DAWN: Dynamic Adversarial Watermarking of Neural Networks (2019-06-03T00:00:00.000000Z)

TL;DR

DAWN (Dynamic Adversarial Watermarking of Neural Networks), the first approach to use watermarking to deter model extraction theft, is introduced and is shown to be resilient against two state-of-the-art model extraction attacks.

Abstract

Training machine learning (ML) models is expensive in terms of computational power, amounts of labeled data and human expertise. Thus, ML models constitute business value for their owners. Embedding digital watermarks during model training allows a model owner to later identify their models in case of theft or misuse. However, model functionality can also be stolen via model extraction, where an adversary trains a surrogate model using results returned from a prediction API of the original model. Recent work has shown that model extraction is a realistic threat. Existing watermarking schemes are ineffective against model extraction since it is the adversary who trains the surrogate model. In this paper, we introduce DAWN (Dynamic Adversarial Watermarking of Neural Networks), the first approach to use watermarking to deter model extraction theft. Unlike prior watermarking schemes, DAWN does not impose changes to the training process but operates at the prediction API of the protected model, by dynamically changing the responses for a small subset of queries (e.g., 0.5%) from API clients. This set is a watermark that will be embedded in case a client uses its queries to train a surrogate model. We show that DAWN is resilient against two state-of-the-art model extraction attacks, effectively watermarking all extracted surrogate models, allowing model owners to reliably demonstrate ownership (with confidence greater than 1-2-64), incurring negligible loss of prediction accuracy (0.03-0.5%).

Authors

Samuel Marchal

2 papers

Sebastian Szyller

1 papers

B. Atli

1 papers

TL;DR

Abstract

Authors

References65 items

Northeastern University

ActiveThief: Model Extraction Using Active Learning and Unannotated Public Data

Entangled Watermarks as a Defense against Model Extraction

Persistent and Unforgeable Watermarks for Deep Neural Networks

BDPL: A Boundary Differentially Private Layer Against Machine Learning Model Extraction Attacks

TABOR: A Highly Accurate Approach to Inspecting and Restoring Trojan Backdoors in AI Systems

Prediction Poisoning: Towards Defenses Against DNN Model Stealing Attacks

DeepSigns: An End-to-End Watermarking Framework for Ownership Protection of Deep Neural Networks

Neural Cleanse: Identifying and Mitigating Backdoor Attacks in Neural Networks

Certified Adversarial Robustness via Randomized Smoothing

Statistical tables

Knockoff Nets: Stealing Functionality of Black-Box Models

Detecting Backdoor Attacks on Deep Neural Networks by Activation Clustering

Copycat CNN: Stealing Knowledge by Persuading Confession with Random Non-Labeled Data

Defending Against Model Stealing Attacks Using Deceptive Perturbations

Defending Against Machine Learning Model Stealing Attacks Using Deceptive Perturbations

Protecting Intellectual Property of Deep Neural Networks with Watermarking

Do Better ImageNet Models Transfer Better?

PRADA: Protecting Against DNN Model Stealing Attacks

Forgotten Siblings: Unifying Attacks on Machine Learning and Digital Watermarking

DeepMarks: A Digital Fingerprinting Framework for Deep Neural Networks

Turning Your Weakness Into a Strength: Watermarking Deep Neural Networks by Backdooring

Targeted Backdoor Attacks on Deep Learning Systems Using Data Poisoning

Model Extraction Warning in MLaaS Paradigm

Adversarial frontier stitching for remote neural network watermarking

Towards Poisoning of Deep Learning Algorithms with Back-gradient Optimization

BadNets: Identifying Vulnerabilities in the Machine Learning Model Supply Chain

Towards Deep Learning Models Resistant to Adversarial Attacks

MagNet: A Two-Pronged Defense against Adversarial Examples

Embedding Watermarks into Deep Neural Networks

Understanding deep learning requires rethinking generalization

Densely Connected Convolutional Networks

Stealing Machine Learning Models via Prediction APIs

Practical Black-Box Attacks against Machine Learning

Deep Residual Learning for Image Recognition

EVILCOHORT: Detecting Communities of Malicious Accounts on Online Services

Explaining and Harnessing Adversarial Examples

The Untapped Potential of Trusted Execution Environments on Mobile Devices

Poisoning Attacks against Support Vector Machines

The German Traffic Sign Recognition Benchmark: A multi-class classification competition

ImageNet: A large-scale hierarchical image database

Sybil-Resilient Online Content Voting

Caltech-256 Object Category Dataset

Pattern Recognition and Machine Learning

Information hiding-a survey

A Simple Weight Decay Can Improve Generalization

Silhouettes: a graphical aid to the interpretation and validation of cluster analysis

Statistical Tables for Biological Agricultural and Medical Research

Roundup of machine learning forecasts and market estimates for 2019

Trojaning Attack on Neural Networks

How tech giants are investing in artificial intelligence

Stealing Machine Learning Models via Prediction APIs

Dropout: a simple way to prevent neural networks from overfitting

MNIST handwritten digit database

Learning Multiple Layers of Features from Tiny Images

Overfitting in Neural Nets: Backpropagation, Conjugate Gradient, and Early Stopping

Statistical Tables for Biological, Agricultural and Medical Research

W4 Linkability : If verify outputs “true” for a model 𝐹 A , the watermark used for verification ( 𝑇, ˆ 𝐵 ( 𝑇 )) can be linked to a specific API client whose queries were used to train 𝐹 A

We identify additional requirements X1

W1 Unremovability : A is unable to remove the watermark from 𝐹 A without significantly decreasing its accuracy, rendering it “unusable”. If 𝐹 V is free of the watermark,

X1 Utility : Incorrect predictions returned by DAWN do not significantly degrade the prediction service provided to legitimate API clients

Table 14: Model architectures of low capacity models

W2 Reliability :If verify outputs“true”forawatermark ( 𝑇, ˆ 𝐵 V ( 𝑇 )) on a model 𝐹 ′ , then 𝐹 ′ is a surrogate of 𝐹 V , with high confidence

X2 Indistinguishability : A cannot distinguish incorrect predictions 𝐵 ( 𝑥 ) from correct victim model predictions 𝐹 V ( 𝑥

W3 Non-ownership piracy : A cannot produce a watermark for a model that was already watermarked by V , such that it can cast V ’s ownership into doubt

Field of Study

Journal Information

Name

Venue Information

Name

Type

URL

Alternate Names