[Paper Review] AdvParams: An Active DNN Intellectual Property Protection Technique via Adversarial Perturbation Based Parameter Encryption

Mingfu Xue, Zhiyu Wu+3 more|arXiv (Cornell University)|May 28, 2021

Adversarial Robustness in Machine Learning22 references4 citations

TL;DR

This paper proposes AdvParams, an active deep neural network (DNN) intellectual property protection method that uses adversarial perturbations to encrypt a minimal number of critical model parameters, drastically reducing model accuracy for unauthorized users while preserving high accuracy for authorized users with a secret key. The method achieves up to 87.91% accuracy drop on GTSRB with only 0.000205% of parameters modified, requiring no retraining or hardware support.

ABSTRACT

A well-trained DNN model can be regarded as an intellectual property (IP) of the model owner. To date, many DNN IP protection methods have been proposed, but most of them are watermarking based verification methods where model owners can only verify their ownership passively after the copyright of DNN models has been infringed. In this paper, we propose an effective framework to actively protect the DNN IP from infringement. Specifically, we encrypt the DNN model's parameters by perturbing them with well-crafted adversarial perturbations. With the encrypted parameters, the accuracy of the DNN model drops significantly, which can prevent malicious infringers from using the model. After the encryption, the positions of encrypted parameters and the values of the added adversarial perturbations form a secret key. Authorized user can use the secret key to decrypt the model. Compared with the watermarking methods which only passively verify the ownership after the infringement occurs, the proposed method can prevent infringement in advance. Moreover, compared with most of the existing active DNN IP protection methods, the proposed method does not require additional training process of the model, which introduces low computational overhead. Experimental results show that, after the encryption, the test accuracy of the model drops by 80.65%, 81.16%, and 87.91% on Fashion-MNIST, CIFAR-10, and GTSRB, respectively. Moreover, the proposed method only needs to encrypt an extremely low number of parameters, and the proportion of the encrypted parameters of all the model's parameters is as low as 0.000205%. The experimental results also indicate that, the proposed method is robust against model fine-tuning attack and model pruning attack. Moreover, for the adaptive attack where attackers know the detailed steps of the proposed method, the proposed method is also demonstrated to be robust.

Motivation & Objective

• To address the limitation of passive watermarking methods that only verify ownership after infringement occurs.
• To develop an active DNN IP protection mechanism that prevents unauthorized usage before infringement happens.
• To minimize computational overhead by avoiding retraining or hardware dependencies in the protection process.
• To ensure robustness against common attacks such as fine-tuning, pruning, and adaptive attacks.

Proposed method

• Identify the most influential model parameters by computing gradients of the loss function with respect to the weights.
• Apply targeted adversarial perturbations to these selected parameters to maximize performance degradation.
• Generate a secret key containing the positions of encrypted parameters and the values of the perturbations.
• Use the secret key to restore the original model behavior during decryption for authorized users.
• Ensure minimal parameter modification—only 23 parameters encrypted in the largest case—while maintaining undetectable perturbation magnitudes.
• Demonstrate resilience against model fine-tuning, pruning, and adaptive attacks where attackers know the method’s mechanism.

Experimental results

Research questions

• RQ1 Can adversarial perturbations be used to selectively encrypt only a few critical parameters to disable a DNN model for unauthorized users?
• RQ2 How effective is the proposed method in reducing model accuracy for unauthorized users while preserving high accuracy for authorized users?
• RQ3 Does the method remain robust against model fine-tuning and pruning attacks that attempt to recover model functionality?
• RQ4 Can the method be applied without retraining or hardware dependencies, ensuring low computational overhead in real-world deployment?
• RQ5 How does the method perform under adaptive attacks where attackers have full knowledge of the encryption mechanism?

Key findings

• The proposed method reduced test accuracy by 80.65%, 81.16%, and 87.91% on Fashion-MNIST, CIFAR-10, and GTSRB, respectively, for unauthorized users.
• Only 23 parameters were encrypted in the largest case, amounting to just 0.000205% of the total model parameters.
• The model maintained 91.01%, 92.02%, and 94.85% accuracy for authorized users on the three datasets.
• After a model fine-tuning attack, accuracy dropped to as low as 61.66%, and after pruning, it fell to 17.64%.
• Even under adaptive attacks where attackers knew the method’s internal steps, the model retained low accuracy (56.28% on Fashion-MNIST, 62.03% on CIFAR-10, 63.92% on GTSRB).
• The method required no additional training or hardware support, making it practical for commercial deployment.