IPGuard: Protecting Intellectual Property of Deep Neural Networks via Fingerprinting the Classification Boundary

Xiaoyu Cao; Jinyuan Jia; Neil Zhenqiang Gong

Source-linked AI summary

IPGuard: Protecting Intellectual Property of Deep Neural Networks via Fingerprinting the Classification Boundary

Xiaoyu Cao, Jinyuan Jia, Neil Zhenqiang Gong

arXiv:1910.12903v5Oct 28, 2019cs.CRcs.AIcs.LG

TL;DR

DNN classifier piracy threatens intellectual property built with proprietary data, algorithms, and computation, while watermarking can reduce classifier accuracy. IPGuard fingerprints an already-trained classifier using labels on data points near its classification boundary, then evaluates suspect classifiers by label agreement. Across CIFAR-10, CIFAR-100, and ImageNet, it identifies post-processed versions as pirated and unrelated classifiers as non-pirated, without accuracy loss.

Problem
Protecting DNN classifier intellectual property is important because training can require proprietary data, confidential algorithms, and substantial computational infrastructure, while watermarking can sacrifice classifier accuracy.
Method
IPGuard extracts data points near a trained classifier's classification boundary and uses their target-model labels as a fingerprint for testing suspect classifiers.
Results
Across CIFAR-10, CIFAR-100, and ImageNet, IPGuard verifies post-processed target classifiers as pirated while not falsely verifying unrelated suspect classifiers.
Takeaways & Limitations
Fingerprinting the classification boundary can provide robustness to classifier post-processing and uniqueness to the target classifier without modifying its training or fine-tuning.
Takeaways & Limitations
IPGuard assumes the target classifier's boundary is closer to those of its post-processed versions than to those of other classifiers, and model extraction attacks were not evaluated.

Abstract

from arXiv · show

A deep neural network (DNN) classifier represents a model owner's intellectual property as training a DNN classifier often requires lots of resource. Watermarking was recently proposed to protect the intellectual property of DNN classifiers. However, watermarking suffers from a key limitation: it sacrifices the utility/accuracy of the model owner's classifier because it tampers the classifier's training or fine-tuning process. In this work, we propose IPGuard, the first method to protect intellectual property of DNN classifiers that provably incurs no accuracy loss for the classifiers. Our key observation is that a DNN classifier can be uniquely represented by its classification boundary. Based on this observation, IPGuard extracts some data points near the classification boundary of the model owner's classifier and uses them to fingerprint the classifier. A DNN classifier is said to be a pirated version of the model owner's classifier if they predict the same labels for most fingerprinting data points. IPGuard is qualitatively different from watermarking. Specifically, IPGuard extracts fingerprinting data points near the classification boundary of a classifier that is already trained, while watermarking embeds watermarks into a classifier during its training or fine-tuning process. We extensively evaluate IPGuard on CIFAR-10, CIFAR-100, and ImageNet datasets. Our results show that IPGuard can robustly identify post-processed versions of the model owner's classifier as pirated versions of the classifier, and IPGuard can identify classifiers, which are not the model owner's classifier nor its post-processed versions, as non-pirated versions of the classifier.

1 INTRODUCTION

IPGuard addresses DNN classifier piracy without sacrificing classifier accuracy by fingerprinting a trained model's classification boundary. It extracts boundary-near data points to distinguish post-processed pirated models from unrelated classifiers.

1 INTRODUCTION: IPGuard fingerprints a trained classifier with data points near its classification boundary and compares suspect-model labels on those points.Matching labels for most fingerprinting data points indicates that a suspect classifier is potentially pirated from the target.
1 INTRODUCTION: Unlike watermarking, IPGuard does not modify the classifier's training or fine-tuning process and therefore provably incurs no accuracy loss.Watermarking embeds a watermark by changing training or fine-tuning, which can sacrifice target-model utility.
1 INTRODUCTION: The method targets boundary-near points because boundary points are vulnerable to post-processing, whereas distant points are less unique to the target classifier.This placement is intended to balance robustness against post-processing with uniqueness to the target and its post-processed versions.
1 INTRODUCTION: IPGuard efficiently finds suitable points by optimizing an objective with gradient descent without constraining the added noise as CW does.The unconstrained-noise design avoids the inefficient minimum-noise search used by CW.
1 INTRODUCTION: IPGuard identifies post-processed target classifiers as pirated while avoiding false verification of unrelated suspect classifiers on CIFAR-10, CIFAR-100, and ImageNet.The evaluation considers fine-tuning, retraining, and model compression, and reports robustness and uniqueness simultaneously.

2 RELATED WORK

The paper reviews watermarking for DNN intellectual-property protection and adversarial-example methods relevant to fingerprinting classification boundaries, highlighting accuracy and efficiency limitations.

2.1 Watermarking: Watermarking embeds protections during classifier training or fine-tuning and verifies piracy by extracting the same or similar watermark.
2.1 Watermarking: Watermarking can reduce target accuracy and cannot protect legacy classifiers that cannot be retrained; one ImageNet example reports a 0.5% decrease after embedding 20 watermark points.
2.2 Adversarial Examples: Adversarial examples move inputs across a classifier’s classification boundary, making them a natural basis for fingerprinting; the paper focuses on targeted examples for class-wise characterization.
2.2 Adversarial Examples: FGSM and IGSM offer suboptimal robustness–uniqueness tradeoffs, while CW-L2 achieves comparable robustness but is inefficient because it searches iteratively for small perturbations.

3 PROBLEM DEFINITION

The problem setting considers an owner defending a deployed DNN classifier against piracy and post-processing, using prediction-only fingerprint verification with fidelity, effectiveness, robustness, uniqueness, and efficiency goals.

3.1 Threat Model: The owner deploys a proprietary target classifier, while an attacker pirates it, may post-process it through compression, and deploys it as software or a service.
3.2 Fingerprinting a DNN Classifier: Fingerprinting derives a target-classifier fingerprint and verifies a suspect classifier through its prediction API, returning 1 when it is predicted pirated.
3.2 Fingerprinting a DNN Classifier: Unlike watermarking, fingerprinting extracts information from an already trained classifier rather than altering training or fine-tuning, avoiding the associated accuracy sacrifice.
3.3 Design Goals: The design goals require no accuracy sacrifice, verification of the original and post-processed classifier, rejection of unrelated classifiers, and efficient extraction and verification.

4 OUR IPGUARD

IPGuard fingerprints a classifier with labeled points near its classification boundary and verifies suspects by prediction-label agreement, using optimization to find points efficiently while balancing robustness and uniqueness.

4.1 Overview: IPGuard represents a classifier by boundary-near fingerprinting points and their labels, then tests a suspect by querying labels for those same points.
4.2 Extract: The Extract function searches n random boundary-near points, while Verify compares suspect and target labels and accepts when the matching rate reaches a threshold.
4.1 Classification Boundary: The classification boundary contains points where at least two labels tie for the largest probability or logit, while predicted labels otherwise select the maximum.
4.2 Extract: Boundary points are distinctive but fragile under post-processing, whereas distant points are robust but not unique; IPGuard therefore searches near, rather than on or far from, the boundary.
4.2 Extract: IPGuard formulates boundary-point discovery as an optimization problem solved with gradient descent, using an objective whose parameter k controls the robustness–uniqueness tradeoff.

5.1 Experimental Setup

The evaluation uses CIFAR-10, CIFAR-100, and ImageNet target classifiers, with post-processed, independently trained, differently architected, and random-forest suspect classifiers. It compares fingerprinting methods using robustness, uniqueness, efficiency, and ARUC, while testing classifier accuracies and multiple initialization and target-label settings.

Datasets and Target Classifiers: The experiments cover CIFAR-10, CIFAR-100, and ImageNet with ResNet20, WRN-22-4, and ResNet50 target classifiers, respectively.ImageNet uses a pre-trained Keras ResNet50, while the CIFAR targets are trained models.
Suspect Classifiers: Suspect classifiers include six post-processing variants, same- and different-architecture neural networks, random forests, and other non-post-processed models.Positive suspects are post-processed target classifiers; remaining suspects are negative classifiers.
Suspect Classifiers: Table 2 reports testing-accuracy ranges for target and suspect classifiers, including post-processed models constrained to at most 3% target-accuracy loss.The table also covers independently trained same-architecture models and pruning-based weight or filter compression.
Compared Methods: Compared methods include random sampling, FGSM, IGSM, CW-L2, and IPGuard, evaluated across initialization and target-label choices.Table 3 organizes the combinations, while IPGuard and CW-L2 use Adam-based optimization settings.
Evaluation Metrics: ARUC jointly evaluates robustness and uniqueness by measuring the area under their intersected curves across matching-rate thresholds from 0 to 1.A larger ARUC indicates that both properties are simultaneously large over a wider threshold range.

5.2 Results

Across datasets, IPGuard and CW-L2 achieve the strongest ARUC, while parameter choices reveal robustness–uniqueness tradeoffs. IPGuard also distinguishes post-processed classifiers from unrelated models and is substantially faster than CW-L2.

For FGSM, ARUC first increases and then decreases or fluctuates as 𝜖 increases, whereas IGSM ARUC first increases and then stabilizes.FGSM and IGSM both remain below 0.7 ARUC regardless of 𝜖.
For CW-L2 and IPGuard, ARUC first increases and then decreases as k increases, reflecting a tradeoff between robustness and uniqueness.Increasing k moves fingerprinting points farther from the classification boundary, raising both positive and negative matching rates.
Least-likely target labels generally outperform random labels for IPGuard at large k, except that the two choices are comparable on ImageNet in one setting.The comparison holds across both initialization choices, with the stated ImageNet exception.
CW-L2 and IPGuard achieve comparable ARUCs and substantially outperform the other compared methods across datasets.
Positive suspect classifiers generally have higher matching rates than negative suspects, with CW-L2 and IPGuard producing the largest matching-rate gaps.On CIFAR-10, their gaps are 0.63 and 0.62, respectively.
IPGuard is slower than FGSM and IGSM but orders of magnitude faster than CW-L2 while achieving comparable ARUC.On CIFAR-100, the average added L2 norms are 1.29 for IPGuard and 0.64 for CW-L2.

6 DISCUSSION AND LIMITATIONS

IPGuard depends on a boundary-separation assumption that post-processed classifiers remain closer to the target than unrelated classifiers. The authors report support for this assumption under several post-processing methods, while leaving model extraction attacks unevaluated and acknowledging an ongoing evasion arms race.

6 DISCUSSION AND LIMITATIONS: IPGuard assumes target and post-processed classifiers agree more often on selected fingerprinting points than unrelated classifiers do.This corresponds to the assumption that their classification boundaries are closer.
6 DISCUSSION AND LIMITATIONS: The assumption was empirically supported for fine-tuning, retraining, and model compression, but model extraction attacks were not evaluated because of limited resources.The authors identify model extraction evaluation as future work.
6 DISCUSSION AND LIMITATIONS: An attacker could seek post-processing that changes the classification boundary significantly without sacrificing classification accuracy, creating an arms race over fingerprint evasion.The paper frames this as a strategic interaction between model owners and attackers.

7 CONCLUSION

The paper concludes that IPGuard fingerprints classifiers with data points near their classification boundaries and efficiently finds such points. Across three benchmark datasets, the fingerprints were both robust to popular post-processing and unique to the target classifier and its post-processed versions.

7 CONCLUSION: IPGuard fingerprints classifiers with data points near their classification boundaries and tracks their use in the wild.The method also introduces an efficient procedure for finding these points.
7 CONCLUSION: Across three large-scale benchmark datasets, IPGuard was simultaneously robust to popular classifier post-processing and unique to the target classifier and its post-processed versions.The conclusion reports both properties as empirical findings.
7 CONCLUSION: IPGuard finds boundary-near data points more efficiently than state-of-the-art adversarial example methods because it does not constrain the added noise.This efficiency comparison is part of the reported empirical conclusion.