Abstract:The construction of Deep Neural Network (DNN) models requires high cost, thus a well-trained DNN model can be considered as intellectual property (IP) of the model owner. To date, many DNN IP protection methods have been proposed, but most of them are watermarking based verification methods where model owners can only verify their ownership passively after the copyright of DNN models has been infringed. In this article, we propose an effective framework to actively protect the DNN IP from infringement. Specifically, we encrypt a small number of model's parameters by perturbing them with well-crafted adversarial perturbations. With the encrypted parameters, the accuracy of the DNN model drops significantly, which can prevent malicious infringers from using the model. After the encryption, the positions of encrypted parameters and the values of the added adversarial perturbations form a secret key. Authorized user can use the secret key to decrypt the model on Machine Learning as a Service, while unauthorized user cannot use the model. Compared with the existing DNN watermarking methods which passively verify the ownership after the infringement occurs, the proposed method can prevent infringement in advance. Moreover, compared with few existing active DNN IP protection methods, the proposed method does not require additional training process of the model, thus introduces low computational overhead. Experimental results show that, after the encryption, the test accuracy of the model drops by 80.65%, 81.16%, and 87.91% on Fashion-MNIST (DenseNet), CIFAR-10 (ResNet), and GTSRB (AlexNet) datasets, respectively. Moreover, the proposed method only needs to encrypt an extremely low number of parameters. The proportion of the encrypted parameters in all the model's parameters is as low as 0.000205%. Experimental results also indicate that, the proposed method is robust against model fine-tuning attack, model pruning attack, and the adaptive attack where attackers know the detailed steps of the proposed method and all the parameters of the encrypted model.

Protecting Semantic Segmentation Models by Using Block-wise Image Encryption with Secret Key from Unauthorized Access

Intellectual property protection for deep semantic segmentation models

Model Copyright Protection in Buyer-seller Environment

Only My Model On My Data: A Privacy Preserving Approach Protecting one Model and Deceiving Unauthorized Black-Box Models

Protecting Intellectual Property with Reliable Availability of Learning Models in AI-Based Cybersecurity Services

SecureNet: Proactive intellectual property protection and model security defense for DNNs based on backdoor learning

Privacy-Preserving Deep Neural Networks with Pixel-Based Image Encryption Considering Data Augmentation in the Encrypted Domain

Color Image Encryption Based on Deep Learning and Block Embedding

NNSplitter: An Active Defense Solution for DNN Model via Automated Weight Obfuscation

AdvParams: An Active DNN Intellectual Property Protection Technique via Adversarial Perturbation Based Parameter Encryption

How to Prove Your Model Belongs to You: A Blind-Watermark based Framework to Protect Intellectual Property of DNN

Deep Model Intellectual Property Protection Via Deep Watermarking

A Robust Watermarking Method For Image Processing Models

Block Scrambling Image Encryption Used in Combination with Data Augmentation for Privacy-Preserving DNNs

Protecting Intellectual Property of Generative Adversarial Networks from Ambiguity Attack

Block-Wise Image Transformation With Secret Key for Adversarially Robust Defense

Protecting Deep Cerebrospinal Fluid Cell Image Processing Models with Backdoor and Semi-Distillation

Intellectual Property Protection for Deep Learning Models: Taxonomy, Methods, Attacks, and Evaluations

Protecting Image Processing Networks Via Model Watermarking

Edge Deep Learning Model Protection via Neuron Authorization

EdgePro: Edge Deep Learning Model Protection Via Neuron Authorization