DAWN: Dynamic Adversarial Watermarking of Neural Networks

Abstract

Training machine learning (ML) models is expensive in terms of computational power, amounts of labeled data and human expertise. Thus, ML models constitute intellectual property (IP) and business value for their owners. Embedding digital watermarks during model training allows a model owner to later identify their models in case of theft or misuse. However, model functionality can also be stolen via model extraction, where an adversary trains a surrogate model using results returned from a prediction API of the original model. Recent work has shown that model extraction is a realistic threat. Existing watermarking schemes are ineffective against IP theft via model extraction since it is the adversary who trains the surrogate model. In this paper, we introduce DAWN (Dynamic Adversarial Watermarking of Neural Networks), the first approach to use watermarking to deter model extraction IP theft. Unlike prior watermarking schemes, DAWN does not impose changes to the training process but it operates at the prediction API of the protected model, by dynamically changing the responses for a small subset of queries (e.g., <0.5%) from API clients. This set is a watermark that will be embedded in case a client uses its queries to train a surrogate model. We show that DAWN is resilient against two state-of-the-art model extraction attacks, effectively watermarking all extracted surrogate models, allowing model owners to reliably demonstrate ownership (with confidence $>1-2^{-64}$), incurring negligible loss of prediction accuracy (0.03-0.5%).

Shorter version of this work to appear in Proceedings of the ACM Multimedia 2021; 16 pages, 3 figures

References in corpus (4)

• Targeted Backdoor Attacks on Deep Learning Systems Using Data Poisoning
• Poisoning Attacks against Support Vector Machines
• TABOR: A Highly Accurate Approach to Inspecting and Restoring Trojan Backdoors in AI Systems
• Prediction Poisoning: Towards Defenses Against DNN Model Stealing Attacks

Cited by in corpus (19)

• Backdoor Attacks and Countermeasures on Deep Learning: A Comprehensive Review
• Thieves on Sesame Street! Model Extraction of BERT-based APIs
• Intellectual Property Protection for Deep Learning Models: Taxonomy, Methods, Attacks, and Evaluations
• Piracy Resistant Watermarks for Deep Neural Networks
• Deep Neural Network Fingerprinting by Conferrable Adversarial Examples
• Model extraction from counterfactual explanations
• Imitation Attacks and Defenses for Black-box Machine Translation Systems
• RIGA: Covert and Robust White-Box Watermarking of Deep Neural Networks
• MEGEX: Data-Free Model Extraction Attack against Gradient-Based Explainable AI
• On the Effectiveness of Dataset Watermarking in Adversarial Settings
• Extraction of Complex DNN Models: Real Threat or Boogeyman?
• Decentralized Attribution of Generative Models
• SoK: How Robust is Image Classification Deep Neural Network Watermarking? (Extended Version)
• Privacy Inference Attacks and Defenses in Cloud-based Deep Neural Network: A Survey
• Exploring Structure Consistency for Deep Model Watermarking
• Careful What You Wish For: on the Extraction of Adversarially Trained Models
• Model Extraction Attacks against Recurrent Neural Networks
• WAFFLE: Watermarking in Federated Learning
• A survey of deep neural network watermarking techniques