Abstract:With the performance of deep neural networks (DNNs) remarkably improving, DNNs have been widely used in many areas. Consequently, the DNN model has become a valuable asset, and its intellectual property is safeguarded by ownership verification techniques (e.g., DNN fingerprinting). However, the feasibility of the DNN fingerprint removal attack and its potential influence remains an open problem. In this paper, we perform the first comprehensive investigation of DNN fingerprint removal attacks. Generally, the knowledge contained in a DNN model can be categorized into general semantic and fingerprint-specific knowledge. To this end, we propose a min-max bilevel optimization-based DNN fingerprint removal attack named RemovalNet, to evade model ownership verification. The lower-level optimization is designed to remove fingerprint-specific knowledge. While in the upper-level optimization, we distill the victim model's general semantic knowledge to maintain the surrogate model's performance. We conduct extensive experiments to evaluate the fidelity, effectiveness, and efficiency of the RemovalNet against four advanced defense methods on six metrics. The empirical results demonstrate that (1) the RemovalNet is effective. After our DNN fingerprint removal attack, the model distance between the target and surrogate models is x100 times higher than that of the baseline attacks, (2) the RemovalNet is efficient. It uses only 0.2% (400 samples) of the substitute dataset and 1,000 iterations to conduct our attack. Besides, compared with advanced model stealing attacks, the RemovalNet saves nearly 85% of computational resources at most, (3) the RemovalNet achieves high fidelity that the created surrogate model maintains high accuracy after the DNN fingerprint removal process. Our code is available at: <a class="link-external link-https" href="https://github.com/grasses/RemovalNet" rel="external noopener nofollow">this https URL</a>.

GNNFingers: A Fingerprinting Framework for Verifying Ownerships of Graph Neural Networks

GanFinger: GAN-Based Fingerprint Generation for Deep Neural Network Ownership Verification

Ownership Verification of DNN Architectures Via Hardware Cache Side Channels.

DGA-GNN: Dynamic Grouping Aggregation GNN for Fraud Detection

Fingerprinting Multi-exit Deep Neural Network Models via Inference Time

MetaV: A Meta-Verifier Approach to Task-Agnostic Model Fingerprinting

Fingerprinting Image-to-Image Generative Adversarial Networks

VeriDIP: Verifying Ownership of Deep Neural Networks through Privacy Leakage Fingerprints

How to Prove Your Model Belongs to You: A Blind-Watermark based Framework to Protect Intellectual Property of DNN

IPGuard: Protecting Intellectual Property of Deep Neural Networks via Fingerprinting the Classification Boundary

RemovalNet: DNN Fingerprint Removal Attacks

Fingerprinting Deep Neural Networks Globally Via Universal Adversarial Perturbations

Stealing Links from Graph Neural Networks

DiG-In-GNN: Discriminative Feature Guided GNN-Based Fraud Detector against Inconsistencies in Multi-Relation Fraud Graph

Regulating Ownership Verification for Deep Neural Networks: Scenarios, Protocols, and Prospects

Securing Graph Neural Networks in MLaaS: A Comprehensive Realization of Query-based Integrity Verification

Shared DNN Model Ownership Verification in Cross-Silo Federated Learning: A GAN-Based Watermark Approach

GENIE: Watermarking Graph Neural Networks for Link Prediction

Watermarking Deep Neural Networks With Greedy Residuals

Watermarking Graph Neural Networks by Random Graphs

TAFA: A Task-Agnostic Fingerprinting Algorithm for Neural Networks