Non-Transferable Learning: A New Approach for Model Ownership Verification and Applicability Authorization

1 INTRODUCTION . Deep Learning ( DL ) is the backbone of Artificial Intelligence as a Service ( AIaaS ) ( Ribeiro et al. , 2015 ) , which is being provided in a wide range of applications including music composition ( Briot et al. , 2020 ) , autonomous driving ( Li et al. , 2021a ) , smart building ( Xu et al. , 2020a ) , etc . However , a good model can be expensive to obtain : it often requires dedicated architecture design ( He et al. , 2016 ) , a large amount of high-quality data ( Deng et al. , 2009 ) , lengthy training on professional devices ( Zoph & Le , 2016 ) , and expert tuning ( Zhang et al. , 2019 ) . Thus , well-trained DL models are valuable intellectual property ( IP ) to the model owners and need protection . Generally speaking , there are two aspects in protecting an IP in AIaaS , verifying who owns the model and authorizing how the model can be used . These two aspects led to the development of two types of protection techniques : ownership verification and usage authorization . For ownership verification , prior works proposed approaches such as embedding watermarks into network parameters ( Song et al. , 2017 ) , learning special behaviors for pre-defined triggers ( Fan et al. , 2019 ) , and extracting fingerprints from the model ( Le Merrer et al. , 2020 ) . However , they are vulnerable to state-of-art watermark removal approaches that are based on model fine-tuning or retraining ( Chen et al. , 2019 ) , watermark overwriting and model pruning ( Rouhani et al. , 2018 ) . For model usage authorization , most prior works were built on encrypting neural network parameters with a secret key ( Alam et al. , 2020 ; Chakraborty et al. , 2020 ) and ensuring that models can only be used by users with this key . However , authorized users may use the model on any data without restriction . We believe that for comprehensive IP protection , the goal of usage authorization is not only who is allowed to use the model , but also what data can the model be used on . We thus consider a new data-centric aspect of usage authorization in this work , i.e. , authorizing models to certain data for preventing their usage on unauthorized data . We call this applicability authorization . Note that applicability authorization goes far beyond IP protection . It can also be viewed as a way to “ control ” how machine learning models are used in general . One example would be a company Data space Reduced model generalization bound Source domain Source-Only NTL Source domain Outside of source domain . Data space Target Target-Specified NTL Source domain Generalization bound Data space Supervised Learning Figure 1 : A visualization of the generalization bound trained with different approaches . The left figure shows Supervised Learning in the source domain , which can derive a wide generalization area . When Target-Specified NTL is applied ( middle ) , the target domain is removed from the generalization area . As for Source-Only NTL ( right ) , the generalization area is significantly reduced . ( e.g. , Facebook ) trains a model from adult data and uses applicability authorization to prevent the model from being used for teenagers . Our Approach and Contribution . In this work , we propose Non-Transferable Learning ( NTL ) , a novel approach that can robustly verify the model ownership and authorize the model applicability on certain data . Intuitively , NTL goes against the current research trend of improving the generalization ability of models across various domains , e.g. , domain generalization and adaptation ( Li et al. , 2020 ; Zhou et al. , 2020 ) . Instead , NTL tries to make the generalization bound of DL models more explicit and narrower , by optimizing the model to learn domain-dependent features and thereby making the model exclusive to certain domains . More specifically , we consider two domains : the source domain where we want the models to perform well , and the auxiliary domain where we aim to degrade the model performance . And if the model trained with NTL is applied to a target domain similar to the auxiliary one , the performance should also be poor . As shown in Figure 1 , we have developed two types of NTL approaches : Target-Specified NTL and Source-Only NTL . • Target-Specified NTL assumes that the source and target domains are both known . We then treat the target domain as the auxiliary domain and enlarge the distance of representations between the source and auxiliary domains . Target-Specified NTL can be used to verify the model ownership by triggering misclassification . While previous model watermarks can often be easily removed because the model memorization of such watermarks encounters catastrophic forgetting ( Kemker et al. , 2018 ) during watermark removal , our NTL-based verification is resistant to state-of-art watermark removal approaches , because the misclassification behavior is dependent on the overall target-private features that have little correlation with the source-private features for the main task . • In Source-Only NTL , the target domain is unknown and thus our approach relies solely on the source domain , aiming to degrade the performance in all other domains . In this case , NTL generates the auxiliary domain from a novel generative adversarial augmentation framework and then increases the representation distance . Source-Only NTL can provide authorization to certain data rather than particular users or devices , by degrading the model performance on all other data domains other than the source domain . This provides data-centric applicability authorization , with which we can also prevent unauthorized model usage that are caused by the secret key leakage and can not be addressed by prior model authorization methods . In addition to proposing the novel concept of NTL and developing its two approaches , we are also able to experimentally validate their effectiveness . We conducte extensive experiments on 5 digit sets , CIFAR10 & STL10 and VisDA . For target-specified cases , we demonstrate how to apply NTL for model ownership verification . Our experiments show that the state-of-art model watermark removal methods are ineffective on NTL-based ownership verification . For source-only NTL , our experiments demonstrate its effectiveness in authorizing model applicability to certain data . 2 RELATED WORK . Domain Generalization & Adaptation ( DG & DA ) . DG aims to generalize learning models with available source domains to unseen target domains ( Blanchard et al. , 2011 ) . A number of methods have been proposed for domain discrepancy minimization ( Li et al. , 2020 ) , adversarial training ( Rahman et al. , 2020 ; Zhao et al. , 2020c ) , invariance representation learning ( Zhou et al. , 2020 ; Piratla et al. , 2020 ) , etc . Recently , there is significant interest on conducting DG with one source domain only , for which well-crafted data augmentation approaches ( Qiao et al. , 2020 ; Zhao et al. , 2020b ; Li et al. , 2021b ; Xu et al. , 2020b ) have been proposed to expand the input space . DA is also related to improving the generalization ability of models across domains ( Ahmed et al. , 2021 ) , and while DA can access the target data , DG has no access to any target sample ( Tzeng et al. , 2017 ; Kundu et al. , 2020 ) . Unlike DG or DA , in this work , we try to weaken the generalization ability of models by expanding the distance between representations of different domains . Our proposed method can work effectively for both the target-specified case and the source-only case with a novel adversarial augmentation framework . Intellectual Property ( IP ) Protection for Deep Learning ( DL ) . While DL has shown its unparalleled advantages in various applications , there are significant challenges in protecting DL models . For instance , Membership Inference Attack ( Shokri et al. , 2017 ) can steal information on whether a particular data sample has been learned by the target DL model . Model Inversion Attack ( He et al. , 2019 ; Salem et al. , 2020 ) is able to recover the input data via an analysis of the model prediction . These two types of attacks directly threaten the privacy of model users , while there are many active attacks ( Suciu et al. , 2018 ; Yao et al. , 2019 ) that lead DL models to produce abnormal behaviors . In addition , verifying model ownership and authorizing model usage have become important issues with the development of AIaaS . There have been a number of watermarking approaches addressing the verification of model ownership . For instance , Zhang et al . ( 2018 ) and Li et al . ( 2019 ) train a neural network on the original datasets and on the watermarked one assigned with a particular label , which makes the model behave abnormally when it encounters watermarked data . Song et al . ( 2017 ) and Uchida et al . ( 2017 ) inject watermark into the least significant bits of the model parameters and provide the corresponding decoding methods . Le Merrer et al . ( 2020 ) and Zhao et al . ( 2020a ) make use of adversarial examples to extract fingerprints from learned neural networks without accessing network weights . Compared to these approaches , our NTL can achieve model ownership verification by triggering universal misclassification . Moreover , with extensive experiments , we also demonstrate that state-of-art model watermark removal methods , e.g. , FTAL and RTAL ( Adi et al. , 2018 ) , EWC and AU ( Chen et al. , 2019 ) , watermark overwriting and model pruning ( Rouhani et al. , 2018 ) are not effective to NTL-based verification . Model usage authorization is another aspect in protecting model intellectual property . For instance , Alam et al . ( 2020 ) encrypt every network parameter with a secret key . Chakraborty et al . ( 2020 ) generate a secret key from hardware fingerprints of a particular device , and require that only users who possess this device can load and employ the model . Different from these methods , our NTL focuses on providing data-centric protection via applicability authorization , which retains good model performance on authorized data while degrading model performance for other data domains . To the best of our knowledge , this is the first work that prevents model usage on unauthorized data via model learning . 3 METHODOLOGY . In this section , we introduce our NTL approach . Section 3.1 presents the inspiration and the design of optimization objective of NTL , which is at the core for both target-specified and source-only cases . Section 3.2 presents the generative augmentation framework for source-only cases . Our method is based on the concept of generative adversarial networks ( GAN ) , however our goal is not to propose a new GAN but to design an effective augmentation method in the context of NTL . Section 3.3 introduces the application of NTL on ownership verification and applicability authorization . 3.1 NON-TRANSFERABLE LEARNING WITH DISTANCE EXPANSION OF REPRESENTATION . We consider a source domain with labeled samples S= { ( x , y ) ∥x∼PSX , y∼PSY } , where PX and PY are the input and label distributions , respectively . In this work , we use image classification as the learning task with K possible classes , in which case x and y are matrix-valued and scalar random variables , respectively . In addition , we consider an auxiliary domain A= { ( x , y ) ∥x∼PAX , y∼PAY } . The source domain S and the auxiliary domain A will be fed into a deep neural network , and without loss of generality , we split the neural network into two parts , one is a feature extractor Φ on the bottom , and the other is a classifier Ω on the top . Inspiration from Information Bottleneck . Our NTL , in particular the design of optimization objective , is inspired by the analysis of Information Bottleneck ( IB ) ( Tishby et al. , 2000 ) . Let us start by introducing Shannon Mutual Information ( SMI ) . In addition to random variables – input x and label y , we also regard representation z extracted by Φ as a random variable . The SMI between two random variables , e.g. , between z and x , is defined as I ( z ; x ) =Ex∼PX [ DKL ( P ( z|x ) ∥P ( z ) ) ] , where DKL ( · ) represents the Kullback-Leible ( KL ) divergence and P ( · ) is the distribution . In IB theory , considering the effectiveness , privacy and generalization , an optimal representation has three properties ( Achille & Soatto , 2018 ) : ( 1 ) Sufficiency : label y sufficiently differentiates representation z , i.e. , I ( z ; y ) = I ( x ; y ) ; ( 2 ) Minimality : z needs to represent as little information about input x as possible , i.e. , min I ( z ; x ) ; ( 3 ) Invariance : z is optimal , meaning that it does not overfit to spurious correlations between y and nuisance n embedded in x , i.e. , I ( z ; n ) =0 . IB theory assumes that nuisance n is a factor that affects input x , and it works with y together to determine what x looks like to some extent . For instance , in domain generalization , nuisance n can be regarded as a domain index that indicates which domain a certain sample comes from ( Du et al. , 2020 ) . In our problem , different from the objective of the IB theory , NTL enforces the models to extract nuisance-dependent representations , which is opposite to the property of invariance . In other words , we aim to increase I ( z ; n ) , and we have the following proposition for achieving this aim . Proposition 1 . Let n be a nuisance for input x . Let z be a representation of x , and the label is y . For the information flow in the representation learning , we have I ( z ; x ) − I ( z ; y|n ) ≥ I ( z ; n ) ( 1 ) The detailed proof for Proposition 1 is included in the Appendix . Optimization Objective Design . Proposition 1 provides guidance for maximizing I ( z ; n ) . First , unlike in the IB theory , we do not minimize I ( z ; x ) for the minimality property . In addition , we try to minimize I ( z ; y|n ) through the design of optimization objective that measures the error between the model prediction and the ground truth during the training of neural networks . Specifically , instead of using the typical CrossEntropy loss to measure the error , we apply KL divergence loss to direct the training , and we have the following theorem . Theorem 1 . Let ŷ be the predicted label outputted by a representation model when feeding with input x , and suppose that ŷ is a scalar random variable and x is balanced on the ground truth label y. Denote the one-hot forms of ŷ and y as ŷ and y , respectively . If the KL divergence loss DKL ( P ( ŷ ) ∥P ( y ) ) increases , the mutual information I ( z ; y ) will decrease . The detailed proof of Theorem 1 is provided in the Appendix . According to this theorem , I ( z ; y|n ) can be minimized by increasing the KL divergence loss of training data conditioned on different n. However , as stated in Section 1 , we aim to degrade the model performance in the auxiliary domain while still maintaining good model performance in the source domain . Thus , we only minimize I ( z ; y|n ) by increasing the KL divergence loss of the auxiliary domain data . In order to achieve this goal , we design a loss L∗ntl that shapes like a minus operation between KL divergence losses of the source and auxiliary domain ( LS , LA ) , i.e. , LS = Ex∼PSX [ DKL ( P ( Ω ( Φ ( x ) ) ) ∥P ( y ) ) ] and LA=Ex∼PAX [ DKL ( P ( Ω ( Φ ( x ) ) ) ∥P ( y ) ) ] . Specifically , this loss can be written as follows : L∗ntl = LS −max ( β , α · LA ) ( 2 ) Here , α is the scaling factor for LA ( α = 0.1 in our experiments ) , and β is an upper bound when LA gets too large and dominates the overall loss ( β=1.0 in experiments ; please see the Appendix for more details about α and β ) . Moreover , if we use n = 0 and n = 1 to denote the source and auxiliary domain respectively , the optimization of Eq . ( 2 ) can guarantee the sufficiency property for the source domain : I ( z ; y|n=0 ) =I ( x ; y|n=0 ) , and increasing LA decreases I ( z ; y|n=1 ) . According to Proposition 1 , we can move the upper bound of I ( z ; n ) to a higher baseline via optimizing Eq . ( 2 ) . However , such optimization might only make classifier Ω more sensitive to domain features and have little effect on feature extractor Φ . In this case , representations of different domains captured by Φ may still be similar , which conflicts with our intention to maximize I ( z ; n ) , and the performance of the target can be easily improved by fine-tuning or adapting Ω with a small number of labeled target samples . On the other hand , directly calculating I ( z ; n ) and taking it as part of the optimization objective are difficult , especially in the optimization of representation learning ( Torkkola , 2003 ) . Achille & Soatto ( 2018 ) apply binary classifier as the nuisance discriminator , and they can estimate I ( z ; n ) after the model training via this discriminator . Here , we find another way to increase I ( z ; n ) indirectly based on the following theorem . Theorem 2 . Let n be a nuisance that is regarded as a domain index . n=0 and n=1 denote that a certain input x comes from two different domains . Suppose that these two domains have the same number of samples d , and the samples of each domain are symmetrically distributed around the centroid . Let z be a representation of x , and it is drawn from distribution PZ . An estimator with the characteristic kernel from Reproducing Kernel Hilbert Spaces ( RKHSs ) – Gaussian Kernel estimator MMD ( P , Q ; exp ) is applied on finite samples from distributions PZ|0 and PZ|1 to approximate the Maximum Mean Discrepancy ( MMD ) between these two distributions . If MMD ( PZ|0 , PZ|1 ; exp ) increases to saturation , the mutual information between z and n will increase . MMD ( PZ|0 , PZ|1 ; exp ) =Ez , z′∼PZ|0 [ e −∥z−z′∥2 ] −2Ez∼PZ|0 , z′∼PZ|1 [ e −∥z−z′∥2 ] +Ez , z′∼PZ|1 [ e −∥z−z′∥2 ] ( 3 ) We also employ a nuisance discriminator to observe the change of I ( z ; n ) during training . The details of this discriminator design and the proof of Theorem 2 can be found in the Appendix . NTL Optimization Objective . Based on the above analysis , we design our NTL optimization objective to increase I ( z ; n ) and extract nuisance-dependent representations . Specifically , we compute the MMD ( P , Q ; exp ) between representations of the source and auxiliary domain data and maximize it . For stability concern , we also set an upper bound to the MMD ( P , Q ; exp ) . Then , the overall optimization objective of NTL with distance expansion of representation is shaped as follows : Lntl = LS−max ( β , α ·LA ·Ldis ) , whereLdis = max ( β′ , α′ ·MMD ( Px∼PS X ( Φ ( x ) ) , Px∼PA X ( Φ ( x ) ) ; exp ) ( 4 ) Here , α′ and β′ represent the scaling factor and upper bound of Ldis respectively ( α′ = 0.1 and β′=1.0 in our experiments ; please refer to the Appendix for more details about α′ and β′ ) . Φ ( · ) is the feature extractor that outputs the corresponding representations of given inputs . When the target domain is known and accessible , it will be regarded as the auxiliary domain , and the above NTL with distance expansion of representation can be conducted directly on the source and auxiliary domains . We call such cases Target-Specified NTL .

Summary: This paper introduces the idea of "non-transferable learning", which is roughly what the name indicates. The authors explain the value of this as a security/IP protection tool to protect the model from being used on unauthorized data. In addition, this presents a kind of attack against domain adaption works that try to improve generalization bounds without access to source data.