generative adversarial augmentation framework and then increases the representation distance . Source-Only NTL can provide authorization to certain data rather than particular users or devices , by degrading the model performance on all other data domains other than the source domain . This provides data-centric applicability authorization , with which we can also prevent unauthorized model usage that are caused by the secret key leakage and can not be addressed by prior model authorization methods . In addition to proposing the novel concept of NTL and developing its two approaches , we are also able to experimentally validate their effectiveness . We conducte extensive experiments on 5 digit sets , CIFAR10 & STL10 and VisDA . For target-specified cases , we demonstrate how to apply NTL for model ownership verification . Our experiments show that the state-of-art model watermark removal methods are ineffective on NTL-based ownership verification . For source-only NTL , our experiments demonstrate its effectiveness in authorizing model applicability to certain data . 2 RELATED WORK . Domain Generalization & Adaptation ( DG & DA ) . DG aims to generalize learning models with available source domains to unseen target domains ( Blanchard et al. , 2011 ) . A number of methods have been proposed for domain discrepancy minimization ( Li et al. , 2020 ) , adversarial training ( Rahman et al. , 2020 ; Zhao et al. , 2020c ) , invariance representation learning ( Zhou et al. , 2020 ; Piratla et al. , 2020 ) , etc . Recently , there is significant interest on conducting DG with one source domain only , for which well-crafted data augmentation approaches ( Qiao et al. , 2020 ; Zhao et al. , 2020b ; Li et al. , 2021b ; Xu et al. , 2020b ) have been proposed to expand the input space . DA is also related to improving the generalization ability of models across domains ( Ahmed et al. , 2021 ) , and while DA can access the target data , DG has no access to any target sample ( Tzeng et al. , 2017 ; Kundu et al. , 2020 ) . Unlike DG or DA , in this work , we try to weaken the generalization ability of models by expanding the distance between representations of different domains . Our proposed method can work effectively for both the target-specified case and the source-only case with a novel adversarial augmentation framework . Intellectual Property ( IP ) Protection for Deep Learning ( DL ) . While DL has shown its unparalleled advantages in various applications , there are significant challenges in protecting DL models . For instance , Membership Inference Attack ( Shokri et al. , 2017 ) can steal information on whether a particular data sample has been learned by the target DL model . Model Inversion Attack ( He et al. , 2019 ; Salem et al. , 2020 ) is able to recover the input data via an analysis of the model prediction . These two types of attacks directly threaten the privacy of model users , while there are many active attacks ( Suciu et al. , 2018 ; Yao et al. , 2019 ) that lead DL models to produce abnormal behaviors . In addition , verifying model ownership and authorizing model usage have become important issues with the development of AIaaS . There have been a number of watermarking approaches addressing the verification of model ownership . For instance , Zhang et al . ( 2018 ) and Li et al . ( 2019 ) train a neural network on the original datasets and on the watermarked one assigned with a particular label , which makes the model behave abnormally when it encounters watermarked data . Song et al . ( 2017 ) and Uchida et al . ( 2017 ) inject watermark into the least significant bits of the model parameters and provide the corresponding decoding methods . Le Merrer et al . ( 2020 ) and Zhao et al . ( 2020a ) make use of adversarial examples to extract fingerprints from learned neural networks without accessing network weights . Compared to these approaches , our NTL can achieve model ownership verification by triggering universal misclassification . Moreover , with extensive experiments , we also demonstrate that state-of-art model watermark removal methods , e.g. , FTAL and RTAL ( Adi et al. , 2018 ) , EWC and AU ( Chen et al. , 2019 ) , watermark overwriting and model pruning ( Rouhani et al. , 2018 ) are not effective to NTL-based verification . Model usage authorization is another aspect in protecting model intellectual property . For instance , Alam et al . ( 2020 ) encrypt every network parameter with a secret key . Chakraborty et al . ( 2020 ) generate a secret key from hardware fingerprints of a particular device , and require that only users who possess this device can load and employ the model . Different from these methods , our NTL focuses on providing data-centric protection via applicability authorization , which retains good model performance on authorized data while degrading model performance for other data domains . To the best of our knowledge , this is the first work that prevents model usage on unauthorized data via model learning . 3 METHODOLOGY . In this section , we introduce our NTL approach . Section 3.1 presents the inspiration and the design of optimization objective of NTL , which is at the core for both target-specified and source-only cases . Section 3.2 presents the generative augmentation framework for source-only cases . Our method is based on the concept of generative adversarial networks ( GAN ) , however our goal is not to propose a new GAN but to design an effective augmentation method in the context of NTL . Section 3.3 introduces the application of NTL on ownership verification and applicability authorization . 3.1 NON-TRANSFERABLE LEARNING WITH DISTANCE EXPANSION OF REPRESENTATION . We consider a source domain with labeled samples S= { ( x , y ) ∥x∼PSX , y∼PSY } , where PX and PY are the input and label distributions , respectively . In this work , we use image classification as the learning task with K possible classes , in which case x and y are matrix-valued and scalar random variables , respectively . In addition , we consider an auxiliary domain A= { ( x , y ) ∥x∼PAX , y∼PAY } . The source domain S and the auxiliary domain A will be fed into a deep neural network , and without loss of generality , we split the neural network into two parts , one is a feature extractor Φ on the bottom , and the other is a classifier Ω on the top . Inspiration from Information Bottleneck . Our NTL , in particular the design of optimization objective , is inspired by the analysis of Information Bottleneck ( IB ) ( Tishby et al. , 2000 ) . Let us start by introducing Shannon Mutual Information ( SMI ) . In addition to random variables – input x and label y , we also regard representation z extracted by Φ as a random variable . The SMI between two random variables , e.g. , between z and x , is defined as I ( z ; x ) =Ex∼PX [ DKL ( P ( z|x ) ∥P ( z ) ) ] , where DKL ( · ) represents the Kullback-Leible ( KL ) divergence and P ( · ) is the distribution . In IB theory , considering the effectiveness , privacy and generalization , an optimal representation has three properties ( Achille & Soatto , 2018 ) : ( 1 ) Sufficiency : label y sufficiently differentiates representation z , i.e. , I ( z ; y ) = I ( x ; y ) ; ( 2 ) Minimality : z needs to represent as little information about input x as possible , i.e. , min I ( z ; x ) ; ( 3 ) Invariance : z is optimal , meaning that it does not overfit to spurious correlations between y and nuisance n embedded in x , i.e. , I ( z ; n ) =0 . IB theory assumes that nuisance n is a factor that affects input x , and it works with y together to determine what x looks like to some extent . For instance , in domain generalization , nuisance n can be regarded as a domain index that indicates which domain a certain sample comes from ( Du et al. , 2020 ) . In our problem , different from the objective of the IB theory , NTL enforces the models to extract nuisance-dependent representations , which is opposite to the property of invariance . In other words , we aim to increase I ( z ; n ) , and we have the following proposition for achieving this aim . Proposition 1 . Let n be a nuisance for input x . Let z be a representation of x , and the label is y . For the information flow in the representation learning , we have I ( z ; x ) − I ( z ; y|n ) ≥ I ( z ; n ) ( 1 ) The detailed proof for Proposition 1 is included in the Appendix . Optimization Objective Design . Proposition 1 provides guidance for maximizing I ( z ; n ) . First , unlike in the IB theory , we do not minimize I ( z ; x ) for the minimality property . In addition , we try to minimize I ( z ; y|n ) through the design of optimization objective that measures the error between the model prediction and the ground truth during the training of neural networks . Specifically , instead of using the typical CrossEntropy loss to measure the error , we apply KL divergence loss to direct the training , and we have the following theorem . Theorem 1 . Let ŷ be the predicted label outputted by a representation model when feeding with input x , and suppose that ŷ is a scalar random variable and x is balanced on the ground truth label y. Denote the one-hot forms of ŷ and y as ŷ and y , respectively . If the KL divergence loss DKL ( P ( ŷ ) ∥P ( y ) ) increases , the mutual information I ( z ; y ) will decrease . The detailed proof of Theorem 1 is provided in the Appendix . According to this theorem , I ( z ; y|n ) can be minimized by increasing the KL divergence loss of training data conditioned on different n. However , as stated in Section 1 , we aim to degrade the model performance in the auxiliary domain while still maintaining good model performance in the source domain . Thus , we only minimize I ( z ; y|n ) by increasing the KL divergence loss of the auxiliary domain data . In order to achieve this goal , we design a loss L∗ntl that shapes like a minus operation between KL divergence losses of the source and auxiliary domain ( LS , LA ) , i.e. , LS = Ex∼PSX [ DKL ( P ( Ω ( Φ ( x ) ) ) ∥P ( y ) ) ] and LA=Ex∼PAX [ DKL ( P ( Ω ( Φ ( x ) ) ) ∥P ( y ) ) ] . Specifically , this loss can be written as follows : L∗ntl = LS −max ( β , α · LA ) ( 2 ) Here , α is the scaling factor for LA ( α = 0.1 in our experiments ) , and β is an upper bound when LA gets too large and dominates the overall loss ( β=1.0 in experiments ; please see the Appendix for more details about α and β ) . Moreover , if we use n = 0 and n = 1 to denote the source and auxiliary domain respectively , the optimization of Eq . ( 2 ) can guarantee the sufficiency property for the source domain : I ( z ; y|n=0 ) =I ( x ; y|n=0 ) , and increasing LA decreases I ( z ; y|n=1 ) . According to Proposition 1 , we can move the upper bound of I ( z ; n ) to a higher baseline via optimizing Eq . ( 2 ) . However , such optimization might only make classifier Ω more sensitive to domain features and have little effect on feature extractor Φ . In this case , representations of different domains captured by Φ may still be similar , which conflicts with our intention to maximize I ( z ; n ) , and the performance of the target can be easily improved by fine-tuning or adapting Ω with a small number of labeled target samples . On the other hand , directly calculating I ( z ; n ) and taking it as part of the optimization objective are difficult , especially in the optimization of representation learning ( Torkkola , 2003 ) . Achille & Soatto ( 2018 ) apply binary classifier as the nuisance discriminator , and they can estimate I ( z ; n ) after the model training via this discriminator . Here , we find another way to increase I ( z ; n ) indirectly based on the following theorem . Theorem 2 . Let n be a nuisance that is regarded as a domain index . n=0 and n=1 denote that a certain input x comes from two different domains . Suppose that these two domains have the same number of samples d , and the samples of each domain are symmetrically distributed around the centroid . Let z be a representation of x , and it is drawn from distribution PZ . An estimator with the characteristic kernel from Reproducing Kernel Hilbert Spaces ( RKHSs ) – Gaussian Kernel estimator MMD ( P , Q ; exp ) is applied on finite samples from distributions PZ|0 and PZ|1 to approximate the Maximum Mean Discrepancy ( MMD ) between these two distributions . If MMD ( PZ|0 , PZ|1 ; exp ) increases to saturation , the mutual information between z and n will increase . MMD ( PZ|0 , PZ|1 ; exp ) =Ez , z′∼PZ|0 [ e −∥z−z′∥2 ] −2Ez∼PZ|0 , z′∼PZ|1 [ e −∥z−z′∥2 ] +Ez , z′∼PZ|1 [ e −∥z−z′∥2 ] ( 3 ) We also employ a nuisance discriminator to observe the change of I ( z ; n ) during training . The details of this discriminator design and the proof of Theorem 2 can be found in the Appendix . NTL Optimization Objective . Based on the above analysis , we design our NTL optimization objective to increase I ( z ; n ) and extract nuisance-dependent representations . Specifically , we compute the MMD ( P , Q ; exp ) between representations of the source and auxiliary domain data and maximize it . For stability concern , we also set an upper bound to the MMD ( P , Q ; exp ) . Then , the overall optimization objective of NTL with distance expansion of representation is shaped as follows : Lntl = LS−max ( β , α ·LA ·Ldis ) , whereLdis = max ( β′ , α′ ·MMD ( Px∼PS X ( Φ ( x ) ) , Px∼PA X ( Φ ( x ) ) ; exp ) ( 4 ) Here , α′ and β′ represent the scaling factor and upper bound of Ldis respectively ( α′ = 0.1 and β′=1.0 in our experiments ; please refer to the Appendix for more details about α′ and β′ ) . Φ ( · ) is the feature extractor that outputs the corresponding representations of given inputs . When the target domain is known and accessible , it will be regarded as the auxiliary domain , and the above NTL with distance expansion of representation can be conducted directly on the source and auxiliary domains . We call such cases Target-Specified NTL .

Summary: In the era of deep learning, pre-trained models have been regarded as intellectual properties of AI companies. Thus, protecting these models has been more and more important. To achieve this aim, this paper proposes a non-transferable learning (NTL) method to capture the exclusive data representation in the learned model and restrict the model generalization ability to certain domains. This approach provides effective solutions to both model verification and authorization. Specifically:  1) For ownership verification, watermarking techniques are commonly used but are often vulnerable to sophisticated watermark removal methods. By comparison, the NTL-based ownership verification provides robust resistance to state-of-the-art watermark removal methods, as shown in extensive experiments with 6 removal approaches over the digits, CIFAR10 & STL10, and VisDA datasets. 2) For usage authorization, prior solutions focus on authorizing specific users to access the model, but authorized users can still apply the model to any data without restriction. The NTL-based authorization approach instead provides a data-centric protection, which is called applicability authorization, by significantly degrading the performance of the model on unauthorized data. In general, this paper contributes a novel method to the field, and experiments verified the success of the proposed method.