Deep Neural Network Fingerprinting by Conferrable Adversarial Examples

Abstract

In Machine Learning as a Service, a provider trains a deep neural network and gives many users access. The hosted (source) model is susceptible to model stealing attacks, where an adversary derives a surrogate model from API access to the source model. For post hoc detection of such attacks, the provider needs a robust method to determine whether a suspect model is a surrogate of their model. We propose a fingerprinting method for deep neural network classifiers that extracts a set of inputs from the source model so that only surrogates agree with the source model on the classification of such inputs. These inputs are a subclass of transferable adversarial examples which we call conferrable adversarial examples that exclusively transfer with a target label from a source model to its surrogates. We propose a new method to generate these conferrable adversarial examples. We present an extensive study on the irremovability of our fingerprint against fine-tuning, weight pruning, retraining, retraining with different architectures, three model extraction attacks from related work, transfer learning, adversarial training, and two new adaptive attacks. Our fingerprint is robust against distillation, related model extraction attacks, and even transfer learning when the attacker has no access to the model provider's dataset. Our fingerprint is the first method that reaches a ROC AUC of 1.0 in verifying surrogates, compared to a ROC AUC of 0.63 by previous fingerprints.

References in corpus (27)

• Adam: A Method for Stochastic Optimization
• Very Deep Convolutional Networks for Large-Scale Image Recognition
• Distilling the Knowledge in a Neural Network
• Deep Learning with Differential Privacy
• Ensemble Adversarial Training: Attacks and Defenses
• Transferability in Machine Learning: from Phenomena to Black-Box Attacks using Adversarial Samples
• Recent Trends in Deep Learning Based Natural Language Processing
• BadNets: Identifying Vulnerabilities in the Machine Learning Model Supply Chain
• Delving into Transferable Adversarial Examples and Black-box Attacks
• Embedding Watermarks into Deep Neural Networks
• To prune, or not to prune: exploring the efficacy of pruning for model compression
• DenseNet: Implementing Efficient ConvNet Descriptor Pyramids
• On Evaluating Adversarial Robustness
• The Space of Transferable Adversarial Examples
• A Downsampled Variant of ImageNet as an Alternative to the CIFAR datasets
• Adversarial Frontier Stitching for Remote Neural Network Watermarking
• Generating Adversarial Examples with Adversarial Networks
• Auto-DeepLab: Hierarchical Neural Architecture Search for Semantic Image Segmentation
• Thieves on Sesame Street! Model Extraction of BERT-based APIs
• Unlabeled Data Improves Adversarial Robustness
• DAWN: Dynamic Adversarial Watermarking of Neural Networks
• High Accuracy and High Fidelity Extraction of Neural Networks
• DeepMarks: A Digital Fingerprinting Framework for Deep Neural Networks
• Have You Stolen My Model? Evasion Attacks Against Deep Neural Network Watermarking Techniques
• Attributing Fake Images to GANs: Learning and Analyzing GAN Fingerprints
• IPGuard: Protecting Intellectual Property of Deep Neural Networks via Fingerprinting the Classification Boundary
• Universal, transferable and targeted adversarial attacks

Cited by in corpus (5)

• Intellectual Property Protection for Deep Learning Models: Taxonomy, Methods, Attacks, and Evaluations
• ModelDiff: Testing-Based DNN Similarity Comparison for Model Reuse Detection
• Witches' Brew: Industrial Scale Data Poisoning via Gradient Matching
• Extraction of Complex DNN Models: Real Threat or Boogeyman?
• High-Robustness, Low-Transferability Fingerprinting of Neural Networks