Entangled Watermarks as a Defense against Model Extraction

Abstract

Machine learning involves expensive data collection and training procedures. Model owners may be concerned that valuable intellectual property can be leaked if adversaries mount model extraction attacks. As it is difficult to defend against model extraction without sacrificing significant prediction accuracy, watermarking instead leverages unused model capacity to have the model overfit to outlier input-output pairs. Such pairs are watermarks, which are not sampled from the task distribution and are only known to the defender. The defender then demonstrates knowledge of the input-output pairs to claim ownership of the model at inference. The effectiveness of watermarks remains limited because they are distinct from the task distribution and can thus be easily removed through compression or other forms of knowledge transfer. We introduce Entangled Watermarking Embeddings (EWE). Our approach encourages the model to learn features for classifying data that is sampled from the task distribution and data that encodes watermarks. An adversary attempting to remove watermarks that are entangled with legitimate data is also forced to sacrifice performance on legitimate data. Experiments on MNIST, Fashion-MNIST, CIFAR-10, and Speech Commands validate that the defender can claim model ownership with 95\% confidence with less than 100 queries to the stolen copy, at a modest cost below 0.81 percentage points on average in the defended model's performance.

arXiv commentpublished in 30th USENIX Security Symposium

References in corpus (18)

• Explaining and Harnessing Adversarial Examples
• UMAP: Uniform Manifold Approximation and Projection for Dimension Reduction
• Fashion-MNIST: a Novel Image Dataset for Benchmarking Machine Learning Algorithms
• Transferability in Machine Learning: from Phenomena to Black-Box Attacks using Adversarial Samples
• Speech Commands: A Dataset for Limited-Vocabulary Speech Recognition
• BadNets: Identifying Vulnerabilities in the Machine Learning Model Supply Chain
• Similarity of Neural Network Representations Revisited
• Algorithms for Learning Kernels Based on Centered Alignment
• Adversarial Risk and the Dangers of Evaluating Against Weak Attacks
• Detecting Backdoor Attacks on Deep Neural Networks by Activation Clustering
• Copycat CNN: Stealing Knowledge by Persuading Confession with Random Non-Labeled Data
• Turning Your Weakness Into a Strength: Watermarking Deep Neural Networks by Backdooring
• Manipulating Machine Learning: Poisoning Attacks and Countermeasures for Regression Learning
• DeepSigns: A Generic Watermarking Framework for IP Protection of Deep Learning Models
• Kapre: On-GPU Audio Preprocessing Layers for a Quick Implementation of Deep Neural Network Models with Keras
• High Accuracy and High Fidelity Extraction of Neural Networks
• A framework for the extraction of Deep Neural Networks by leveraging public data
• Fine-Pruning: Defending Against Backdooring Attacks on Deep Neural Networks

Cited by in corpus (9)

• Backdoor Attacks and Countermeasures on Deep Learning: A Comprehensive Review
• Intellectual Property Protection for Deep Learning Models: Taxonomy, Methods, Attacks, and Evaluations
• Piracy Resistant Watermarks for Deep Neural Networks
• Dataset Inference: Ownership Resolution in Machine Learning
• Model extraction from counterfactual explanations
• Fusion: Efficient and Secure Inference Resilient to Malicious Servers
• Privacy Inference Attacks and Defenses in Cloud-based Deep Neural Network: A Survey
• Model Extraction and Defenses on Generative Adversarial Networks
• Evading Malware Classifiers via Monte Carlo Mutant Feature Discovery