Deep Neural Network Fingerprinting by Conferrable Adversarial Examples (2019-12-02T00:00:00.000000Z)

TL;DR

The fingerprint is robust against distillation, related model extraction attacks, and even transfer learning when the attacker has no access to the model provider's dataset, and is the first method that reaches an AUC of 1.0 in verifying surrogates.

Abstract

In Machine Learning as a Service, a provider trains a deep neural network and provides many users access. The hosted (source) model is susceptible to model stealing attacks, where an adversary derives a \emph{surrogate model} from API access to the source model. For post hoc detection of such attacks, the provider needs a robust method to determine whether a suspect model is a surrogate of their model. We propose a fingerprinting method for deep neural network classifiers that extracts a set of inputs from the source model so that only surrogates agree with the source model on the classification of such inputs. These inputs are a subclass of transferable adversarial examples which we call \emph{conferrable} adversarial examples that exclusively transfer with a target label from a source model to its surrogates. We propose a new method to generate these conferrable adversarial examples. We present an extensive study on the unremovability of our fingerprint against fine-tuning, weight pruning, retraining, retraining with different architectures, three model extraction attacks from related work, transfer learning, adversarial training, and two new adaptive attacks. Our fingerprint is robust against distillation, related model extraction attacks, and even transfer learning when the attacker has no access to the model provider's dataset. Our fingerprint is the first method that reaches an AUC of 1.0 in verifying surrogates, compared to an AUC of 0.63 by previous fingerprints.

Authors

F. Kerschbaum

3 papers

Nils Lukas

1 papers

Yuxuan Zhang

1 papers

TL;DR

Abstract

Authors

References83 items

On the Robustness of Backdoor-based Watermarking in Deep Neural Networks

IPGuard: Protecting the Intellectual Property of Deep Neural Networks via Fingerprinting the Classification Boundary

Thieves on Sesame Street! Model Extraction of BERT-based APIs

Structure Matters: Towards Generating Transferable Adversarial Images

High Accuracy and High Fidelity Extraction of Neural Networks

High-Fidelity Extraction of Neural Network Models

Universal, transferable and targeted adversarial attacks

On the Robustness of the Backdoor-based Watermarking in Deep Neural Networks

DAWN: Dynamic Adversarial Watermarking of Neural Networks

Evasion Attacks Against Watermarking Techniques found in MLaaS Systems

Unlabeled Data Improves Adversarial Robustness

DeepSigns: An End-to-End Watermarking Framework for Ownership Protection of Deep Neural Networks

How to prove your model belongs to you: a blind-watermark based framework to protect intellectual property of DNN

On Evaluating Adversarial Robustness

Auto-DeepLab: Hierarchical Neural Architecture Search for Semantic Image Segmentation

A guide to deep learning in healthcare

Feature Denoising for Improving Adversarial Robustness

Knockoff Nets: Stealing Functionality of Black-Box Models

Disentangling Adversarial Robustness and Generalization

Attributing Fake Images to GANs: Learning and Analyzing GAN Fingerprints

Attributing Fake Images to GANs: Analyzing Fingerprints in Generated Images

Learning GAN fingerprints towards Image Attribution

Watermarking Deep Neural Networks for Embedded Systems

Why Do Adversarial Attacks Transfer? Explaining Transferability of Evasion and Poisoning Attacks

Are adversarial examples inevitable?

Have You Stolen My Model? Evasion Attacks Against Deep Neural Network Watermarking Techniques

Adversarial Robustness Toolbox v1.0.0

Robust Physical-World Attacks on Deep Learning Visual Classification

Defending Against Machine Learning Model Stealing Attacks Using Deceptive Perturbations

Protecting Intellectual Property of Deep Neural Networks with Watermarking

PRADA: Protecting Against DNN Model Stealing Attacks

DeepMarks: A Digital Fingerprinting Framework for Deep Neural Networks

Turning Your Weakness Into a Strength: Watermarking Deep Neural Networks by Backdooring

Generating Adversarial Examples with Adversarial Networks

Audio Adversarial Examples: Targeted Attacks on Speech-to-Text

ConvNets and ImageNet Beyond Accuracy: Understanding Mistakes and Uncovering Biases

Adversarial frontier stitching for remote neural network watermarking

Boosting Adversarial Attacks with Momentum

To prune, or not to prune: exploring the efficacy of pruning for model compression

Adversarial Examples for Malware Detection

DeepTest: Automated Testing of Deep-Neural-Network-Driven Autonomous Cars

BadNets: Identifying Vulnerabilities in the Machine Learning Model Supply Chain

Recent Trends in Deep Learning Based Natural Language Processing

A Downsampled Variant of ImageNet as an Alternative to the CIFAR datasets

Towards Deep Learning Models Resistant to Adversarial Attacks

Adversarial Examples Are Not Easily Detected: Bypassing Ten Detection Methods

Ensemble Adversarial Training: Attacks and Defenses

The Space of Transferable Adversarial Examples

Embedding Watermarks into Deep Neural Networks

Delving into Transferable Adversarial Examples and Black-box Attacks

Towards Evaluating the Robustness of Neural Networks

Stealing Machine Learning Models via Prediction APIs

Adversarial examples in the physical world

Deep Learning with Differential Privacy

Transferability in Machine Learning: from Phenomena to Black-Box Attacks using Adversarial Samples

Identity Mappings in Deep Residual Networks

Convolutional Neural Networks for Medical Image Analysis: Full Training or Fine Tuning?

Practical Black-Box Attacks against Machine Learning

Deep Residual Learning for Image Recognition

DeepFool: A Simple and Accurate Method to Fool Deep Neural Networks

Distilling the Knowledge in a Neural Network

Adam: A Method for Stochastic Optimization

Explaining and Harnessing Adversarial Examples

Very Deep Convolutional Networks for Large-Scale Image Recognition

Intriguing properties of neural networks

ImageNet: A large-scale hierarchical image database

Model compression

Friction and nonlinearity compensation in hard disk drive servo systems using robust composite nonlinear feedback control

Language Models are Unsupervised Multitask Learners

With Great Training Comes Great Vulnerability: Practical Attacks against Transfer Learning

show that an attacker can evade the black-box verification by rejecting queries or returning random labels when the verification process is detectable

Cifar-10 (canadian institute for advanced research). URL http://www.cs.toronto.edu/ ̃kriz/cifar.html

Cleaning big data: Most time-consuming, least enjoyable data science task, survey says

Keras

Dropout: a simple way to prevent neural networks from overfitting

School of Informatics, University of Edinburgh