A deep learning framework supporting model ownership protection and traitor tracing

• Main Authors: XU, Guowen, LI, Hongwei, ZHANG, Yuan, LIN, Xiaodong, DENG, Robert H., SHEN, Xuemin (Sherman)
• Format: text
• Language: English
• Published: Institutional Knowledge at Singapore Management University 2020
• Subjects: Watermarking; Cloud Computing; Deep Learning; Ownership Protection; Traitor Tracing; Information Security
• Online Access: https://ink.library.smu.edu.sg/sis_research/5914; https://ink.library.smu.edu.sg/context/sis_research/article/6917/viewcontent/DeepLearning_icpads_2020_av.pdf
• Institution: Singapore Management University

Cloud-based deep learning (DL) solutions have been widely used in applications ranging from image recognition to speech recognition. Meanwhile, as commercial software and services, such solutions have raised the need for intellectual property rights protection of the underlying DL models. Watermarking is the mainstream of existing solutions to address this concern, by primarily embedding pre-defined secrets in a model's training process. However, existing efforts almost exclusively focus on detecting whether a target model is pirated, without considering traitor tracing. In this paper, we present SecureMark_DL, which enables a model owner to embed a unique fingerprint for every customer within parameters of a DL model, extract and verify the fingerprint from a pirated model, and hence trace the rogue customer who illegally distributed his model for profits. We demonstrate that SecureMark_DL is robust against various attacks including fingerprints collusion and network transformation (e.g., model compression and model fine-tuning). Extensive experiments conducted on MNIST and CIFAR10 datasets, as well as various types of deep neural network show the superiority of SecureMark_DL in terms of training accuracy and robustness against various types of attacks.