Source-linked AI summary
Fingerprinting Deep Neural Networks Globally via Universal Adversarial Perturbations
Zirui Peng, Shaofeng Li, Guoxing Chen, Cheng Zhang, Haojin Zhu, Minhui Xue
TL;DR
Model extraction can compromise trained-model ownership, while existing watermarking and local adversarial-example approaches face utility, forgery, or transferability concerns. This paper fingerprints models using UAPs and contrastive learning. It reports effective, general, and robust performance across three benchmark datasets, including capability to detect postmodified piracy models.
Problem
Model extraction threatens model confidentiality, while watermarking can reduce utility and local adversarial examples may not transfer when extraction changes decision boundaries.
Source: §1 · p. 1Method
The framework uses UAP-based fingerprints to profile decision-boundary subspaces and a contrastive encoder to compare victim and suspect fingerprints.
Source: §1 · p. 1, §3.3 · p. 3Results
Takeaways & Limitations
The framework is reported to detect postmodified piracy models, addressing a setting considered in model extraction defenses.
Source: §1 · p. 2, §3.2 · p. 3Fingerprint information depends on query number, leaving an effectiveness-efficiency trade-off, and encoder training-data preparation overhead remains future work.
Source: §6 · p. 8
Abstract
from arXiv · showhide
In this paper, we propose a novel and practical mechanism which enables the service provider to verify whether a suspect model is stolen from the victim model via model extraction attacks. Our key insight is that the profile of a DNN model's decision boundary can be uniquely characterized by its Universal Adversarial Perturbations (UAPs). UAPs belong to a low-dimensional subspace and piracy models' subspaces are more consistent with victim model's subspace compared with non-piracy model. Based on this, we propose a UAP fingerprinting method for DNN models and train an encoder via contrastive learning that takes fingerprint as inputs, outputs a similarity score. Extensive studies show that our framework can detect model IP breaches with confidence > 99.99 within only 20 fingerprints of the suspect model. It has good generalizability across different model architectures and is robust against post-modifications on stolen models.
1. Introduction
Model extraction threatens trained-model ownership, while watermarking and local adversarial-example fingerprints have practical or robustness concerns. The paper uses UAP subspaces to profile global decision-boundary structure and proposes fingerprints and contrastive learning for ownership verification.
1. Introduction
- Watermarking can reduce model utility and raise non-forgeability concerns, while local adversarial examples may fail to transfer after extraction changes decision boundaries.Existing adversarial examples capture local boundary geometry.Source: §1 · p. 1
- UAPs lie in a low-dimensional subspace containing many decision-boundary normals, and piracy-model subspaces are more consistent with the victim's.The paper uses this dependency to derive a similarity score.Source: §1 · p. 1
- UAP fingerprinting faces a white-box access obstacle for suspect models and must distinguish piracy models from homologous models.Homologous models are independently trained on the same training data rather than the victim's outputs.Source: §1 · pp. 1–2
- Victim UAPs are added to queried datapoints, selected across source and target classes using K-means clustering on the victim's last layer.This selection is intended to capture more parts of the decision boundary.Source: §1 · p. 2
- A contrastive encoder maps victim, piracy, and homologous fingerprints into a shared space, separating homologous models farther from the victim than piracy models.The training uses contrastive learning to shorten within-class distances and push apart other classes.Source: §1 · p. 2
- The paper reports that UAPs outperform adversarial perturbations for fingerprinting and that its framework detects postmodified piracy models.It also proposes a fingerprint ownership-verification framework with a competitive AUC detection rate.Source: §1 · p. 2
2. Background and Related Work
Model extraction uses black-box queries to train a functionally similar piracy model. Prior fingerprinting work uses adversarial-example transferability, with reported architecture instability and substantial crafting overhead in cited approaches.
2. Background and Related Work
- In model extraction, attackers query a victim with natural and synthesized data, then train a piracy model on the returned labels until it reaches satisfying utility.The attack is described as violating model confidentiality.Source: §2 · p. 2
- Prior fingerprinting uses adversarial-example transferability, but one cited approach is unstable across architectures and another requires training up to 30 models with backpropagation.The latter approach crafts conferrable examples intended to transfer to piracy models rather than homologous models.Source: §2 · p. 2
3. Problem Formulation
The paper distinguishes independently trained homologous models from piracy models trained using a victim model’s outputs, then frames detection as a comparison of their decision-boundary fingerprints. Its design uses victim-generated UAPs and fingerprints of suspect-model behavior to assess whether the suspect shares the victim’s UAP subspace.
3.1. Model Definition
- A DNN model maps inputs in R^M to output vectors in R^N, whose entries represent class confidence.The protected model is trained by its owner on labeled data.Source: §3.1 · p. 3
- Homologous models are independently trained but highly similar, whereas piracy models are trained on inputs labeled with a victim model’s outputs.The piracy model is obtained through model extraction.Source: §3.1 · p. 3
3.2. Threat Model
- The owner deploys the victim model as a service and acts as both victim and defender, checking whether a black-box suspect is piracy or homologous.The defender has white-box access to the victim and limited-query black-box access to the suspect, without knowledge of the suspect’s architecture or training data.Source: §3.2 · p. 3
3.3. Design Overview
- A UAP is a perturbation that can fool a model on almost all datapoints, and its low-dimensional subspace contains most decision-boundary normal vectors.The paper treats UAPs as exposing geometric correlations among local decision-boundary gradients.Source: §3.3 · p. 3
- The design relies on piracy-model UAP subspaces being more consistent with the victim’s than homologous-model subspaces, while suspect-model UAPs cannot be directly obtained without white-box access.Instead, the defender uses a victim-generated UAP to test whether it lies in the suspect’s UAP subspace.Source: §3.3 · p. 3
- Fingerprint generation records how a model behaves around selected datapoints with respect to a victim-generated UAP.The function F takes the model, the perturbation, and datapoints as inputs.Source: §3.3 · p. 3
- An encoder maps victim and suspect fingerprints into a latent space where piracy pairs should have high similarity and homologous pairs low similarity.The similarity may be measured with cosine similarity.Source: §3.3 · p. 3
4. UAP based Fingerprinting
The section uses UAP-subspace consistency to distinguish piracy models from homologous models, then generates fingerprints from model outputs before and after a UAP and trains an encoder to compare them.
4.1. Observation Explanation
- Consistency is the ℓ2 distance between suspect and victim UAP projections on principal directions obtained by SVD of the victim’s UAP matrix.Source: §4.1 · p. 4
- On FMNIST, UAP inconsistency for a piracy model is 3 times smaller than for a homologous model, matching the observed subspace distinction.The victim model’s UAP subspace is consistent with its piracy model’s and inconsistent with a homologous model’s.Source: §4.1 · p. 4
4.2. Fingerprint Generation
- The fingerprint function records model outputs on selected datapoints before and after adding the UAP, with datapoints sampled across last-layer K-means clusters.The fingerprint captures output changes around datapoints; the clustering is intended to spread samples across decision boundaries.Source: §4.2 · p. 4
- UAP-based fingerprints separate model types into distinct clusters, whereas local adversarial perturbation fingerprints mix across types.The comparison covers victim, piracy, and homologous models.Source: §4.2 · p. 4
4.3. Fingerprint Verification
- Supervised contrastive learning labels victim and piracy fingerprints as 0 and homologous fingerprints as 1, pulling same-label pairs together and separating other-label pairs.Source: §4.3 · p. 5
- The approach creates positive fingerprint views by sampling nearest neighbors within clusters, then uses an encoder whose representations are compared by cosine similarity.The encoder projects fingerprint features into a latent space.Source: §4.3 · pp. 4–5
5. Experiments
Across datasets and architectures, the experiments distinguish piracy from homologous models, outperform IPGuard on AUC, and retain detection signals under the tested model modifications.
5.1. Setup
- Evaluation spans three datasets and varied architectures; encoder training used five piracy and five homologous models, while the authors report that practice requires only 10 models and 20 fingerprints.The datasets were FMNIST, CIFAR-10, and TinyImageNet.Source: §5.1 · pp. 5–6
5.2. Fingerprint Identification and Matching
- Similarity gaps were at least 0.77, 0.69, and 0.43 across datasets; 20-fingerprint t-tests rejected H0 for every piracy model, yielding 100% detection success.Tests used significance level α = 0.05.Source: §5.2 · p. 7, Table 2 · p. 7, Table 3 · p. 7
- Across architectures, piracy similarities cluster near 1 and homologous similarities near zero; AUCs were 1.0, 1.0, and 0.98 versus IPGuard’s 0.83, 0.75, and 0.61.The AUC values are for FMNIST, CIFAR10, and T-ImageNet, respectively.Source: §5.2 · p. 7
5.3. Ablation Study
- The similarity gap grows with datapoints until a 70-point plateau, while it remains at k = 1 and stabilizes at k = 3.The authors fix n at 100 to balance effectiveness and efficiency; the average sum of returned top-3 confidence scores is 0.9996.Source: §5.3 · p. 7, Figure 6 · p. 8
- At a 0.78 recovery rate, the framework still detects piracy with similarity 0.88.The authors explain that extracted models roughly align their global decision boundaries with the victim before refining local gradients.Source: §5.3 · p. 7
- UAP-based fingerprints outperform adversarial-example-based fingerprints, whose piracy similarities are less concentrated near 1 and homologous similarities less concentrated near 0.The comparison replaces UAPs with DeepFool-crafted adversarial perturbations of approximately the same norm.Source: §5.3 · p. 8, Figure 7 · p. 8
5.4. Resistance against Model Modifications
- After fine-tuning, pruning, or quantization, all modified piracy models retain similarities above 0.88.The tested pruning rates were 0.2–0.6, and quantization converted models from FP32 to INT8.Source: §5.4 · p. 8, Figure 8 · p. 8
- After more than 120 adversarial-training iterations, similarity falls from 0.99 to 0.89 but remains high; after 270 iterations the gap is imperceptible as utility drops 0.17.The authors describe this as a trade-off for an attacker seeking to evade detection.Source: Figure 8 · p. 8, §5.4 · p. 8
6. Discussion
The framework uses UAP subspace dependency and contrastive learning, and evaluation on three benchmark datasets shows it is effective, general, and robust. The supplementary analysis finds local boundary information less robust during extraction and identifies query count and encoder-training data preparation as limitations.
6. Discussion
- Evaluation on three benchmark datasets shows the framework is highly effective, general, and robust.It is based on the subspace dependency of victim- and piracy-model UAPs and uses contrastive learning to place piracy models closer to the victim than homologous models.Source: §6 · p. 8
- The effectiveness-efficiency trade-off depends on query number, while encoder training-data preparation remains future work.Source: §6 · p. 8
A. Local Variations of Decision Boundaries During Model Extraction
- Fingerprints encode local boundary information less robustly because decision boundaries vary significantly during model extraction.Borderpoints on the victim model’s boundary have a significant prediction gap on piracy models, indicating they lie far from those models’ boundaries.Source: A. Local Variations of Decision… · p. 11
B. Effectiveness of Multi-views Fingerprints Augmentations
The multi-view augmentation creates multiple views of each fingerprint for contrastive-encoder training. In the reported comparisons, views are more similar to one another than other positive fingerprints are.
B. Effectiveness of Multi-views Fingerprints Augmentations
- The augmentation strategy forms multiple views for each fingerprint and uses them to train the contrastive encoder.Source: B. Effectiveness of Multi-views… · p. 11
- Figure 10 visualizes view-versus-positive similarity distributions and fingerprint distances, with red points marking views from one fingerprint.Source: Figure 10 · p. 11
- Views of a fingerprint are more similar to each other than other positives, matching the augmentation design.Figure 10 compares cosine similarities between views and positives and visualizes fingerprint distances using the reciprocal of similarity.Source: B. Effectiveness of Multi-views… · p. 11, Figure 10 · p. 11
C.1. Contrastive Loss
The contrastive encoder places victim and piracy fingerprints together while separating homologous-model fingerprints. The comparison with a non-contrastive encoder supports the authors’ conclusion that contrastive learning is vital to nearly perfect detection.
C.1. Contrastive Loss
- The encoder’s latent-space distance property is intended to distinguish homologous models from piracy models and support high-confidence verification.Source: §C.1 · p. 11
- The contrastive encoder entangles victim and piracy representations while placing homologous-model representations on the opposite side.The authors report a visible decision boundary separating these clusters in the t-SNE visualization.Source: §C.1 · p. 12, Figure 11 · p. 12
- Unlike the contrastive encoder, the non-contrastive encoder separates fingerprint types without consistent cross-cluster distances or victim-piracy overlap.The authors conclude that contrastive learning is vital to achieving nearly perfect detection.Source: §C.1 · p. 12, Figure 11 · p. 12
C.2. Datasets Overlapping
On FMNIST, the reported verification performance is not undermined by overlap between victim and homologous training datasets. The supplement also identifies Table 4 as the source of test-set accuracy for experimental models.
C.2. Datasets Overlapping
- The overlapping rate does not undermine verification performance on FMNIST across 20 homologous models tested at rates from 0 to 0.9.The comparison varies overlap between Dv and Dhomo; the authors note that overlap with the piracy dataset is difficult to measure because of extraction data augmentation.Source: §C.2 · p. 12, Figure 12 · p. 12
D. Model Accuracy
- Table 4 reports test-set accuracy for the models used in the experiments.Source: D. Model Accuracy · p. 12
E. Transferability of Encoder
The authors test whether an encoder trained for one victim model can protect an independent victim model, using FashionMNIST. Its projections keep piracy fingerprints closer to the victim than homologous fingerprints, though the similarity gap is smaller than with a victim-specific encoder.
E. Transferability of Encoder
- The evaluation uses FashionMNIST, with an encoder trained for fV,v1 applied to fingerprints from independent victim fV,v2 and its homologous and piracy models.They prepare 10 homologous models and 10 piracy models for fV,v2.Source: E. Transferability of Encoder · p. 12
- 0.85 average similarity sim(fpir, fV,v2) versus 0.33 sim(fhomo, fV,v2) shows the transferred encoder separates piracy from independent homologous models.The authors note the gap is slightly smaller than with an encoder trained specifically for fV,v2, leaving transferability for future improvement.Source: E. Transferability of Encoder · p. 12
- Figure 13 compares fingerprints before encoding with their encoder representations; the authors report piracy fingerprints entangled with the victim while homologous fingerprints remain distant.The figure shows fingerprints associated with fV,v2 and representations produced by the encoder associated with fV,v1.Source: E. Transferability of Encoder · pp. 12–13, Figure 13 · p. 13
F. Ethical Considerations
The authors describe the work as a defense against model extraction and discuss risks related to verification claims and query data. They note false positives as a concern and propose auxiliary evidence during confirmation.
F. Ethical Considerations
- The authors characterize the work as a defense against model extraction and say a trustworthy third party could audit a potentially misused ownership argument.They describe an honest-but-curious adversary involving a normal MLaaS provider in a lawsuit as a worst case.Source: F. Ethical Considerations · p. 13
- The defender’s query data need not come from users’ original datasets, since auxiliary data from the problem domain can be used.The authors connect this choice to concerns that query data might reveal training-set membership information.Source: F. Ethical Considerations · p. 13
- False positives remain a concern despite a reported AUC score of 1.0; the authors suggest social-engineering evidence as auxiliary confirmation.They characterize such false positives as hardly appearing.Source: F. Ethical Considerations · p. 13