Protecting Deep Learning Model Copyrights with Adversarial Example-Free Reuse Detection

2024-07-04

arXiv.org

AI Summary

Detecting model reuse of deep learning models under heterogeneous architectures and black-box settings remains challenging due to difficulties in generating highly transferable adversarial examples and performing cross-architecture comparisons. Method: This paper proposes the first neuron-function (NF)-based model reuse detection paradigm. It formalizes neuron input-output mappings to define an NF distance metric and introduces an optimal linear projection matrix to achieve unified representation alignment across architectures and access modes (white-box and black-box), eliminating the need for adversarial example generation. Contribution/Results: Evaluated on the newly constructed Reuse Zoo benchmark, the method achieves F1 scores of 0.984 (black-box) and 1.0 (white-box), with inference speedups of 2×–99× over baselines. It offers a verifiable, high-accuracy, low-overhead solution for deep learning model copyright protection.

Technology Category

• Machine Learning: Deep Neural Architectures and Foundation Models
• Computer Vision: Adversarial Attacks & Robustness
• Natural Language Processing: Fact-Checking / Misinformation Detection (NLP Focus)

Application Category

• Graph Algorithms and Modeling for the Web: Graph neural networks and deep learning approaches for Web-related graphs
• User Modeling, Personalization and Recommendation: Attacks and countermeasures in recommendation systems
• Web Mining and Content Analysis: Large pretrained models with web data

Abstract

Model reuse techniques can reduce the resource requirements for training high-performance deep neural networks (DNNs) by leveraging existing models. However, unauthorized reuse and replication of DNNs can lead to copyright infringement and economic loss to the model owner. This underscores the need to analyze the reuse relation between DNNs and develop copyright protection techniques to safeguard intellectual property rights. Existing white-box testing-based approaches cannot address the common heterogeneous reuse case where the model architecture is changed, and DNN fingerprinting approaches heavily rely on generating adversarial examples with good transferability, which is known to be challenging in the black-box setting. To bridge the gap, we propose NFARD, a Neuron Functionality Analysis-based Reuse Detector, which only requires normal test samples to detect reuse relations by measuring the models' differences on a newly proposed model characterization, i.e., neuron functionality (NF). A set of NF-based distance metrics is designed to make NFARD applicable to both white-box and black-box settings. Moreover, we devise a linear transformation method to handle heterogeneous reuse cases by constructing the optimal projection matrix for dimension consistency, significantly extending the application scope of NFARD. To the best of our knowledge, this is the first adversarial example-free method that exploits neuron functionality for DNN copyright protection. As a side contribution, we constructed a reuse detection benchmark named Reuse Zoo that covers various practical reuse techniques and popular datasets. Extensive evaluations on this comprehensive benchmark show that NFARD achieves F1 scores of 0.984 and 1.0 for detecting reuse relationships in black-box and white-box settings, respectively, while generating test suites 2 ~ 99 times faster than previous methods.

Problem

• Detects unauthorized deep neural network reuse without adversarial examples
• Handles heterogeneous reuse cases with changed model architectures
• Provides efficient copyright protection for DNNs in black-box settings

Innovation

• Uses neuron functionality analysis for detection
• Requires only normal test samples
• Handles heterogeneous reuse via linear transformation