Abstract:The construction of Deep Neural Network (DNN) models requires high cost, thus a well-trained DNN model can be considered as intellectual property (IP) of the model owner. To date, many DNN IP protection methods have been proposed, but most of them are watermarking based verification methods where model owners can only verify their ownership passively after the copyright of DNN models has been infringed. In this article, we propose an effective framework to actively protect the DNN IP from infringement. Specifically, we encrypt a small number of model's parameters by perturbing them with well-crafted adversarial perturbations. With the encrypted parameters, the accuracy of the DNN model drops significantly, which can prevent malicious infringers from using the model. After the encryption, the positions of encrypted parameters and the values of the added adversarial perturbations form a secret key. Authorized user can use the secret key to decrypt the model on Machine Learning as a Service, while unauthorized user cannot use the model. Compared with the existing DNN watermarking methods which passively verify the ownership after the infringement occurs, the proposed method can prevent infringement in advance. Moreover, compared with few existing active DNN IP protection methods, the proposed method does not require additional training process of the model, thus introduces low computational overhead. Experimental results show that, after the encryption, the test accuracy of the model drops by 80.65%, 81.16%, and 87.91% on Fashion-MNIST (DenseNet), CIFAR-10 (ResNet), and GTSRB (AlexNet) datasets, respectively. Moreover, the proposed method only needs to encrypt an extremely low number of parameters. The proportion of the encrypted parameters in all the model's parameters is as low as 0.000205%. Experimental results also indicate that, the proposed method is robust against model fine-tuning attack, model pruning attack, and the adaptive attack where attackers know the detailed steps of the proposed method and all the parameters of the encrypted model.

Probabilistic Selective Encryption of Convolutional Neural Networks for Hierarchical Services

Industrial Scale Privacy Preserving Deep Neural Network

TEESlice: Protecting Sensitive Neural Network Models in Trusted Execution Environments When Attackers have Pre-Trained Models

Privacy-Preserving Convolutional Neural Network Classification Scheme With Multiple Keys

A Privacy-Preserving Scheme For Convolutional Neural Network-Based Applications In Mobile Cloud

Masked image: Visually protected image dataset privacy-preserving scheme for convolutional neural networks

AdvParams: An Active DNN Intellectual Property Protection Technique via Adversarial Perturbation Based Parameter Encryption

Hierarchical Authorization of Convolutional Neural Networks for Multi-User

Privacy-Preserving Convolutional Neural Networks Using Homomorphic Encryption

Crypto-Nets: Neural Networks over Encrypted Data

Privacy preserving Neural Network Inference on Encrypted Data with GPUs

Towards Scalable and Privacy-Preserving Deep Neural Network via Algorithmic-Cryptographic Co-design

Privacy-Preserving DNN Model Authorization Against Model Theft and Feature Leakage

CryptoDL: Deep Neural Networks over Encrypted Data

Pratical Privacy-preserving Convolutional Neural Network Inference Framework with Edge Computing for Health Monitoring

A Secure Convolutional Neural Network Inference Model Based on Homomorphic Encryption

Privacy‐preserving convolutional neural network prediction with low latency and lightweight users

EdgePro: Edge Deep Learning Model Protection Via Neuron Authorization

2P-DNN : Privacy-Preserving Deep Neural Networks Based on Homomorphic Cryptosystem

Edge Deep Learning Model Protection via Neuron Authorization

Secure Neural Network Prediction in the Cloud-Based Open Neural Network Service