Undistillable: Making A Nasty Teacher That CANNOT teach students

1 INTRODUCTION . Knowledge Distillation ( KD ) ( Hinton et al. , 2015 ) aims to transfer useful knowledge from a teacher neural network to a student network by imitating the input-output behaviors . The student model imitates logit outputs or activation maps from the teacher by optimizing a distillation loss . The efficacy of leveraging teacher knowledge to boost student performance has been justified in many application fields ( Wang et al. , 2019 ; Liu et al. , 2019 ; Chen et al. , 2020b ; a ) , yielding high performance and often lighter-weight student models . Typically KD requires learning the student model over the same training set used to train the teacher . However , recent studies ( Lopes et al. , 2017 ; Chen et al. , 2019 ) have demonstrated the feasibility of the data-free knowledge distillation , in which the knowledge is transferred from the teacher to the student without accessing the same training data . This is possible because the training data are implicitly encoded in the trained weights of deep neural nets . The data-free knowledge distillation is able to inversely decode and re-synthesize the training data from the weights , and then clone the input-output mapping of the teacher network . With many practical benefits brought by the KD technique , this paper looks at KD ’ s unwanted severe side effect , that it might pose risks to the machine learning intellectual property ( IP ) protection . Many machine learning models will be only released as executable software or APIs , without opensourcing model configuration files or codes , e.g. , as “ black boxes ” . That can be due to multifold reasons , such as ( 1 ) those advanced models might take huge efforts and resources for the model owners to develop , who would need to keep this technical barrier ; or ( 2 ) those trained models have involved protected training data or other information , that are legally or ethically prohibited to be openly shared . However , KD techniques might open a loophole to unauthorized infringers to clone the IP model ’ s functionality , by simply imitating the black box ’ s input and output behaviors ( leaked knowledge ) . The feasibility of data-free KD ( Chen et al. , 2019 ; Yin et al. , 2020 ) eliminates the necessity of accessing original training data , therefore making this cloning more practically feasible . Even worse , those techniques point to reverse-engineering ways ( Yin et al. , 2020 ) to recover the ( potentially private ) training data from black-box models , threatening the owners ’ data privacy and security ( Yonetani et al. , 2017 ; Wu et al. , 2018 ) . To alleviate the issue , this paper introduces a defensive approach for model owners , called Nasty Teacher . A nasty teacher is a specially trained network that yields nearly the same performance as a normal one ; but if used as a teacher model , it will significantly degrade the performance of student models that try to imitate it . In general , the concept of nasty teacher is related to the backdoor attack on deep learning systems ( Chen et al. , 2017 ) , which creates a model to fit “ adversarial ” goals in an “ imperceptible ” way . However , while backdoor attacks aim to manipulate or damage the performance of the poisoned model itself when triggered by specific inputs , the goal of the nasty teacher is to undermine the performance of any student network derived from it . The primary objective of constructing a nasty teacher is for model protection - a novel motivation and setting that have not been explored before . Our contributions are summarized as follows : • We introduce the novel concept of Nasty Teacher , a defensive approach to prevent knowledge leaking and unauthorized model cloning through KD without sacrificing performance . We consider it a promising first step towards machine learning IP and privacy protection . • We propose a simple yet efficient algorithm , called self-undermining knowledge distillation , to directly build a nasty teacher through self-training , requiring no additional dataset nor auxiliary network . Specifically , the model is optimized by maximizing the difference between the nasty teacher ( the desired one ) and a normally trained counterpart . • We conduct extensive experiments on both standard KD and data-free KD approaches , and demonstrate that nasty teacher trained by self-undermining KD can achieve nearly the same accuracy as their original counterpart ( less than 1 % accuracy gap ) , while the student model learned from it will degrade accuracy by up to over 10 % or even diverge during training . 2 RELATED WORK . 2.1 KNOWLEDGE DISTILLATION . Knowledge distillation aims to boost the performance of light-weight models ( students ) under the guidance of well-trained complicated networks ( teachers ) . It is firstly introduced in ( Hinton et al. , 2015 ) , where the student directly mimics the soft probabilities output produced by the well pretrained teacher . The following researchers explore the knowledge transferal from either intermediate features ( Romero et al. , 2014 ; Zagoruyko & Komodakis , 2016 ; Passalis & Tefas , 2018 ; Ahn et al. , 2019 ; Li et al. , 2020 ) , or logit responses ( Park et al. , 2019 ; Mirzadeh et al. , 2019 ; Chen et al. , 2021a ; b ; Ma et al. , 2021 ) . Recent studies have also shown that , instead of distilling from a complicated teacher , the student networks can even be boosted by learning from its own pre-trained version ( Furlanello et al. , 2018 ; Zhang et al. , 2019 ; Yun et al. , 2020 ; Yuan et al. , 2020 ) . Several recent works also focus on data-free knowledge distillation , under which settings students are not able to access the data used to train teachers . In ( Lopes et al. , 2017 ) , the author attempts to reconstruct input data by exploring encoded meta-data lying in the pre-trained teacher network . In the following work , the author of ( Chen et al. , 2019 ) proposes a learning scheme , called “ Data-Free Learning ” ( DAFL ) , which treats the teacher as a fixed discriminator , and jointly trains a generator to synthesize training examples so that maximum responses could be obtained on the discriminator . The latest work “ DeepInversion ” ( Yin et al. , 2020 ) directly synthesizes input images given random noise by ” inverting ” a trained network . Specifically , their method optimizes the input random noise into high-fidelity images with a fixed pre-trained network ( teacher ) . 2.2 POISONING ATTACK ON NEURAL NETWORK . The typical goal of poisoning attack is to degrade the accuracy of models by injecting poisoned data into training set ( Xiao et al. , 2015 ; Moosavi-Dezfooli et al. , 2016 ) . On the contrary , backdoor attack intends to open a loophole ( usually unperceived ) to the model via inserting well-crafted malicious data into training set ( Chen et al. , 2017 ; Gu et al. , 2017 ; Kurita et al. , 2020 ) . The goal of back- door attack is to make the poisoned model perform normally well for most of the time , yet failing specifically when attacker-triggered signals are given . Our proposed self-undermining knowledge distillation aims to create a special teacher model ( i.e. , an undistillable model ) , which normally performs by itself but “ triggers to fail ” only when being mimiced through KD . The motivation looks similar to backdoor attack ’ s at the first glance , but differs in the following aspects . Firstly , the backdoor attack can only be triggered by pre-defined patterns , while our nasty teachers target at degrading any arbitrary student network through KD . Secondly , backdoor attack tends to poison the model itself , while our nasty teacher aims to undermine other student networks while preservingits own performance . Thirdly , our goal is to prevent knowledge leaking in order to protect released IP , as a defensive point of view , while the backdoor attack tends to break down the system by triggering attacking signals , as an attacking point of view . 2.3 PROTECTION OF MODEL IP . Due to the commercial value , IP protection for deep networks has drawn increasing interests from both academia and industry . Previous methods usually rely on watermark-based ( Uchida et al. , 2017 ; Zhang et al. , 2020a ) or passport-based ( Fan et al. , 2019 ; Zhang et al. , 2020b ) ownership verification methods to protect the IP . Nevertheless , these methods can only detect IP infringement but remain ineffective to avoid model cloning . A few recent works also explore defensive methods against model stealing ( Kariyappa & Qureshi , 2020 ; Juuti et al. , 2019 ; Orekondy et al. , 2020 ) . Typically , they assume attackers obtain pseudolabels on their own synthetic data or surrogate data by querying the black-box model , and train a network on the new dataset to clone the model . However , none of these defense approaches have explored the KD-based model stealing , which is rather a practical threat . 3 METHODOLOGY . 3.1 REVISITING KNOWLEDGE DISTILLATION . Knowledge distillation ( Hinton et al. , 2015 ) helps the training process of ” student ” networks by distilling knowledge from one or multiple well-trained “ teacher ” networks . The key idea is to leverage soft probabilities output of teacher networks , of which incorrect-class assignments reveal the way how teacher networks generalize from previous training . By mimicking probabilities output , student networks are able to imbibe the knowledge that teacher networks have discovered before , and the performance of student networks is usually better than those being trained with labels only . In what follows , we formally formulate the learning process of knowledge distillation . Given a pre-trained teacher network fθT ( · ) and a student network fθS ( · ) , where θT and θS denote the network parameters , the goal of knowledge distillation is to force the output probabilities of fθS ( · ) to be close to that of fθT ( · ) . Let ( xi , yi ) denote a training sample in dataset X and pfθ ( xi ) indicate the logit response of xi from fθ ( · ) , the student network fθS could be learned by the following : min θS ∑ ( xi , yi ) ∈X ατ2sKL ( στs ( pfθT ( xi ) ) , στs ( pfθS ( xi ) ) ) + ( 1− α ) XE ( σ ( pfθS ( xi ) ) , yi ) , ( 1 ) where KL ( · , · ) and XE ( · , · ) are Kullback-Leibler divergence ( K-L divergence ) and cross-entropy loss , respectively . The introduced “ softmax temperature ” function στs ( · ) ( Hinton et al. , 2015 ) produces soft probabilities output when a large temperature τs ( usually greater than 1 ) is picked , and it decays to normal softmax function σ ( · ) when τs equals 1 . Another hyper-parameter α is also introduced to balance between knowledge distillation and cost minimization . 3.2 TRAINING NASTY TEACHERS : RATIONALE AND IMPLEMENTATION . Rationale The goal of nasty teacher training endeavors to create a special teacher network , of which performance is nearly the same as its normal counterpart , that any arbitrary student networks can not distill knowledge from it . To this end , we propose a simple yet effective algorithm , dubbed Self-Undermining Knowledge Distillation , while maintaining its correct class assignments , maximally disturbing its in-correct class assignments so that no beneficial information could be distilled from it , as described next . Let fθT ( · ) and fθA ( · ) denote the desired nasty teacher and its adversarial learning counterpart , the self-undermining training aims to maximize the K-L divergence between the adversarial network and the nasty teacher one , so that a false sense of generalization could be output from the nasty teacher . The learning process of the nasty teacher could be formulated as follows , min θT ∑ ( xi , yi ) ∈X XE ( σ ( pfθT ( xi ) ) , yi ) − ωτ 2 AKL ( στA ( pfθT ( xi ) ) , στA ( pfθA ( xi ) ) ) , ( 2 ) where the former term aims to maintain the accuracy of the nasty teacher by minimizing the cross entropy loss , and the latter term achieves the “ undistillability ” by maximizing KL divergence between the nasty teacher and the adversarial one . Similarly in equation 1 , τA denotes the temperature for self-undermining , and ω balances the behavior between normal training and adversarial learning . Implementation We naturally choose the same network architecture for fθT ( · ) and fθA ( · ) ( yet different group of network parameters ) since no additional assumption on network architecture is made here . We provide a throughout study with respect to the selection of architectures in 4.3 , revealing how the architecture of fθA ( · ) influences the adversarial training . As for the update rule , the parameter of fθA ( · ) is typically normally pre-trained in advance and fixed during adversarial training , and only the parameter of fθT ( · ) is updated . Note that the selected temperature τA does not to be necessary the same as τs in equation 1 , and we provide a comprehensive study with respect to τs in 4.3 . Once upon finishing adversarial training , the nasty teacher fθT ( · ) could be released within defense of KD-based model stealing .

Summary: This paper explores an interesting and novel research problem: how to make a teacher model undistillable. This can be a promising countermeasure to model extraction/stealing. The proposed Nasty Teacher approach is a two stage method, which first trains a good teacher network, then utilizes a self-undermining KD strategy to further distill the good teacher network to a bad one. Overall, this  Nasty Teacher approach can reduce the performance of the student network by ~5% in most cases. Although the performance decrease is not huge, the proposed approach is promising and can be a very useful baseline for this new research direction. A set of ablation and understanding experiments have also been conducted to support the effectiveness of  Nasty Teacher.