Paper: Two Birds with One Stone: Protecting DNN Models Against Unauthorized Inference and Domain Transfer (ICLR-2024)

Reviewer comment (Theory):
The authors assume an unpractical threat model for the attacker. Although this can be the worst case for the defender, such unpractical threat model for attack can make that such an attack can never happen in the real world. Thus, developing a valid defense for such unrealistic attack is not very meaningful. It would be great if the authors can provide more detailed discussion or justification on the threat model side.

Author response:
Thanks for your comments.

**[For Q1]**

We appreciate your feedback regarding the practicality of our threat model. To address your concern effectively, **we would like to understand which specific aspect you find impractical.** It's crucial for us to receive more technical details/comments to provide a targeted clarification and justification for our chosen threat model. **It's worth noting that Reviewer rjhp considered our threat model realistic and listed it as a strength.** We are eager to ensure a clear understanding and address any potential concerns regarding the practicality of our threat model.

Reviewer comment (Experiments):
The evaluation setup for this paper, such as dataset and models selection, is very ad-hoc. There is no justification on the reason for such selections. For instance, are the selection representative or the state-of-the-art? Without such justification, it is unclear whether their designs and findings can transfer and work well in the most representative setup.

Author response:
**[For Q2]**

Indeed, we have provided detailed justifications for our choices in Sections 4.1 and 4.2, **aligning with state-of-the-art works** to ensure fair and meaningful comparisons.

**Given your positive evaluation of the robustness, presentation, and contribution of our work, and recognizing the impressive results we achieved, we respectfully ask for a reconsideration of the rating in light of the information we provided (including responses to other reviewers if helpful).**  We firmly believe that our research makes a substantial contribution to enhancing on-device ML protection by effectively tackling dual vulnerabilities, with the results showcasing the effectiveness of our proposed approach.

Reviewer comment (Evaluation):
I have concerns regarding the threat model and evaluation method which are given in questions.

Author response:
Our work aims to ensure the secure deployment of pre-trained models by generating a protected version. **The protected model is deployed on devices, and crucial data (the original values of the perturbed weights) is safeguarded by TEE**. During inference, users can access this data but cannot extract it, thanks to the properties of TEE. On the other hand, attackers cannot even gain access to the secure memory of TEE, although they can extract the unprotected model deployed in unsecured memory, which exhibits low performance for both domains. Therefore, our assumption is that the protected model can be white-box for attackers, which is a stronger threat model with a stronger attacker. We will provide further clarification on the threat model and delve into the details of TEE properties in the final version to eliminate any confusion.

Reviewer comment (Theory):
I'm uncertain if this is a mistake, but in your threat model, you mentioned, "We assume the attacker is able to extract the DNN model, including its architecture and well-trained weights." I find this confusing. What exactly is the Trusted Execution Environment (TEE) used to protect in this context? How is it feasible to protect the model against **unauthorized inference** when the attacker has both the model weights and architecture?

Author response:
Our work aims to ensure the secure deployment of pre-trained models by generating a protected version. **The protected model is deployed on devices, and crucial data (the original values of the perturbed weights) is safeguarded by TEE**. During inference, users can access this data but cannot extract it, thanks to the properties of TEE. On the other hand, attackers cannot even gain access to the secure memory of TEE, although they can extract the unprotected model deployed in unsecured memory, which exhibits low performance for both domains. Therefore, our assumption is that the protected model can be white-box for attackers, which is a stronger threat model with a stronger attacker. We will provide further clarification on the threat model and delve into the details of TEE properties in the final version to eliminate any confusion.

Reviewer comment (Evaluation):
Comparing transferability is challenging. In the evaluation, you present the final test accuracy of a model transferred from the source to the target domain, which is a good starting point. However, it is hard to conclude that the approach reduces model transferability. Many other factors could influence your evaluation, such as model initialization and target domain selection. Is it possible to include learning curves in your analysis?

Author response:
Our method takes pre-trained models as input and generates their protected versions. To avoid introducing any initialization bias, we utilized open-sourced pre-trained models available online. For the selection of the target domain, we adhered to the experiment settings outlined in SOTA works [1] and [2]. Notably, these references did not include the learning curve in their work, thereby we overlooked its significance. However, we appreciate your suggestion and are willing to incorporate it into the final version.

Reviewer comment (Theory):
Can you show that the bi-level optimization added during the training stage does not compromise model quality in the source domain? What you are trying to show is the existence of distinct local minima for the source domain compared to nearby target domains. This is very hard to prove.

Author response:
The primary advantage of our method lies in leveraging TEE to ensure model quality on the source domain for users. Specifically, we perturbed one filter per layer to generate the protected model through bi-level optimization. The original values of these perturbed weights are stored inside the TEE to preserve the source performance for users. Consequently, **bi-level optimization does not compromise the model quality in the source domain.**

Reviewer comment (Evaluation):
I find the problem and the solution in this paper intriguing. However, I still have some concerns regarding the evaluation and threat model.

Author response:
We acknowledge that the way we leverage TEE may cause confusion to you. We hope the information provided above addresses your concerns.
We appreciate your acknowledgment that our paper is intriguing and hope we have addressed all your concerns.

Reviewer comment (Experiments):
Lack of comparisons against wider range of prior arts.

Author response:
Thank you for your feedback, and **we appreciate your acknowledgment of the soundness, presentation, and contribution of our work.** We understand your interest in broader evaluations and comparisons.

As mentioned in Section 4.2, our work is pioneering in simultaneously addressing both unauthorized inference and cross-domain transfer (i.e., dual protection). Given the novelty of our approach, there are no previous works that are directly comparable or as the baseline. However, we tried our best to find comparison methods, including state-of-the-art approaches like [1-3]. Moreover, for fair evaluation, we intentionally aligned with their datasets and model selections to ensure meaningful comparisons and to underscore the notable performance achieved by our method.

Regarding a wider range of prior arts, **we have made efforts to include relevant and state-of-the-art methods for comparison.** However, **if you have specific suggestions for additional prior arts, we would appreciate your insights.**

**Considering your positive assessment of our work's soundness, presentation, and contribution, and acknowledging that the evaluation is your primary concern, we kindly request you to reconsider the rating in light of the information provided above. We believe our work significantly advances on-device ML protection by addressing dual vulnerabilities, and the results demonstrate the efficacy of our proposed method.**