Identifying Appropriate Intellectual Property Protection Mechanisms for Machine Learning Models: A Systematization of Watermarking, Fingerprinting, Model Access, and Attacks

Abstract

The commercial use of Machine Learning (ML) is spreading; at the same time, ML models are becoming more complex and more expensive to train, which makes Intellectual Property Protection (IPP) of trained models a pressing issue. Unlike other domains that can build on a solid understanding of the threats, attacks and defenses available to protect their IP, the ML-related research in this regard is still very fragmented. This is also due to a missing unified view as well as a common taxonomy of these aspects. In this paper, we systematize our findings on IPP in ML, while focusing on threats and attacks identified and defenses proposed at the time of writing. We develop a comprehensive threat model for IP in ML, categorizing attacks and defenses within a unified and consolidated taxonomy, thus bridging research from both the ML and security communities.

References in corpus (20)

• Embedding Watermarks into Deep Neural Networks
• Adversarial Frontier Stitching for Remote Neural Network Watermarking
• A Robust Image Watermarking System Based on Deep Neural Networks
• How to Prove Your Model Belongs to You: A Blind-Watermark based Framework to Protect Intellectual Property of DNN
• I Know What You Trained Last Summer: A Survey on Stealing Machine Learning Models and Defences
• Digital Watermarking for Deep Neural Networks
• A Systematic Review on Model Watermarking for Neural Networks
• REFIT: A Unified Watermark Removal Framework For Deep Learning Systems With Limited Data
• Reversible Watermarking in Deep Convolutional Neural Networks for Integrity Authentication
• BlackMarks: Blackbox Multibit Watermarking for Deep Neural Networks
• Piracy Resistant Watermarks for Deep Neural Networks
• Effectiveness of Distillation Attack and Countermeasure on Neural Network Watermarking
• Performance Comparison of Contemporary DNN Watermarking Techniques
• DeepObfuscation: Securing the Structure of Convolutional Neural Networks via Knowledge Distillation
• Sequential Triggers for Watermarking of Deep Reinforcement Learning Policies
• A Comprehensive Survey of Watermarking Relational Databases Research
• Stealing Knowledge from Protected Deep Neural Networks Using Composite Unlabeled Data
• Deep Serial Number: Computational Watermarking for DNN Intellectual Property Protection
• Evolutionary Trigger Set Generation for DNN Black-Box Watermarking
• A novel method for identifying the deep neural network model with the Serial Number

Cited by in corpus (3)

• I Know What You Trained Last Summer: A Survey on Stealing Machine Learning Models and Defences
• Stealing the Invisible: Unveiling Pre-Trained CNN Models through Adversarial Examples and Timing Side-Channels
• Integrated Security Mechanisms for Weight Protection in Memristive Crossbar Arrays