Dataset Inference for Self-Supervised Models
Anonymous Author(s)
AfﬁliationAddress email
Abstract
Self-supervised models are increasingly prevalent in machine learning (ML) sincethey reduce the need for expensively labeled data.
Because of their versatility indownstream applications, they are increasingly used as a service exposed via public
APIs.
At the same time, these encoder models are particularly vulnerable to modelstealing attacks due to the high dimensionality of vector representations they output.
Yet, encoders remain undefended: existing mitigation strategies for stealing attacksfocus on supervised learning.
We introduce a new dataset inference defense, whichuses the private training set of the victim encoder model to attribute its ownershipin the event of stealing.
The intuition is that the log-likelihood of an encoder’soutput representations is higher on the victim’s training data than on test data if itis stolen from the victim, but not if it is independently trained.
We compute thislog-likelihood using density estimation models.
As part of our evaluation, we alsopropose to measure the ﬁdelity of stolen encoders without involving downstreamtasks and to quantify the effectiveness of the theft detection; instead, we leveragemutual information and distance measurements.
Our extensive empirical results inthe vision domain demonstrate that dataset inference is a promising direction fordefending self-supervised models against model stealing.
Introduction
The self-supervised learning (SSL) paradigm enables pre-training models with unlabeled data to learngenerally useful domain knowledge and then transfer the knowledge to solve speciﬁc downstream tasks.
The ability to learn from unlabeled data alleviates the high costs of labeling large datasets [23],and the transfer learning setup reduces the computational costs of retraining.
These advantages havemade SSL increasingly popular [20] in domains like vision [5], language [12] and bioinformatics [27].
Recently, commercial service providers like Cohere [1] and OpenAI [2]began offering paid queryaccess to trained SSL encoders over public APIs.
This exposes the encoders to black-box extractionattacks, i e., model stealing.
In a model stealing attack, an attacker aims to train an approximatecopy of a victim model by submitting carefully chosen queries and observing the victim’s outputs.
The high costs of data collection, preprocessing and model training make encoders valuable targetsfor stealing.
For example, the training data of CLIP includes 400 million image and text pairs [36],while computation costs of training a large language model can exceed one million USD [40].
Thethreat of model stealing in SSL is real: researchers have demonstrated that encoders can be stolen at afraction of the victim’s training cost [14, 38].
Yet, most current defenses are designed for supervisedmodels [15, 22, 34] and cannot be directly applied to encoders [14].
Dataset inference [29] is a state-of-the-art defense against model stealing in the supervised learningsetting.
The defense provides ownership resolution: it enables the model owner to make a strongstatistical claim that a given model is a stolen copy of their own model by showing that this modelis derivative of their own private training data.
Dataset inference does not require retraining oroverﬁtting the model to any form of explicit watermark has been shown to resist attacks from
[Table]
[Figure]
adaptive adversaries [29].
These properties make the defense particularly attractive for SSL, as largeencoders can be expensive to retrain, and performance is paramount because it carries over to alldownstream tasks.
However, the original dataset inference algorithm from [29] cannot be appliedto encoders, because it relies on computing distances between data points and decision boundaries.
These decision boundaries do not exist in encoders since they are trained on unlabeled data.
We introduce a new dataset inference algorithm (Figure 1) to defend against model stealing forencoders.
Our algorithm is suitable for the high-dimensional outputs of SSL encoders and does notrely on labeled data or decision boundaries.
Instead, it relies solely on the private training data of thevictim encoder as a signature.
Moreover, our algorithm retains the advantages of dataset inference forsupervised models [29], namely, it does not require retraining or overﬁtting the model.
Our key intuition is to identify stolen encoders by characterizing differences between an encoder’srepresentations on its training data vs on unseen test data.
The victim encoder and its derivatives,such as stolen copies, exhibit different behavior on the victim’s private training data than on testdata; independently trained encoders do not.
These differences exist because encoders overﬁt totraining data [18, 28].
Although for well-trained encoders the effect is minimal on any given datapoint, we show that when aggregated over many training points it provides a statistically strongsignal.
To identify the differences, we train a Gaussian Mixture Model (GMM), as an efﬁcient generalapproximator,to model the distribution of an encoder’s representations of data from its trainingdomain.
We then use the GMMs to predict the log-likelihood of the encoders’ representations of thevictim’s training set and a test set; derivatives of the victim encoder will have a higher log-likelihoodon the training set than on the test set.
We perform experiments on ﬁve datasets from the visiondomain and show that we are able to distinguish between stolen and independent encoders even incases when adversaries obfuscate the representations from the stolen encoders to hide the theft ( e.g.,by shufﬂing the elements in the representation vectors).
As part of our evaluation, we also introduce new metrics to measure the ﬁdelity of stolen encoderswithout involving downstream tasks and to quantify the effectiveness of theft detection.
We computescores directly on the representations using tools from information theory and distance metrics.
Thesemethods work well because losses used for stealing encoders directly minimize distances betweenrepresentations of victim and stolen encoders.
Our mutual information score to assess the quality ofthe stolen encoders is robust against obfuscations that an adversary might apply to the representationsreturned by a stolen encoder.
Without any obfuscation, our cosine similarity score shows a clearerdistinction between stolen and independent encoders.
Finally, using these metrics, we observe that thehigher the quality of the stolen encoders, the more conﬁdent our dataset inference defense becomes.
Our main contributions are as follows:
• We propose a new defense against model stealing attacks on encoders, by combining datasetinference with density estimation models for ownership resolution on unlabeled data.
• We are the ﬁrst to design new metrics that quantify the quality of stolen encoders, which are derivedfrom the mutual information and distances between representations.•
We evaluate our defense using ﬁve datasets from the computer vision domain and show that ourdefense can successfully identify stolen encoders with a strong statistical signiﬁcance.
Related Work
In model stealing, an adversary queries the victim model, obtains outputs, and uses them to recreate acopy of the victim [42].
This is most commonly performed with black-box access, e.g., via a public
API.
When stealing encoders in SSL, the goal of an adversary is to extract high-quality embeddingseither to train a stolen copy that achieves high performance on downstream tasks, or to obtain faithfulreplicas of the victim’s embeddings on the same inputs.
Stolen encoders might be further used formodel reselling, backdoor attacks, or membership inference [9].
While most past research on model stealing and defenses focuses on classiﬁers trained via supervisedlearning, recent work constructed new attacks that target encoders [14, 38].
The main differencesbetween the attacks in these settings are that the outputs of encoders leak more information dueto their higher dimensionalities [38], and the attacks require different loss functions.
Inspired bycontrastive learning, Cont-Steal [38] provides a method of stealing encoders using a loss functionbased on InfoNCE [5].
SSL extraction [14]—a general Siamese-network-based framework forstealing encoders—leverages losses including mean squared error, InfoNCE, Soft Nearest Neighbor,and Wasserstein distance.
The authors empirically show that an adversary can steal an ImageNetvictim encoder in less than a ﬁfth of the queries required for training.
Unfortunately, current defenses against model stealing for supervised learning are inadequate fordefending encoders, and adjusting them to the speciﬁcities of encoders is non-trivial [14].
One lineof approach is watermarking [9, 14], where the defender embeds a secret trigger into the victimencoder during training to determine ownership at test time.
However, watermarking-based defenseshave two signiﬁcant disadvantages.
First, researchers have repeatedly shown that adaptive attackerscan remove watermarks without severely affecting model performance [7, 21, 39, 44], e.g., throughpruning, ﬁne-tuning, rounding or performing backdoor removal [4].
Second, the watermark mustbe embedded during training; if a model is already trained, or if a watermark defense needs to beupdated, the model must be retrained.
This is not practical for large encoders.
Another state-of-the-art defense against model stealing in the supervised setting is dataset inference [29] which addresses these disadvantages.
However, the adaptation of dataset inference toencoders is difﬁcult, because (1) the algorithm [29] relies on decision boundaries, which do not existfor encoders; and (2) encoders are less prone to overﬁtting, which provides the signal for datasetinference [14, 29].
Therefore, naive approaches like computing the loss of representations or distancesbetween train and test sets are ineffective [14].
To overcome these issues, we extract more signalsfrom the representations by estimating their densities for train and test sets, as described in Section 3.
When it comes to comparing signals within representations, prior work has considered measuring thesimilarity between different representations.
This has led to the proposal of various similarity metricsincluding canonical correlation analysis (CCA) [31], centered kernel alignment (CKA) [24], and theorthogonal Procrustes distance [13], which use methods from linear regression, principal componentanalysis (PCA), and singular value decomposition (SVD).
However, these metrics are very generaland complex.
They have also been shown to disagree in some cases [13].
Since we can only accessthe ﬁnal embeddings from encoders, we design metrics more closely related to our setting.
Defense Method
It enables the model owneror a third-party arbitrator to attribute the ownership of a model in the event that it is stolen.
The idea is to take advantage of the effects of knowledge from the victim’s training set and to use that as a signature for attributing ownership.
Given a well-trained encoder, the effects are small on any single data point; however, when aggregated over many points inthe training set, they collectively provide a strong statistical signal for dataset inference.
[Figure] (cid:3015) [Figure]
(cid:3263) ℎ 𝐷 (cid:3265) ℎ [Figure] (cid:3263) Independent 𝑓 (cid:3036)
As depicted in Figure 2, for a victim that leverages the privatedata D P during training or a stolen copy, we can identify adifference between distributions of the train data’s representations h D P and the test data’s representations h D N while thedistributions of these representations from an independent encoder cannot be distinguished.
We use this signal to determinewhether a model is derivative of the victim’s training data, i e ,either directly trained on the data or stolen from the victim.
To capture the signal, we ﬁrst partition the victim encoder’straining data into two subsets and use one to train Gaussian Mixture Models (GMMs) with the aim of modeling the distribution of representations of data from the encoder’s domain.
Then, we apply the GMMs to perform dataset inference bymeasuring the log-likelihood of the encoder’s representationsof the remaining training data vs some test data (see Figure 1).
For the victim encoder or its stolen copies, the log-likelihood oftraining data representations is signiﬁcantly higher than the one of test data.
We use this to constructstatistical t-tests to determine whether a model is stolen, and present our empirical results in Section 5.
3.1 Threat Model
As described in Figure 1, we consider a victim encoder f v trained on a private training dataset D P .
An adversary with black-box access to f v trains a stolen encoder f s by querying the victim with datapoints from a dataset D S to obtain representations.
These representations are then used as part ofthe training objective for the stolen encoder.
During the dataset inference, we assume the presenceof a third-party arbitrator, such as law enforcement, with white-box access to the victim’s trainingdata, as well as all encoders.
Additionally, the arbitrator requires the test dataset D N from the samedistribution as D P to perform dataset inference.
An independent encoder f
i is trained with no accessto the victim’s private training set D P and without any queries to the victim’s encoder.
It is used as abaseline for the ownership resolution in the dataset inference.
3.2 Density Estimation of Representations
Representations from encoders contain rich features for given inputs.
We analyze the inputs thatcome from the training and test sets through their representations.
For the training inputs, we computetheir representations and model their densities [16].
To this end, we leverage GMMs as universalapproximators of densities.
We give representations a probabilistic interpretation such that they havea smooth enough density which can be approximated by any speciﬁc nonzero amount of error usinga GMM with enough components.
Each component has a separately parameterized mean µ andcovariance ⌃ .
We observe that GMMs can overﬁt to their training data when no constraints are appliedto the covariance matrix, hence we limit the covariance matrix for each component to be diagonal.
Components with diagonal covariance matrices act together to model feature density even whenfeatures are in fact correlated [37].
Moreover, this constraint makes training more computationallyefﬁcient since it avoids storing and inverting full high-dimensional covariance matrices.
3.3 Data Flow
The full ﬂow of our dataset inference for encoders consists of the following four main steps whichare also visualized in Figure 1:
Victim Training.
The victim’s encoder f v is trained using the whole private training dataset D P .
Encoder Stealing.
To steal the victim encoder f v , an adversary queries f v with data points from D S to obtain representations h D S 2 R n : h D S
= f v ( D S ) .
With these representations, the adversary trains the stolen encoder f s in a contrastive manner.
Training Estimators.
To perform ownership resolution, an arbitrator trains three density estima-
tors E v , E s and E i
for the victim f
v
, stolen f s , and independent encoder f i
as follows:
a) D P is divided into two non-overlapping subsets D P 1 and D P 2 .
While D P 2 serves as the base
for training the density estimators, D P 1 is used to evaluate density estimates of the private
training data vs the test data D N .
b) For a given encoder f 2 { f v , f s , f i } , the arbitrator generates representations h 2 R n :h D P 2 = f
( D P 2 ) on dataset D P 2 .
Training the density estimators on the respective representations yields the ﬁnal density estimators E v , E s , and E i .
Estimating Densities.
The arbitrator generates representations of D P 1 and D N with each encoder
f 2 { f v , f s , f i } .
Applying the respective density estimator E 2 {E v , E s , E i } on the representationsyields the log-likelihood of each data point x in the respective dataset: 8 x 2 D : p ( x ) =
E ( f ( x )) .
3.4 Ownership Resolution
For an encoder f , we compute the log-likelihood on D P 1 and D N as: u P := | D P 1 | P x 2 D P 1 E ( f ( x ))and u N := | D N | P x 2 D N E ( f ( x )) .
The density estimator E measures the similarity between thedistributions over the victim’s representations of the training D P vs test data D N .
The intuitionbehind the setup is that if an encoder was trained on D P , representations of D P 1 are much moresimilar to representations of D P 2 , because the whole dataset D P was used for training the encoder,however, representations of D N differ from representation of D P 2 since D N was not used to trainthe encoder.
For a victim f v and a stolen encoder f s , u P is signiﬁcantly larger than u N , whereas, foran independent encoder f
i , the values do not differ signiﬁcantly.
Finally, we carry out a hypothesistest with the null hypothesis being: H 0 :=
u P  u N .
If the null-hypothesis can be rejected (p-value< 0 . 05 ), i.e., when the log-likelihood for the training set D P 1 is higher than that for the test set D N ,we can conclude that the tested model was stolen.
On the other hand, if the null hypothesis cannot berejected then the test is inconclusive and we cannot determine if a tested encoder was stolen or not.
Encoder Similarity Scores
Measuring the quality of stolen encoders allows us to assess attacks and defenses.
In standardsupervised learning, the quality of a stolen model is evaluated using two main objectives, namely taskaccuracy, which is the model’s performance on the test set, and ﬁdelity, which is the agreement in thepredictions for a given task between the stolen and the victim model [19].
One of the approachesto measure the quality of an extracted encoder is to use its outputs to train a downstream task andcompute the accuracy on that task or ﬁdelity (with respect to the outputs of the downstream tasktrained on the victim encoder).
However, a single downstream task cannot adequately reﬂect thedegree of similarity between encoders since it reduces their high dimensional embeddings to singlelabel representations, which are confounded by choices of downstream data and training protocol.
Instead, we propose two new metrics.
Our ﬁrst metric is an information-theoretic score based onmutual information [10, 25].
This metric corresponds to the accuracy in supervised learning.
Oursecond metric is a cosine similarity score based on the representations returned by different encoders.
This corresponds to the ﬁdelity metric in supervised learning.
The behavior of the two metrics differsin certain cases, for example, when used on obfuscated representations ( e.g., with shufﬂed elements)or with independent models, however, we ﬁnd that the overall trend is similar.
Moreover, the mutualinformation score is based on an approximation while the cosine similarity score is calculated exactlygiven representation vectors.
Often the effectiveness of defenses may be underestimated against lowquality stolen copies that haven’t successfully stolen victim behavior.
Our metrics help disentanglesuch effects and enable faithful evaluation of defenses.
4.1 Mutual Information Score
Our ﬁrst approach to assessing the quality of a stolen encoder uses a score based on mutual information.
We sample N data points from the victim’s private training dataset D P and pass them through theencoders f v , f s , and f i to generate the respective representations.
Per standard practice, we recenterand normalize the representations [13].
We denote the entropy by H and compute it accordingto Algorithm 2 which takes f v , D P , and N as input.
For the joint entropy H ( f v , f s | D ) , wegenerate representations from the two encoders (in this case victim f v and stolen f s ) and concatenate them, which increases the dimensionality of the ﬁnal representation to 2 d , while other steps remainunchanged.
A detailed algorithm for computing the joint entropy can be found in the Appendix as
Algorithm 3.
We compute an approximate score that is based on the deﬁnition of mutual information
I ( f v , f s | D P ) between the victim encoder f v and the stolen copy f s as well as the analogous mutualinformation
I ( f v , f i | D P ) between the victim encoder f v and the independently trained encoder f i .
We rely on approximations since we measure mutual information using ﬁnite data.
Yet, in practice,such approximations have proven useful [30].
We deﬁne our mutual information score as follows:
[Equation]
A higher value of the mutual information I ( f v , f s | D P ) indicates a higher information leakageincurred by the stolen encoder.
Expectedly, mutual information is higher between the victim and thestolen encoder than between the victim and independent encoders
I ( f v , f s | D P ) >
> I ( f v , f i | D P ) .
We can normalize mutual information into a score (between 0 and 1) by setting the lower bound as themutual information between the victim f v and a randomly initialized model f r : I min =
I ( f v , f r | D P )and the upper bound as the mutual information between the victim and itself: I max =
I ( f v , f v | D P )
For the current mutual information score I c , the normalized score is deﬁned as S :
= I c
I min I max  I min .
4.2 Cosine Similarity Score
The second score we use to assess the quality of a stolen encoder is based on the cosine similaritybetween its representations and the victim’s representations.
More speciﬁcally, we ﬁrst computerepresentations for the two encoders on a set of N randomly selected data points from the dataset D P .
Again as per standard practice [13], we recenter and normalize these representations.
For each of the
N inputs, we then compute the cosine similarity between the corresponding representations fromboth encoders where the cosine similarity sim( a, b )
= a T b ||
a || 2 || b
|| 2 for representation vectors a and b .
We show (in Section 4.3) that the loss functions, which are used for stealing encoders, directlymaximize the cosine similarity between representations from victim and stolen encoders.
We thuspropose to use the cosine similarity score C as a metric, which we deﬁne as: [Equation]
The score yields values in the range [0 , 1] , with a higher score indicating closer representations.
Tocalculate a per-encoder cosine similarity score, we average the cosine similarity scores over all inputs.
We ﬁnd that the cosine similarity score is well-calibrated across encoders.
Namely, an independentencoder, expected to have representations unrelated to the victim encoder, has an average cosinesimilarity concentrated around
[9], while a stolen encoder exhibits signiﬁcantly higher scores.
Thecosine similarity score is also easy to compute since it only requires the corresponding representationsof the two models and their dot product.
4.3 Analysis
There are various ways in which an attacker may steal an encoder.
To simplify our analysis of thecosine similarity score, we consider two best performing loss functions used for stealing [14]: theﬁrst where the attacker minimizes the non-contrastive MSE (Mean Squared Error) loss between itsrepresentations and the victim encoder’s representations to train the stolen encoder, and the secondwhere the attacker uses a contrastive loss function, such as the InfoNCE loss [43] which is applied in
SimCLR [5].
Stealing with MSE loss.
In the case where the MSE loss is used, let x i be a query made byan attacker and let f v ( x i )
=
h v i , f s ( x i ) =
h s i 2 R n be the corresponding representations ofthe victim and stolen encoders respectively.
The MSE loss between these two representations is1 n
P nj =1 ( h v ij  h s ij ) 2 = 1 n ||
h
v i  h
s
i ||
It follows directly that minimizing the MSE loss alsominimizes the ` 2 distance between representations and equivalently maximizes the cosine similaritybetween representations (see Theorem I.1).
[-|| 
-]
Stealing with InfoNCE loss.
When an attacker uses the InfoNCE loss for stealing , minimizingthe loss corresponds to maximizing the sum of the cosine similarities between positive pairs, i.e.,
P mc =1 (sim( h s c , h v c ) / ⌧ ) .
The InfoNCE loss, or contrastive losses in general, also increase the mutual information score [3, 43].
We, therefore, expect that stolen encoders will have larger similarity scoresw.r.t.
the victim encoder than independent encoders.
We refer the reader to Appendix I.1 for a moredetailed discussion of the loss functions and their relationship with the similarity scores.
Empirical Evaluation
We evaluate our defense against encoder extraction attacks using ﬁve different vision datasets(CIFAR10, CIFAR100 [26], SVHN [32], STL10 [8], and ImageNet [11]).
Table 1 shows that ourdataset inference method is able to differentiate between the stolen copies of the victim encoder andindependently trained encoders by using the victim’s private training data as the signature.
We alsoshow that our defense works in the scenario where the adversary modiﬁes the representations torender them inconspicuous, e.g., by shufﬂing the order of elements in the representation vectors.
Toassess the quality of the stolen encoders and performance of our defense, we measure the mutualinformation and cosine similarity scores between encoders and present our results in Tables 2 and 3.
5.1 Training Victim, Stolen and Independent Encoders
Victim.
We use victim encoders trained on the ImageNet, CIFAR10, and SVHN datatsets.
For the
ImageNet victim encoder , we use a model released by the authors of SimSiam [6].
To train CIFAR10and SVHN victim encoders, we use an open-source PyTorch implementation of SimCLR [5].
The
ImageNet victim has an output representation dimension of 2048, while the CIFAR10 and SVHNvictim encoders have 512-dimensional representations.
Stolen.
When stealing from the victim encoders, we evaluate different numbers of queries fromvarious datasets, including CIFAR10, SVHN, ImageNet, and STL10.
Stolen encoders are trained in asimilar contrastive way as the victim and use the InfoNCE loss, where the positive pairs consist ofrepresentations from the victim and stolen encoder for a given input.
Algorithm 1 summarizes thestealing approach used by the stolen encoder.
Independent.
For each victim encoder, we train independent encoders using datasets differentfrom the victim’s private training dataset D P .
The encoders are trained with the SimCLR approach,similar to the way the victim encoders were trained.
In the case where the dataset used to train theindependent model had different image dimensions from the victim’s training dataset, the dataset wasresized to be of the same size.
More details on training and stealing encoders can be found in Section D.4 of the Appendix.
5.2 Dataset Inference on Encoders
Setup.
We train GMMs with 10 components for CIFAR10 and SVHN, and GMMs with 20 components for ImageNet.
For all cases, we restrict the covariance matrix to be diagonal (as stated in Section 3.2).
For CIFAR10 and SVHN, we use 80% of the training set to train GMMs, and theremaining 20% to evaluate the training log-likelihood.
For ImageNet, we use 100 K images from thetraining set to train GMMs and 50 K as an evaluation set.
The whole test sets are used to evaluate testlog-likelihood in all datasets.
For each setting, we tune the hyperparameters on the victim model anda randomly-initialized model.
Evaluation of our Defense.
The empirical results in Table 1 demonstrate that we are able todifferentiate between stolen and independent encoders from the difference of log-likelihoods.
Weobserve that the stolen encoders have signiﬁcantly larger  µ than the independent encoders.
Thep-values further show that for stolen encoders the null-hypothesis is rejected while for independentencoders, the test is inconclusive.
Similar to dataset inference for supervised learning [29], the victimmodel typically has the largest  µ and the smallest p-values.
Also, we observe that our method isbetter at detecting encoders that are stolen using the victim’s train set to extract queries.
Number of Stolen Queries.
Table 3 shows that as the attacker steals more queries, the p-value fromour defense becomes lower.
This is consistent with the ﬁnding in [29] that dataset inference worksbetter with stronger stolen encoders.
We also ﬁnd that our defense is able to detect stolen encoderseven if the attacker only steals from a small number of queries.
For example, in Table 3, we are ableto claim ownership when only 10K queries are used for stealing the SVHN victim encoder (less than15 % of its training set) and around 50K queries for ImageNet (less than 4 % of its training set).
[Table]
{+.31e7.
+}
Transform
CIFAR 1.37e4.
CIFAR 5.32e5.
CIFAR 8.45e8.
f i
N/A
CIFAR 8.39e- -0.
CIFAR 2.13e0.
CIFAR 7.89e4.56 SVHN 6.90e- -0.
CIFAR 3.56e0.
SVHN 5.42e0.
Robustness of Dataset Inference to Obfuscations.
The attacker can obfuscate the stolen encoderrepresentations by, for instance, applying shufﬂing (changing the order of elements), padding (addingzeros), or linear transformations ( e.g., scaling or adding a constant).
These obfuscations have littleimpact on the downstream performance [17] but may pose challenges to the defenses of the victim.
The results in Table 1 show that the p-values for the stolen encoders after attackers’ obfuscationsremain low, which implies that our method is robust to these types of obfuscations.
5.3 Measuring Quality of Stolen Encoders
Setup.
To measure the quality of stolen encoders, we selecta random subset of N = 20 K unaugmented images from theprivate training dataset D P and compute their representationsfrom stolen and victim encoders.
We then centralize (subtractthe mean for each dimension) and normalize the representations (divide by the ` 2 norm).
For the mutual information score,we ﬁrst estimate the entropies H ( f v ) , H ( f s ) , H ( f v , f s ) , whichare then added and normalized as in Section 4.1.
The score iscapped to be in the range [0 , 1] .
To compute the cosine similarity score, we ﬁnd the absolute value of the dot product of corresponding representations for the two encoders (Equation 2).
These dot products are then averaged over all representations.
Evaluation of Metrics.
To evaluate the mutual information andthe cosine similarity scores, we conduct two sets of experimentsto verify if: (1) the scores are higher for stolen than independentencoders, and (2) the scores increase as more queries are used to steal encoders, which implies a higherquality of the stolen copies [14].
In Table 2, we observe that both our scores assign higher valuesto the stolen encoders than the independent encoders.
Table 3 shows that our mutual informationand cosine similarity scores increase while the p-values from our dataset inference decrease withrespect to the number of queries used to steal an encoder.
This implies that the performance of ourdefense is consistent with the similarity metrics and becomes more effective as the quality of thestolen encoder improves.
We also plot a histogram of the cosine similarity scores for the stolenand independent encoders in Figure 3 for an SVHN victim encoder, a stolen encoder from it (using CIFAR10 training data as the stealing dataset), and an independent encoder (trained on CIFAR100).
There is a pronounced difference between the two distributions with the scores for the independentencoder being close to 0 and the scores for the stolen encoder being much higher than 0 .
Robustness of Metrics to Obfuscations.
We also consider the effect of obfuscations on these metrics.
Without any obfuscation of the representations from stolen encoders, the cosine similarity scoreshows a clearer distinction between stolen and independent encoders than the mutual information
[Table]
The quality of the stolen encoders increases with more stealing queries, which is reﬂected by the rise in the mutual information and cosine similarity scores as well as the better performance of our defense as indicated by the decreasing p-values.
D P is the private dataset used to train the victim and
D S is the dataset used for stealing.
[Table]
score: in Table [Table]
the cosine similarity scores for all independent encoders are close to zero
[Table] but themutual information scores can be quite high (such as, 0 . 9 for the independent encoders of SVHN)
[Table] However, the mutual information score is robust to the obfuscations of the attackers while cosinesimilarity is not: in Table 2, the cosine similarity score for the stolen encoders after shufﬂing andpadding drops close to zero.
Mutual information, as a more general metric based on the informationmeasurement instead of the brittle structure of the representation vectors, performs better and isoblivious to the obfuscations that attackers might introduce.
Conclusions
New public APIs expose self-supervised encoder models which return high-dimensional embeddingsfor provided inputs.
Adversaries can use these embeddings to steal the encoders.
We present a novelmethod based on dataset inference for defending against such stealing attacks along with metricsto assess the quality of the stolen encoders and to quantify the effectiveness of our defense.
Weobserve that knowledge contained in the private training set is transferred from the victim encoder toits stolen copy.
Thus, the private data acts as a signature of the victim encoder.
By leveraging densityestimation on the respective encoders’ representations, we obtain a signal allowing us to differentiatebetween the encoder’s training and test data.
This difference is detectable in both the victim encoderand its stolen copy but not in independent encoders which are legitimately trained on different datathan the victim’s private training data.
Thus, we are able to ﬂag the stolen copy of the victim encoderwhile not accusing creators of legitimately trained encoders of theft.
We show the high effectivenessof our defense on vision encoders.
Future work may explore additional applications of our proposeddefense and metrics beyond model stealing and ownership veriﬁcation, as well as their use in otherdomains such as natural language processing (NLP).
In particular, our method may help enforce theethical usage of sensitive online data, such as images on social media, in accordance with privacyregulations by auditing if a given providers’ encoder contains knowledge of these sensitive data.