Are You Stealing My Model? Sample Correlation for Fingerprinting Deep Neural Networks
Anonymous Author(s)
AffiliationAddress email
Abstract
An off-the-shelf model as a commercial service could be stolen by model stealingattacks, posing great threats to the rights of the model owner.
Model fingerprintingaims to verify whether a suspect model is stolen from the victim model, whichgains more and more attention nowadays.
Previous methods always leveragethe transferable adversarial examples as the model fingerprint, which is sensitiveto adversarial defense or transfer learning scenarios.
To address this issue, weconsider the pairwise relationship between samples instead and propose a novelyet simple model stealing detection method based on SAmple Correlation (SAC).
Specifically, we present SAC-w that selects wrongly classified normal samples asmodel inputs and calculates the mean correlation among their model outputs.
Toreduce the training time, we further develop SAC-m that selects mixed samplesvia CutMix as model inputs, without the need for training the surrogate models orgenerating adversarial examples.
Extensive results validate that both SAC-w and
SAC-m successfully defend against various model stealing attacks, even includingadversarial training or transfer learning, and detect the stolen models with the bestperformance in terms of AUC across different datasets and model architectures.
Code is attached in the supplementary.
Introduction
Over the past years, Deep Neural Networks (DNNs) have played an important role in many criticalfields, e g., face recognition [1], medical diagnosis [2] and autonomous driving [3].
As a popularoption, the model owners always provide their models as a cloud service or a client-sided software tothe clients.
But, training a deep neural network is costly and involves expensive data collection andlarge computation resource consumption and thus, models trained for inference constitute valuableintellectual property and should be protected [4, 5].
However, model stealing attacks can steal thevaluable model with only API access to the model owner’s well-performed model (source model)
[6],causing serious threats to the model owner’s intellectual property (IP).
Model stealing attacks aim to illegally steal functionally equivalent copies of the source model withwhite-box or even black-box access to the model.
As for the white-box case, the attacker can accessall the inner parameters of the source model and evade the model owner’s detection by source modelmodification such as pruning [7, 8] or fine-tuning the source model.
By contrast, model extractionattack [9, 10] as a more powerful attack, has been proposed with the black-box access to the model.
That is to say, the model extraction attack only requires model outputs rather than the inner parametersto steal the function of the source model, and thus is more threatening.
As model stealing has raised considerable concerns about model ownership, an increasing numberof model IP protection methods have been proposed in the last years.
Generally, there are twocategories to validate and protect the source model’s IP, i.e., the watermarking methods [4, 11–18] and the fingerprinting methods [6, 19–22].
The watermarking methods use weight regularization[11–13] or backdoor inserting [4, 15, 16] during model training and leave the specific watermark inthe model.
However, they need to involve the model’s training procedure and sacrifice the model’sperformance on the main task.
A typical example is EWE [4] that witnesses a 4% classificationaccuracy drop on CIFAR10.
On the contrary, the fingerprinting methods make use of adversarialexamples’ transferability and identify the stolen models by adversarial examples’ attack success rateson the suspect model.
Since they do not involve in the training procedure, model fingerprinting doesnot influence the model’s accuracy.
Nevertheless, these adversarial example based fingerprintingmethods are still sensitive to adversarial training [23].
They also take up a large amount of timefor the model owner to train the surrogate models (models that the model owner trains using modelextraction by themselves) and generate adversarial examples.
In addition, with the changes in labelspace on transfer-learning, the adversarial examples’ target label disappears, meaning that they alsocan not identify model stealing attacks with transfer learning techniques [24].
As stated above, existing fingerprinting methods, leveraging the suspect model’s output as a pointwise indicator to detect the stolen models, are sensitive to adversarial training or transfer learning.
Toaddress this problem, we focus on the pair-wise relationship between the outputs and develop a newmethod called SAC.
Intuitively, samples with similar outputs in the source model are more likely toalso have similar outputs in the stolen models.
In particular, we employ the correlation differencebetween the source model and the suspect model as the indicator to detect the stolen model.
However,calculating correlation using all the samples from the defender’s dataset will be influenced by thecommon knowledge, on which most models will output the same label.
To avoid it, we leverage thenormal samples which are wrongly predicted by both the source and the surrogate models as themodel input and propose to fingerprint using sample correlation with wrongly predicted samples(SAC-w).
Furthermore, to reduce time consumption, we use CutMix augmented samples directlyto calculate the correlation difference (SAC-m), which does not need to train the surrogate modelsor generate adversarial examples.
To verify the effectiveness of SAC-w and SAC-m, we investigate5 types of attacks (i.e., fine-tuning, pruning, transfer learning, model extraction, and adversarialtraining), and compare the performance against these attacks across different model architectures anddatasets.
Our main contributions are summarized as follows:
• We introduce sample correlation into model IP protection, and propose to leverage the correlationdifference as the robust indicator to identify the model stealing attacks and provide a new insightinto model IP protection.•
We introduce the wrongly-predicted normal samples and CutMix samples to replace adversarialexamples as the model inputs, providing two robust correlation-based model fingerprinting methods.• Extensive results verify that both SAC-w and SAC-m identify different model stealing attacksacross different architectures and datasets with AUC = 1 in most cases, performing better thanprevious methods.
Besides, SAC-m only takes up 4.45 seconds on CIFAR10 dataset, greatlylowering the model owner’s computation burden.
Related Work
Model stealing attacks greatly threaten the rights of the model owner.
In general, we can summarizethem in several categories as follows: (1) Fine-tuning [25]: The attacker updates the parameters of thesource model using training data.
(2) Pruning [7, 8]: The attacker prunes less significant weights ofthe source model based on some indicators such as activation.
(3) Transfer learning [24]: The attackertransfers the source model to some similar tasks and makes use of the source model’s knowledge.
Model extraction [9, 10]: Because data labeling is costly and time-consuming, and there is a largeamount of unlabeled data on the Internet, the attacker can steal the function of the source model usingonly unlabeled same-distribution data.
Different from the above attacks which need access to theinner parameters of the model, the model extraction attack can steal the source model with only thesource model’s output.
(5) Adversarial training [23]: The attacker can train models with both normalexamples and adversarial examples, which help evade most fingerprinting detection.
Because of the threat of model stealing attacks, there are many model intellectual property (IP)protection methods has been proposed.
Generally, there are two main categories to validate and protectthe model IP, the watermarking methods and the fingerprinting methods.
Watermarking methods
[Figure]
usually leverage weight regularization [11–14] to put secret watermark in the model parametersor train models on triggered set to leave backdoor [15, 16] in them.
However, these methods cannot detect newer attacks such as model extraction which trains a stolen model from scratch [6, 10].
There are also some watermarking methods such as VEF [26], which can survive during the modelextraction.
However, VEF needs a white-box access to the suspect model, limiting the scope of itsapplication.
Also, they all need to involve the training process, which sacrifices the model’s accuracy[4, 17, 18], and in many critical domains, even 1% accuracy loss is intolerable [19].
Fingerprinting, on the contrary, utilizes transferability of the adversarial examples and can verifymodels’ ownership without participating in the models’ training process, guaranteeing no accuracyloss.
Lukas et al.
[6] proposes conferrable adversarial examples to maximize adversarial examples’transferability to stolen models and minimize transferability to independently trained models (irrelevant models).
Besides, ModelDiff [20], FUAP [21], DFA [22] leverage different kinds of adversarialexamples such as DeepFool [27] and UAP [28], to fingerprint the source model.
However, all thesemethods rely on adversarial examples and can be easily cleared out by adversarial defense such asadversarial training [23] or transfer learning.
Furthermore, these methods usually need to train lots ofsurrogate models and irrelevant models with different model architectures to form well-establishedfingerprints, causing a great computation burden for the model owner.
DeepJudge [29] proposes aunified framework to use different indicators to detect model stealing attacks in both the white-boxand the black-box setting.
Unlike previous methods, our method makes use of the correlation between samples rather than just the instance level difference in previous methods and can fingerprintmodels much faster and more robust with misclassified normal samples or CutMix samples instead ofadversarial examples.
Furthermore, different from Teacher Model Fingerprinting [30], which usesthe paired samples generated from the matching of the representation layers to detect the transferlearning attack, our method makes use of the correlation of independent samples and can detect morecategories of model stealing attacks.
Proposed Method
3.1 Problem Definition
There are two parties in the model IP protection, the defender and the attacker.
The defender is themodel owner, who trains a well-performed model with a (proprietary) training dataset and algorithm[19].
The defender can deploy their models as a cloud service or client-sided software.
In cloudservice setting, the attacker can only get the output of the model.
On the contrary, in client-sidedsoftware setting, the attacker can get access to all the inner parameters of the models.
The attacker’sgoal is to use their same-distribution data to derive a stolen model with similar accuracy to the sourcemodel but evade the defender’s detection.
The defender’s goal is to identify whether the suspectmodel is stolen from him.
Because the attacker may deploy their stolen model on cloud, our IPprotection is based on a black-box setting, where the defender can only get access to the output of thesuspect model and can not have the knowledge of the stolen model’s architecture or training dataset.
3.2 Sample Correlation for Neural Network Fingerprinting
Previous fingerprinting methods only consider the point-wise consistency between the source modeland the stolen model, and identify the stolen model by whether it classifies the same adversarialexamples into the same wrong classes as the source model.
However, they are not robust to adversarialtraining or transfer learning.
For robustly detecting the stolen models, instead of the point-wisecriteria, we focus on the pair-wise relationship between the outputs.
Intuitively, two samples withsimilar outputs in the source model are more likely to have similar outputs in the stolen models.
Thus,we introduce a correlation-based fingerprinting method SAC which makes use of the correlationconsistency mentioned above to recognize the stolen models.
Furthermore, to get rid of the influenceof common knowledge shared by irrelevant models, we study how to find suitable samples in Section3.3.
An overview of our framework is shown in Figure 1.
Then, we introduce how to use sample correlation [31] as the model fingerprint, let O source ={ o source, o source, · · · , o sourcen } and O stolen = { o stolen, o stolen, · · · , o stolenn } be the set of the outputs for the source and stolen models, where o sourcek and o stolenk represent the output of the sourcemodel and stolen model for the k - th input sample.
Then we can calculate the correlation matrixbetween all n input samples and get a model-specific correlation matrix C as follows:
C =
Φ( O ) , C ∈ R n × n where C i,j = corr
( o i , o j ) i, j = 1 , · · · , n, (1) where C i,j represents the i, j entry of the correlation matrix C , which can be calculated by thecorrelation between the i - th and j - th output of the model and Φ is the function of calculating thecorrelation matrix from the output set.
To capture the complex correlations between the model’soutputs, we introduce several functions to estimate the outputs’ relationship: First is cosine similarity[32].
Cosine similarity is measured by the cosine of the angle between two vectors, expressed as:
[Equation]
Another method for measuring outputs’ correlation is Gaussian RBF [33].
Gaussian RBF is a popularkernel function, measuring two instances’ distance based on their euclidean distances:
[Equation]
After calculating the correlation matrix for both the source model and the suspect model, we calculatethe L1 distance between them and use it as our fingerprinting indicator, any model’s distance to thesource model smaller than a threshold d will be regarded as a stolen model:
[Equation]
where C stolen and C source represent the correlation matrix of the stolen model and the source model.
Furthermore, there is a more strict situation in which the defender can only get access to the suspectmodel’s predicted label but not the output probability.
Facing this, we propose to use the predictedlabel to form a smooth-label probability.
Smooth-label probability, as the soft form of the predictedlabel, has a similar form to the teacher’s output and can replace the teacher’s output in knowledgedistillation [34].
In our fingerprinting method, we generate the smooth-label probability as follows:
[Equation]
where p ( x ) is the smooth-label probability of the model input x , δ ( x ) =
[0 , 0 , · · · , 1 , · · · , 0] is theone-hot encoding for the predicted label, and u(x) is a uniform distribution.
More similar to themodel’s output probability, the smooth label performs better in model fingerprinting.
3.3 How to Find Suitable Samples?
Fingerprinting with Misclassified Normal Samples.
Using the correlation matrix mentionedabove, our fingerprinting method can robustly and efficiently identify model stealing attacks.
Meanwhile, we also need suitable samples as model input to help fingerprint.
All the previous fingerprintingmethods use transferable adversarial examples to identify stolen models, but they are not robust toadversarial defense and can easily be cleared out by adversarial training.
In fact, the attacker can evade detection by fine-tuning the extracted model only several epochs with same-distribution dataand source model’s predicted label in an adversarial training way, expressed as follows:
[Equation]
where f stolen and f source represent the stolen and the source model, δ represents adversarial noisesmaller than the bound ϵ , which is generated by the stolen model using methods such as FGSM[35]or PGD[23] and θ stolen represents the stolen model’s parameters.
To solve the above problem, wepropose to use the defender’s training samples directly as the fingerprinting samples.
Because thereare hundreds or thousands of samples misclassified by the source model in the defender’s dataset, wecan use them as fingerprinting samples.
The defender first uses the source model as the teacher totrain several surrogate models by knowledge distillation [36].
Then the defender finds out the samplesthat both the source and the surrogate models predict wrongly and forms a hard sample dataset D :
[Equation]
where x 1 · · · x n are all from the defender’s dataset, f i represents the source and the surrogate modelswhose total number is m , and label k is the ground truth label for x k .
Fingerprinting with CutMix Samples.
SAC-w can robustly and accurately identify whether thesuspect models are stolen from the source models, but it can be further improved.
In some cases, thedefender can not have enough normal samples to form the misclassified sample dataset.
Besides,although SAC-w only needs to train much fewer surrogate models than CAE [6], it still consumessome computation resources of the defender.
Therefore we propose to use CutMix [37] to augmentdata, and use the CutMix samples as the model’s input.
CutMix is a data augmentation method whichis used in model training procedure and can promote models’ accuracy.
CutMix generates a newtraining sample (˜ x, ˜ y ) using two training samples ( x 0 , y 0 ) and ( x 1 , y 1 ) by cutting off and pastingpatches among them:
[Equation]
where M ∈ { 0 , 1 } W × H represents the binary mask to combine images in different part of images, ⊙represents an element-wise multiplication and α ∈ (0 , 1) is a combination ratio.
After CutMix, weuse random flip on mixed samples to augment data further.
Using CutMix method mentioned above,we randomly select images (dozens are enough) from the defender’s dataset and mix them up to forma larger detection dataset.
On one hand, CutMix increases the number of images, decreasing thenumber of normal samples needed by the defender.
On the other hand, mixing up and image flippinggenerates harder samples.
Because most models will agree on the same ground-truth label on normalsamples, much harder CutMix samples magnify the difference between two independent modelsand lower the influence of common knowledge across models.
Besides, the correlation similaritybetween the source and the stolen model still holds up on these data augmented samples.
Thus, wecan leverage the CutMix samples’ correlation metric consistency and recognize the suspect modelsrobustly and efficiently with only dozens of normal samples from the defender’s dataset.
Experiments4.1 Setup
In this section, we evaluate different model intellectual property (IP) protection methods against different model stealing attacks on different datasets and model architectures, validating the effectivenessof our SAC-w and SAC-m methods.
We evaluate different IP protection methods against the following five categories of stealing attacks:
• Fine-tuning.
In general, there are two common fine-tuning methods.
One is fine-tune the lastlayer (Finetune-L), which only fine-tunes the last layer and leaves the other layers unchanged.
Theother is fine-tune all the layers (Finetune-A), which fine-tunes all the layers in the model.
In ourexperiments, we assume the attacker fine-tune the source model for 30 epochs with SGD optimizer. • Pruning.
In our experiments, we leverage Fine Pruning [7] as our pruning methods.
Fine Pruning, as a common backdoor defense method, prunes neurons according to their activation.
[Table]
Transfer
[Table]
• Transfer Learning.
The attacker may transfer the source model to another related task and makeuse of the source model’s knowledge.
We transfer both the CIFAR10 [38] model and the TinyImageNet [39] model to other tasks and find out whether the fingerprinting methods can recognize.
We transfer the CIFAR10 model to CIFAR10-C [40] and CIFAR100 dataset, of which we choosethe front ten labels.
Furthermore, we transfer Tiny-ImageNet model (trained with the front 100labels in Tiny-ImageNet) to the 100 labels left behind in Tiny-ImageNet dataset.• Model Extraction.
Generally, there are two categories of model extraction, the probability-basedmodel extraction, and the label-based model extraction.
Label-based model extraction [9, 10]can only leverage the defender’s predicted label to steal the knowledge of the source model andthe loss function can be expressed as L = CE ( f stolen ( x ) , l source ) , where l source represents thelabel predicted by the source model and CE ( · ) represents the cross entropy loss.
As for theprobability-based model extraction [9, 41, 42], the attacker have access to the output probabilityand use it to train their stolen model: [Equation] , l source )
[Equation]
where f Tstolen ( x ) and f Tsource ( x ) represent the soft output of the stolen and source models, calculated by f T ( x ) = softmax ( f ( x ) T ) , where T represents the temperature, and KL ( · ) represents theKL divergence.•
Adversarial Model Extraction.
Similar to the adaptive model extraction in CAE [6], the attackercan evade the fingerprinting detection by applying adversarial training after the label-based modelextraction.
But different from the adaptive model extraction, which uses the ground-truth label, wepropose that the attacker can achieve the same goal with just the source models’ predicted label inEquation 6.
Thus, the attacker can leverage adversarial extraction with the same setting as simplemodel extraction and evade existing adversarial example based fingerprinting methods easily.
Model Architecture.
We evaluate different IP protection methods on most of the common modelarchitectures.
All the extraction models and irrelevant models are trained on VGG [43], ResNet [44],DenseNet [45] and MobielNet [46].
Specifically, We use a VGG16 model as the source model and allthe irrelevant and stolen models are trained on VGG13, ResNet18, DenseNet121, and MobileNet-v2.Moreover, for every attack and irrelevant model, we train 20 models to avoid contingency.
Model IP Protection Methods.
To
validate our method’s effectiveness we compare it with several
existing
methods
, including
IPGuard [19]
CAE [6] and
EWE
IPGuard and CAE leverage the
transferability of adversarial examples and test these adversarial examples’ attack success rate on the suspect models.
Any model’s attack success rate larger than a threshold will be recognized
asa
stolen model.
In our experiments, we choose ϵ = 0 .
08 as the max L ∞ norm boundary for the adversarial noise in both IPGuard and CAE to maximize their performance and robustness against adversarial training. EWE , on the contrary
trains the source model on backdoor data [47] and leavesthe watermark in the model.
Utilizing soft nearest neighbor loss to entangle the watermark data andthe training data, EWE tries to increase the transferability of the watermark against model extraction.
Datasets.
To validate different fingerprinting methods’ effectiveness and robustness, we conductexperiments on different datasets.
Same as previous works, we split the training dataset into twosame-size parts D defender and D attacker , which the defender and the attacker own respectively.
Because the number of samples for one label in Tiny-ImageNet is only 250 and the average accuracyis only 40% , we choose the front 100 labels to form a smaller dataset.
Evaluation Metrics.
To evaluate the effectiveness of different fingerprinting methods, same as
CAE[6], we leverage AUC-ROC curve [48] and use AUC value between the fingerprinting scores ofthe irrelevant models and the stolen models to measure the fingerprinting effectiveness.
ROC is aprobability curve, which is plotted with True Positive Rate and False Positive Rate.
AUC representsthe area under ROC curve (max is 1 ) and a larger AUC represents a better fingerprinting method.
Furthermore, to better depict the influence of model architectures and initialization on fingerprinting,we introduce the fingerprinting score (Score) to represent the indicator that different methods use todistinguish the suspect models.
To be specific, the Score represents the attack success rate in IPGuard,
CAE, and EWE, and represents the correlation difference between the suspect model and the sourcemodel in SAC-w and SAC-m. A score with a smaller variance represents the fingerprinting method ismore robust across different model architectures.
[Table]
4.2 Fingerprinting against Different Attacks
Tables 1 and 2 demonstrate different fingerprinting methods against different model stealing attackson CIFAR10 and Tiny-ImageNet.
Finetune-A and Finetune-L represent fine-tuning the sourcemodel on all the layers and the last layer, and Extract-L , Extract-P and Extract-Adv representthe three settings of the model extraction, label-based model extraction, probability-based modelextraction and adversarial model extraction.
Besides, Irrelevant-10C and Irrelevant-New representmodels trained on CIFAR10C and a new dataset from scratch, and Transfer-A and Transfer-Lrepresent transferring the source model to a new dataset by fine-tuning all the layers or the lastlayer.
Tables 1 and 2 illustrate the effectiveness and robustness of our SAC-w and SAC-m. In mostsituations, our method has a better AUC than other model IP protection methods.
Furthermore,to demonstrate our methods’ effectiveness across different source model architectures or datasets,we conduct experiments with the ResNet source model and on several common datasets, including
CIFAR100 and FashionMNIST, which are shown in the supplementary material
[Table] [Table] When facing adversarial extraction, adversarial example based method IPGuard and CAE’s AUCdeclines sharply to near 0 .
5 , which is also illustrated in [6], and AUC = 0 .
5 represents a randomguess.
Furthermore, our experiments demonstrate that EWE is sensitive to pruning, although its AUCdecline is smaller than other normal backdoor-based watermark methods.
On the contrary, our twomethods SAC-w and SAC-m have the best detection performance when facing most model stealingattacks.
Furthermore, the Score of the stolen models used by our methods have a much smallervariance than other three methods.
Because the attack success rate of the adversarial examples ormodel watermark will be influenced by the robustness of the model, models with a more robustarchitecture or after adversarial training, which even is stolen from the source model, may have alower attack success rate than the irrelevant models.
On the contrary, correlation difference is notrelated to the robustness of the model architectures and can better detect the stolen model acrossdifferent model architectures.
Furthermore, because all the other three methods use the attack successrate as the only identification criteria, when facing transfer learning or label changing, they are notable to identify the stolen models.
On the contrary, our methods use the correlation difference as thefingerprint and the correlation consistency holds up when the models are transferred to another task.
[Table]
Table 3 illustrates the average accuracy of the source and stolen models, demonstrating that mostof the model stealing attacks are able to steal the source model with only a small accuracy decline.
Furthermore, we also take the situation that the defender can only access the defender’s predictedlabel into account.
Table 4 demonstrates that even only with the predicted label, our correlation-basedmethod recognizes the stolen models effectively and robustly, where smooth-label represents thesituation that only the predicted label is available and probability represents the output probabilityis available.
FT , Ex , and Trans are abbreviation for Finetune , Extract and Transfer .
Only withpredicted label, SAC can also succeed in two hard tasks, adversarial extraction, and Transfer-L. SACfails in Transfer-A when there is only the hard label available and it is because of the larger featurelayers’ change in Transfer-A, compared with Transfer-L.
4.3 Influence of Fingerprinting on the Defender
When the defender wants to fingerprint or watermark a model, there will always be some sacrifice,such as a larger time consumption or some accuracy decline in the source models.
Table 5 demonstrates different IP protection methods’ time consumption and influence on the source model.
First,we focus on the accuracy decline, and only EWE causes the source model’s accuracy to decline.
Because model fingerprinting methods, including IPGuard, CAE, SAC-w, and SAC-m, do not involvein the source model’s training procedure, there is no accuracy loss.
On the contrary, EWE needs totrain the source model on the watermark data, leading to an accuracy decline, i.e. 4 . 0% and 14 .
8%accuracy decline on CIFAR10 and Tiny-ImageNet, respectively.
As for the time consumption, CAEconsumes several hours to train surrogate models and form adversarial examples, causing a greatcomputation burden for the defenders.
Moreover, on a larger dataset such as ImageNet, CAE mayeven take up several days to form the fingerprint.
On the contrary, our SAC-m method costs only4.45 seconds to form our fingerprint, which is 5,738 faster than the CAE method.
4.4 Ablation Study
In this subsection, we will take the input samples’ choice, correlation’s choice, and correlationfunction into consideration to validate our SAC-w and SAC-m’s effectiveness.
In Table 6, SACnormal represents fingerprinting correlation with normal samples from the defender’s dataset, SAC-
[Table] [Table]
[Table]
source represents fingerprinting correlation with source extracted model’s misclassified samplesand Prediction-mix represents the defender use the number of wrong predictions on the CutMixsamples as the fingerprinting criteria.
Table 6 illustrates SAC-m is not only more effective thanfingerprinting with normal samples or source model’s misclassified samples, but also declines theneed for samples from the defender’s dataset.
Our experiments demonstrate that only with 50 normalsamples, SAC-m fingerprints the source model accurately.
Furthermore, Prediction-mix in Table6 demonstrates just using the CutMix augmented samples, which we choose misclassified by boththe source and the surrogate models, to replace the adversarial examples in IPGuard or CAE isineffective.
It demonstrates that fingerprinting with correlation matrix, compared with the wrongprediction used in IPGuard and CAE, is more robust and effective.
Moreover, we also consider thedifferent correlation function’s influence on the model fingerprinting.
Table 7 illustrates that boththe Gaussian RBF kernel and cosine similarity fingerprint the source model successfully.
Becausethe correlation using cosine similarity has a larger gap between the irrelevant models and the stolenmodels, we choose the cosine similarity as our correlation function in the above experiments.
Conclusion and Limitation
In this paper, we propose a correlation-based fingerprinting framework to detect different modelstealing attacks.
Different from previous adversarial example based fingerprinting methods, ourmethods SAC-w and SAC-m make use of misclassified normal samples or CutMix samples asthe model input and calculate the correlation difference as the indicator to recognize the stolemodels without involving in the model’s training procedure.
SAC-w and SAC-m achieve the bestmodel stealing attack detection performance, with AUC = 1 in most cases, across different modelarchitectures and datasets.
Furthermore, SAC-w and SAC-m can identify the model stealing attackswith adversarial training or transfer learning techniques, which can not be detected by previousfingerprinting methods.
Moreover, SAC-m does not need to train the surrogate models or generateadversarial examples, and thus, is much faster than other fingerprinting methods (5,738 faster than
CAE).
Although SAC-m is robust to adversarial extraction (training), SAC-m still performs a littleworse than SAC-w and we leave finding for a better data augmentation method to future work.
Broader Impact
SAC, as a model IP protection method, will help both academia and industry to protect their model’sintellectual property.
However, on the other hand, the protection of the model owner’s rights maypromote the development of machine learning as a service, and potentially bring social unemployment.
Checklist
For all authors...
(a) Do the main claims made in the abstract and introduction accurately reflect the paper’s
contributions and scope?
[Yes]
(b) Did you describe the limitations of your work?
[Yes] See Section 5.
(c) Did you discuss any potential negative societal impacts of your work?
[Yes] SeeSection 6.(d) Have you read the ethics review guidelines and ensured that your paper conforms tothem?
[Yes]2.
If you are including theoretical results...
(a) Did you state the full set of assumptions of all theoretical results?
[N/A]
(b) Did you include complete proofs of all theoretical results?
[N/A]
If you ran experiments...
(a) Did you include the code, data, and instructions needed to reproduce the main experi-
mental results (either in the supplemental material or as a URL)?
[Yes] The code, data,and instructions are provided in supplementary material.
(b) Did you specify all the training details (e.g., data splits, hyperparameters, how theywere chosen)?
[Yes] See Section 4.1 and Appendix.(c)
Did you report error bars (e.g., with respect to the random seed after running experiments multiple times)?
[Yes] See Section 4.2.(d)
Did you include the total amount of compute and the type of resources used (e.g., typeof GPUs, internal cluster, or cloud provider)?
[Yes] See Appendix.4.
If you are using existing assets (e.g., code, data, models) or curating/releasing new assets...
(a) If your work uses existing assets, did you cite the creators?
[Yes] We use severalexisting datasets, and cite in Section 4.1. [Table]
(b) Did you mention the license of the assets?
[Yes] See Appendix.
[Table]
(c) Did you include any new assets either in the supplemental material or as a URL?
[Yes] [Table] The code is provided in the supplemental material. [Table]
(d) Did you discuss whether and how consent was obtained from people whose data you’re
[Table]
using/curating?
[Yes] All datasets used in this paper are all open-source datasets.
[Table]
(e) Did you discuss whether the data you are using/curating contains personally identifi-
[Table]
able information or offensive content?
[N/A]
There is no identifiable information or
[Table]
offensive content in the datasets.
[Table]
If you used crowdsourcing or conducted research with human subjects...
[Table] (a) Did you include the full text of instructions given to participants and screenshots, if
[Table]
applicable?
[N/A] [Table] (b) Did you describe any potential participant risks, with links to Institutional Review [Table]
Board (IRB) approvals, if applicable? [N/A] [Table] (c) Did you include the estimated hourly wage paid to participants and the total amount
[Table]
spent on participant compensation?
[N/A]
[Table]