PaperlayerView exact revision on arXiv

Source-linked AI summary

Deep Neural Network Fingerprinting by Conferrable Adversarial Examples

Nils Lukas, Yuxuan Zhang, Florian Kerschbaum

arXiv:1912.00888v4cs.LGcs.CRstat.ML

TL;DR

Model stealing lets attackers derive surrogate models from MLaaS APIs, creating a need to identify stolen models after deployment. This paper fingerprints source classifiers with conferrable adversarial examples and reports robust verification across many attacks, including ROC AUC 1.0 for retrained CIFAR-10 surrogates. The main boundaries are transfer learning with attacker access to CIFAR-10 data and adversarial training from scratch.

  • Problem

    MLaaS providers need a robust way to determine whether a remotely deployed suspect model is a stolen surrogate of their source model.

  • Method

    The method generates a fingerprint from conferrable adversarial examples that transfer targeted source-model misclassifications to surrogates but not reference models.

  • Results

    ROC AUC 1.0 verifies retrained CIFAR-10 surrogates, compared with ROC AUC 0.63 for related fingerprints, while robustness holds across most tested extraction and modification attacks.

  • Takeaways & Limitations

    Conferrable adversarial examples provide a passive fingerprint for verifying surrogates through black-box access across varied derivation and extraction settings.

  • Takeaways & Limitations

    The fingerprint is not robust to transfer learning when attackers have CIFAR-10 data or to adversarial training from scratch.

Abstract

from arXiv · show

In Machine Learning as a Service, a provider trains a deep neural network and gives many users access. The hosted (source) model is susceptible to model stealing attacks, where an adversary derives a surrogate model from API access to the source model. For post hoc detection of such attacks, the provider needs a robust method to determine whether a suspect model is a surrogate of their model. We propose a fingerprinting method for deep neural network classifiers that extracts a set of inputs from the source model so that only surrogates agree with the source model on the classification of such inputs. These inputs are a subclass of transferable adversarial examples which we call conferrable adversarial examples that exclusively transfer with a target label from a source model to its surrogates. We propose a new method to generate these conferrable adversarial examples. We present an extensive study on the irremovability of our fingerprint against fine-tuning, weight pruning, retraining, retraining with different architectures, three model extraction attacks from related work, transfer learning, adversarial training, and two new adaptive attacks. Our fingerprint is robust against distillation, related model extraction attacks, and even transfer learning when the attacker has no access to the model provider's dataset. Our fingerprint is the first method that reaches a ROC AUC of 1.0 in verifying surrogates, compared to a ROC AUC of 0.63 by previous fingerprints.

1 INTRODUCTION

The paper addresses detecting stolen surrogate models in MLaaS by introducing a passive DNN fingerprint based on conferrable adversarial examples. The method achieves perfect verification on retrained CIFAR-10 surrogates, while adapted attacks expose specific limitations.

  • Motivation: MLaaS providers need post hoc detection because users with source-model access cannot be prevented from deriving surrogate models.Model stealing can produce effective, low-cost surrogates from limited domain data.
  • Contribution: The proposed passive fingerprinting method distinguishes stolen surrogates from benign reference models and is designed to withstand model extraction and modification attacks.It extends robustness beyond attacks that alter an existing model, such as weight pruning.
  • Contribution: Conferrable adversarial examples transfer a targeted misclassification from the source model to surrogates but not to independently trained reference models.The paper uses these examples as an identifying code extracted from the source model.
  • Results: ROC AUC 1.0 verifies retrained CIFAR-10 surrogates with the proposed fingerprint, compared with ROC AUC 0.63 for related work.The result is reported for retrained CIFAR-10 surrogate models.
  • Limitations: The fingerprint is not robust to transfer learning with ImageNet32 pretraining and CIFAR-10 data or to adversarial training from scratch.The paper hypothesizes that incorporating adversarial training into fingerprint generation could improve robustness.

2 RELATED WORK

The related work distinguishes transfer-based adversarial attacks, watermarking, and earlier fingerprinting methods. The paper positions its approach as targeting extraction attacks that train surrogates from scratch.

  • Adversarial attacks: Black-box adversarial attacks lack direct gradients because the target architecture is unknown, while transfer-based attacks exploit shared decision boundaries.Targeted transferability additionally specifies the adversarial example’s target class.
  • Adversarial attacks: Ensemble optimization can boost targeted transferability, and this paper adapts it to maximize transfer to surrogates while minimizing transfer to reference models.The paper names this specialized transferability conferrable.
  • Watermarking: DNN watermarking embeds identifying information into model parameters or behavior, but some schemes require white-box verification or affect model utility.Backdoor-based schemes can support black-box verification through API access.
  • Prior limitations: Existing adversarial-example watermarks were evaluated against model modification attacks but not extraction attacks that train surrogates from scratch.At least two cited watermarking schemes were shown not to withstand model extraction.
  • Prior limitations: Cao et al.’s fingerprint uses adversarial examples near the source decision boundary, but the paper reports that retraining removes it.The proposed fingerprint is presented as an alternative designed for model extraction robustness.

3 DNN FINGERPRINTING

The fingerprinting framework generates a secret input set and verification key from a source model, then tests suspect models through black-box queries. Verification uses output disagreement and a threshold to classify surrogates or references.

  • Threat Model: The threat model considers attackers deriving high-accuracy surrogates while evading verification, with possible white-box source access, unbounded computation, and domain data.Attackers are limited in access to ground-truth labeled data.
  • Threat Model: The defender has white-box source access, black-box suspect-model access, and a limited query budget, without knowing the suspect architecture or extraction attack.These constraints define remote post hoc verification.
  • Fingerprinting framework: Fingerprint generation outputs a secret fingerprint F of size n and verification keys containing the source model’s outputs on F.The framework separates generation from verification.
  • Fingerprinting framework: Verification queries the suspect model on F and returns 1 when the fingerprint verifies the model, otherwise 0.The verification input consists of the suspect outputs, fingerprint, and verification keys.
  • Verification: The verifier computes source–target error on the fingerprint and uses a threshold ρ to classify models as surrogate or reference.The fingerprint must be irremovable and non-evasive under the stated definitions.

4 CONFERRABLE ADVERSARIAL EXAMPLES

Conferrable adversarial examples are targeted transferable examples designed to affect a source model and its surrogates, but not independently trained references. The Conferrable Ensemble Method generates them by optimizing surrogate-reference prediction differences and filtering examples by conferrability.

  • Conferrable examples are a subclass of targeted transferable adversarial examples that fool the source and surrogates but not reference models.They operationalize similarity through shared adversarial vulnerabilities.
  • The conferrability score measures an example’s transferability to surrogate and reference models.The objective maximizes activation differences between the two model groups.
  • CEM constructs an ensemble over the source, surrogate, and reference models and optimizes a perturbation for high conferrability.The ensemble outputs conferrability scores for each output class.
  • CEM’s loss maximizes a target-class output, separates the perturbed source prediction from its initial prediction, and aligns it with surrogate predictions.The total loss is a weighted sum of these three objectives.
  • The defender trains 18 surrogate and 18 reference models, then retains optimized examples whose conferrability score is at least τ ≥0.95.Verification compares source and target predictions on the resulting fingerprint using an error-rate threshold.

5 EXPERIMENTAL SETUP

The experiments evaluate fingerprint quality, evasiveness, and retention against model modification, extraction, and adaptive attacks across CIFAR-10 and ImageNet32 settings. The setup varies attacker datasets and defines removal success using both model accuracy and fingerprint accuracy.

  • The study evaluates irremovability and non-evasiveness, including comparisons with IPGuard and multiple attacks across CIFAR-10 and ImageNet32.CEM is compared with FGM, BIM, PGD, and CW-L∞ for conferrability.
  • Fingerprint retention is measured by Conferrable Adversarial Example Accuracy, the success rate of fingerprint examples receiving their target labels.An example is successful when the target model predicts the label stored in the verification key.
  • CIFAR-10 experiments use a ResNet20 source model, with locally trained ResNet20 surrogate and reference models and attacker models spanning several architectures.The source and defender models follow standard CIFAR-10 training without modifications.
  • Removal attacks are successful only when the stolen surrogate maintains at least 85.55% CIFAR-10 test accuracy and falls below the verification threshold in CAEAcc.The evaluation covers model modification, model extraction, and adapted extraction attacks.
  • Adapted attacks include PGD adversarial training and a Ground-Truth attack using p ∈[0.6, 0.7, 0.8] ground-truth labels.Differentially private training was also tested but produced about 76% CIFAR-10 test accuracy.
  • Attacker datasets include CIFAR-10, CINIC, and ImageNet32, which differ in similarity to the source domain.ImageNet32 is described as the most dissimilar dataset relative to CIFAR-10.

6 EMPIRICAL RESULTS

The experiments evaluate fingerprint robustness across model modification, extraction, adapted attacks, non-evasiveness, and verification. The fingerprint generally persists across attacks, but adversarial training from scratch and dataset-access-dependent transfer learning can remove it.

  • Conferrability Scores: CEM produces significantly more conferrable examples than FGM, PGD, and CW-L∞ at small perturbation thresholds.At ϵ = 0.01, the mean conferrability score is 0.49, corresponding to mean CAEAcc values of 0.85 for surrogates and 0.42 for references.
  • Non-Evasiveness: For perturbation thresholds ϵ ≤0.025, the attack-detection method achieves ROC AUC only 0.67, making detection unreliable in practice.Detectability increases with larger perturbation thresholds, but sufficiently high recall requires a higher threshold.
  • Model Modification Attacks: The fingerprint remains robust against four fine-tuning variants and most model modification attacks.The evaluated variants include fine-tuning or retraining of the last layer or all layers.
  • Model Modification Attacks: Higher pruning rates p ∈[0.7, 0.8, 0.9] reduce CAEAcc but also significantly degrade surrogate test accuracy.For p = 0.9, the attack is unsuccessful because test accuracy falls below 85.55%; remaining configurations do not remove the fingerprint.
  • Model Extraction Attacks: The fingerprint withstands most model extraction settings, including different surrogate architectures and extraction with CINIC data, but transfer learning removes it with CIFAR-10 access.CINIC surrogates show higher mean CAEAcc than CIFAR-10 surrogates despite 2.16% lower test accuracy, while CINIC-only transfer learning does not remove the fingerprint.
  • Removal Attacks: Table 2 reports mean CIFAR-10 test accuracies for surrogate models across threefold-repeated attacks, generally using CIFAR-10 training images.The table provides the accuracy criterion used when assessing whether removal attacks succeed.
  • Adapted Model Extraction Attacks: Adversarial training from scratch removes the fingerprint, yielding a mean CAEAcc of only 15% for CIFAR-10 surrogates at ϵ = 0.025.With the Ground-Truth attack, the fingerprint remains unremovable for attackers with up to 50% ground-truth labels.
  • Confidence Analysis: Fingerprint verification reaches ROC AUC 1.0 on retrained CIFAR-10 models, compared with ROC AUC 0.63 for IPGuard.For well-trained surrogate and reference models, the fingerprint also produces a mean CAEAcc difference of about 30%.

7 CONCLUSION

The paper introduces conferrable adversarial examples as a DNN fingerprint for identifying stolen surrogates. Experiments show strong robustness across many attacks, while transfer learning with defender data and adversarial training from scratch remain effective removal attacks.

  • CONCLUSION: CEM generates highly conferrable adversarial examples and outperforms FGM, PGD, and CW-L∞ for this purpose.The fingerprint uses these examples to distinguish surrogate models from reference models.
  • CONCLUSION: The fingerprint is more robust to model modification and extraction attacks than related approaches across the evaluated settings.Transfer learning succeeds as a removal attack with CIFAR-10 data but not with CINIC-only access.
  • CONCLUSION: Adversarial training from scratch is the most effective evaluated removal attack and successfully removes the fingerprint.The authors hypothesize that incorporating adversarial training into fingerprint generation could improve robustness.
  • CONCLUSION: The experiments support non-evasiveness against the detection method proposed by Hitaj et al. (2019).The conclusion also reports perfect verification performance as the first such result for this fingerprinting setting.

A.1 SUPPLEMENTARY MATERIAL FOR CIFAR-10 EXPERIMENTS

The CIFAR-10 supplementary experiments describe the CEM setup and analyze the fingerprint’s class-pair structure. Conferrable examples are concentrated among semantically similar classes, helping explain elevated reference-model CAE accuracy.

  • Generation setup: CEM generates CIFAR-10 fingerprints with perturbation limit ϵ = 0.025.The corresponding examples are shown in Figure 5(a).
  • Confusion-matrix analysis: The CIFAR-10 fingerprint’s confusion matrix uses initial labels vertically and target labels horizontally, with normalized percentage values.The matrix is evaluated at ϵ = 0.025.
  • Confusion-matrix analysis: All classes appear in the fingerprint, and target classes are distributed in a balanced manner.The confusion matrix also exhibits symmetry along its diagonal.
  • Class-pair structure: Source-target pairs occur more often when classes are visually or semantically similar, such as dog-cat and automobile-truck.Reference models are therefore more likely to share these confusions and adversarial vulnerabilities with the source model.
  • Class-pair structure: Reference models achieve CAE accuracies above 50%, although random guessing has a 10% baseline.Similar-class confusions and shared vulnerabilities with the source model partially explain this elevated accuracy.

A.2 EXPERIMENTS ON IMAGENET32

The ImageNet32 experiments test conferrable-example generation across a broader model-architecture set. Their results are comparable to CIFAR-10 and yield even lower CAE accuracy for reference models.

  • Experimental setup: The ImageNet32 study uses images from 100 selected classes.The passage introduces the ImageNet32 class-selection procedure without listing all classes here.
  • Experimental setup: The experiment trains a ResNet20 source model, 14 surrogate models, and 15 reference models.The defender also considers ResNet56, DenseNet, VGG19, and MobileNetV2 architectures.
  • Results: ImageNet32 test accuracies and CAEAcc values are comparable to those obtained on CIFAR-10.The reported ImageNet32 results use ϵ = 0.15, whereas the cited CIFAR-10 results use a different perturbation setting.
  • Results: Reference models on ImageNet32 have lower CAE accuracy than reference models trained on CIFAR-10.The passage states this as an observed cross-dataset comparison.

A.3 FINGERPRINTING DEFINITIONS

This section formalizes surrogate and reference models and frames fingerprint verification as distinguishing stolen models from independently trained alternatives. It also introduces the verification schematic and ImageNet32 accuracy tables.

  • Verification framework: Fingerprint verification must distinguish the source model, surrogate S, and reference model R.The schematic labels distillation attacks as producing surrogates with source-like performance and classifies model outputs on fingerprint inputs.
  • Fingerprint construction: The section introduces an auxiliary function for generating a source-model fingerprint.This function supports the formal definitions and verification framework.
  • Reported measurements: Tables 3 and 4 report ImageNet32 surrogate-model and reference-model accuracies, respectively.These tables provide the accuracy results used to compare the two model categories.

3. Output (M, F, Fy)

The paper defines verification security properties and optimizes conferrability so adversarial examples transfer to surrogates but not references. It evaluates sensitivity and describes several removal attacks.

  • Security properties: Irremovability requires surrogate and reference models to remain correctly verified despite an attacker’s removal attempt.The attacker derives a suspect model from the source model and participates in a security game.
  • Security properties: Non-evasiveness makes fingerprint members difficult to distinguish from benign samples under black-box verification.The formal property considers adversarial examples bounded by a maximum perturbation ϵ.
  • Conferrability objective: Conferrability is optimized to maximize targeted transfer to surrogate models while avoiding targeted transfer to reference models.The score is maximal when surrogates select the target label and references do not, while equal transfer or equal non-transfer yields minimal scores.
  • Conferrability constraints: High-conferrability examples must receive target label t from the source, transfer to surrogates with probability near one, and remain constrained by an infinity-norm perturbation bound.The optimization is applied to a benign input x with perturbation δ.
  • Optimization limitations: Generating conferrable examples requires an optimization strategy that finds near-global minima while using few surrogate and reference models.Training many auxiliary models can be impractical when even one model is expensive to train.
  • Removal attacks: The evaluated removal attacks include retraining, soft-label distillation, iterative adversarial-example augmentation, Jacobian-based extraction, and Knockoff.The section also describes the parameter search used to assess the conferrability objective.
  • Sensitivity analysis: For α = 1.0 and β = γ = 0.1, mean conferrability reaches 0.49, improving over the paper’s baseline.The sensitivity analysis averages scores over 50 inputs and five surrogate and five reference models not used during generation.
Loading 1912.00888v4…