Dataset Inference for Self-Supervised Models
Anonymous Author(s)
AfﬁliationAddress email
Abstract
Self-supervised models are increasingly prevalent in machine learning (ML) sincethey reduce the need for expensively labeled data.
Because of their versatility indownstream applications, they are increasingly used as a service exposed via public
APIs.
At the same time, these encoder models are particularly vulnerable to modelstealing attacks due to the high dimensionality of vector representations they output.
Yet, encoders remain undefended: existing mitigation strategies for stealing attacksfocus on supervised learning.
We introduce a new dataset inference defense, whichuses the private training set of the victim encoder model to attribute its ownershipin the event of stealing.
The intuition is that the log-likelihood of an encoder’soutput representations is higher on the victim’s training data than on test data if itis stolen from the victim, but not if it is independently trained.
We compute thislog-likelihood using density estimation models.
As part of our evaluation, we alsopropose to measure the ﬁdelity of stolen encoders without involving downstreamtasks and to quantify the effectiveness of the theft detection; instead, we leveragemutual information and distance measurements.
Our extensive empirical results inthe vision domain demonstrate that dataset inference is a promising direction fordefending self-supervised models against model stealing.
Introduction
The self-supervised learning (SSL) paradigm enables pre-training models with unlabeled data to learngenerally useful domain knowledge and then transfer the knowledge to solve speciﬁc downstream tasks.
The ability to learn from unlabeled data alleviates the high costs of labeling large datasets [24],and the transfer learning setup reduces the computational costs of retraining.
These advantages havemade SSL increasingly popular [20] in domains like vision [5], language [12] and bioinformatics [29].
Recently, commercial service providers like Cohere [1] and OpenAI [2]began offering paid queryaccess to trained SSL encoders over public APIs.
This exposes the encoders to black-box extractionattacks, i e., model stealing.
In a model stealing attack, an attacker aims to train an approximatecopy of a victim model by submitting carefully chosen queries and observing the victim’s outputs.
The high costs of data collection, preprocessing and model training make encoders valuable targetsfor stealing.
For example, the training data of CLIP includes 400 million image and text pairs [36],while computation costs of training a large language model can exceed one million USD [41].
Thethreat of model stealing in SSL is real: researchers have demonstrated that encoders can be stolen at afraction of the victim’s training cost [14, 39].
Yet, most current defenses are designed for supervisedmodels [15, 23, 35] and cannot be directly applied to encoders [14].
Dataset inference [31] is a state-of-the-art defense against model stealing in the supervised learningsetting.
The defense provides ownership resolution: it enables the model owner to make a strongstatistical claim that a given model is a stolen copy of their own model by showing that this modelis derivative of their own private training data.
Dataset inference does not require retraining oroverﬁtting the model to any form of explicit watermark has been shown to resist attacks from
Test
[Figure]
adaptive adversaries [31].
These properties make the defense particularly attractive for SSL, as largeencoders can be expensive to retrain, and performance is paramount because it carries over to alldownstream tasks.
However, the original dataset inference algorithm from [31] cannot be appliedto encoders, because it relies on computing distances between data points and decision boundaries.
These decision boundaries do not exist in encoders since they are trained on unlabeled data.
We introduce a new dataset inference method (Figure 1) to defend against model stealing for encoders.
Our algorithm is suitable for the high-dimensional outputs of SSL encoders and does not rely onlabeled data or decision boundaries.
Instead, it relies solely on the private training data of the victimencoder as a signature.
Moreover, our algorithm retains the advantages of dataset inference forsupervised models [31], namely, it does not require retraining or overﬁtting the model.
Our key intuition is to identify stolen encoders by characterizing differences between an encoder’srepresentations on its training data vs on unseen test data.
The victim encoder and its derivatives,such as stolen copies, exhibit different behavior on the victim’s private training data than on testdata; independently trained encoders do not.
These differences exist because encoders overﬁt totraining data [18, 30].
Although for well-trained encoders the effect is minimal on any given datapoint, we show that when aggregated over many training points it provides a statistically strongsignal.
To identify the differences, we train a Gaussian Mixture Model (GMM), as an efﬁcient generalapproximator,to model the distribution of an encoder’s representations of data from its trainingdomain.
We then use the GMMs to predict the log-likelihood of the encoders’ representations of thevictim’s training set and a test set; derivatives of the victim encoder will have a higher log-likelihoodon the training set than on the test set.
We perform experiments on ﬁve datasets from the visiondomain and show that we are able to distinguish between stolen and independent encoders even incases when adversaries obfuscate the representations from the stolen encoders to hide the theft ( e.g.,by shufﬂing the elements in the representation vectors).
As part of our evaluation, we also introduce new metrics to measure the ﬁdelity of stolen encoderswithout involving downstream tasks and to quantify the effectiveness of theft detection.
We computescores directly on the representations using tools from information theory and distance metrics.
Thesemethods work well because losses used for stealing encoders directly minimize distances betweenrepresentations of victim and stolen encoders.
Our mutual information score to assess the quality ofthe stolen encoders is robust against obfuscations that an adversary might apply to the representationsreturned by a stolen encoder.
Without any obfuscation, our cosine similarity score shows a clearerdistinction between stolen and independent encoders.
Finally, using these metrics, we observe that thehigher the quality of the stolen encoders, the more conﬁdent our dataset inference defense becomes.
Our main contributions are as follows:
• We propose a new defense against model stealing attacks on encoders, by combining datasetinference with density estimation models for ownership resolution on unlabeled data.
• We are the ﬁrst to design new metrics that quantify the quality of stolen encoders, which are derivedfrom the mutual information and distances between representations.•
We evaluate our defense using ﬁve datasets from the computer vision domain and show that our
defense can successfully identify stolen encoders with a strong statistical signiﬁcance.
In model stealing, an adversary queries the victim model, obtains outputs, and uses them to recreate acopy of the victim [42].
This is most commonly performed with black-box access, e.g., via a public
API.
When stealing encoders in SSL, the goal of an adversary is to extract high-quality embeddingseither to train a stolen copy that achieves high performance on downstream tasks, or to obtain faithfulreplicas of the victim’s embeddings on the same inputs.
Stolen encoders might be further used formodel reselling, backdoor attacks, or membership inference [9].
While most past research on model stealing and defenses focuses on classiﬁers trained via supervisedlearning, recent work constructed new attacks that target encoders [14, 39].
The main differencesbetween the attacks in these settings are that the outputs of encoders leak more information dueto their higher dimensionalities [39], and the attacks require different loss functions.
Inspired bycontrastive learning, Cont-Steal [39] provides a method of stealing encoders using a loss functionbased on InfoNCE [5].
SSL extraction [14]—a general Siamese-network-based framework forstealing encoders—leverages losses including mean squared error, InfoNCE, Soft Nearest Neighbor,and Wasserstein distance.
The authors empirically show that an adversary can steal an ImageNetvictim encoder in less than a ﬁfth of the queries required for training.
Proof of Learning (PoL) [22] is a reactive defense that involves the defender claiming ownership of amodel by showing incremental updates of the model training.
It is a complementary method to datasetinference, which instead identiﬁes a stolen model.
PoL could be applied directly to SSL encoders,however, it requires an expensive veriﬁcation process, where the veriﬁer needs to perform modelupdates and the prover needs to save intermediate weights of the model, which is more expensivethan dataset inference with GMMs.
Unfortunately, other current defenses against model stealing forsupervised learning are inadequate for defending encoders, and adjusting them to the speciﬁcitiesof encoders is non-trivial [14].
One line of approach is watermarking [9, 14], where the defenderembeds a secret trigger into the victim encoder during training to determine ownership at test time.
However, watermarking-based defenses have two signiﬁcant disadvantages.
First, researchers haverepeatedly shown that adaptive attackers can remove watermarks without severely affecting modelperformance [7, 21, 40, 44], e.g., through pruning, ﬁne-tuning, rounding or performing backdoorremoval [4].
Second, the watermark must be embedded during training; if a model is already trained,or if a watermark defense needs to be updated, the model must be retrained.
This is not practical forlarge encoders.
Another state-of-the-art defense against model stealing in the supervised setting is dataset inference [31] which addresses these disadvantages.
However, the adaptation of dataset inference toencoders is difﬁcult, because (1) the algorithm [31] relies on decision boundaries, which do not existfor encoders; and (2) encoders are less prone to overﬁtting, which provides the signal for datasetinference [14, 31].
Therefore, naive approaches like computing the loss of representations or distancesbetween train and test sets are ineffective [14].
To overcome these issues, we extract more signalsfrom the representations by estimating their densities for train and test sets, as described in Section 3.
When it comes to comparing signals within representations, prior work has considered measuring thesimilarity between different representations.
This has led to the proposal of various similarity metricsincluding canonical correlation analysis (CCA) [33], centered kernel alignment (CKA) [25], and theorthogonal Procrustes distance [13], which use methods from linear regression, principal componentanalysis (PCA), and singular value decomposition (SVD).
However, these metrics are very generaland complex.
They have also been shown to disagree in some cases [13].
Since we can only accessthe ﬁnal embeddings from encoders, we design metrics more closely related to our setting.
Defense Method
Dataset inference serves as a defense against model stealing.
It enables the model owner or athird-party arbitrator to attribute the ownership of a model in the event that it is stolen.
The ideais to take advantage of the effects of knowledge from the victim’s training set and to use that asa signature for attributing ownership.
Given a well-trained encoder, the effects are small on anysingle data point; however, when aggregated over many points in the training set, they collectivelyprovide a strong statistical signal for dataset inference.
As depicted in Figure 2, for a victim thatleverages the private data D P during training or a stolen copy, we can identify a difference between
[Figure]
(cid:1830) (cid:3015) (cid:1830) (cid:3017) (cid:1830) (cid:1860) (cid:3005) (cid:3265) (cid:1860) (cid:3005) (cid:3263) (cid:1860) (cid:3005) (cid:3265) (cid:1860) (cid:3005) (cid:3263)
Independent (cid:1858) (cid:3036) distributions of the train data’s representations
P and thetest data’s representations h D N while the distributions of theserepresentations from an independent encoder cannot be distinguished.
We use this signal to determine whether a modelis derivative of the victim’s training data, i.e., either directlytrained on the data or stolen from the victim.
To capture the signal, we ﬁrst partition the victim encoder’s training data into twosubsets and use one to train Gaussian Mixture Models (GMMs)with the aim of modeling the distribution of representations ofdata from the encoder’s domain.
Then, we apply the GMMsto perform dataset inference by measuring the log-likelihoodof the encoder’s representations of the remaining training datavs some test data (see Figure 1).
For the victim encoder or itsstolen copies, the log-likelihood of training data representationsis signiﬁcantly higher than the one of test data.
We use this toconstruct statistical t-tests to determine whether a model is stolen, and present our empirical resultsin Section 5.
3.1 Threat Model
As described in Figure 7, we consider a victim encoder f v trained on a private training dataset D P .
An adversary with black-box access to f v trains a stolen encoder f s by querying the victim with datapoints from a dataset D S to obtain representations.
These representations are then used as part ofthe training objective for the stolen encoder.
During the dataset inference, we assume the presenceof a third-party arbitrator, such as law enforcement, with white-box access to the victim’s trainingdata, as well as all encoders.
Additionally, the arbitrator requires the test dataset D N from the samedistribution as D P to perform dataset inference.
An independent encoder f
i is trained with no accessto the victim’s private training set D P and without any queries to the victim’s encoder.
It is used as abaseline for the ownership resolution in the dataset inference.
3.2 Density Estimation of Representations
Representations from encoders contain rich features for given inputs.
We analyze the inputs thatcome from the training and test sets through their representations.
For the training inputs, we computetheir representations and model their densities [16].
To this end, we leverage GMMs as universalapproximators of densities.
We give representations a probabilistic interpretation such that they havea smooth enough density which can be approximated by any speciﬁc nonzero amount of error usinga GMM with enough components.
Each component has a separately parameterized mean µ andcovariance ⌃ .
We observe that GMMs can overﬁt to their training data when no constraints are appliedto the covariance matrix, hence we limit the covariance matrix for each component to be diagonal.
Components with diagonal covariance matrices act together to model feature density even whenfeatures are in fact correlated [37].
Moreover, this constraint makes training more computationallyefﬁcient since it avoids storing and inverting full high-dimensional covariance matrices.
3.3 Data Flow
The full ﬂow of our dataset inference for encoders consists of the following four main steps (whichare also visualized in Figure 7 in Appendix):
Victim Training.
The victim’s encoder f v is trained using the whole private training dataset D P .
Encoder Stealing.
To steal the victim encoder f v , an adversary queries f v with data points
from D S to obtain representations h D S 2 R n : h D S
= f v ( D S ) .
With these representations, the
adversary trains the stolen encoder f s in a contrastive manner.
Training Estimators.
To perform ownership resolution, an arbitrator trains three density estima-
tors E v , E s and E i for the victim f v , stolen f s , and independent encoder f
i as follows:
a) D P is divided into two non-overlapping subsets D P 1 and D P 2 .
While D P 2 serves as the base
for training the density estimators, D P 1 is used to evaluate density estimates of the private
training data vs the test data D N .
b) For a given encoder f 2 { f v , f s , f i } , the arbitrator generates representations h 2 R n :
h D P 2 = f
( D P 2 ) on dataset D P 2 .
Training the density estimators on the respective represen-
tations yields the ﬁnal density estimators E v , E s , and E i .
Estimating Densities.
The arbitrator generates representations of D P 1 and D N with each encoder
f 2 { f v , f s , f i } .
Applying the respective density estimator E 2 {E v , E s , E i } on the representations
yields the log-likelihood of each data point x in the respective dataset: 8 x 2 D : p ( x ) =
E ( f ( x ))
3.4 Ownership Resolution
For an encoder f , we compute the log-likelihood on D P 1 and D N as: u P :=
| D P 1 |
P x 2 D P 1 E ( f ( x ))and u N := | D N |
P x 2 D N E ( f ( x )) .
The density estimator E measures the similarity between thedistributions over the victim’s representations of the training D P vs test data D N .
The intuitionbehind the setup is that if an encoder was trained on D P , representations of D P 1 are much moresimilar to representations of D P 2 , because the whole dataset D P was used for training the encoder,however, representations of D N differ from representation of D P 2 since D N was not used to trainthe encoder.
For a victim f v and a stolen encoder f s , u P is signiﬁcantly larger than u N , whereas, foran independent encoder f
i , the values do not differ signiﬁcantly.
Finally, we carry out a hypothesistest with the null hypothesis being: H 0 :=
u P  u N .
If the null-hypothesis can be rejected (p-value< 0 . 05 ), i.e., when the log-likelihood for the training set D P 1 is higher than that for the test set D N ,we can conclude that the tested model was stolen.
On the other hand, if the null hypothesis cannot berejected then the test is inconclusive and we cannot determine if a tested encoder was stolen or not.
Encoder Similarity Scores
Measuring the quality of stolen encoders allows us to assess attacks and defenses.
In standardsupervised learning, the quality of a stolen model is evaluated using two main objectives, namely taskaccuracy, which is the model’s performance on the test set, and ﬁdelity, which is the agreement in thepredictions for a given task between the stolen and the victim model [19].
One of the approachesto measure the quality of an extracted encoder is to use its outputs to train a downstream task andcompute the accuracy on that task or ﬁdelity (with respect to the outputs of the downstream tasktrained on the victim encoder).
However, a single downstream task cannot adequately reﬂectthe degree of similarity between encoders since it reduces their high dimensional embeddings tosingle label representations, which are confounded by choices of downstream data and trainingprotocol.
Instead, we propose two new metrics.
Our ﬁrst metric is an information-theoretic scorebased on mutual information [10, 27].
Our second metric is a cosine similarity score based on therepresentations returned by different encoders.
These metrics correspond to the ﬁdelity metric insupervised learning.
The behavior of the two metrics differs in certain cases, for example, when usedon obfuscated representations ( e.g., with shufﬂed elements) or with independent models, however,we ﬁnd that the overall trend is similar.
Moreover, the mutual information score is based on anapproximation while the cosine similarity score is calculated exactly given representation vectors.
Often the effectiveness of defenses may be underestimated against low-quality stolen copies thathaven’t successfully stolen victim behavior.
Our metrics help disentangle such effects and enablefaithful evaluation of defenses.
4.1 Mutual Information Score
Our ﬁrst approach to assessing the quality of a stolen encoder uses a score based on mutual information.
We sample N data points from the victim’s private training dataset D P and pass them through theencoders f v , f s , and f i to generate the respective representations.
Per standard practice, we recenterand normalize the representations [13].
We denote the entropy by H and compute it accordingto Algorithm 2 which takes f v , D P , and N as input.
For the joint entropy H ( f v , f s | D ) , wegenerate representations from the two encoders (in this case victim f v and stolen f s ) and concatenatethem, which increases the dimensionality of the ﬁnal representation to 2 d , while other steps remainunchanged.
A detailed algorithm for computing the joint entropy can be found in the Appendix as
Algorithm 3.
We compute an approximate score that is based on the deﬁnition of mutual information
I ( f v , f s | D P ) between the victim encoder f v and the stolen copy f s as well as the analogous mutualinformation
I ( f v , f i | D P ) between the victim encoder f v and the independently trained encoder f i .
We rely on approximations since we measure mutual information using ﬁnite data.
Yet, in practice,such approximations have proven useful [32].
We deﬁne our mutual information score as follows:
[Equation]
A higher value of the mutual information I ( f v , f s | D P ) indicates a higher information leakageincurred by the stolen encoder.
Expectedly, mutual information is higher between the victim and thestolen encoder than between the victim and independent encoders
I ( f v , f s | D P ) >
> I ( f v , f i | D P ) .
We can normalize mutual information into a score (between 0 and 1) by setting the lower bound as themutual information between the victim f v and a randomly initialized model f r : I min =
I ( f v , f r | D P )and the upper bound as the mutual information between the victim and itself: I max =
I ( f v , f v | D P )
For the current mutual information score I c , the normalized score is deﬁned as S :
= I c
I min I max  I min .
4.2 Cosine Similarity Score
The second score we use to assess the quality of a stolen encoder is based on the cosine similaritybetween its representations and the victim’s representations.
More speciﬁcally, we ﬁrst computerepresentations for the two encoders on a set of N randomly selected data points from the dataset D P .
Again as per standard practice [13], we recenter and normalize these representations.
For each of the
N inputs, we then compute the cosine similarity between the corresponding representations fromboth encoders where the cosine similarity sim( a, b )
= a T b ||
a || 2 || b
|| 2 for representation vectors a and b .
We show (in Section 4.3) that the loss functions, which are used for stealing encoders, directlymaximize the cosine similarity between representations from victim and stolen encoders.
We thuspropose to use the cosine similarity score C as a metric, which we deﬁne as: C = | sim( a, b ) | (2).
The score yields values in the range [0 , 1] , with a higher score indicating closer representations.
Tocalculate a per-encoder cosine similarity score, we average the cosine similarity scores over all inputs.
We ﬁnd that the cosine similarity score is well-calibrated across encoders.
Namely, an independentencoder, expected to have representations unrelated to the victim encoder, has an average cosinesimilarity concentrated around
[9], while a stolen encoder exhibits signiﬁcantly higher scores.
Thecosine similarity score is also easy to compute since it only requires the corresponding representationsof the two models and their dot product.
4.3 Analysis
There are various ways in which an attacker may steal an encoder.
To simplify our analysis of thecosine similarity score, we consider two best performing loss functions used for stealing [14]: theﬁrst where the attacker minimizes the non-contrastive MSE (Mean Squared Error) loss between itsrepresentations and the victim encoder’s representations to train the stolen encoder, and the secondwhere the attacker uses a contrastive loss function, such as the InfoNCE loss [43] which is applied in
SimCLR [5].
Stealing with MSE loss.
In the case where the MSE loss is used, let x i be a query made byan attacker and let f v ( x i )
=
h v i , f s ( x i ) =
h s i 2 R n be the corresponding representations ofthe victim and stolen encoders, respectively.
The MSE loss between these two representations is1 n
P nj =
( h
[Equation]
ij  h s ij ) 2 = 1 n ||
h
v i
h
s
i ||
It follows directly that minimizing the MSE loss alsominimizes the ` 2 distance between representations and equivalently maximizes the cosine similaritybetween representations: Theorem 1 ||
a  b || 2 =
[Equation]
a, b )) , || a || 2 =
||
b
||
= 1 (see H.1).
Stealing with InfoNCE loss.
When an attacker uses the InfoNCE loss for stealing , minimizingthe loss corresponds to maximizing the sum of the cosine similarities between positive pairs, i.e.,
P mc =1 (sim( h s c , h v c ) / ⌧ ) .
The InfoNCE loss, or contrastive losses in general, also increase the mutualinformation score [3, 43].
We, therefore, expect that stolen encoders will have larger similarity scoresw.r.t.
the victim encoder than independent encoders.
We refer the reader to Appendix H.1 for a moredetailed discussion of the loss functions and their relationship with the similarity scores.
Empirical Evaluation
We evaluate our defense against encoder extraction attacks using ﬁve different vision datasets(CIFAR10, CIFAR100 [28], SVHN [34], STL10 [8], and ImageNet [11]).
Table 1 shows that our dataset inference method is able to differentiate between the stolen copies of the victim encoder andindependently trained encoders by using the victim’s private training data as the signature.
We alsoshow that our defense works in the scenario where the adversary modiﬁes the representations torender them inconspicuous, e.g., by shufﬂing the order of elements in the representation vectors.
Toassess the quality of the stolen encoders and the performance of our defense, we measure the mutualinformation and cosine similarity scores between encoders and present our results in Tables 2 and 3.
5.1 Training Victim, Stolen and Independent Encoders
Victim.
We use victim encoders trained on the ImageNet, CIFAR10, and SVHN datatsets.
For the
ImageNet victim encoder , we use a model released by the authors of SimSiam [6].
To train CIFAR10and SVHN victim encoders, we use an open-source PyTorch implementation of SimCLR [5].
The
ImageNet victim has an output representation dimension of 2048, while the CIFAR10 and SVHNvictim encoders have 512-dimensional representations.
Stolen.
When stealing from the victim encoders, we evaluate different numbers of queries fromvarious datasets, including CIFAR10, SVHN, ImageNet, and STL10.
Stolen encoders are trained in asimilar contrastive way as the victim and use the InfoNCE loss, where the positive pairs consist ofrepresentations from the victim and stolen encoder for a given input.
Algorithm 1 summarizes thestealing approach used by an adversary.
Independent.
For each victim encoder, we train independent encoders using datasets differentfrom the victim’s private training dataset D P .
The encoders are trained with the SimCLR approach,similar to the way the victim encoders were trained.
In the case where the dataset used to train theindependent model had different image dimensions from the victim’s training dataset, the dataset wasresized to be of the same size.
More details on training and stealing encoders can be found in Section C.3 of the Appendix. Inference on
Setup.
We train GMMs with 10 components for SVHN, and with 20 components for CIFAR10 and
ImageNet.
We observe that the larger the number of components for GMMs, the better the defenseis.
We describe our approach to the selection of components for GMMs in Appendix D. For allcases, we restrict the covariance matrix to be diagonal (as stated in Section 3.2).
For CIFAR10 and SVHN, we use 80% of the training set to train GMMs, and the remaining 20% to evaluate the traininglog-likelihood.
For ImageNet, we use 100 K images from the training set to train GMMs and 50 K asan evaluation set.
The whole test sets are used to evaluate test log-likelihood in all datasets.
For eachsetting, we tune the hyperparameters on the victim model and a randomly-initialized model.
Evaluation of our Defense.
The empirical results in Table 1 demonstrate that we are able todifferentiate between stolen and independent encoders from the difference in log-likelihoods.
Weobserve that the stolen encoders have signiﬁcantly larger  µ than the independent encoders.
Thep-values further show that for stolen encoders the null hypothesis is rejected while for independentencoders, the test is inconclusive.
Similar to dataset inference for supervised learning [31], the victimmodel typically has the largest  µ and the smallest p-values.
Also, we observe that our method isbetter at detecting encoders that are stolen using the victim’s train set to extract queries.
Number of Stolen Queries.
Table 3 shows that as the attacker steals more queries, the p-value fromour defense becomes lower.
This is consistent with the ﬁnding in [31] that dataset inference worksbetter with stronger stolen encoders.
We also ﬁnd that our defense is able to detect stolen encoderseven if the attacker only steals from a small number of queries.
For example, in Table 3, we are ableto claim ownership when only 10K queries are used for stealing the SVHN victim encoder (less than15 % of its training set) and around 50K queries for ImageNet (less than 4 % of its training set).
Robustness of Dataset Inference to Obfuscations.
The attacker can obfuscate the stolen encoderrepresentations by, for instance, applying shufﬂing (changing the order of elements), padding (addingzeros), or linear transformations ( e.g., scaling or adding a constant).
These obfuscations have littleimpact on the downstream performance [17] but may pose challenges to the defenses of the victim.
The results in Table 1 show that the p-values for the stolen encoders after attackers’ obfuscationsremain low, which implies that our method is robust to these types of obfuscations.
[Table]
- 10.21 Pad
CIFAR 3.34e4.
CIFAR 7.81e7.
CIFAR 2.31e7.23 Transform
CIFAR 6.81e5.
CIFAR 5.32e5.
CIFAR 8.45e8.
f i
N/A
CIFAR 3.67e- -0.
CIFAR 2.13e0.
CIFAR 7.89e4.56 SVHN 2.96e0.
CIFAR 3.56e0.
SVHN 5.42e0.
5.3 Measuring Quality of Stolen Encoders
Setup.
To measure the quality of stolen encoders, we select a random subsetof N = 20 K unaugmented images from the private training dataset D Pand compute their representations from stolen and victim encoders.
Wethen centralize (subtract the mean for each dimension) and normalize therepresentations (divide by the ` 2 norm).
For the mutual information score, weﬁrst estimate the entropies H ( f v ) , H ( f s ) , H ( f v , f s ) , which are then addedand normalized as in Section 4.1.
The score is capped to be in the range[0 , 1] .
To compute the cosine similarity score, we ﬁnd the absolute valueof the dot product of corresponding representations for the two encoders(Equation 2).
These dot products are then averaged over all representations.
Evaluation of Metrics.
To evaluate the mutual information and the cosinesimilarity scores, we conduct two sets of experiments to verify if: (1) thescores are higher for stolen than independent encoders, and (2) the scores increase as more queriesare used to steal encoders, which suggests a higher quality of the stolen copies [14].
In Table 2,we observe that both our scores assign higher values to the stolen encoders than the independentencoders.
Table 3 shows that our mutual information and cosine similarity scores increase while thep-values from our dataset inference decrease with respect to the number of queries used to steal anencoder.
This implies that the performance of our defense is consistent with the similarity metricsand becomes more effective as the quality of the stolen encoder improves.
We also plot a histogramof the cosine similarity scores for the stolen and independent encoders in Figure 3 for an SVHNvictim encoder, a stolen encoder from it (using CIFAR10 training data as the stealing dataset), andan independent encoder (trained on CIFAR100).
There is a pronounced difference between the twodistributions with the scores for the independent encoder being close to 0 and the scores for the stolenencoder being much higher than 0 .
Robustness of Metrics to Obfuscations.
We also consider the effect of obfuscations on these metrics.
Without any obfuscation of the representations from stolen encoders, the cosine similarity scoreshows a clearer distinction between stolen and independent encoders than the mutual informationscore: in Table 2, the cosine similarity scores for all independent encoders are close to zero, but themutual information scores can be quite high (such as 0 .
9 for the independent encoders of SVHN,which is likely because of the mutual information score being based on an approximation).
However,the mutual information score is robust to the obfuscations of the attackers while cosine similarity isnot: in Table 2, the cosine similarity score for the stolen encoders after shufﬂing and padding dropsclose to zero.
Mutual information, as a more general metric based on the information measurementinstead of the brittle structure of the representation vectors, performs better and is oblivious to theobfuscations that attackers might introduce.
[Table]
The quality of the stolen encoders increases with more stealing queries, which is reﬂected by the rise in the mutual information and cosine similarity scores as well as the better performance of our defense as indicated by the decreasing p-values.
D P is the private dataset used to train the victim and
D S is the dataset used for stealing.
[Table]
5.4 Limitations
If the t-test run as part of dataset inference is inconclusive for an extracted encoder, we cannotstate whether the encoder was stolen.
Similarly, for an independent encoder, there is the possibilityof it being incorrectly classiﬁed as stolen.
Previous work [26, 38] has shown that self-supervisedencoders trained using heavy augmentations and contrastive learning generalize better than theirsupervised counterparts, which makes it harder for the dataset inference to differentiate between trainand test representations in SSL than in the SL setting [14].
The loss values of projected individualrepresentations are insufﬁcient for dataset inference [14].
We build on top of this observation to enabledataset inference for encoders and use GMMs to distinguish between train and test representations.
Conclusions
New public APIs expose self-supervised encoder models which return high-dimensional embeddingsfor provided inputs.
Adversaries can use these embeddings to steal the encoders.
We present a novelmethod based on dataset inference for defending against such stealing attacks along with metricsto assess the quality of the stolen encoders and to quantify the effectiveness of our defense.
Weobserve that knowledge contained in the private training set is transferred from the victim encoder toits stolen copy.
Thus, the private data acts as a signature of the victim encoder.
By leveraging densityestimation on the respective encoders’ representations, we obtain a signal allowing us to differentiatebetween the encoder’s training and test data.
This difference is detectable in both the victim encoderand its stolen copy but not in independent encoders which are legitimately trained on different datathan the victim’s private training data.
Thus, we are able to ﬂag the stolen copy of the victim encoderwhile not accusing creators of legitimately trained encoders of theft.
We show the high effectivenessof our defense on vision encoders.
Future work may explore additional applications of our proposeddefense and metrics beyond model stealing and ownership veriﬁcation, as well as their use in otherdomains such as natural language processing (NLP).
In particular, our method may help enforce theethical usage of sensitive online data, such as images on social media, in accordance with privacyregulations by auditing if a given providers’ encoder contains knowledge of these sensitive data.