Undistillable: Making A Nasty Teacher That CANNOT teach students

1 INTRODUCTION . Knowledge Distillation ( KD ) ( Hinton et al. , 2015 ) aims to transfer useful knowledge from a teacher neural network to a student network by imitating the input-output behaviors . The student model imitates logit outputs or activation maps from the teacher by optimizing a distillation loss . The efficacy of leveraging teacher knowledge to boost student performance has been justified in many application fields ( Wang et al. , 2019 ; Liu et al. , 2019 ; Chen et al. , 2020b ; a ) , yielding high performance and often lighter-weight student models . Typically KD requires learning the student model over the same training set used to train the teacher . However , recent studies ( Lopes et al. , 2017 ; Chen et al. , 2019 ) have demonstrated the feasibility of the data-free knowledge distillation , in which the knowledge is transferred from the teacher to the student without accessing the same training data . This is possible because the training data are implicitly encoded in the trained weights of deep neural nets . The data-free knowledge distillation is able to inversely decode and re-synthesize the training data from the weights , and then clone the input-output mapping of the teacher network . With many practical benefits brought by the KD technique , this paper looks at KD ’ s unwanted severe side effect , that it might pose risks to the machine learning intellectual property ( IP ) protection . Many machine learning models will be only released as executable software or APIs , without opensourcing model configuration files or codes , e.g. , as “ black boxes ” . That can be due to multifold reasons , such as ( 1 ) those advanced models might take huge efforts and resources for the model owners to develop , who would need to keep this technical barrier ; or ( 2 ) those trained models have involved protected training data or other information , that are legally or ethically prohibited to be openly shared . However , KD techniques might open a loophole to unauthorized infringers to clone the IP model ’ s functionality , by simply imitating the black box ’ s input and output behaviors ( leaked knowledge ) . The feasibility of data-free KD ( Chen et al. , 2019 ; Yin et al. , 2020 ) eliminates the necessity of accessing original training data , therefore making this cloning more practically feasible . Even worse , those techniques point to reverse-engineering ways ( Yin et al. , 2020 ) to recover the ( potentially private ) training data from black-box models , threatening the owners ’ data privacy and security ( Yonetani et al. , 2017 ; Wu et al. , 2018 ) . To alleviate the issue , this paper introduces a defensive approach for model owners , called Nasty Teacher . A nasty teacher is a specially trained network that yields nearly the same performance as a normal one ; but if used as a teacher model , it will significantly degrade the performance of student models that try to imitate it . In general , the concept of nasty teacher is related to the backdoor attack on deep learning systems ( Chen et al. , 2017 ) , which creates a model to fit “ adversarial ” goals in an “ imperceptible ” way . However , while backdoor attacks aim to manipulate or damage the performance of the poisoned model itself when triggered by specific inputs , the goal of the nasty teacher is to undermine the performance of any student network derived from it . The primary objective of constructing a nasty teacher is for model protection - a novel motivation and setting that have not been explored before . Our contributions are summarized as follows : • We introduce the novel concept of Nasty Teacher , a defensive approach to prevent knowledge leaking and unauthorized model cloning through KD without sacrificing performance . We consider it a promising first step towards machine learning IP and privacy protection . • We propose a simple yet efficient algorithm , called self-undermining knowledge distillation , to directly build a nasty teacher through self-training , requiring no additional dataset nor auxiliary network . Specifically , the model is optimized by maximizing the difference between the nasty teacher ( the desired one ) and a normally trained counterpart . • We conduct extensive experiments on both standard KD and data-free KD approaches , and demonstrate that nasty teacher trained by self-undermining KD can achieve nearly the same accuracy as their original counterpart ( less than 1 % accuracy gap ) , while the student model learned from it will degrade accuracy by up to over 10 % or even diverge during training . 2 RELATED WORK . 2.1 KNOWLEDGE DISTILLATION . Knowledge distillation aims to boost the performance of light-weight models ( students ) under the guidance of well-trained complicated networks ( teachers ) . It is firstly introduced in ( Hinton et al. , 2015 ) , where the student directly mimics the soft probabilities output produced by the well pretrained teacher . The following researchers explore the knowledge transferal from either intermediate features ( Romero et al. , 2014 ; Zagoruyko & Komodakis , 2016 ; Passalis & Tefas , 2018 ; Ahn et al. , 2019 ; Li et al. , 2020 ) , or logit responses ( Park et al. , 2019 ; Mirzadeh et al. , 2019 ; Chen et al. , 2021a ; b ; Ma et al. , 2021 ) . Recent studies have also shown that , instead of distilling from a complicated teacher , the student networks can even be boosted by learning from its own pre-trained version ( Furlanello et al. , 2018 ; Zhang et al. , 2019 ; Yun et al. , 2020 ; Yuan et al. , 2020 ) . Several recent works also focus on data-free knowledge distillation , under which settings students are not able to access the data used to train teachers . In ( Lopes et al. , 2017 ) , the author attempts to reconstruct input data by exploring encoded meta-data lying in the pre-trained teacher network . In the following work , the author of ( Chen et al. , 2019 ) proposes a learning scheme , called “ Data-Free Learning ” ( DAFL ) , which treats the teacher as a fixed discriminator , and jointly trains a generator to synthesize training examples so that maximum responses could be obtained on the discriminator . The latest work “ DeepInversion ” ( Yin et al. , 2020 ) directly synthesizes input images given random noise by ” inverting ” a trained network . Specifically , their method optimizes the input random noise into high-fidelity images with a fixed pre-trained network ( teacher ) . 2.2 POISONING ATTACK ON NEURAL NETWORK . The typical goal of poisoning attack is to degrade the accuracy of models by injecting poisoned data into training set ( Xiao et al. , 2015 ; Moosavi-Dezfooli et al. , 2016 ) . On the contrary , backdoor attack intends to open a loophole ( usually unperceived ) to the model via inserting well-crafted malicious data into training set ( Chen et al. , 2017 ; Gu et al. , 2017 ; Kurita et al. , 2020 ) . The goal of back- door attack is to make the poisoned model perform normally well for most of the time , yet failing specifically when attacker-triggered signals are given . Our proposed self-undermining knowledge distillation aims to create a special teacher model ( i.e. , an undistillable model ) , which normally performs by itself but “ triggers to fail ” only when being mimiced through KD . The motivation looks similar to backdoor attack ’ s at the first glance , but differs in the following aspects . Firstly , the backdoor attack can only be triggered by pre-defined patterns , while our nasty teachers target at degrading any arbitrary student network through KD . Secondly , backdoor attack tends to poison the model itself , while our nasty teacher aims to undermine other student networks while preservingits own performance . Thirdly , our goal is to prevent knowledge leaking in order to protect released IP , as a defensive point of view , while the backdoor attack tends to break down the system by triggering attacking signals , as an attacking point of view . 2.3 PROTECTION OF MODEL IP . Due to the commercial value , IP protection for deep networks has drawn increasing interests from both academia and industry . Previous methods usually rely on watermark-based ( Uchida et al. , 2017 ; Zhang et al. , 2020a ) or passport-based ( Fan et al. , 2019 ; Zhang et al. , 2020b ) ownership verification methods to protect the IP . Nevertheless , these methods can only detect IP infringement but remain ineffective to avoid model cloning . A few recent works also explore defensive methods against model stealing ( Kariyappa & Qureshi , 2020 ; Juuti et al. , 2019 ; Orekondy et al. , 2020 ) . Typically , they assume attackers obtain pseudolabels on their own synthetic data or surrogate data by querying the black-box model , and train a network on the new dataset to clone the model . However , none of these defense approaches have explored the KD-based model stealing , which is rather a practical threat . 3 METHODOLOGY . 3.1 REVISITING KNOWLEDGE DISTILLATION . Knowledge distillation ( Hinton et al. , 2015 ) helps the training process of ” student ” networks by distilling knowledge from one or multiple well-trained “ teacher ” networks . The key idea is to leverage soft probabilities output of teacher networks , of which incorrect-class assignments reveal the way how teacher networks generalize from previous training . By mimicking probabilities output , student networks are able to imbibe the knowledge that teacher networks have discovered before , and the performance of student networks is usually better than those being trained with labels only . In what follows , we formally formulate the learning process of knowledge distillation . Given a pre-trained teacher network fθT ( · ) and a student network fθS ( · ) , where θT and θS denote the network parameters , the goal of knowledge distillation is to force the output probabilities of fθS ( · ) to be close to that of fθT ( · ) . Let ( xi , yi ) denote a training sample in dataset X and pfθ ( xi ) indicate the logit response of xi from fθ ( · ) , the student network fθS could be learned by the following : min θS ∑ ( xi , yi ) ∈X ατ2sKL ( στs ( pfθT ( xi ) ) , στs ( pfθS ( xi ) ) ) + ( 1− α ) XE ( σ ( pfθS ( xi ) ) , yi ) , ( 1 ) where KL ( · , · ) and XE ( · , · ) are Kullback-Leibler divergence ( K-L divergence ) and cross-entropy loss , respectively . The introduced “ softmax temperature ” function στs ( · ) ( Hinton et al. , 2015 ) produces soft probabilities output when a large temperature τs ( usually greater than 1 ) is picked , and it decays to normal softmax function σ ( · ) when τs equals 1 . Another hyper-parameter α is also introduced to balance between knowledge distillation and cost minimization . 3.2 TRAINING NASTY TEACHERS : RATIONALE AND IMPLEMENTATION . Rationale The goal of nasty teacher training endeavors to create a special teacher network , of which performance is nearly the same as its normal counterpart , that any arbitrary student networks can not distill knowledge from it . To this end , we propose a simple yet effective algorithm , dubbed Self-Undermining Knowledge Distillation , while maintaining its correct class assignments , maximally disturbing its in-correct class assignments so that no beneficial information could be distilled from it , as described next . Let fθT ( · ) and fθA ( · ) denote the desired nasty teacher and its adversarial learning counterpart , the self-undermining training aims to maximize the K-L divergence between the adversarial network and the nasty teacher one , so that a false sense of generalization could be output from the nasty teacher . The learning process of the nasty teacher could be formulated as follows , min θT ∑ ( xi , yi ) ∈X XE ( σ ( pfθT ( xi ) ) , yi ) − ωτ 2 AKL ( στA ( pfθT ( xi ) ) , στA ( pfθA ( xi ) ) ) , ( 2 ) where the former term aims to maintain the accuracy of the nasty teacher by minimizing the cross entropy loss , and the latter term achieves the “ undistillability ” by maximizing KL divergence between the nasty teacher and the adversarial one . Similarly in equation 1 , τA denotes the temperature for self-undermining , and ω balances the behavior between normal training and adversarial learning . Implementation We naturally choose the same network architecture for fθT ( · ) and fθA ( · ) ( yet different group of network parameters ) since no additional assumption on network architecture is made here . We provide a throughout study with respect to the selection of architectures in 4.3 , revealing how the architecture of fθA ( · ) influences the adversarial training . As for the update rule , the parameter of fθA ( · ) is typically normally pre-trained in advance and fixed during adversarial training , and only the parameter of fθT ( · ) is updated . Note that the selected temperature τA does not to be necessary the same as τs in equation 1 , and we provide a comprehensive study with respect to τs in 4.3 . Once upon finishing adversarial training , the nasty teacher fθT ( · ) could be released within defense of KD-based model stealing .

Summary: This paper’s main idea is refreshing and attractive: proposing a defensive method called nasty teacher, to avoid knowledge leaking or cloning through KD. A nasty teacher model is a specially trained network that yields nearly the same performance itself, while significantly degrading the performance of student models learned by imitating it. The standing point for machine learning IP protection is novel and hasn’t seen many discussions before. The introduction section motivated the study clearly and nicely. The method and experiments demonstrate a promising first step towards protecting machine learning IPs.