PaperlayerView exact revision on arXiv

Source-linked AI summary

[Extended version] Rethinking Deep Neural Network Ownership Verification: Embedding Passports to Defeat Ambiguity Attacks

Lixin Fan, Kam Woh Ng, Chee Seng Chan

arXiv:1909.07830v3cs.CRcs.CVcs.LG

TL;DR

DNN watermarking must protect costly model inventions, but ambiguity attacks can forge counterfeit watermarks and undermine ownership verification. This paper proposes passport-based schemes that tie verification to inference performance, and reports experimental evidence that the schemes defeat ambiguity attacks while remaining robust to model modifications.

  • Problem

    Existing DNN watermarking methods can be challenged by ambiguity attacks that forge counterfeit watermarks, threatening ownership verification for costly DNN models.

  • Method

    The paper embeds digital passports and trains DNNs so valid passports preserve original-task inference performance while forged or modified passports cause significant deterioration.

  • Results

    Counterfeit watermarks were forged with 100% detection rate, while the proposed passport-based schemes were demonstrated to defeat ambiguity attacks and remain robust to removal attacks.

  • Takeaways & Limitations

    Ownership verification can be reasserted through both passport signatures and the DNN's inference performance, rather than signature detection alone.

Abstract

from arXiv · show

With substantial amount of time, resources and human (team) efforts invested to explore and develop successful deep neural networks (DNN), there emerges an urgent need to protect these inventions from being illegally copied, redistributed, or abused without respecting the intellectual properties of legitimate owners. Following recent progresses along this line, we investigate a number of watermark-based DNN ownership verification methods in the face of ambiguity attacks, which aim to cast doubts on the ownership verification by forging counterfeit watermarks. It is shown that ambiguity attacks pose serious threats to existing DNN watermarking methods. As remedies to the above-mentioned loophole, this paper proposes novel passport-based DNN ownership verification schemes which are both robust to network modifications and resilient to ambiguity attacks. The gist of embedding digital passports is to design and train DNN models in a way such that, the DNN inference performance of an original task will be significantly deteriorated due to forged passports. In other words, genuine passports are not only verified by looking for the predefined signatures, but also reasserted by the unyielding DNN model inference performances. Extensive experimental results justify the effectiveness of the proposed passport-based DNN ownership verification schemes. Code and models are available at https://github.com/kamwoh/DeepIPR

I. INTRODUCTION

Existing DNN watermarking methods protect models against several weight-modification attacks but remain vulnerable to ambiguity attacks that forge counterfeit watermarks. The paper formulates this verification problem and proposes passport-based schemes that use inference performance to distinguish genuine ownership.

  • Motivation: DNN watermarking protects models against intellectual-property infringement by embedding signatures during training and verifying them after model modifications.Existing methods target fine-tuning, pruning, and watermark overwriting.
  • Existing methods and their weakness: Feature-based and trigger-set methods are robust to removal attacks, yet ambiguity attacks can forge additional watermarks and cast doubt on ownership.The two method families embed signatures in weights or use adversarial trigger samples with designated labels.
  • Proposed remedy: Passport-based schemes modulate DNN inference performance so valid passports preserve performance while modified or forged passports significantly deteriorate it.This performance dependence is intended to provide robustness to removal attacks and resilience to ambiguity attacks.
  • Proposed remedy: The paper positions performance modulation as central to controlling DNN behavior against adversarial attacks and resolving ownership ambiguity.The proposed schemes are presented as a remedy to the invertibility weakness of watermark-based verification.
  • Formalization: The verification framework models embedding, fidelity evaluation, verification, and inversion as processes that determine whether ownership claims can be established unambiguously.The embedding process trains the model, while fidelity evaluation checks whether inference performance remains within a predefined threshold.
  • Formalization: An ambiguity attack succeeds when forged triggers or signatures are reverse-engineered, verified against the model, and preserve the fidelity evaluation outcome.Such schemes are called invertible when at least one invert process exists.

B. Watermark-based DNN in the face of ambiguity attacks

The paper examines watermark-based DNN ownership verification under ambiguity attacks, which forge counterfeit watermarks to cast doubt on ownership claims.

  • Watermark-based DNN ownership verification methods are investigated specifically against ambiguity attacks that forge counterfeit watermarks.

1) Ambiguity attacks on feature-based method [1]:

Ambiguity attacks can forge feature-based and trigger-set watermarks that pass ownership verification, including after fine-tuning. The experiments show that forged trigger sets can be visually and statistically indistinguishable from genuine ones.

  • Feature-based method: The feature-based attack freezes DNN weights and optimizes new binary signatures to minimize the watermark embedding loss.The fixed weights make the original training loss constant during optimization, enabling rapid forging.
  • Feature-based method: Counterfeit watermarks are hardly distinguishable from original watermarks, and thresholding extracted features makes ownership verification unable to separate them.Their extracted-feature distributions differ before thresholding, but the verification representation remains indistinguishable afterward.
  • Feature-based method: 100% of 256-bit counterfeit watermarks are detected, including after fine-tuning for CIFAR100 and Caltech-101.The reported detection rate remains 100% for counterfeit watermarks under both transferred tasks.
  • Trigger-set method: The trigger-set attack adds trainable noise with η = 0.04 to base images, assigns random labels, and optimizes the noise while fixing the DNN parameters.The optimization does not require the original training data because the network parameters remain fixed.
  • Trigger-set method: Both genuine and forged trigger images achieve 100% assigned-label accuracy, while their visual and histogram distributions are indistinguishable.This indistinguishability casts doubt on ownership verification based only on trigger-set images.
  • Trigger-set method: After fine-tuning, both trigger-set accuracies deteriorate drastically, but forged images retain slightly better detection than the original trigger set.The fake-trigger optimization takes about 100 epochs and 100 seconds, or 5% of the original-task training time.

3) Summary on ambiguity attacks on watermark-based DNN:

Ambiguity attacks can forge convincing watermarks for already watermarked DNNs, making ownership claims unresolved. Passport layers address this by tying inference performance to the presented passport, so forged passports significantly degrade the original task.

  • Ambiguity attacks: 100% detection rates and reconstructed trigger sets show that counterfeit watermarks can be forged for representative feature-based and trigger-set methods.The attacks require minor computational cost and no original training data.
  • Ambiguity attacks: The ambiguity loophole arises because the original-task loss is independent of forged watermarks.Consequently, counterfeit signatures can be added without substantially affecting the original task during watermark verification.
  • Passport-layer design: Passport layers make scale and bias terms depend on convolution kernels and designated passports.They are appended after convolution layers and use passport-derived parameters to control downstream outputs.
  • Passport-layer design: With a genuine passport, inference remains near the original accuracy; with a counterfeit passport, accuracy can deteriorate to about 10%.The model’s performance therefore helps reassert ownership alongside signature verification.
  • Verification principle: Passport-layer scale and bias dependence supplies the non-invertibility needed to defeat ambiguity attacks.The proposed verification schemes use this dependence to preserve performance for valid passports and reject forged ones.

B. Methods to generate passports

The paper considers random-pattern, fixed-image, and randomly shuffled image passports. It adopts randomly shuffled image passports because they provide protection and flexibility through many possible layer-wise combinations.

  • Passport types: Fixed-image passports use one selected image and its feature maps from a same-architecture trained DNN as passports across layers.The selected image is fed at the input layer, while corresponding feature maps are used at other layers.
  • Passport types: Randomly shuffled image passports collect feature maps from N selected images and randomly choose one option at each layer.With N images and L layers, this yields N^L possible passport combinations.
  • Experimental choice: The experiments use randomly shuffled passports because they offer strong protection and flexibility in passport generation and distribution.Twenty images are selected, and feature maps at corresponding convolution layers become possible passports.

C. Sign of scale factors as signature

The method encodes ownership signatures in the signs of passport-layer scale factors and provides three verification schemes with different deployment and protection trade-offs.

  • Signature embedding: Sign-loss regularization forces scale factors to take designated positive or negative signs, forming a binary fingerprint.The binary bits are associated with convolution kernels and magnitudes are encouraged to exceed γ0.
  • Signature embedding: Persistent scale-factor signs explain the embedded passports’ robustness against reverse-engineering ambiguity attacks.The paper states that these enforced signs remain persistent against various adversarial attacks.
  • Verification schemes: Scheme V1 distributes the passport with the trained model, while Scheme V2 embeds a private passport without distributing it.V2 verifies ownership later by appending passport layers and checking signatures together with inference performance.
  • Verification trade-offs: V1 incurs about 10% extra inference cost and requires distributing and safely guarding passports.Passport use during inference creates both computational and handling burdens.
  • Verification trade-offs: V2 avoids passport use and extra inference cost for end-users but requires access to DNN weights and appending passport layers for verification.These requirements are identified as disadvantages of white-box protection.
  • Verification schemes: Scheme V3 adds a trigger set to the embedded passport, enabling black-box ownership claims through service APIs followed by white-box passport reassertion.This combines remote trigger-set probing with passport verification.

1) Algorithms:

The algorithms train passport-protected models, compute passport-derived signatures, and decode the resulting binary signs to verify ownership.

  • Reproducibility: The paper makes source code and the training and test datasets publicly available for reproducibility.This availability is stated alongside the pseudo-code for the verification schemes.
  • Signature detection: Signature detection averages passport-weight convolutions, takes the sign, converts it to binary, decodes it, and matches it against the target signature.Positive scale factors map to 1 and negative scale factors to 0.

2) Multi-task learning with private passports and/or trigger set images:

Schemes V2 and V3 embed private passports through multi-task learning, optionally combining passport keys with trigger-set images. The training procedure encodes signatures into scale-factor signs and optimizes classification-related losses.

  • Schemes V2 and V3 use Algorithm 6, a multi-task learning procedure similar to Algorithm 2.
  • Batch normalization is unsuitable for these multi-task learning tasks because its dependence on running batch averages significantly reduces test accuracy despite optimized training accuracy.
  • Experiments use AlexNetp and ResNetp-18 on CIFAR10 and CIFAR100, repeating experiments five times and testing against 50 fake passports for mean inference performance.
  • The training initializes passport layers and keys, with scheme V3 additionally initializing trigger sets.
  • The desired signature is binary-encoded into the signs of γp across all passport layers before iterative training.
  • Training samples minibatches and, when enabled, concatenates trigger-set samples and targets with ordinary task data.
  • The procedure computes cross-entropy losses and combines the classification loss with a regularization term before updating the model.

A. Convergence

Passport layers do not hinder DNN convergence. They separate public convolutional weights from hidden scale and bias parameters, while passport information remains embedded in the learned weights and scale factors.

  • Passport layers do not hinder convergence: test accuracies, network weights, and linear transformation parameters converge and stagnate after the learning rate is reduced.The learning rate changes from 0.01 to 0.0001 during training.
  • Passport layers separate public convolution parameters W from hidden passport parameters γ and β.Traditional hidden-layer parameters are treated as public parameters in this work.
  • The convolution-weight distribution remains similar to the original DNN, while passport information is still embedded into W through enforced constraints.
  • The sign loss forces scale factors to take positive or negative values far from zero, and their signs remain persistent against adversarial attacks.Non-zero scale-factor magnitudes also ensure non-zero channel outputs and slightly improve performance.

1) Fine-tuning:

Passport signatures remain detectable after fine-tuning and pruning, while trigger-set detection deteriorates without passports. The experiments also examine how scale-factor signs affect model performance under attacks.

  • 1) Fine-tuning: Passport signatures are detected at near 100% accuracy on the original task and remain almost 100% detectable after fine-tuning to a new task.The new-task example transfers from CIFAR10 to Caltech-101.
  • 1) Fine-tuning: Without passports, trigger-set label detection deteriorates drastically after fine-tuning, although trigger images can complement scheme V3 verification.
  • 2) Model pruning: With 60% of parameters pruned, passport models generally maintain near 100% signature accuracy while test-data accuracy drops around 5%-25%.
  • 2) Model pruning: A rigorous proof of the explanation for scale-factor-sign persistence under pruning remains under investigation.
  • The experiments use AlexNetp and ResNetp-18 architectures with scheduled training parameters and evaluate convergence using test accuracies, weight updates, scale factors, and bias terms.
  • Randomly flipping scale-factor signs causes significant performance drops when at least 50% of the factors are flipped.
  • Under random passport attacks, poor performances range from 10% to 30% on CIFAR10/CIFAR100 and from 1% to 3% on the corresponding reported tasks.

2) Reversed-engineering attacks:

Reverse-engineering and insider attacks cannot preserve original task performance while forging passports. Modifying passport scale signs causes accuracy degradation, supporting fidelity-based ownership verification.

  • 2) Reversed-engineering attacks: Reverse-engineering scale factors achieves at most 84%/70% on CIFAR10 and 40%/38% on CIFAR100 for AlexNetp/ResNetp-18, respectively.
  • 2) Reversed-engineering attacks: Fake passports cannot maintain original DNN performance when adversaries use random or reverse-engineered passports.
  • The reported ambiguity-attack results cover schemes V1, V2, and V3 under three attack modes.
  • Under random attacks, valid passports preserve accuracy, while fake1 and fake2 produce lower classification accuracy on CIFAR10 and CIFAR100.
  • With 10% of original scale signs modified, CIFAR100 accuracy drops about 5%; with 50% modified, it drops about 50%.
  • The verification thresholds are set to 3% for AlexNetp and 20% for ResNetp-18 using the fidelity evaluation process.

E. Sign of scale factors as signature

The method encodes a signature in the signs of learned scale factors and decodes those signs for ownership verification. Signature fidelity controls inference performance, while the proposed schemes add limited inference overhead and prioritize minimizing end-user computational cost.

  • Signature encoding: The sign of each learned scale factor encodes a digital signature, whose maximum capacity depends on the DNN channel count.Conv5 of AlexNetp has 256 channels, allowing a maximum 256-bit signature.
  • Signature decoding: Ownership verification decodes every 8-bit group of scale-factor signs into ASCII characters.The decoding examples map sign patterns to character codes such as 116 → t and 104 → h.
  • Verification behavior: 90.89% CIFAR10 accuracy with the correct signature fell to 82.23% with a partially correct signature and 11.44% with a totally wrong signature.Using the threshold ϵf = 3% and the fidelity evaluation process, the authors report that ambiguity attacks, including partially correct signatures, are defeated.
  • Computational cost: Scheme V1 increases inference time by about 10% versus the baseline, whereas the baseline, V2, and V3 have almost identical inference times.The extra V1 cost comes from calculating γ and β from the passport.
  • Computational cost: Inference cost is prioritized for minimization because end users perform network inference frequently, while training and verification costs are borne by network owners.The complexity comparison covers the proposed V1, V2, and V3 passport networks.
Loading 1909.07830v3…