Distillation-Resistant Watermarking for Model Protection in NLP (2022)

Abstract: How can we protect the intellectual property of trained NLP models? Modern NLP models are prone to stealing by querying and distilling from their publicly exposed APIs. However, existing protection methods such as watermarking only work for images but are not applicable to text. We propose Distillation-Resistant Watermarking (DRW), a novel technique to protect NLP models from being stolen via distillation. DRW protects a model by injecting watermarks into the victim’s prediction probability corresponding to a secret key and is able to detect such a key by probing a suspect model. We prove that a protected model still retains the original accuracy within a certain bound. We evaluate DRW on a diverse set of NLP tasks including text classification, part-of-speech tagging, and named entity recognition. Experiments show that DRW protects the original model and detects stealing suspects at 100% mean average precision for all four tasks while the prior method fails on two.

## introduction large-scale pre-trained neural models have shown great success in nlp tasks @xcite . task-specific nlp models are often deployed as web services with pay-per-query apis in business applications. protecting the intellectual property of these cloud deployed models is a critical issue in both research and practice. service providers often use authentication mechanism to authorize valid accesses. however, while this prevents clients directly copying a victim model, it does not hinder clients from stealing it using distillation. emerging model extraction attacks have demonstrated convincingly that most functions of the victim api are likely to be stolen with carefully designed queries (tramèr et al., 2016; wallace et al., 2020; krishna et al., 2020; he et al., 1 our code is available at https://github.com/ xuandongzhao/drw 2021). a model extraction process is often imperceptible because it queries apis in the same way as a normal user does @xcite . in this paper, we study the problem of model protection for nlp against distillation stealing. little has been done to adapt watermarking to identify model infringements in language tasks. although a number of defense techniques have been proposed to prevent the model extraction for computer vision, they are not applicable to language tasks with discrete tokens. among them, deep neural networks (dnn) watermarking @xcite works by embedding a secret watermark (e.g., logo or signature) into the model exploiting the over-parameterization property of dnns. this procedure leverages a trigger set to stamp invisible watermarks on their commercial models before distributing them to customers. when suspicion of model theft arises, model owners can conduct an official ownership claim with the aid of the trigger set. however, these protections all focus on the image/audio tasks, since it is easy to modify the continuous data. in addition, most watermarking methods are invasive and fragile. they cannot avoid tampering with the training procedure in order to embed the watermark. besides, the watermarks are outliers of the task distribution so that the adversary may not carry the watermark through distillation. to fill in the gap, we make the first attempt to protect nlp models from distillation. we propose distillation-resistant watermarking (drw) to protect models and detect suspicious stealing. inspired by the idea from coswm for computer vision @xcite , we utilize prediction perturbation to embed a secret sinusoidal signal to the output of the victim api. to handle discrete tokens, we design a technique to randomly project tokens to a uniform region within sinusoidal cycles. we design watermarking effective for distillation with soft labels and with hard-sampled labels. as long as the adversary trains the distillation procedure till convergence, drw is able to detect the watermark signal from the extracted model. the advantages of drw include 1) training independence: it works directly on the trained models and can be directly plugged into the final output. 2) flexibility: it can be applied to both soft-label output and hard-label output in the black-box setting. the contributions of this paper are as follows: ## theoretical analysis in this section, we provide theoretical guarantees for drw for both argmax soft output and sampling hard output. the analysis assumes the victim is calibrated so its soft-predictions are informative. we also focus on the binary classification task, i.e., @xmath0. generalization to @xmath1. the proof is deferred to appendix a.1. equation ( 6 ) says that, in the soft label setting, drw does not hurt the accuracy too much if the watermark level ε is small. note that only samples in which the victim model output lies around 0.5 (±ε) might be affected by the watermarking. these are data points where the victim model is uncertain and inaccurate anyway. equation ( 7 ) lowerbounds the accuracy of the sampled hard labels, which is close to the vanilla victim model if τ is small. observe that if τ = 1, the accuracy may drop even if the watermark magnitude ε = 0 due to the sampling of the output label foot_0 . our design of a second random projection v s plays an important role here as it allows us to control the accuracy drop to any level we desire by adjusting τ . ## conclusion in this work, we propose distillation-resistant watermarking (drw), a novel and unified watermarking technique against model extraction attacks on nlp models. by injecting watermarks into the prediction output of the victim model, the model owner can detect the watermark if the adversary distills the protected model. we prove the theoretical guarantee of drw and show remarkable empirical results on text classification and sequence labeling tasks.