Fingerprinting Deep Neural Networks Globally via Universal Adversarial Perturbations
In this paper, we propose a novel and practical mechanism which enables the service provider to verify whether a suspect model is stolen from the victim model via model extraction attacks. Our key insight is that the profile of a DNN model's decision boundary can be uniquely characterized by its Universal Adversarial Perturbations (UAPs). UAPs belong to a low-dimensional subspace and piracy models' subspaces are more consistent with victim model's subspace compared with non-piracy model. Based on this, we propose a UAP fingerprinting method for DNN models and train an encoder via contrastive learning that takes fingerprint as inputs, outputs a similarity score. Extensive studies show that our framework can detect model IP breaches with confidence > 99.99 within only 20 fingerprints of the suspect model. It has good generalizability across different model architectures and is robust against post-modifications on stolen models.
Code (0)
등록된 구현이 없습니다.
Tasks
Contrastive LearningModel extractionMethods 이 논문이 사용한 방법론
Similar Papers 제목 키워드 기반
FLARE: Fingerprinting Deep Reinforcement Learning Agents using Universal Adversarial Masks
We propose FLARE, the first fingerprinting mechanism to verify whether a suspected Deep Reinforcement Learning (DRL) policy is an illegitimate copy of another (victim) policy. We first show that it is possible to find no…
Decision MakingDeep Reinforcement Learningreinforcement-learningReinforcement Learning+1Robust Eavesdropping in the Presence of Adversarial Communications for RF Fingerprinting
Deep learning is an effective approach for performing radio frequency (RF) fingerprinting, which aims to identify the transmitter corresponding to received RF signals. However, beyond the intended receiver, malicious eav…
Deep LearningAre Robust LLM Fingerprints Adversarially Robust?
Model fingerprinting has emerged as a promising paradigm for claiming model ownership. However, robustness evaluations of these schemes have mostly focused on benign perturbations such as incremental fine-tuning, model m…
Adversarial RobustnessBlind Adversarial Network Perturbations
Deep Neural Networks (DNNs) are commonly used for various traffic analysis problems, such as website fingerprinting and flow correlation, as they outperform traditional (e.g., statistical) techniques by large margins. Ho…
ARIA: Adversarially Robust Image Attribution for Content Provenance
Image attribution -- matching an image back to a trusted source -- is an emerging tool in the fight against online misinformation. Deep visual fingerprinting models have recently been explored for this purpose. However, …
Contrastive LearningImage AttributionMisinformationvalid